fs/jffs2/readinode.c

   1 /*
   2  * JFFS2 -- Journalling Flash File System, Version 2.
   3  *
   4  * Copyright © 2001-2007 Red Hat, Inc.
   5  *
   6  * Created by David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * For licensing information, see the file 'LICENCE' in this directory.
   9  *
  10  */
  11
  12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13
  14 #include <linux/kernel.h>
  15 #include <linux/sched.h>
  16 #include <linux/slab.h>
  17 #include <linux/fs.h>
  18 #include <linux/crc32.h>
  19 #include <linux/pagemap.h>
  20 #include <linux/mtd/mtd.h>
  21 #include <linux/compiler.h>
  22 #include "nodelist.h"
  23
  24 /*
  25  * Check the data CRC of the node.
  26  *
  27  * Returns: 0 if the data CRC is correct;
  28  *          1 - if incorrect;
  29  *          error code if an error occurred.
  30  */
  31 static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
  32 {
  33         struct jffs2_raw_node_ref *ref = tn->fn->raw;
  34         int err = 0, pointed = 0;
  35         struct jffs2_eraseblock *jeb;
  36         unsigned char *buffer;
  37         uint32_t crc, ofs, len;
  38         size_t retlen;
  39
  40         BUG_ON(tn->csize == 0);
  41
  42         /* Calculate how many bytes were already checked */
  43         ofs = ref_offset(ref) + sizeof(struct jffs2_raw_inode);
  44         len = tn->csize;
  45
  46         if (jffs2_is_writebuffered(c)) {
  47                 int adj = ofs % c->wbuf_pagesize;
  48                 if (likely(adj))
  49                         adj = c->wbuf_pagesize - adj;
  50
  51                 if (adj >= tn->csize) {
  52                         dbg_readinode("no need to check node at %#08x, data length %u, data starts at %#08x - it has already been checked.\n",
  53                                       ref_offset(ref), tn->csize, ofs);
  54                         goto adj_acc;
  55                 }
  56
  57                 ofs += adj;
  58                 len -= adj;
  59         }
  60
  61         dbg_readinode("check node at %#08x, data length %u, partial CRC %#08x, correct CRC %#08x, data starts at %#08x, start checking from %#08x - %u bytes.\n",
  62                 ref_offset(ref), tn->csize, tn->partial_crc, tn->data_crc, ofs - len, ofs, len);
  63
  64 #ifndef __ECOS
  65         /* TODO: instead, incapsulate point() stuff to jffs2_flash_read(),
  66          * adding and jffs2_flash_read_end() interface. */
  67         err = mtd_point(c->mtd, ofs, len, &retlen, (void **)&buffer, NULL);
  68         if (!err && retlen < len) {
  69                 JFFS2_WARNING("MTD point returned len too short: %zu instead of %u.\n", retlen, tn->csize);
  70                 mtd_unpoint(c->mtd, ofs, retlen);
  71         } else if (err) {
  72                 if (err != -EOPNOTSUPP)
  73                         JFFS2_WARNING("MTD point failed: error code %d.\n", err);
  74         } else
  75                 pointed = 1; /* succefully pointed to device */
  76 #endif
  77
  78         if (!pointed) {
  79                 buffer = kmalloc(len, GFP_KERNEL);
  80                 if (unlikely(!buffer))
  81                         return -ENOMEM;
  82
  83                 /* TODO: this is very frequent pattern, make it a separate
  84                  * routine */
  85                 err = jffs2_flash_read(c, ofs, len, &retlen, buffer);
  86                 if (err) {
  87                         JFFS2_ERROR("can not read %d bytes from 0x%08x, error code: %d.\n", len, ofs, err);
  88                         goto free_out;
  89                 }
  90
  91                 if (retlen != len) {
  92                         JFFS2_ERROR("short read at %#08x: %zd instead of %d.\n", ofs, retlen, len);
  93                         err = -EIO;
  94                         goto free_out;
  95                 }
  96         }
  97
  98         /* Continue calculating CRC */
  99         crc = crc32(tn->partial_crc, buffer, len);
 100         if(!pointed)
 101                 kfree(buffer);
 102 #ifndef __ECOS
 103         else
 104                 mtd_unpoint(c->mtd, ofs, len);
 105 #endif
 106
 107         if (crc != tn->data_crc) {
 108                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 109                              ref_offset(ref), tn->data_crc, crc);
 110                 return 1;
 111         }
 112
 113 adj_acc:
 114         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 115         len = ref_totlen(c, jeb, ref);
 116         /* If it should be REF_NORMAL, it'll get marked as such when
 117            we build the fragtree, shortly. No need to worry about GC
 118            moving it while it's marked REF_PRISTINE -- GC won't happen
 119            till we've finished checking every inode anyway. */
 120         ref->flash_offset |= REF_PRISTINE;
 121         /*
 122          * Mark the node as having been checked and fix the
 123          * accounting accordingly.
 124          */
 125         spin_lock(&c->erase_completion_lock);
 126         jeb->used_size += len;
 127         jeb->unchecked_size -= len;
 128         c->used_size += len;
 129         c->unchecked_size -= len;
 130         jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
 131         spin_unlock(&c->erase_completion_lock);
 132
 133         return 0;
 134
 135 free_out:
 136         if(!pointed)
 137                 kfree(buffer);
 138 #ifndef __ECOS
 139         else
 140                 mtd_unpoint(c->mtd, ofs, len);
 141 #endif
 142         return err;
 143 }
 144
 145 /*
 146  * Helper function for jffs2_add_older_frag_to_fragtree().
 147  *
 148  * Checks the node if we are in the checking stage.
 149  */
 150 static int check_tn_node(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 151 {
 152         int ret;
 153
 154         BUG_ON(ref_obsolete(tn->fn->raw));
 155
 156         /* We only check the data CRC of unchecked nodes */
 157         if (ref_flags(tn->fn->raw) != REF_UNCHECKED)
 158                 return 0;
 159
 160         dbg_readinode("check node %#04x-%#04x, phys offs %#08x\n",
 161                       tn->fn->ofs, tn->fn->ofs + tn->fn->size, ref_offset(tn->fn->raw));
 162
 163         ret = check_node_data(c, tn);
 164         if (unlikely(ret < 0)) {
 165                 JFFS2_ERROR("check_node_data() returned error: %d.\n",
 166                         ret);
 167         } else if (unlikely(ret > 0)) {
 168                 dbg_readinode("CRC error, mark it obsolete.\n");
 169                 jffs2_mark_node_obsolete(c, tn->fn->raw);
 170         }
 171
 172         return ret;
 173 }
 174
 175 static struct jffs2_tmp_dnode_info *jffs2_lookup_tn(struct rb_root *tn_root, uint32_t offset)
 176 {
 177         struct rb_node *next;
 178         struct jffs2_tmp_dnode_info *tn = NULL;
 179
 180         dbg_readinode("root %p, offset %d\n", tn_root, offset);
 181
 182         next = tn_root->rb_node;
 183
 184         while (next) {
 185                 tn = rb_entry(next, struct jffs2_tmp_dnode_info, rb);
 186
 187                 if (tn->fn->ofs < offset)
 188                         next = tn->rb.rb_right;
 189                 else if (tn->fn->ofs >= offset)
 190                         next = tn->rb.rb_left;
 191                 else
 192                         break;
 193         }
 194
 195         return tn;
 196 }
 197
 198
 199 static void jffs2_kill_tn(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 200 {
 201         jffs2_mark_node_obsolete(c, tn->fn->raw);
 202         jffs2_free_full_dnode(tn->fn);
 203         jffs2_free_tmp_dnode_info(tn);
 204 }
 205 /*
 206  * This function is used when we read an inode. Data nodes arrive in
 207  * arbitrary order -- they may be older or newer than the nodes which
 208  * are already in the tree. Where overlaps occur, the older node can
 209  * be discarded as long as the newer passes the CRC check. We don't
 210  * bother to keep track of holes in this rbtree, and neither do we deal
 211  * with frags -- we can have multiple entries starting at the same
 212  * offset, and the one with the smallest length will come first in the
 213  * ordering.
