fs/jffs2/readinode.c

   1 /*
   2  * JFFS2 -- Journalling Flash File System, Version 2.
   3  *
   4  * Copyright © 2001-2007 Red Hat, Inc.
   5  *
   6  * Created by David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * For licensing information, see the file 'LICENCE' in this directory.
   9  *
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/sched.h>
  14 #include <linux/slab.h>
  15 #include <linux/fs.h>
  16 #include <linux/crc32.h>
  17 #include <linux/pagemap.h>
  18 #include <linux/mtd/mtd.h>
  19 #include <linux/compiler.h>
  20 #include "nodelist.h"
  21
  22 /*
  23  * Check the data CRC of the node.
  24  *
  25  * Returns: 0 if the data CRC is correct;
  26  *          1 - if incorrect;
  27  *          error code if an error occured.
  28  */
  29 static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
  30 {
  31         struct jffs2_raw_node_ref *ref = tn->fn->raw;
  32         int err = 0, pointed = 0;
  33         struct jffs2_eraseblock *jeb;
  34         unsigned char *buffer;
  35         uint32_t crc, ofs, len;
  36         size_t retlen;
  37
  38         BUG_ON(tn->csize == 0);
  39
  40         /* Calculate how many bytes were already checked */
  41         ofs = ref_offset(ref) + sizeof(struct jffs2_raw_inode);
  42         len = tn->csize;
  43
  44         if (jffs2_is_writebuffered(c)) {
  45                 int adj = ofs % c->wbuf_pagesize;
  46                 if (likely(adj))
  47                         adj = c->wbuf_pagesize - adj;
  48
  49                 if (adj >= tn->csize) {
  50                         dbg_readinode("no need to check node at %#08x, data length %u, data starts at %#08x - it has already been checked.\n",
  51                                       ref_offset(ref), tn->csize, ofs);
  52                         goto adj_acc;
  53                 }
  54
  55                 ofs += adj;
  56                 len -= adj;
  57         }
  58
  59         dbg_readinode("check node at %#08x, data length %u, partial CRC %#08x, correct CRC %#08x, data starts at %#08x, start checking from %#08x - %u bytes.\n",
  60                 ref_offset(ref), tn->csize, tn->partial_crc, tn->data_crc, ofs - len, ofs, len);
  61
  62 #ifndef __ECOS
  63         /* TODO: instead, incapsulate point() stuff to jffs2_flash_read(),
  64          * adding and jffs2_flash_read_end() interface. */
  65         if (c->mtd->point) {
  66                 err = c->mtd->point(c->mtd, ofs, len, &retlen, &buffer);
  67                 if (!err && retlen < len) {
  68                         JFFS2_WARNING("MTD point returned len too short: %zu instead of %u.\n", retlen, tn->csize);
  69                         c->mtd->unpoint(c->mtd, buffer, ofs, retlen);
  70                 } else if (err)
  71                         JFFS2_WARNING("MTD point failed: error code %d.\n", err);
  72                 else
  73                         pointed = 1; /* succefully pointed to device */
  74         }
  75 #endif
  76
  77         if (!pointed) {
  78                 buffer = kmalloc(len, GFP_KERNEL);
  79                 if (unlikely(!buffer))
  80                         return -ENOMEM;
  81
  82                 /* TODO: this is very frequent pattern, make it a separate
  83                  * routine */
  84                 err = jffs2_flash_read(c, ofs, len, &retlen, buffer);
  85                 if (err) {
  86                         JFFS2_ERROR("can not read %d bytes from 0x%08x, error code: %d.\n", len, ofs, err);
  87                         goto free_out;
  88                 }
  89
  90                 if (retlen != len) {
  91                         JFFS2_ERROR("short read at %#08x: %zd instead of %d.\n", ofs, retlen, len);
  92                         err = -EIO;
  93                         goto free_out;
  94                 }
  95         }
  96
  97         /* Continue calculating CRC */
  98         crc = crc32(tn->partial_crc, buffer, len);
  99         if(!pointed)
 100                 kfree(buffer);
 101 #ifndef __ECOS
 102         else
 103                 c->mtd->unpoint(c->mtd, buffer, ofs, len);
 104 #endif
 105
 106         if (crc != tn->data_crc) {
 107                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 108                              ref_offset(ref), tn->data_crc, crc);
 109                 return 1;
 110         }
 111
 112 adj_acc:
 113         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 114         len = ref_totlen(c, jeb, ref);
 115         /* If it should be REF_NORMAL, it'll get marked as such when
 116            we build the fragtree, shortly. No need to worry about GC
 117            moving it while it's marked REF_PRISTINE -- GC won't happen
 118            till we've finished checking every inode anyway. */
 119         ref->flash_offset |= REF_PRISTINE;
 120         /*
 121          * Mark the node as having been checked and fix the
 122          * accounting accordingly.
 123          */
 124         spin_lock(&c->erase_completion_lock);
 125         jeb->used_size += len;
 126         jeb->unchecked_size -= len;
 127         c->used_size += len;
 128         c->unchecked_size -= len;
 129         jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
 130         spin_unlock(&c->erase_completion_lock);
 131
 132         return 0;
 133
 134 free_out:
 135         if(!pointed)
 136                 kfree(buffer);
 137 #ifndef __ECOS
 138         else
 139                 c->mtd->unpoint(c->mtd, buffer, ofs, len);
 140 #endif
 141         return err;
 142 }
 143
 144 /*
 145  * Helper function for jffs2_add_older_frag_to_fragtree().
 146  *
 147  * Checks the node if we are in the checking stage.