 214  *
 215  * Returns 0 if the node was handled (including marking it obsolete)
 216  *       < 0 an if error occurred
 217  */
 218 static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
 219                                 struct jffs2_readinode_info *rii,
 220                                 struct jffs2_tmp_dnode_info *tn)
 221 {
 222         uint32_t fn_end = tn->fn->ofs + tn->fn->size;
 223         struct jffs2_tmp_dnode_info *this, *ptn;
 224
 225         dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
 226
 227         /* If a node has zero dsize, we only have to keep it if it might be the
 228            node with highest version -- i.e. the one which will end up as f->metadata.
 229            Note that such nodes won't be REF_UNCHECKED since there are no data to
 230            check anyway. */
 231         if (!tn->fn->size) {
 232                 if (rii->mdata_tn) {
 233                         if (rii->mdata_tn->version < tn->version) {
 234                                 /* We had a candidate mdata node already */
 235                                 dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
 236                                 jffs2_kill_tn(c, rii->mdata_tn);
 237                         } else {
 238                                 dbg_readinode("kill new mdata with ver %d (older than existing %d\n",
 239                                               tn->version, rii->mdata_tn->version);
 240                                 jffs2_kill_tn(c, tn);
 241                                 return 0;
 242                         }
 243                 }
 244                 rii->mdata_tn = tn;
 245                 dbg_readinode("keep new mdata with ver %d\n", tn->version);
 246                 return 0;
 247         }
 248
 249         /* Find the earliest node which _may_ be relevant to this one */
 250         this = jffs2_lookup_tn(&rii->tn_root, tn->fn->ofs);
 251         if (this) {
 252                 /* If the node is coincident with another at a lower address,
 253                    back up until the other node is found. It may be relevant */
 254                 while (this->overlapped) {
 255                         ptn = tn_prev(this);
 256                         if (!ptn) {
 257                                 /*
 258                                  * We killed a node which set the overlapped
 259                                  * flags during the scan. Fix it up.
 260                                  */
 261                                 this->overlapped = 0;
 262                                 break;
 263                         }
 264                         this = ptn;
 265                 }
 266                 dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
 267         }
 268
 269         while (this) {
 270                 if (this->fn->ofs > fn_end)
 271                         break;
 272                 dbg_readinode("Ponder this ver %d, 0x%x-0x%x\n",
 273                               this->version, this->fn->ofs, this->fn->size);
 274
 275                 if (this->version == tn->version) {
 276                         /* Version number collision means REF_PRISTINE GC. Accept either of them
 277                            as long as the CRC is correct. Check the one we have already...  */
 278                         if (!check_tn_node(c, this)) {
 279                                 /* The one we already had was OK. Keep it and throw away the new one */
 280                                 dbg_readinode("Like old node. Throw away new\n");
 281                                 jffs2_kill_tn(c, tn);
 282                                 return 0;
 283                         } else {
 284                                 /* Who cares if the new one is good; keep it for now anyway. */
 285                                 dbg_readinode("Like new node. Throw away old\n");
 286                                 rb_replace_node(&this->rb, &tn->rb, &rii->tn_root);
 287                                 jffs2_kill_tn(c, this);
 288                                 /* Same overlapping from in front and behind */
 289                                 return 0;
 290                         }
 291                 }
 292                 if (this->version < tn->version &&
 293                     this->fn->ofs >= tn->fn->ofs &&
 294                     this->fn->ofs + this->fn->size <= fn_end) {
 295                         /* New node entirely overlaps 'this' */
 296                         if (check_tn_node(c, tn)) {
 297                                 dbg_readinode("new node bad CRC\n");
 298                                 jffs2_kill_tn(c, tn);
 299                                 return 0;
 300                         }
 301                         /* ... and is good. Kill 'this' and any subsequent nodes which are also overlapped */
 302                         while (this && this->fn->ofs + this->fn->size <= fn_end) {
 303                                 struct jffs2_tmp_dnode_info *next = tn_next(this);
 304                                 if (this->version < tn->version) {
 305                                         tn_erase(this, &rii->tn_root);
 306                                         dbg_readinode("Kill overlapped ver %d, 0x%x-0x%x\n",
 307                                                       this->version, this->fn->ofs,
 308                                                       this->fn->ofs+this->fn->size);
 309                                         jffs2_kill_tn(c, this);
 310                                 }
 311                                 this = next;
 312                         }
 313                         dbg_readinode("Done killing overlapped nodes\n");
 314                         continue;
 315                 }
 316                 if (this->version > tn->version &&
 317                     this->fn->ofs <= tn->fn->ofs &&
 318                     this->fn->ofs+this->fn->size >= fn_end) {
 319                         /* New node entirely overlapped by 'this' */
 320                         if (!check_tn_node(c, this)) {
 321                                 dbg_readinode("Good CRC on old node. Kill new\n");
 322                                 jffs2_kill_tn(c, tn);
 323                                 return 0;
 324                         }
 325                         /* ... but 'this' was bad. Replace it... */
 326                         dbg_readinode("Bad CRC on old overlapping node. Kill it\n");
 327                         tn_erase(this, &rii->tn_root);
 328                         jffs2_kill_tn(c, this);
 329                         break;
 330                 }
 331
 332                 this = tn_next(this);
 333         }
 334
 335         /* We neither completely obsoleted nor were completely
 336            obsoleted by an earlier node. Insert into the tree */
 337         {
 338                 struct rb_node *parent;
 339                 struct rb_node **link = &rii->tn_root.rb_node;
 340                 struct jffs2_tmp_dnode_info *insert_point = NULL;
 341
 342                 while (*link) {
 343                         parent = *link;
 344                         insert_point = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 345                         if (tn->fn->ofs > insert_point->fn->ofs)
 346                                 link = &insert_point->rb.rb_right;
 347                         else if (tn->fn->ofs < insert_point->fn->ofs ||
 348                                  tn->fn->size < insert_point->fn->size)
 349                                 link = &insert_point->rb.rb_left;
 350                         else
 351                                 link = &insert_point->rb.rb_right;
 352                 }
 353                 rb_link_node(&tn->rb, &insert_point->rb, link);
 354                 rb_insert_color(&tn->rb, &rii->tn_root);
 355         }
 356
 357         /* If there's anything behind that overlaps us, note it */
 358         this = tn_prev(tn);
 359         if (this) {
 360                 while (1) {
 361                         if (this->fn->ofs + this->fn->size > tn->fn->ofs) {
 362                                 dbg_readinode("Node is overlapped by %p (v %d, 0x%x-0x%x)\n",
 363                                               this, this->version, this->fn->ofs,
 364                                               this->fn->ofs+this->fn->size);
 365                                 tn->overlapped = 1;
 366                                 break;
 367                         }
 368                         if (!this->overlapped)
 369                                 break;
 370
 371                         ptn = tn_prev(this);
 372                         if (!ptn) {
 373                                 /*
 374                                  * We killed a node which set the overlapped
 375                                  * flags during the scan. Fix it up.
 376                                  */
 377                                 this->overlapped = 0;
 378                                 break;
 379                         }
 380                         this = ptn;
 381                 }
 382         }
 383
 384         /* If the new node overlaps anything ahead, note it */
 385         this = tn_next(tn);
 386         while (this && this->fn->ofs < fn_end) {
 387                 this->overlapped = 1;
 388                 dbg_readinode("Node ver %d, 0x%x-0x%x is overlapped\n",
 389                               this->version, this->fn->ofs,
 390                               this->fn->ofs+this->fn->size);
 391                 this = tn_next(this);
 392         }
 393         return 0;
 394 }
 395
 396 /* Trivial function to remove the last node in the tree. Which by definition
 397    has no right-hand child — so can be removed just by making its left-hand
 398    child (if any) take its place under its parent. Since this is only done
 399    when we're consuming the whole tree, there's no need to use rb_erase()
 400    and let it worry about adjusting colours and balancing the tree. That
 401    would just be a waste of time. */
 402 static void eat_last(struct rb_root *root, struct rb_node *node)
 403 {
 404         struct rb_node *parent = rb_parent(node);
 405         struct rb_node **link;
 406
 407         /* LAST! */
 408         BUG_ON(node->rb_right);
 409
 410         if (!parent)
 411                 link = &root->rb_node;
 412         else if (node == parent->rb_left)
 413                 link = &parent->rb_left;
 414         else
 415                 link = &parent->rb_right;
 416
 417         *link = node->rb_left;
 418         if (node->rb_left)
 419                 node->rb_left->__rb_parent_color = node->__rb_parent_color;
 420 }
 421
 422 /* We put the version tree in reverse order, so we can use the same eat_last()
 423    function that we use to consume the tmpnode tree (tn_root). */
 424 static void ver_insert(struct rb_root *ver_root, struct jffs2_tmp_dnode_info *tn)
 425 {
 426         struct rb_node **link = &ver_root->rb_node;
 427         struct rb_node *parent = NULL;
 428         struct jffs2_tmp_dnode_info *this_tn;
 429
 430         while (*link) {
 431                 parent = *link;
 432                 this_tn = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 433
 434                 if (tn->version > this_tn->version)
 435                         link = &parent->rb_left;
 436                 else
 437                         link = &parent->rb_right;
 438         }
 439         dbg_readinode("Link new node at %p (root is %p)\n", link, ver_root);
 440         rb_link_node(&tn->rb, parent, link);
 441         rb_insert_color(&tn->rb, ver_root);
 442 }
 443
 444 /* Build final, normal fragtree from tn tree. It doesn't matter which order
 445    we add nodes to the real fragtree, as long as they don't overlap. And
 446    having thrown away the majority of overlapped nodes as we went, there
 447    really shouldn't be many sets of nodes which do overlap. If we start at
 448    the end, we can use the overlap markers -- we can just eat nodes which
 449    aren't overlapped, and when we encounter nodes which _do_ overlap we
 450    sort them all into a temporary tree in version order before replaying them. */
 451 static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
 452                                       struct jffs2_inode_info *f,
 453                                       struct jffs2_readinode_info *rii)
 454 {
 455         struct jffs2_tmp_dnode_info *pen, *last, *this;
 456         struct rb_root ver_root = RB_ROOT;
 457         uint32_t high_ver = 0;
 458
 459         if (rii->mdata_tn) {
 460                 dbg_readinode("potential mdata is ver %d at %p\n", rii->mdata_tn->version, rii->mdata_tn);
 461                 high_ver = rii->mdata_tn->version;
 462                 rii->latest_ref = rii->mdata_tn->fn->raw;
 463         }
 464 #ifdef JFFS2_DBG_READINODE_MESSAGES
 465         this = tn_last(&rii->tn_root);
 466         while (this) {
 467                 dbg_readinode("tn %p ver %d range 0x%x-0x%x ov %d\n", this, this->version, this->fn->ofs,
 468                               this->fn->ofs+this->fn->size, this->overlapped);
 469                 this = tn_prev(this);
 470         }
 471 #endif
 472         pen = tn_last(&rii->tn_root);
 473         while ((last = pen)) {
 474                 pen = tn_prev(last);
 475
 476                 eat_last(&rii->tn_root, &last->rb);
 477                 ver_insert(&ver_root, last);
 478
 479                 if (unlikely(last->overlapped)) {
 480                         if (pen)
 481                                 continue;
 482                         /*
 483                          * We killed a node which set the overlapped
 484                          * flags during the scan. Fix it up.
 485                          */
 486                         last->overlapped = 0;
 487                 }
 488
 489                 /* Now we have a bunch of nodes in reverse version
 490                    order, in the tree at ver_root. Most of the time,
 491                    there'll actually be only one node in the 'tree',
 492                    in fact. */
 493                 this = tn_last(&ver_root);
 494
 495                 while (this) {
 496                         struct jffs2_tmp_dnode_info *vers_next;
 497                         int ret;
 498                         vers_next = tn_prev(this);
 499                         eat_last(&ver_root, &this->rb);
 500                         if (check_tn_node(c, this)) {
 501                                 dbg_readinode("node ver %d, 0x%x-0x%x failed CRC\n",
 502                                              this->version, this->fn->ofs,
 503                                              this->fn->ofs+this->fn->size);
 504                                 jffs2_kill_tn(c, this);
 505                         } else {
 506                                 if (this->version > high_ver) {
 507                                         /* Note that this is different from the other
 508                                            highest_version, because this one is only
 509                                            counting _valid_ nodes which could give the
 510                                            latest inode metadata */
 511                                         high_ver = this->version;
 512                                         rii->latest_ref = this->fn->raw;
 513                                 }
 514                                 dbg_readinode("Add %p (v %d, 0x%x-0x%x, ov %d) to fragtree\n",
 515                                              this, this->version, this->fn->ofs,
 516                                              this->fn->ofs+this->fn->size, this->overlapped);
 517
 518                                 ret = jffs2_add_full_dnode_to_inode(c, f, this->fn);
 519                                 if (ret) {
 520                                         /* Free the nodes in vers_root; let the caller
 521                                            deal with the rest */
 522                                         JFFS2_ERROR("Add node to tree failed %d\n", ret);
 523                                         while (1) {
 524                                                 vers_next = tn_prev(this);
 525                                                 if (check_tn_node(c, this))
 526                                                         jffs2_mark_node_obsolete(c, this->fn->raw);
 527                                                 jffs2_free_full_dnode(this->fn);
 528                                                 jffs2_free_tmp_dnode_info(this);
 529                                                 this = vers_next;
 530                                                 if (!this)
 531                                                         break;
 532                                                 eat_last(&ver_root, &vers_next->rb);
 533                                         }
 534                                         return ret;
 535                                 }
 536                                 jffs2_free_tmp_dnode_info(this);
 537                         }
 538                         this = vers_next;
 539                 }
 540         }
 541         return 0;
 542 }
 543
 544 static void jffs2_free_tmp_dnode_info_list(struct rb_root *list)
 545 {
 546         struct jffs2_tmp_dnode_info *tn, *next;
 547
 548         rbtree_postorder_for_each_entry_safe(tn, next, list, rb) {
 549                         jffs2_free_full_dnode(tn->fn);
 550                         jffs2_free_tmp_dnode_info(tn);
 551         }
 552
 553         *list = RB_ROOT;
 554 }
 555
 556 static void jffs2_free_full_dirent_list(struct jffs2_full_dirent *fd)
 557 {
 558         struct jffs2_full_dirent *next;
 559
 560         while (fd) {
 561                 next = fd->next;
 562                 jffs2_free_full_dirent(fd);
 563                 fd = next;
 564         }
 565 }
 566
 567 /* Returns first valid node after 'ref'. May return 'ref' */
 568 static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_ref *ref)
 569 {
 570         while (ref && ref->next_in_ino) {
 571                 if (!ref_obsolete(ref))
 572                         return ref;
 573                 dbg_noderef("node at 0x%08x is obsoleted. Ignoring.\n", ref_offset(ref));
 574                 ref = ref->next_in_ino;
 575         }
 576         return NULL;
 577 }
 578
 579 /*
 580  * Helper function for jffs2_get_inode_nodes().