 148  */
 149 static int check_tn_node(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 150 {
 151         int ret;
 152
 153         BUG_ON(ref_obsolete(tn->fn->raw));
 154
 155         /* We only check the data CRC of unchecked nodes */
 156         if (ref_flags(tn->fn->raw) != REF_UNCHECKED)
 157                 return 0;
 158
 159         dbg_readinode("check node %#04x-%#04x, phys offs %#08x\n",
 160                       tn->fn->ofs, tn->fn->ofs + tn->fn->size, ref_offset(tn->fn->raw));
 161
 162         ret = check_node_data(c, tn);
 163         if (unlikely(ret < 0)) {
 164                 JFFS2_ERROR("check_node_data() returned error: %d.\n",
 165                         ret);
 166         } else if (unlikely(ret > 0)) {
 167                 dbg_readinode("CRC error, mark it obsolete.\n");
 168                 jffs2_mark_node_obsolete(c, tn->fn->raw);
 169         }
 170
 171         return ret;
 172 }
 173
 174 static struct jffs2_tmp_dnode_info *jffs2_lookup_tn(struct rb_root *tn_root, uint32_t offset)
 175 {
 176         struct rb_node *next;
 177         struct jffs2_tmp_dnode_info *tn = NULL;
 178
 179         dbg_readinode("root %p, offset %d\n", tn_root, offset);
 180
 181         next = tn_root->rb_node;
 182
 183         while (next) {
 184                 tn = rb_entry(next, struct jffs2_tmp_dnode_info, rb);
 185
 186                 if (tn->fn->ofs < offset)
 187                         next = tn->rb.rb_right;
 188                 else if (tn->fn->ofs >= offset)
 189                         next = tn->rb.rb_left;
 190                 else
 191                         break;
 192         }
 193
 194         return tn;
 195 }
 196
 197
 198 static void jffs2_kill_tn(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 199 {
 200         jffs2_mark_node_obsolete(c, tn->fn->raw);
 201         jffs2_free_full_dnode(tn->fn);
 202         jffs2_free_tmp_dnode_info(tn);
 203 }
 204 /*
 205  * This function is used when we read an inode. Data nodes arrive in
 206  * arbitrary order -- they may be older or newer than the nodes which
 207  * are already in the tree. Where overlaps occur, the older node can
 208  * be discarded as long as the newer passes the CRC check. We don't
 209  * bother to keep track of holes in this rbtree, and neither do we deal
 210  * with frags -- we can have multiple entries starting at the same
 211  * offset, and the one with the smallest length will come first in the
 212  * ordering.
 213  *
 214  * Returns 0 if the node was handled (including marking it obsolete)
 215  *       < 0 an if error occurred
 216  */
 217 static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
 218                                 struct jffs2_readinode_info *rii,
 219                                 struct jffs2_tmp_dnode_info *tn)
 220 {
 221         uint32_t fn_end = tn->fn->ofs + tn->fn->size;
 222         struct jffs2_tmp_dnode_info *this;
 223
 224         dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
 225
 226         /* If a node has zero dsize, we only have to keep if it if it might be the
 227            node with highest version -- i.e. the one which will end up as f->metadata.
 228            Note that such nodes won't be REF_UNCHECKED since there are no data to
 229            check anyway. */
 230         if (!tn->fn->size) {
 231                 if (rii->mdata_tn) {
 232                         if (rii->mdata_tn->version < tn->version) {
 233                                 /* We had a candidate mdata node already */
 234                                 dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
 235                                 jffs2_kill_tn(c, rii->mdata_tn);
 236                         } else {
 237                                 dbg_readinode("kill new mdata with ver %d (older than existing %d\n",
 238                                               tn->version, rii->mdata_tn->version);
 239                                 jffs2_kill_tn(c, tn);
 240                                 return 0;
 241                         }
 242                 }
 243                 rii->mdata_tn = tn;
 244                 dbg_readinode("keep new mdata with ver %d\n", tn->version);
 245                 return 0;
 246         }
 247
 248         /* Find the earliest node which _may_ be relevant to this one */
 249         this = jffs2_lookup_tn(&rii->tn_root, tn->fn->ofs);
 250         if (this) {
 251                 /* If the node is coincident with another at a lower address,
 252                    back up until the other node is found. It may be relevant */
 253                 while (this->overlapped)
 254                         this = tn_prev(this);
 255
 256                 /* First node should never be marked overlapped */
 257                 BUG_ON(!this);
 258                 dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
 259         }
 260
 261         while (this) {
 262                 if (this->fn->ofs > fn_end)
 263                         break;
 264                 dbg_readinode("Ponder this ver %d, 0x%x-0x%x\n",
 265                               this->version, this->fn->ofs, this->fn->size);
 266
 267                 if (this->version == tn->version) {
 268                         /* Version number collision means REF_PRISTINE GC. Accept either of them
 269                            as long as the CRC is correct. Check the one we have already...  */
 270                         if (!check_tn_node(c, this)) {
 271                                 /* The one we already had was OK. Keep it and throw away the new one */
 272                                 dbg_readinode("Like old node. Throw away new\n");
 273                                 jffs2_kill_tn(c, tn);
 274                                 return 0;
 275                         } else {
 276                                 /* Who cares if the new one is good; keep it for now anyway. */
 277                                 dbg_readinode("Like new node. Throw away old\n");
 278                                 rb_replace_node(&this->rb, &tn->rb, &rii->tn_root);
 279                                 jffs2_kill_tn(c, this);
 280                                 /* Same overlapping from in front and behind */
 281                                 return 0;
 282                         }
 283                 }
 284                 if (this->version < tn->version &&
 285                     this->fn->ofs >= tn->fn->ofs &&
 286                     this->fn->ofs + this->fn->size <= fn_end) {
 287                         /* New node entirely overlaps 'this' */
 288                         if (check_tn_node(c, tn)) {
 289                                 dbg_readinode("new node bad CRC\n");
 290                                 jffs2_kill_tn(c, tn);
 291                                 return 0;
 292                         }
 293                         /* ... and is good. Kill 'this' and any subsequent nodes which are also overlapped */
 294                         while (this && this->fn->ofs + this->fn->size <= fn_end) {
 295                                 struct jffs2_tmp_dnode_info *next = tn_next(this);
 296                                 if (this->version < tn->version) {
 297                                         tn_erase(this, &rii->tn_root);
 298                                         dbg_readinode("Kill overlapped ver %d, 0x%x-0x%x\n",
 299                                                       this->version, this->fn->ofs,
 300                                                       this->fn->ofs+this->fn->size);
 301                                         jffs2_kill_tn(c, this);
 302                                 }
 303                                 this = next;
 304                         }
 305                         dbg_readinode("Done killing overlapped nodes\n");