 581  * It is called every time an directory entry node is found.
 582  *
 583  * Returns: 0 on success;
 584  *          negative error code on failure.
 585  */
 586 static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 587                                 struct jffs2_raw_dirent *rd, size_t read,
 588                                 struct jffs2_readinode_info *rii)
 589 {
 590         struct jffs2_full_dirent *fd;
 591         uint32_t crc;
 592
 593         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 594         BUG_ON(ref_obsolete(ref));
 595
 596         crc = crc32(0, rd, sizeof(*rd) - 8);
 597         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 598                 JFFS2_NOTICE("header CRC failed on dirent node at %#08x: read %#08x, calculated %#08x\n",
 599                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 600                 jffs2_mark_node_obsolete(c, ref);
 601                 return 0;
 602         }
 603
 604         /* If we've never checked the CRCs on this node, check them now */
 605         if (ref_flags(ref) == REF_UNCHECKED) {
 606                 struct jffs2_eraseblock *jeb;
 607                 int len;
 608
 609                 /* Sanity check */
 610                 if (unlikely(PAD((rd->nsize + sizeof(*rd))) != PAD(je32_to_cpu(rd->totlen)))) {
 611                         JFFS2_ERROR("illegal nsize in node at %#08x: nsize %#02x, totlen %#04x\n",
 612                                     ref_offset(ref), rd->nsize, je32_to_cpu(rd->totlen));
 613                         jffs2_mark_node_obsolete(c, ref);
 614                         return 0;
 615                 }
 616
 617                 jeb = &c->blocks[ref->flash_offset / c->sector_size];
 618                 len = ref_totlen(c, jeb, ref);
 619
 620                 spin_lock(&c->erase_completion_lock);
 621                 jeb->used_size += len;
 622                 jeb->unchecked_size -= len;
 623                 c->used_size += len;
 624                 c->unchecked_size -= len;
 625                 ref->flash_offset = ref_offset(ref) | dirent_node_state(rd);
 626                 spin_unlock(&c->erase_completion_lock);
 627         }
 628
 629         fd = jffs2_alloc_full_dirent(rd->nsize + 1);
 630         if (unlikely(!fd))
 631                 return -ENOMEM;
 632
 633         fd->raw = ref;
 634         fd->version = je32_to_cpu(rd->version);
 635         fd->ino = je32_to_cpu(rd->ino);
 636         fd->type = rd->type;
 637
 638         if (fd->version > rii->highest_version)
 639                 rii->highest_version = fd->version;
 640
 641         /* Pick out the mctime of the latest dirent */
 642         if(fd->version > rii->mctime_ver && je32_to_cpu(rd->mctime)) {
 643                 rii->mctime_ver = fd->version;
 644                 rii->latest_mctime = je32_to_cpu(rd->mctime);
 645         }
 646
 647         /*
 648          * Copy as much of the name as possible from the raw
 649          * dirent we've already read from the flash.
 650          */
 651         if (read > sizeof(*rd))
 652                 memcpy(&fd->name[0], &rd->name[0],
 653                        min_t(uint32_t, rd->nsize, (read - sizeof(*rd)) ));
 654
 655         /* Do we need to copy any more of the name directly from the flash? */
 656         if (rd->nsize + sizeof(*rd) > read) {
 657                 /* FIXME: point() */
 658                 int err;
 659                 int already = read - sizeof(*rd);
 660
 661                 err = jffs2_flash_read(c, (ref_offset(ref)) + read,
 662                                 rd->nsize - already, &read, &fd->name[already]);
 663                 if (unlikely(read != rd->nsize - already) && likely(!err))
 664                         return -EIO;
 665
 666                 if (unlikely(err)) {
 667                         JFFS2_ERROR("read remainder of name: error %d\n", err);
 668                         jffs2_free_full_dirent(fd);
 669                         return -EIO;
 670                 }
 671         }
 672
 673         fd->nhash = full_name_hash(fd->name, rd->nsize);
 674         fd->next = NULL;
 675         fd->name[rd->nsize] = '\0';
 676
 677         /*
 678          * Wheee. We now have a complete jffs2_full_dirent structure, with
 679          * the name in it and everything. Link it into the list
 680          */
 681         jffs2_add_fd_to_list(c, fd, &rii->fds);
 682
 683         return 0;
 684 }
 685
 686 /*
 687  * Helper function for jffs2_get_inode_nodes().
 688  * It is called every time an inode node is found.
 689  *
 690  * Returns: 0 on success (possibly after marking a bad node obsolete);
 691  *          negative error code on failure.
 692  */
 693 static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 694                              struct jffs2_raw_inode *rd, int rdlen,
 695                              struct jffs2_readinode_info *rii)
 696 {
 697         struct jffs2_tmp_dnode_info *tn;
 698         uint32_t len, csize;
 699         int ret = 0;
 700         uint32_t crc;
 701
 702         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 703         BUG_ON(ref_obsolete(ref));
 704
 705         crc = crc32(0, rd, sizeof(*rd) - 8);
 706         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 707                 JFFS2_NOTICE("node CRC failed on dnode at %#08x: read %#08x, calculated %#08x\n",
 708                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 709                 jffs2_mark_node_obsolete(c, ref);
 710                 return 0;
 711         }
 712
 713         tn = jffs2_alloc_tmp_dnode_info();
 714         if (!tn) {
 715                 JFFS2_ERROR("failed to allocate tn (%zu bytes).\n", sizeof(*tn));
 716                 return -ENOMEM;
 717         }
 718
 719         tn->partial_crc = 0;
 720         csize = je32_to_cpu(rd->csize);
 721
 722         /* If we've never checked the CRCs on this node, check them now */
 723         if (ref_flags(ref) == REF_UNCHECKED) {
 724
 725                 /* Sanity checks */
 726                 if (unlikely(je32_to_cpu(rd->offset) > je32_to_cpu(rd->isize)) ||
 727                     unlikely(PAD(je32_to_cpu(rd->csize) + sizeof(*rd)) != PAD(je32_to_cpu(rd->totlen)))) {
 728                         JFFS2_WARNING("inode node header CRC is corrupted at %#08x\n", ref_offset(ref));
 729                         jffs2_dbg_dump_node(c, ref_offset(ref));
 730                         jffs2_mark_node_obsolete(c, ref);
 731                         goto free_out;
 732                 }
 733
 734                 if (jffs2_is_writebuffered(c) && csize != 0) {
 735                         /* At this point we are supposed to check the data CRC
 736                          * of our unchecked node. But thus far, we do not
 737                          * know whether the node is valid or obsolete. To
 738                          * figure this out, we need to walk all the nodes of
 739                          * the inode and build the inode fragtree. We don't
 740                          * want to spend time checking data of nodes which may
 741                          * later be found to be obsolete. So we put off the full
 742                          * data CRC checking until we have read all the inode
 743                          * nodes and have started building the fragtree.
 744                          *
 745                          * The fragtree is being built starting with nodes
 746                          * having the highest version number, so we'll be able
 747                          * to detect whether a node is valid (i.e., it is not
 748                          * overlapped by a node with higher version) or not.
 749                          * And we'll be able to check only those nodes, which
 750                          * are not obsolete.
 751                          *
 752                          * Of course, this optimization only makes sense in case
 753                          * of NAND flashes (or other flashes with
 754                          * !jffs2_can_mark_obsolete()), since on NOR flashes
 755                          * nodes are marked obsolete physically.
 756                          *
 757                          * Since NAND flashes (or other flashes with
 758                          * jffs2_is_writebuffered(c)) are anyway read by
 759                          * fractions of c->wbuf_pagesize, and we have just read
 760                          * the node header, it is likely that the starting part
 761                          * of the node data is also read when we read the
 762                          * header. So we don't mind to check the CRC of the
 763                          * starting part of the data of the node now, and check
 764                          * the second part later (in jffs2_check_node_data()).
 765                          * Of course, we will not need to re-read and re-check
 766                          * the NAND page which we have just read. This is why we
 767                          * read the whole NAND page at jffs2_get_inode_nodes(),
 768                          * while we needed only the node header.
 769                          */
 770                         unsigned char *buf;
 771
 772                         /* 'buf' will point to the start of data */
 773                         buf = (unsigned char *)rd + sizeof(*rd);
 774                         /* len will be the read data length */
 775                         len = min_t(uint32_t, rdlen - sizeof(*rd), csize);
 776                         tn->partial_crc = crc32(0, buf, len);
 777
 778                         dbg_readinode("Calculates CRC (%#08x) for %d bytes, csize %d\n", tn->partial_crc, len, csize);
 779
 780                         /* If we actually calculated the whole data CRC
 781                          * and it is wrong, drop the node. */
 782                         if (len >= csize && unlikely(tn->partial_crc != je32_to_cpu(rd->data_crc))) {
 783                                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 784                                         ref_offset(ref), tn->partial_crc, je32_to_cpu(rd->data_crc));
 785                                 jffs2_mark_node_obsolete(c, ref);
 786                                 goto free_out;
 787                         }
 788
 789                 } else if (csize == 0) {
 790                         /*
 791                          * We checked the header CRC. If the node has no data, adjust
 792                          * the space accounting now. For other nodes this will be done
 793                          * later either when the node is marked obsolete or when its
 794                          * data is checked.
 795                          */
 796                         struct jffs2_eraseblock *jeb;
 797
 798                         dbg_readinode("the node has no data.\n");
 799                         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 800                         len = ref_totlen(c, jeb, ref);
 801
 802                         spin_lock(&c->erase_completion_lock);
 803                         jeb->used_size += len;
 804                         jeb->unchecked_size -= len;
 805                         c->used_size += len;
 806                         c->unchecked_size -= len;
 807                         ref->flash_offset = ref_offset(ref) | REF_NORMAL;
 808                         spin_unlock(&c->erase_completion_lock);
 809                 }
 810         }
 811
 812         tn->fn = jffs2_alloc_full_dnode();
 813         if (!tn->fn) {
 814                 JFFS2_ERROR("alloc fn failed\n");
 815                 ret = -ENOMEM;
 816                 goto free_out;
 817         }
 818
 819         tn->version = je32_to_cpu(rd->version);
 820         tn->fn->ofs = je32_to_cpu(rd->offset);
 821         tn->data_crc = je32_to_cpu(rd->data_crc);
 822         tn->csize = csize;
 823         tn->fn->raw = ref;
 824         tn->overlapped = 0;
 825
 826         if (tn->version > rii->highest_version)
 827                 rii->highest_version = tn->version;
 828
 829         /* There was a bug where we wrote hole nodes out with
 830            csize/dsize swapped. Deal with it */
 831         if (rd->compr == JFFS2_COMPR_ZERO && !je32_to_cpu(rd->dsize) && csize)
 832                 tn->fn->size = csize;
 833         else // normal case...
 834                 tn->fn->size = je32_to_cpu(rd->dsize);
 835
 836         dbg_readinode2("dnode @%08x: ver %u, offset %#04x, dsize %#04x, csize %#04x\n",
 837                        ref_offset(ref), je32_to_cpu(rd->version),
 838                        je32_to_cpu(rd->offset), je32_to_cpu(rd->dsize), csize);
 839
 840         ret = jffs2_add_tn_to_tree(c, rii, tn);
 841
 842         if (ret) {
 843                 jffs2_free_full_dnode(tn->fn);
 844         free_out:
 845                 jffs2_free_tmp_dnode_info(tn);
 846                 return ret;
 847         }
 848 #ifdef JFFS2_DBG_READINODE2_MESSAGES
 849         dbg_readinode2("After adding ver %d:\n", je32_to_cpu(rd->version));
 850         tn = tn_first(&rii->tn_root);
 851         while (tn) {
 852                 dbg_readinode2("%p: v %d r 0x%x-0x%x ov %d\n",
 853                                tn, tn->version, tn->fn->ofs,
 854                                tn->fn->ofs+tn->fn->size, tn->overlapped);
 855                 tn = tn_next(tn);
 856         }
 857 #endif
 858         return 0;
 859 }
 860
 861 /*
 862  * Helper function for jffs2_get_inode_nodes().
 863  * It is called every time an unknown node is found.
 864  *
 865  * Returns: 0 on success;
 866  *          negative error code on failure.
 867  */
 868 static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref, struct jffs2_unknown_node *un)
 869 {
 870         /* We don't mark unknown nodes as REF_UNCHECKED */
 871         if (ref_flags(ref) == REF_UNCHECKED) {
 872                 JFFS2_ERROR("REF_UNCHECKED but unknown node at %#08x\n",
 873                             ref_offset(ref));
 874                 JFFS2_ERROR("Node is {%04x,%04x,%08x,%08x}. Please report this error.\n",
 875                             je16_to_cpu(un->magic), je16_to_cpu(un->nodetype),
 876                             je32_to_cpu(un->totlen), je32_to_cpu(un->hdr_crc));
 877                 jffs2_mark_node_obsolete(c, ref);
 878                 return 0;
 879         }
 880
 881         un->nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(un->nodetype));
 882
 883         switch(je16_to_cpu(un->nodetype) & JFFS2_COMPAT_MASK) {
 884
 885         case JFFS2_FEATURE_INCOMPAT:
 886                 JFFS2_ERROR("unknown INCOMPAT nodetype %#04X at %#08x\n",
 887                             je16_to_cpu(un->nodetype), ref_offset(ref));
 888                 /* EEP */
 889                 BUG();
 890                 break;
 891
 892         case JFFS2_FEATURE_ROCOMPAT:
 893                 JFFS2_ERROR("unknown ROCOMPAT nodetype %#04X at %#08x\n",
 894                             je16_to_cpu(un->nodetype), ref_offset(ref));
 895                 BUG_ON(!(c->flags & JFFS2_SB_FLAG_RO));
 896                 break;
 897
 898         case JFFS2_FEATURE_RWCOMPAT_COPY:
 899                 JFFS2_NOTICE("unknown RWCOMPAT_COPY nodetype %#04X at %#08x\n",
 900                              je16_to_cpu(un->nodetype), ref_offset(ref));
 901                 break;
 902
 903         case JFFS2_FEATURE_RWCOMPAT_DELETE:
 904                 JFFS2_NOTICE("unknown RWCOMPAT_DELETE nodetype %#04X at %#08x\n",
 905                              je16_to_cpu(un->nodetype), ref_offset(ref));
 906                 jffs2_mark_node_obsolete(c, ref);
 907                 return 0;
 908         }
 909
 910         return 0;
 911 }
 912
 913 /*
 914  * Helper function for jffs2_get_inode_nodes().