 306                         continue;
 307                 }
 308                 if (this->version > tn->version &&
 309                     this->fn->ofs <= tn->fn->ofs &&
 310                     this->fn->ofs+this->fn->size >= fn_end) {
 311                         /* New node entirely overlapped by 'this' */
 312                         if (!check_tn_node(c, this)) {
 313                                 dbg_readinode("Good CRC on old node. Kill new\n");
 314                                 jffs2_kill_tn(c, tn);
 315                                 return 0;
 316                         }
 317                         /* ... but 'this' was bad. Replace it... */
 318                         dbg_readinode("Bad CRC on old overlapping node. Kill it\n");
 319                         tn_erase(this, &rii->tn_root);
 320                         jffs2_kill_tn(c, this);
 321                         break;
 322                 }
 323
 324                 this = tn_next(this);
 325         }
 326
 327         /* We neither completely obsoleted nor were completely
 328            obsoleted by an earlier node. Insert into the tree */
 329         {
 330                 struct rb_node *parent;
 331                 struct rb_node **link = &rii->tn_root.rb_node;
 332                 struct jffs2_tmp_dnode_info *insert_point = NULL;
 333
 334                 while (*link) {
 335                         parent = *link;
 336                         insert_point = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 337                         if (tn->fn->ofs > insert_point->fn->ofs)
 338                                 link = &insert_point->rb.rb_right;
 339                         else if (tn->fn->ofs < insert_point->fn->ofs ||
 340                                  tn->fn->size < insert_point->fn->size)
 341                                 link = &insert_point->rb.rb_left;
 342                         else
 343                                 link = &insert_point->rb.rb_right;
 344                 }
 345                 rb_link_node(&tn->rb, &insert_point->rb, link);
 346                 rb_insert_color(&tn->rb, &rii->tn_root);
 347         }
 348
 349         /* If there's anything behind that overlaps us, note it */
 350         this = tn_prev(tn);
 351         if (this) {
 352                 while (1) {
 353                         if (this->fn->ofs + this->fn->size > tn->fn->ofs) {
 354                                 dbg_readinode("Node is overlapped by %p (v %d, 0x%x-0x%x)\n",
 355                                               this, this->version, this->fn->ofs,
 356                                               this->fn->ofs+this->fn->size);
 357                                 tn->overlapped = 1;
 358                                 break;
 359                         }
 360                         if (!this->overlapped)
 361                                 break;
 362                         this = tn_prev(this);
 363                 }
 364         }
 365
 366         /* If the new node overlaps anything ahead, note it */
 367         this = tn_next(tn);
 368         while (this && this->fn->ofs < fn_end) {
 369                 this->overlapped = 1;
 370                 dbg_readinode("Node ver %d, 0x%x-0x%x is overlapped\n",
 371                               this->version, this->fn->ofs,
 372                               this->fn->ofs+this->fn->size);
 373                 this = tn_next(this);
 374         }
 375         return 0;
 376 }
 377
 378 /* Trivial function to remove the last node in the tree. Which by definition
 379    has no right-hand -- so can be removed just by making its only child (if
 380    any) take its place under its parent. */
 381 static void eat_last(struct rb_root *root, struct rb_node *node)
 382 {
 383         struct rb_node *parent = rb_parent(node);
 384         struct rb_node **link;
 385
 386         /* LAST! */
 387         BUG_ON(node->rb_right);
 388
 389         if (!parent)
 390                 link = &root->rb_node;
 391         else if (node == parent->rb_left)
 392                 link = &parent->rb_left;
 393         else
 394                 link = &parent->rb_right;
 395
 396         *link = node->rb_left;
 397         /* Colour doesn't matter now. Only the parent pointer. */
 398         if (node->rb_left)
 399                 node->rb_left->rb_parent_color = node->rb_parent_color;
 400 }
 401
 402 /* We put this in reverse order, so we can just use eat_last */
 403 static void ver_insert(struct rb_root *ver_root, struct jffs2_tmp_dnode_info *tn)
 404 {
 405         struct rb_node **link = &ver_root->rb_node;
 406         struct rb_node *parent = NULL;
 407         struct jffs2_tmp_dnode_info *this_tn;
 408
 409         while (*link) {
 410                 parent = *link;
 411                 this_tn = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 412
 413                 if (tn->version > this_tn->version)
 414                         link = &parent->rb_left;
 415                 else
 416                         link = &parent->rb_right;
 417         }
 418         dbg_readinode("Link new node at %p (root is %p)\n", link, ver_root);
 419         rb_link_node(&tn->rb, parent, link);
 420         rb_insert_color(&tn->rb, ver_root);
 421 }
 422
 423 /* Build final, normal fragtree from tn tree. It doesn't matter which order
 424    we add nodes to the real fragtree, as long as they don't overlap. And
 425    having thrown away the majority of overlapped nodes as we went, there
 426    really shouldn't be many sets of nodes which do overlap. If we start at
 427    the end, we can use the overlap markers -- we can just eat nodes which
 428    aren't overlapped, and when we encounter nodes which _do_ overlap we
 429    sort them all into a temporary tree in version order before replaying them. */
 430 static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
 431                                       struct jffs2_inode_info *f,
 432                                       struct jffs2_readinode_info *rii)
 433 {
 434         struct jffs2_tmp_dnode_info *pen, *last, *this;
 435         struct rb_root ver_root = RB_ROOT;
 436         uint32_t high_ver = 0;
 437
 438         if (rii->mdata_tn) {
 439                 dbg_readinode("potential mdata is ver %d at %p\n", rii->mdata_tn->version, rii->mdata_tn);
 440                 high_ver = rii->mdata_tn->version;
 441                 rii->latest_ref = rii->mdata_tn->fn->raw;
 442         }
 443 #ifdef JFFS2_DBG_READINODE_MESSAGES
 444         this = tn_last(&rii->tn_root);
 445         while (this) {
 446                 dbg_readinode("tn %p ver %d range 0x%x-0x%x ov %d\n", this, this->version, this->fn->ofs,
 447                               this->fn->ofs+this->fn->size, this->overlapped);
 448                 this = tn_prev(this);
 449         }
 450 #endif
 451         pen = tn_last(&rii->tn_root);
 452         while ((last = pen)) {
 453                 pen = tn_prev(last);
 454
 455                 eat_last(&rii->tn_root, &last->rb);
 456                 ver_insert(&ver_root, last);
 457
 458                 if (unlikely(last->overlapped))
 459                         continue;
 460
 461                 /* Now we have a bunch of nodes in reverse version
 462                    order, in the tree at ver_root. Most of the time,
 463                    there'll actually be only one node in the 'tree',
 464                    in fact. */
 465                 this = tn_last(&ver_root);
 466
 467                 while (this) {
 468                         struct jffs2_tmp_dnode_info *vers_next;
 469                         int ret;
 470                         vers_next = tn_prev(this);
 471                         eat_last(&ver_root, &this->rb);
 472                         if (check_tn_node(c, this)) {