 915  * The function detects whether more data should be read and reads it if yes.
 916  *
 917  * Returns: 0 on success;
 918  *          negative error code on failure.
 919  */
 920 static int read_more(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 921                      int needed_len, int *rdlen, unsigned char *buf)
 922 {
 923         int err, to_read = needed_len - *rdlen;
 924         size_t retlen;
 925         uint32_t offs;
 926
 927         if (jffs2_is_writebuffered(c)) {
 928                 int rem = to_read % c->wbuf_pagesize;
 929
 930                 if (rem)
 931                         to_read += c->wbuf_pagesize - rem;
 932         }
 933
 934         /* We need to read more data */
 935         offs = ref_offset(ref) + *rdlen;
 936
 937         dbg_readinode("read more %d bytes\n", to_read);
 938
 939         err = jffs2_flash_read(c, offs, to_read, &retlen, buf + *rdlen);
 940         if (err) {
 941                 JFFS2_ERROR("can not read %d bytes from 0x%08x, "
 942                         "error code: %d.\n", to_read, offs, err);
 943                 return err;
 944         }
 945
 946         if (retlen < to_read) {
 947                 JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n",
 948                                 offs, retlen, to_read);
 949                 return -EIO;
 950         }
 951
 952         *rdlen += to_read;
 953         return 0;
 954 }
 955
 956 /* Get tmp_dnode_info and full_dirent for all non-obsolete nodes associated
 957    with this ino. Perform a preliminary ordering on data nodes, throwing away
 958    those which are completely obsoleted by newer ones. The naïve approach we
 959    use to take of just returning them _all_ in version order will cause us to
 960    run out of memory in certain degenerate cases. */
 961 static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 962                                  struct jffs2_readinode_info *rii)
 963 {
 964         struct jffs2_raw_node_ref *ref, *valid_ref;
 965         unsigned char *buf = NULL;
 966         union jffs2_node_union *node;
 967         size_t retlen;
 968         int len, err;
 969
 970         rii->mctime_ver = 0;
 971
 972         dbg_readinode("ino #%u\n", f->inocache->ino);
 973
 974         /* FIXME: in case of NOR and available ->point() this
 975          * needs to be fixed. */
 976         len = sizeof(union jffs2_node_union) + c->wbuf_pagesize;
 977         buf = kmalloc(len, GFP_KERNEL);
 978         if (!buf)
 979                 return -ENOMEM;
 980
 981         spin_lock(&c->erase_completion_lock);
 982         valid_ref = jffs2_first_valid_node(f->inocache->nodes);
 983         if (!valid_ref && f->inocache->ino != 1)
 984                 JFFS2_WARNING("Eep. No valid nodes for ino #%u.\n", f->inocache->ino);
 985         while (valid_ref) {
 986                 /* We can hold a pointer to a non-obsolete node without the spinlock,
 987                    but _obsolete_ nodes may disappear at any time, if the block
 988                    they're in gets erased. So if we mark 'ref' obsolete while we're
 989                    not holding the lock, it can go away immediately. For that reason,
 990                    we find the next valid node first, before processing 'ref'.
 991                 */
 992                 ref = valid_ref;
 993                 valid_ref = jffs2_first_valid_node(ref->next_in_ino);
 994                 spin_unlock(&c->erase_completion_lock);
 995
 996                 cond_resched();
 997
 998                 /*
 999                  * At this point we don't know the type of the node we're going
1000                  * to read, so we do not know the size of its header. In order
1001                  * to minimize the amount of flash IO we assume the header is
1002                  * of size = JFFS2_MIN_NODE_HEADER.
1003                  */
1004                 len = JFFS2_MIN_NODE_HEADER;
1005                 if (jffs2_is_writebuffered(c)) {
1006                         int end, rem;
1007
1008                         /*
1009                          * We are about to read JFFS2_MIN_NODE_HEADER bytes,
1010                          * but this flash has some minimal I/O unit. It is
1011                          * possible that we'll need to read more soon, so read
1012                          * up to the next min. I/O unit, in order not to
1013                          * re-read the same min. I/O unit twice.
1014                          */
1015                         end = ref_offset(ref) + len;
1016                         rem = end % c->wbuf_pagesize;
1017                         if (rem)
1018                                 end += c->wbuf_pagesize - rem;
1019                         len = end - ref_offset(ref);
1020                 }
1021
1022                 dbg_readinode("read %d bytes at %#08x(%d).\n", len, ref_offset(ref), ref_flags(ref));
1023
1024                 /* FIXME: point() */
1025                 err = jffs2_flash_read(c, ref_offset(ref), len, &retlen, buf);
1026                 if (err) {
1027                         JFFS2_ERROR("can not read %d bytes from 0x%08x, error code: %d.\n", len, ref_offset(ref), err);
1028                         goto free_out;
1029                 }
1030
1031                 if (retlen < len) {
1032                         JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n", ref_offset(ref), retlen, len);
1033                         err = -EIO;
1034                         goto free_out;
1035                 }
1036
1037                 node = (union jffs2_node_union *)buf;
1038
1039                 /* No need to mask in the valid bit; it shouldn't be invalid */
1040                 if (je32_to_cpu(node->u.hdr_crc) != crc32(0, node, sizeof(node->u)-4)) {
1041                         JFFS2_NOTICE("Node header CRC failed at %#08x. {%04x,%04x,%08x,%08x}\n",
1042                                      ref_offset(ref), je16_to_cpu(node->u.magic),
1043                                      je16_to_cpu(node->u.nodetype),
1044                                      je32_to_cpu(node->u.totlen),
1045                                      je32_to_cpu(node->u.hdr_crc));
1046                         jffs2_dbg_dump_node(c, ref_offset(ref));
1047                         jffs2_mark_node_obsolete(c, ref);
1048                         goto cont;
1049                 }
1050                 if (je16_to_cpu(node->u.magic) != JFFS2_MAGIC_BITMASK) {
1051                         /* Not a JFFS2 node, whinge and move on */
1052                         JFFS2_NOTICE("Wrong magic bitmask 0x%04x in node header at %#08x.\n",
1053                                      je16_to_cpu(node->u.magic), ref_offset(ref));
1054                         jffs2_mark_node_obsolete(c, ref);
1055                         goto cont;
1056                 }
1057
1058                 switch (je16_to_cpu(node->u.nodetype)) {
1059
1060                 case JFFS2_NODETYPE_DIRENT:
1061
1062                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent) &&
1063                             len < sizeof(struct jffs2_raw_dirent)) {
1064                                 err = read_more(c, ref, sizeof(struct jffs2_raw_dirent), &len, buf);
1065                                 if (unlikely(err))
1066                                         goto free_out;
1067                         }
1068
1069                         err = read_direntry(c, ref, &node->d, retlen, rii);
1070                         if (unlikely(err))
1071                                 goto free_out;
1072
1073                         break;
1074
1075                 case JFFS2_NODETYPE_INODE:
1076
1077                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode) &&
1078                             len < sizeof(struct jffs2_raw_inode)) {
1079                                 err = read_more(c, ref, sizeof(struct jffs2_raw_inode), &len, buf);
1080                                 if (unlikely(err))
1081                                         goto free_out;
1082                         }
1083
1084                         err = read_dnode(c, ref, &node->i, len, rii);
1085                         if (unlikely(err))
1086                                 goto free_out;
1087
1088                         break;
1089
1090                 default:
1091                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node) &&
1092                             len < sizeof(struct jffs2_unknown_node)) {
1093                                 err = read_more(c, ref, sizeof(struct jffs2_unknown_node), &len, buf);
1094                                 if (unlikely(err))
1095                                         goto free_out;
1096                         }
1097
1098                         err = read_unknown(c, ref, &node->u);
1099                         if (unlikely(err))
1100                                 goto free_out;
1101
1102                 }
1103         cont:
1104                 spin_lock(&c->erase_completion_lock);
1105         }
1106
1107         spin_unlock(&c->erase_completion_lock);
1108         kfree(buf);
1109
1110         f->highest_version = rii->highest_version;
1111
1112         dbg_readinode("nodes of inode #%u were read, the highest version is %u, latest_mctime %u, mctime_ver %u.\n",
1113                       f->inocache->ino, rii->highest_version, rii->latest_mctime,
1114                       rii->mctime_ver);
1115         return 0;
1116
1117  free_out:
1118         jffs2_free_tmp_dnode_info_list(&rii->tn_root);
1119         jffs2_free_full_dirent_list(rii->fds);
1120         rii->fds = NULL;
1121         kfree(buf);
1122         return err;
1123 }
1124
1125 static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
1126                                         struct jffs2_inode_info *f,
1127                                         struct jffs2_raw_inode *latest_node)
1128 {
1129         struct jffs2_readinode_info rii;
1130         uint32_t crc, new_size;
1131         size_t retlen;
1132         int ret;
1133
1134         dbg_readinode("ino #%u pino/nlink is %d\n", f->inocache->ino,
1135                       f->inocache->pino_nlink);
1136
1137         memset(&rii, 0, sizeof(rii));
1138
1139         /* Grab all nodes relevant to this ino */
1140         ret = jffs2_get_inode_nodes(c, f, &rii);
1141
1142         if (ret) {
1143                 JFFS2_ERROR("cannot read nodes for ino %u, returned error is %d\n", f->inocache->ino, ret);
1144                 if (f->inocache->state == INO_STATE_READING)
1145                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1146                 return ret;
1147         }
1148
1149         ret = jffs2_build_inode_fragtree(c, f, &rii);
1150         if (ret) {
1151                 JFFS2_ERROR("Failed to build final fragtree for inode #%u: error %d\n",
1152                             f->inocache->ino, ret);
1153                 if (f->inocache->state == INO_STATE_READING)
1154                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1155                 jffs2_free_tmp_dnode_info_list(&rii.tn_root);
1156                 /* FIXME: We could at least crc-check them all */
1157                 if (rii.mdata_tn) {
1158                         jffs2_free_full_dnode(rii.mdata_tn->fn);
1159                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1160                         rii.mdata_tn = NULL;
1161                 }
1162                 return ret;
1163         }
1164
1165         if (rii.mdata_tn) {
1166                 if (rii.mdata_tn->fn->raw == rii.latest_ref) {
1167                         f->metadata = rii.mdata_tn->fn;
1168                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1169                 } else {
1170                         jffs2_kill_tn(c, rii.mdata_tn);
1171                 }
1172                 rii.mdata_tn = NULL;
1173         }
1174
1175         f->dents = rii.fds;
1176
1177         jffs2_dbg_fragtree_paranoia_check_nolock(f);
1178
1179         if (unlikely(!rii.latest_ref)) {
1180                 /* No data nodes for this inode. */
1181                 if (f->inocache->ino != 1) {
1182                         JFFS2_WARNING("no data nodes found for ino #%u\n", f->inocache->ino);
1183                         if (!rii.fds) {
1184                                 if (f->inocache->state == INO_STATE_READING)
1185                                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1186                                 return -EIO;
1187                         }
1188                         JFFS2_NOTICE("but it has children so we fake some modes for it\n");
1189                 }
1190                 latest_node->mode = cpu_to_jemode(S_IFDIR|S_IRUGO|S_IWUSR|S_IXUGO);
1191                 latest_node->version = cpu_to_je32(0);
1192                 latest_node->atime = latest_node->ctime = latest_node->mtime = cpu_to_je32(0);
1193                 latest_node->isize = cpu_to_je32(0);
1194                 latest_node->gid = cpu_to_je16(0);
1195                 latest_node->uid = cpu_to_je16(0);
1196                 if (f->inocache->state == INO_STATE_READING)
1197                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1198                 return 0;
1199         }
1200
1201         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref), sizeof(*latest_node), &retlen, (void *)latest_node);
1202         if (ret || retlen != sizeof(*latest_node)) {
1203                 JFFS2_ERROR("failed to read from flash: error %d, %zd of %zd bytes read\n",
1204                         ret, retlen, sizeof(*latest_node));
1205                 /* FIXME: If this fails, there seems to be a memory leak. Find it. */
1206                 return ret ? ret : -EIO;
1207         }
1208
1209         crc = crc32(0, latest_node, sizeof(*latest_node)-8);
1210         if (crc != je32_to_cpu(latest_node->node_crc)) {
1211                 JFFS2_ERROR("CRC failed for read_inode of inode %u at physical location 0x%x\n",
1212                         f->inocache->ino, ref_offset(rii.latest_ref));
1213                 return -EIO;
1214         }
1215
1216         switch(jemode_to_cpu(latest_node->mode) & S_IFMT) {
1217         case S_IFDIR:
1218                 if (rii.mctime_ver > je32_to_cpu(latest_node->version)) {
1219                         /* The times in the latest_node are actually older than
1220                            mctime in the latest dirent. Cheat. */
1221                         latest_node->ctime = latest_node->mtime = cpu_to_je32(rii.latest_mctime);
1222                 }
1223                 break;
1224
1225
1226         case S_IFREG:
1227                 /* If it was a regular file, truncate it to the latest node's isize */
1228                 new_size = jffs2_truncate_fragtree(c, &f->fragtree, je32_to_cpu(latest_node->isize));
1229                 if (new_size != je32_to_cpu(latest_node->isize)) {
1230                         JFFS2_WARNING("Truncating ino #%u to %d bytes failed because it only had %d bytes to start with!\n",
1231                                       f->inocache->ino, je32_to_cpu(latest_node->isize), new_size);
1232                         latest_node->isize = cpu_to_je32(new_size);
1233                 }
1234                 break;
1235
1236         case S_IFLNK:
1237                 /* Hack to work around broken isize in old symlink code.