 473                                 dbg_readinode("node ver %d, 0x%x-0x%x failed CRC\n",
 474                                              this->version, this->fn->ofs,
 475                                              this->fn->ofs+this->fn->size);
 476                                 jffs2_kill_tn(c, this);
 477                         } else {
 478                                 if (this->version > high_ver) {
 479                                         /* Note that this is different from the other
 480                                            highest_version, because this one is only
 481                                            counting _valid_ nodes which could give the
 482                                            latest inode metadata */
 483                                         high_ver = this->version;
 484                                         rii->latest_ref = this->fn->raw;
 485                                 }
 486                                 dbg_readinode("Add %p (v %d, 0x%x-0x%x, ov %d) to fragtree\n",
 487                                              this, this->version, this->fn->ofs,
 488                                              this->fn->ofs+this->fn->size, this->overlapped);
 489
 490                                 ret = jffs2_add_full_dnode_to_inode(c, f, this->fn);
 491                                 if (ret) {
 492                                         /* Free the nodes in vers_root; let the caller
 493                                            deal with the rest */
 494                                         JFFS2_ERROR("Add node to tree failed %d\n", ret);
 495                                         while (1) {
 496                                                 vers_next = tn_prev(this);
 497                                                 if (check_tn_node(c, this))
 498                                                         jffs2_mark_node_obsolete(c, this->fn->raw);
 499                                                 jffs2_free_full_dnode(this->fn);
 500                                                 jffs2_free_tmp_dnode_info(this);
 501                                                 this = vers_next;
 502                                                 if (!this)
 503                                                         break;
 504                                                 eat_last(&ver_root, &vers_next->rb);
 505                                         }
 506                                         return ret;
 507                                 }
 508                                 jffs2_free_tmp_dnode_info(this);
 509                         }
 510                         this = vers_next;
 511                 }
 512         }
 513         return 0;
 514 }
 515
 516 static void jffs2_free_tmp_dnode_info_list(struct rb_root *list)
 517 {
 518         struct rb_node *this;
 519         struct jffs2_tmp_dnode_info *tn;
 520
 521         this = list->rb_node;
 522
 523         /* Now at bottom of tree */
 524         while (this) {
 525                 if (this->rb_left)
 526                         this = this->rb_left;
 527                 else if (this->rb_right)
 528                         this = this->rb_right;
 529                 else {
 530                         tn = rb_entry(this, struct jffs2_tmp_dnode_info, rb);
 531                         jffs2_free_full_dnode(tn->fn);
 532                         jffs2_free_tmp_dnode_info(tn);
 533
 534                         this = rb_parent(this);
 535                         if (!this)
 536                                 break;
 537
 538                         if (this->rb_left == &tn->rb)
 539                                 this->rb_left = NULL;
 540                         else if (this->rb_right == &tn->rb)
 541                                 this->rb_right = NULL;
 542                         else BUG();
 543                 }
 544         }
 545         list->rb_node = NULL;
 546 }
 547
 548 static void jffs2_free_full_dirent_list(struct jffs2_full_dirent *fd)
 549 {
 550         struct jffs2_full_dirent *next;
 551
 552         while (fd) {
 553                 next = fd->next;
 554                 jffs2_free_full_dirent(fd);
 555                 fd = next;
 556         }
 557 }
 558
 559 /* Returns first valid node after 'ref'. May return 'ref' */
 560 static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_ref *ref)
 561 {
 562         while (ref && ref->next_in_ino) {
 563                 if (!ref_obsolete(ref))
 564                         return ref;
 565                 dbg_noderef("node at 0x%08x is obsoleted. Ignoring.\n", ref_offset(ref));
 566                 ref = ref->next_in_ino;
 567         }
 568         return NULL;
 569 }
 570
 571 /*
 572  * Helper function for jffs2_get_inode_nodes().
 573  * It is called every time an directory entry node is found.
 574  *
 575  * Returns: 0 on success;
 576  *          negative error code on failure.
 577  */
 578 static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 579                                 struct jffs2_raw_dirent *rd, size_t read,
 580                                 struct jffs2_readinode_info *rii)
 581 {
 582         struct jffs2_full_dirent *fd;
 583         uint32_t crc;
 584
 585         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 586         BUG_ON(ref_obsolete(ref));
 587
 588         crc = crc32(0, rd, sizeof(*rd) - 8);
 589         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 590                 JFFS2_NOTICE("header CRC failed on dirent node at %#08x: read %#08x, calculated %#08x\n",
 591                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 592                 jffs2_mark_node_obsolete(c, ref);
 593                 return 0;
 594         }
 595
 596         /* If we've never checked the CRCs on this node, check them now */
 597         if (ref_flags(ref) == REF_UNCHECKED) {
 598                 struct jffs2_eraseblock *jeb;
 599                 int len;
 600
 601                 /* Sanity check */
 602                 if (unlikely(PAD((rd->nsize + sizeof(*rd))) != PAD(je32_to_cpu(rd->totlen)))) {
 603                         JFFS2_ERROR("illegal nsize in node at %#08x: nsize %#02x, totlen %#04x\n",
 604                                     ref_offset(ref), rd->nsize, je32_to_cpu(rd->totlen));
 605                         jffs2_mark_node_obsolete(c, ref);
 606                         return 0;
 607                 }
 608
 609                 jeb = &c->blocks[ref->flash_offset / c->sector_size];
 610                 len = ref_totlen(c, jeb, ref);
 611
 612                 spin_lock(&c->erase_completion_lock);
 613                 jeb->used_size += len;
 614                 jeb->unchecked_size -= len;
 615                 c->used_size += len;
 616                 c->unchecked_size -= len;
 617                 ref->flash_offset = ref_offset(ref) | dirent_node_state(rd);
 618                 spin_unlock(&c->erase_completion_lock);
 619         }
 620
 621         fd = jffs2_alloc_full_dirent(rd->nsize + 1);
 622         if (unlikely(!fd))
 623                 return -ENOMEM;
 624
 625         fd->raw = ref;
 626         fd->version = je32_to_cpu(rd->version);
 627         fd->ino = je32_to_cpu(rd->ino);
 628         fd->type = rd->type;
 629
 630         if (fd->version > rii->highest_version)
 631                 rii->highest_version = fd->version;
 632
 633         /* Pick out the mctime of the latest dirent */
 634         if(fd->version > rii->mctime_ver && je32_to_cpu(rd->mctime)) {
 635                 rii->mctime_ver = fd->version;
 636                 rii->latest_mctime = je32_to_cpu(rd->mctime);
 637         }
 638
 639         /*
 640          * Copy as much of the name as possible from the raw
 641          * dirent we've already read from the flash.
 642          */
 643         if (read > sizeof(*rd))
 644                 memcpy(&fd->name[0], &rd->name[0],
 645                        min_t(uint32_t, rd->nsize, (read - sizeof(*rd)) ));
 646
 647         /* Do we need to copy any more of the name directly from the flash? */
 648         if (rd->nsize + sizeof(*rd) > read) {
 649                 /* FIXME: point() */
 650                 int err;
 651                 int already = read - sizeof(*rd);
 652
 653                 err = jffs2_flash_read(c, (ref_offset(ref)) + read,
 654                                 rd->nsize - already, &read, &fd->name[already]);
 655                 if (unlikely(read != rd->nsize - already) && likely(!err))
 656                         return -EIO;
 657
 658                 if (unlikely(err)) {
 659                         JFFS2_ERROR("read remainder of name: error %d\n", err);
 660                         jffs2_free_full_dirent(fd);
 661                         return -EIO;
 662                 }
 663         }
 664
 665         fd->nhash = full_name_hash(fd->name, rd->nsize);
 666         fd->next = NULL;
 667         fd->name[rd->nsize] = '\0';
 668
 669         /*
 670          * Wheee. We now have a complete jffs2_full_dirent structure, with
 671          * the name in it and everything. Link it into the list
 672          */
 673         jffs2_add_fd_to_list(c, fd, &rii->fds);
 674
 675         return 0;
 676 }
 677
 678 /*
 679  * Helper function for jffs2_get_inode_nodes().
 680  * It is called every time an inode node is found.
 681  *
 682  * Returns: 0 on success (possibly after marking a bad node obsolete);
 683  *          negative error code on failure.
 684  */
 685 static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 686                              struct jffs2_raw_inode *rd, int rdlen,
 687                              struct jffs2_readinode_info *rii)
 688 {
 689         struct jffs2_tmp_dnode_info *tn;
 690         uint32_t len, csize;
 691         int ret = 0;
 692         uint32_t crc;
 693
 694         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 695         BUG_ON(ref_obsolete(ref));
 696
 697         crc = crc32(0, rd, sizeof(*rd) - 8);
 698         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 699                 JFFS2_NOTICE("node CRC failed on dnode at %#08x: read %#08x, calculated %#08x\n",
 700                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 701                 jffs2_mark_node_obsolete(c, ref);
 702                 return 0;
 703         }
 704
 705         tn = jffs2_alloc_tmp_dnode_info();
 706         if (!tn) {
 707                 JFFS2_ERROR("failed to allocate tn (%zu bytes).\n", sizeof(*tn));
 708                 return -ENOMEM;
 709         }
 710
 711         tn->partial_crc = 0;
 712         csize = je32_to_cpu(rd->csize);
 713
 714         /* If we've never checked the CRCs on this node, check them now */
 715         if (ref_flags(ref) == REF_UNCHECKED) {
 716
 717                 /* Sanity checks */
 718                 if (unlikely(je32_to_cpu(rd->offset) > je32_to_cpu(rd->isize)) ||
 719                     unlikely(PAD(je32_to_cpu(rd->csize) + sizeof(*rd)) != PAD(je32_to_cpu(rd->totlen)))) {
 720                         JFFS2_WARNING("inode node header CRC is corrupted at %#08x\n", ref_offset(ref));
 721                         jffs2_dbg_dump_node(c, ref_offset(ref));
 722                         jffs2_mark_node_obsolete(c, ref);
 723                         goto free_out;
 724                 }
 725
 726                 if (jffs2_is_writebuffered(c) && csize != 0) {
 727                         /* At this point we are supposed to check the data CRC
 728                          * of our unchecked node. But thus far, we do not
 729                          * know whether the node is valid or obsolete. To
 730                          * figure this out, we need to walk all the nodes of
 731                          * the inode and build the inode fragtree. We don't
 732                          * want to spend time checking data of nodes which may
 733                          * later be found to be obsolete. So we put off the full
 734                          * data CRC checking until we have read all the inode
 735                          * nodes and have started building the fragtree.
 736                          *
 737                          * The fragtree is being built starting with nodes
 738                          * having the highest version number, so we'll be able
 739                          * to detect whether a node is valid (i.e., it is not
 740                          * overlapped by a node with higher version) or not.
 741                          * And we'll be able to check only those nodes, which
 742                          * are not obsolete.
 743                          *
 744                          * Of course, this optimization only makes sense in case
 745                          * of NAND flashes (or other flashes with
 746                          * !jffs2_can_mark_obsolete()), since on NOR flashes
 747                          * nodes are marked obsolete physically.
 748                          *
 749                          * Since NAND flashes (or other flashes with
 750                          * jffs2_is_writebuffered(c)) are anyway read by
 751                          * fractions of c->wbuf_pagesize, and we have just read
 752                          * the node header, it is likely that the starting part
 753                          * of the node data is also read when we read the
 754                          * header. So we don't mind to check the CRC of the
 755                          * starting part of the data of the node now, and check
 756                          * the second part later (in jffs2_check_node_data()).
 757                          * Of course, we will not need to re-read and re-check
 758                          * the NAND page which we have just read. This is why we
 759                          * read the whole NAND page at jffs2_get_inode_nodes(),
 760                          * while we needed only the node header.
 761                          */
 762                         unsigned char *buf;
 763
 764                         /* 'buf' will point to the start of data */
 765                         buf = (unsigned char *)rd + sizeof(*rd);
 766                         /* len will be the read data length */
 767                         len = min_t(uint32_t, rdlen - sizeof(*rd), csize);
 768                         tn->partial_crc = crc32(0, buf, len);
 769
 770                         dbg_readinode("Calculates CRC (%#08x) for %d bytes, csize %d\n", tn->partial_crc, len, csize);
 771
 772                         /* If we actually calculated the whole data CRC
 773                          * and it is wrong, drop the node. */
 774                         if (len >= csize && unlikely(tn->partial_crc != je32_to_cpu(rd->data_crc))) {
 775                                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 776                                         ref_offset(ref), tn->partial_crc, je32_to_cpu(rd->data_crc));
 777                                 jffs2_mark_node_obsolete(c, ref);
 778                                 goto free_out;
 779                         }
 780
 781                 } else if (csize == 0) {
 782                         /*
 783                          * We checked the header CRC. If the node has no data, adjust
 784                          * the space accounting now. For other nodes this will be done
 785                          * later either when the node is marked obsolete or when its
 786                          * data is checked.