1238                    Remove this when dwmw2 comes to his senses and stops
1239                    symlinks from being an entirely gratuitous special
1240                    case. */
1241                 if (!je32_to_cpu(latest_node->isize))
1242                         latest_node->isize = latest_node->dsize;
1243
1244                 if (f->inocache->state != INO_STATE_CHECKING) {
1245                         /* Symlink's inode data is the target path. Read it and
1246                          * keep in RAM to facilitate quick follow symlink
1247                          * operation. */
1248                         uint32_t csize = je32_to_cpu(latest_node->csize);
1249                         if (csize > JFFS2_MAX_NAME_LEN)
1250                                 return -ENAMETOOLONG;
1251                         f->target = kmalloc(csize + 1, GFP_KERNEL);
1252                         if (!f->target) {
1253                                 JFFS2_ERROR("can't allocate %u bytes of memory for the symlink target path cache\n", csize);
1254                                 return -ENOMEM;
1255                         }
1256
1257                         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref) + sizeof(*latest_node),
1258                                                csize, &retlen, (char *)f->target);
1259
1260                         if (ret || retlen != csize) {
1261                                 if (retlen != csize)
1262                                         ret = -EIO;
1263                                 kfree(f->target);
1264                                 f->target = NULL;
1265                                 return ret;
1266                         }
1267
1268                         f->target[csize] = '\0';
1269                         dbg_readinode("symlink's target '%s' cached\n", f->target);
1270                 }
1271
1272                 /* fall through... */
1273
1274         case S_IFBLK:
1275         case S_IFCHR:
1276                 /* Certain inode types should have only one data node, and it's
1277                    kept as the metadata node */
1278                 if (f->metadata) {
1279                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o had metadata node\n",
1280                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1281                         return -EIO;
1282                 }
1283                 if (!frag_first(&f->fragtree)) {
1284                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o has no fragments\n",
1285                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1286                         return -EIO;
1287                 }
1288                 /* ASSERT: f->fraglist != NULL */
1289                 if (frag_next(frag_first(&f->fragtree))) {
1290                         JFFS2_ERROR("Argh. Special inode #%u with mode 0x%x had more than one node\n",
1291                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1292                         /* FIXME: Deal with it - check crc32, check for duplicate node, check times and discard the older one */
1293                         return -EIO;
1294                 }
1295                 /* OK. We're happy */
1296                 f->metadata = frag_first(&f->fragtree)->node;
1297                 jffs2_free_node_frag(frag_first(&f->fragtree));
1298                 f->fragtree = RB_ROOT;
1299                 break;
1300         }
1301         if (f->inocache->state == INO_STATE_READING)
1302                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1303
1304         return 0;
1305 }
1306
1307 /* Scan the list of all nodes present for this ino, build map of versions, etc. */
1308 int jffs2_do_read_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
1309                         uint32_t ino, struct jffs2_raw_inode *latest_node)
1310 {
1311         dbg_readinode("read inode #%u\n", ino);
1312
1313  retry_inocache:
1314         spin_lock(&c->inocache_lock);
1315         f->inocache = jffs2_get_ino_cache(c, ino);
1316
1317         if (f->inocache) {
1318                 /* Check its state. We may need to wait before we can use it */
1319                 switch(f->inocache->state) {
1320                 case INO_STATE_UNCHECKED:
1321                 case INO_STATE_CHECKEDABSENT:
1322                         f->inocache->state = INO_STATE_READING;
1323                         break;
1324
1325                 case INO_STATE_CHECKING:
1326                 case INO_STATE_GC:
1327                         /* If it's in either of these states, we need
1328                            to wait for whoever's got it to finish and
1329                            put it back. */
1330                         dbg_readinode("waiting for ino #%u in state %d\n", ino, f->inocache->state);
1331                         sleep_on_spinunlock(&c->inocache_wq, &c->inocache_lock);
1332                         goto retry_inocache;
1333
1334                 case INO_STATE_READING:
1335                 case INO_STATE_PRESENT:
1336                         /* Eep. This should never happen. It can
1337                         happen if Linux calls read_inode() again
1338                         before clear_inode() has finished though. */
1339                         JFFS2_ERROR("Eep. Trying to read_inode #%u when it's already in state %d!\n", ino, f->inocache->state);
1340                         /* Fail. That's probably better than allowing it to succeed */
1341                         f->inocache = NULL;
1342                         break;
1343
1344                 default:
1345                         BUG();
1346                 }
1347         }
1348         spin_unlock(&c->inocache_lock);
1349
1350         if (!f->inocache && ino == 1) {
1351                 /* Special case - no root inode on medium */
1352                 f->inocache = jffs2_alloc_inode_cache();
1353                 if (!f->inocache) {
1354                         JFFS2_ERROR("cannot allocate inocache for root inode\n");
1355                         return -ENOMEM;
1356                 }
1357                 dbg_readinode("creating inocache for root inode\n");
1358                 memset(f->inocache, 0, sizeof(struct jffs2_inode_cache));
1359                 f->inocache->ino = f->inocache->pino_nlink = 1;
1360                 f->inocache->nodes = (struct jffs2_raw_node_ref *)f->inocache;
1361                 f->inocache->state = INO_STATE_READING;
1362                 jffs2_add_ino_cache(c, f->inocache);
1363         }
1364         if (!f->inocache) {
1365                 JFFS2_ERROR("requestied to read an nonexistent ino %u\n", ino);
1366                 return -ENOENT;
1367         }
1368
1369         return jffs2_do_read_inode_internal(c, f, latest_node);
1370 }
1371
1372 int jffs2_do_crccheck_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
1373 {
1374         struct jffs2_raw_inode n;
1375         struct jffs2_inode_info *f = kzalloc(sizeof(*f), GFP_KERNEL);
1376         int ret;
1377
1378         if (!f)
1379                 return -ENOMEM;
1380
1381         mutex_init(&f->sem);
1382         mutex_lock(&f->sem);
1383         f->inocache = ic;
1384
1385         ret = jffs2_do_read_inode_internal(c, f, &n);
1386         mutex_unlock(&f->sem);
1387         jffs2_do_clear_inode(c, f);
1388         jffs2_xattr_do_crccheck_inode(c, ic);
1389         kfree (f);
1390         return ret;
1391 }
1392
1393 void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
1394 {
1395         struct jffs2_full_dirent *fd, *fds;
1396         int deleted;
1397
1398         jffs2_xattr_delete_inode(c, f->inocache);
1399         mutex_lock(&f->sem);
1400         deleted = f->inocache && !f->inocache->pino_nlink;
1401
1402         if (f->inocache && f->inocache->state != INO_STATE_CHECKING)
1403                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CLEARING);
1404
1405         if (f->metadata) {
1406                 if (deleted)
1407                         jffs2_mark_node_obsolete(c, f->metadata->raw);
1408                 jffs2_free_full_dnode(f->metadata);
1409         }
1410
1411         jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
1412
1413         if (f->target) {
1414                 kfree(f->target);
1415                 f->target = NULL;
1416         }
1417
1418         fds = f->dents;
1419         while(fds) {
1420                 fd = fds;
1421                 fds = fd->next;
1422                 jffs2_free_full_dirent(fd);
1423         }
1424
1425         if (f->inocache && f->inocache->state != INO_STATE_CHECKING) {
1426                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1427                 if (f->inocache->nodes == (void *)f->inocache)
1428                         jffs2_del_ino_cache(c, f->inocache);
1429         }
1430
1431         mutex_unlock(&f->sem);
1432 }