 787                          */
 788                         struct jffs2_eraseblock *jeb;
 789
 790                         dbg_readinode("the node has no data.\n");
 791                         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 792                         len = ref_totlen(c, jeb, ref);
 793
 794                         spin_lock(&c->erase_completion_lock);
 795                         jeb->used_size += len;
 796                         jeb->unchecked_size -= len;
 797                         c->used_size += len;
 798                         c->unchecked_size -= len;
 799                         ref->flash_offset = ref_offset(ref) | REF_NORMAL;
 800                         spin_unlock(&c->erase_completion_lock);
 801                 }
 802         }
 803
 804         tn->fn = jffs2_alloc_full_dnode();
 805         if (!tn->fn) {
 806                 JFFS2_ERROR("alloc fn failed\n");
 807                 ret = -ENOMEM;
 808                 goto free_out;
 809         }
 810
 811         tn->version = je32_to_cpu(rd->version);
 812         tn->fn->ofs = je32_to_cpu(rd->offset);
 813         tn->data_crc = je32_to_cpu(rd->data_crc);
 814         tn->csize = csize;
 815         tn->fn->raw = ref;
 816         tn->overlapped = 0;
 817
 818         if (tn->version > rii->highest_version)
 819                 rii->highest_version = tn->version;
 820
 821         /* There was a bug where we wrote hole nodes out with
 822            csize/dsize swapped. Deal with it */
 823         if (rd->compr == JFFS2_COMPR_ZERO && !je32_to_cpu(rd->dsize) && csize)
 824                 tn->fn->size = csize;
 825         else // normal case...
 826                 tn->fn->size = je32_to_cpu(rd->dsize);
 827
 828         dbg_readinode2("dnode @%08x: ver %u, offset %#04x, dsize %#04x, csize %#04x\n",
 829                        ref_offset(ref), je32_to_cpu(rd->version),
 830                        je32_to_cpu(rd->offset), je32_to_cpu(rd->dsize), csize);
 831
 832         ret = jffs2_add_tn_to_tree(c, rii, tn);
 833
 834         if (ret) {
 835                 jffs2_free_full_dnode(tn->fn);
 836         free_out:
 837                 jffs2_free_tmp_dnode_info(tn);
 838                 return ret;
 839         }
 840 #ifdef JFFS2_DBG_READINODE2_MESSAGES
 841         dbg_readinode2("After adding ver %d:\n", je32_to_cpu(rd->version));
 842         tn = tn_first(&rii->tn_root);
 843         while (tn) {
 844                 dbg_readinode2("%p: v %d r 0x%x-0x%x ov %d\n",
 845                                tn, tn->version, tn->fn->ofs,
 846                                tn->fn->ofs+tn->fn->size, tn->overlapped);
 847                 tn = tn_next(tn);
 848         }
 849 #endif
 850         return 0;
 851 }
 852
 853 /*
 854  * Helper function for jffs2_get_inode_nodes().
 855  * It is called every time an unknown node is found.
 856  *
 857  * Returns: 0 on success;
 858  *          negative error code on failure.
 859  */
 860 static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref, struct jffs2_unknown_node *un)
 861 {
 862         /* We don't mark unknown nodes as REF_UNCHECKED */
 863         if (ref_flags(ref) == REF_UNCHECKED) {
 864                 JFFS2_ERROR("REF_UNCHECKED but unknown node at %#08x\n",
 865                             ref_offset(ref));
 866                 JFFS2_ERROR("Node is {%04x,%04x,%08x,%08x}. Please report this error.\n",
 867                             je16_to_cpu(un->magic), je16_to_cpu(un->nodetype),
 868                             je32_to_cpu(un->totlen), je32_to_cpu(un->hdr_crc));
 869                 jffs2_mark_node_obsolete(c, ref);
 870                 return 0;
 871         }
 872
 873         un->nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(un->nodetype));
 874
 875         switch(je16_to_cpu(un->nodetype) & JFFS2_COMPAT_MASK) {
 876
 877         case JFFS2_FEATURE_INCOMPAT:
 878                 JFFS2_ERROR("unknown INCOMPAT nodetype %#04X at %#08x\n",
 879                             je16_to_cpu(un->nodetype), ref_offset(ref));
 880                 /* EEP */
 881                 BUG();
 882                 break;
 883
 884         case JFFS2_FEATURE_ROCOMPAT:
 885                 JFFS2_ERROR("unknown ROCOMPAT nodetype %#04X at %#08x\n",
 886                             je16_to_cpu(un->nodetype), ref_offset(ref));
 887                 BUG_ON(!(c->flags & JFFS2_SB_FLAG_RO));
 888                 break;
 889
 890         case JFFS2_FEATURE_RWCOMPAT_COPY:
 891                 JFFS2_NOTICE("unknown RWCOMPAT_COPY nodetype %#04X at %#08x\n",
 892                              je16_to_cpu(un->nodetype), ref_offset(ref));
 893                 break;
 894
 895         case JFFS2_FEATURE_RWCOMPAT_DELETE:
 896                 JFFS2_NOTICE("unknown RWCOMPAT_DELETE nodetype %#04X at %#08x\n",
 897                              je16_to_cpu(un->nodetype), ref_offset(ref));
 898                 jffs2_mark_node_obsolete(c, ref);
 899                 return 0;
 900         }
 901
 902         return 0;
 903 }
 904
 905 /*
 906  * Helper function for jffs2_get_inode_nodes().
 907  * The function detects whether more data should be read and reads it if yes.
 908  *
 909  * Returns: 0 on succes;
 910  *          negative error code on failure.
 911  */
 912 static int read_more(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 913                      int needed_len, int *rdlen, unsigned char *buf)
 914 {
 915         int err, to_read = needed_len - *rdlen;
 916         size_t retlen;
 917         uint32_t offs;
 918
 919         if (jffs2_is_writebuffered(c)) {
 920                 int rem = to_read % c->wbuf_pagesize;
 921
 922                 if (rem)
 923                         to_read += c->wbuf_pagesize - rem;
 924         }
 925
 926         /* We need to read more data */
 927         offs = ref_offset(ref) + *rdlen;
 928
 929         dbg_readinode("read more %d bytes\n", to_read);
 930
 931         err = jffs2_flash_read(c, offs, to_read, &retlen, buf + *rdlen);
 932         if (err) {
 933                 JFFS2_ERROR("can not read %d bytes from 0x%08x, "
 934                         "error code: %d.\n", to_read, offs, err);
 935                 return err;
 936         }
 937
 938         if (retlen < to_read) {
 939                 JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n",
 940                                 offs, retlen, to_read);
 941                 return -EIO;
 942         }
 943
 944         *rdlen += to_read;
 945         return 0;
 946 }
 947
 948 /* Get tmp_dnode_info and full_dirent for all non-obsolete nodes associated
 949    with this ino. Perform a preliminary ordering on data nodes, throwing away
 950    those which are completely obsoleted by newer ones. The naïve approach we
 951    use to take of just returning them _all_ in version order will cause us to
 952    run out of memory in certain degenerate cases. */
 953 static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 954                                  struct jffs2_readinode_info *rii)
 955 {
 956         struct jffs2_raw_node_ref *ref, *valid_ref;
 957         unsigned char *buf = NULL;
 958         union jffs2_node_union *node;
 959         size_t retlen;
 960         int len, err;
 961
 962         rii->mctime_ver = 0;
 963
 964         dbg_readinode("ino #%u\n", f->inocache->ino);
 965
 966         /* FIXME: in case of NOR and available ->point() this
 967          * needs to be fixed. */
 968         len = sizeof(union jffs2_node_union) + c->wbuf_pagesize;
 969         buf = kmalloc(len, GFP_KERNEL);
 970         if (!buf)
 971                 return -ENOMEM;
 972
 973         spin_lock(&c->erase_completion_lock);
 974         valid_ref = jffs2_first_valid_node(f->inocache->nodes);
 975         if (!valid_ref && f->inocache->ino != 1)
 976                 JFFS2_WARNING("Eep. No valid nodes for ino #%u.\n", f->inocache->ino);
 977         while (valid_ref) {
 978                 /* We can hold a pointer to a non-obsolete node without the spinlock,
 979                    but _obsolete_ nodes may disappear at any time, if the block
 980                    they're in gets erased. So if we mark 'ref' obsolete while we're
 981                    not holding the lock, it can go away immediately. For that reason,
 982                    we find the next valid node first, before processing 'ref'.
 983                 */
 984                 ref = valid_ref;
 985                 valid_ref = jffs2_first_valid_node(ref->next_in_ino);
 986                 spin_unlock(&c->erase_completion_lock);
 987
 988                 cond_resched();
 989
 990                 /*
 991                  * At this point we don't know the type of the node we're going
 992                  * to read, so we do not know the size of its header. In order
 993                  * to minimize the amount of flash IO we assume the header is
 994                  * of size = JFFS2_MIN_NODE_HEADER.
 995                  */
 996                 len = JFFS2_MIN_NODE_HEADER;
 997                 if (jffs2_is_writebuffered(c)) {
 998                         int end, rem;
 999
1000                         /*
1001                          * We are about to read JFFS2_MIN_NODE_HEADER bytes,
1002                          * but this flash has some minimal I/O unit. It is
1003                          * possible that we'll need to read more soon, so read
1004                          * up to the next min. I/O unit, in order not to
1005                          * re-read the same min. I/O unit twice.
1006                          */
1007                         end = ref_offset(ref) + len;
1008                         rem = end % c->wbuf_pagesize;
1009                         if (rem)
1010                                 end += c->wbuf_pagesize - rem;
1011                         len = end - ref_offset(ref);
1012                 }
1013
1014                 dbg_readinode("read %d bytes at %#08x(%d).\n", len, ref_offset(ref), ref_flags(ref));
1015
1016                 /* FIXME: point() */
1017                 err = jffs2_flash_read(c, ref_offset(ref), len, &retlen, buf);
1018                 if (err) {
1019                         JFFS2_ERROR("can not read %d bytes from 0x%08x, " "error code: %d.\n", len, ref_offset(ref), err);
1020                         goto free_out;
1021                 }
1022
1023                 if (retlen < len) {
1024                         JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n", ref_offset(ref), retlen, len);
1025                         err = -EIO;
1026                         goto free_out;
1027                 }
1028
1029                 node = (union jffs2_node_union *)buf;
1030
1031                 /* No need to mask in the valid bit; it shouldn't be invalid */
1032                 if (je32_to_cpu(node->u.hdr_crc) != crc32(0, node, sizeof(node->u)-4)) {
1033                         JFFS2_NOTICE("Node header CRC failed at %#08x. {%04x,%04x,%08x,%08x}\n",
1034                                      ref_offset(ref), je16_to_cpu(node->u.magic),
1035                                      je16_to_cpu(node->u.nodetype),
1036                                      je32_to_cpu(node->u.totlen),
1037                                      je32_to_cpu(node->u.hdr_crc));
1038                         jffs2_dbg_dump_node(c, ref_offset(ref));
1039                         jffs2_mark_node_obsolete(c, ref);
1040                         goto cont;
1041                 }
1042                 if (je16_to_cpu(node->u.magic) != JFFS2_MAGIC_BITMASK) {
1043                         /* Not a JFFS2 node, whinge and move on */
1044                         JFFS2_NOTICE("Wrong magic bitmask 0x%04x in node header at %#08x.\n",
1045                                      je16_to_cpu(node->u.magic), ref_offset(ref));
1046                         jffs2_mark_node_obsolete(c, ref);
1047                         goto cont;
1048                 }
1049
1050                 switch (je16_to_cpu(node->u.nodetype)) {
1051
1052                 case JFFS2_NODETYPE_DIRENT:
1053
1054                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent) &&
1055                             len < sizeof(struct jffs2_raw_dirent)) {
1056                                 err = read_more(c, ref, sizeof(struct jffs2_raw_dirent), &len, buf);
1057                                 if (unlikely(err))
1058                                         goto free_out;
1059                         }
1060
1061                         err = read_direntry(c, ref, &node->d, retlen, rii);
1062                         if (unlikely(err))
1063                                 goto free_out;
1064
1065                         break;
1066
1067                 case JFFS2_NODETYPE_INODE:
1068
1069                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode) &&
1070                             len < sizeof(struct jffs2_raw_inode)) {
1071                                 err = read_more(c, ref, sizeof(struct jffs2_raw_inode), &len, buf);
1072                                 if (unlikely(err))
1073                                         goto free_out;
1074                         }
1075
1076                         err = read_dnode(c, ref, &node->i, len, rii);
1077                         if (unlikely(err))
1078                                 goto free_out;
1079
1080                         break;
1081
1082                 default:
1083                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node) &&
1084                             len < sizeof(struct jffs2_unknown_node)) {
1085                                 err = read_more(c, ref, sizeof(struct jffs2_unknown_node), &len, buf);
1086                                 if (unlikely(err))
1087                                         goto free_out;
1088                         }
1089
1090                         err = read_unknown(c, ref, &node->u);
1091                         if (unlikely(err))
1092                                 goto free_out;
1093
1094                 }
1095         cont:
1096                 spin_lock(&c->erase_completion_lock);
1097         }
1098
1099         spin_unlock(&c->erase_completion_lock);
1100         kfree(buf);
1101
1102         f->highest_version = rii->highest_version;
1103
1104         dbg_readinode("nodes of inode #%u were read, the highest version is %u, latest_mctime %u, mctime_ver %u.\n",
1105                       f->inocache->ino, rii->highest_version, rii->latest_mctime,
1106                       rii->mctime_ver);
1107         return 0;
1108
1109  free_out:
1110         jffs2_free_tmp_dnode_info_list(&rii->tn_root);
1111         jffs2_free_full_dirent_list(rii->fds);
1112         rii->fds = NULL;
1113         kfree(buf);
1114         return err;
1115 }
1116
1117 static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
1118                                         struct jffs2_inode_info *f,
1119                                         struct jffs2_raw_inode *latest_node)
1120 {
1121         struct jffs2_readinode_info rii;
1122         uint32_t crc, new_size;
1123         size_t retlen;
1124         int ret;
1125
1126         dbg_readinode("ino #%u nlink is %d\n", f->inocache->ino, f->inocache->nlink);
1127
1128         memset(&rii, 0, sizeof(rii));
1129
1130         /* Grab all nodes relevant to this ino */
1131         ret = jffs2_get_inode_nodes(c, f, &rii);
1132
1133         if (ret) {
1134                 JFFS2_ERROR("cannot read nodes for ino %u, returned error is %d\n", f->inocache->ino, ret);
1135                 if (f->inocache->state == INO_STATE_READING)
1136                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1137                 return ret;
1138         }
1139
1140         ret = jffs2_build_inode_fragtree(c, f, &rii);
1141         if (ret) {
1142                 JFFS2_ERROR("Failed to build final fragtree for inode #%u: error %d\n",
1143                             f->inocache->ino, ret);
1144                 if (f->inocache->state == INO_STATE_READING)
1145                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1146                 jffs2_free_tmp_dnode_info_list(&rii.tn_root);
1147                 /* FIXME: We could at least crc-check them all */
1148                 if (rii.mdata_tn) {
1149                         jffs2_free_full_dnode(rii.mdata_tn->fn);
1150                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1151                         rii.mdata_tn = NULL;
1152                 }
1153                 return ret;
1154         }
1155
1156         if (rii.mdata_tn) {
1157                 if (rii.mdata_tn->fn->raw == rii.latest_ref) {
1158                         f->metadata = rii.mdata_tn->fn;
1159                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1160                 } else {
1161                         jffs2_kill_tn(c, rii.mdata_tn);
1162                 }
1163                 rii.mdata_tn = NULL;
1164         }
1165
1166         f->dents = rii.fds;
1167
1168         jffs2_dbg_fragtree_paranoia_check_nolock(f);
1169
1170         if (unlikely(!rii.latest_ref)) {
1171                 /* No data nodes for this inode. */
1172                 if (f->inocache->ino != 1) {
1173                         JFFS2_WARNING("no data nodes found for ino #%u\n", f->inocache->ino);
1174                         if (!rii.fds) {
1175                                 if (f->inocache->state == INO_STATE_READING)
1176                                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1177                                 return -EIO;
1178                         }
1179                         JFFS2_NOTICE("but it has children so we fake some modes for it\n");
1180                 }
1181                 latest_node->mode = cpu_to_jemode(S_IFDIR|S_IRUGO|S_IWUSR|S_IXUGO);
1182                 latest_node->version = cpu_to_je32(0);
1183                 latest_node->atime = latest_node->ctime = latest_node->mtime = cpu_to_je32(0);
1184                 latest_node->isize = cpu_to_je32(0);
1185                 latest_node->gid = cpu_to_je16(0);
1186                 latest_node->uid = cpu_to_je16(0);
1187                 if (f->inocache->state == INO_STATE_READING)
1188                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1189                 return 0;
1190         }
1191
1192         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref), sizeof(*latest_node), &retlen, (void *)latest_node);
1193         if (ret || retlen != sizeof(*latest_node)) {
1194                 JFFS2_ERROR("failed to read from flash: error %d, %zd of %zd bytes read\n",
1195                         ret, retlen, sizeof(*latest_node));
1196                 /* FIXME: If this fails, there seems to be a memory leak. Find it. */
1197                 mutex_unlock(&f->sem);
1198                 jffs2_do_clear_inode(c, f);
1199                 return ret?ret:-EIO;
1200         }
1201
1202         crc = crc32(0, latest_node, sizeof(*latest_node)-8);
1203         if (crc != je32_to_cpu(latest_node->node_crc)) {
1204                 JFFS2_ERROR("CRC failed for read_inode of inode %u at physical location 0x%x\n",
1205                         f->inocache->ino, ref_offset(rii.latest_ref));
1206                 mutex_unlock(&f->sem);
1207                 jffs2_do_clear_inode(c, f);
1208                 return -EIO;
1209         }
1210
1211         switch(jemode_to_cpu(latest_node->mode) & S_IFMT) {
1212         case S_IFDIR:
1213                 if (rii.mctime_ver > je32_to_cpu(latest_node->version)) {
1214                         /* The times in the latest_node are actually older than
1215                            mctime in the latest dirent. Cheat. */
1216                         latest_node->ctime = latest_node->mtime = cpu_to_je32(rii.latest_mctime);
1217                 }
1218                 break;
1219
1220
1221         case S_IFREG:
1222                 /* If it was a regular file, truncate it to the latest node's isize */
1223                 new_size = jffs2_truncate_fragtree(c, &f->fragtree, je32_to_cpu(latest_node->isize));
1224                 if (new_size != je32_to_cpu(latest_node->isize)) {
1225                         JFFS2_WARNING("Truncating ino #%u to %d bytes failed because it only had %d bytes to start with!\n",
1226                                       f->inocache->ino, je32_to_cpu(latest_node->isize), new_size);
1227                         latest_node->isize = cpu_to_je32(new_size);
1228                 }
1229                 break;
1230
1231         case S_IFLNK:
1232                 /* Hack to work around broken isize in old symlink code.
1233                    Remove this when dwmw2 comes to his senses and stops
1234                    symlinks from being an entirely gratuitous special
1235                    case. */
1236                 if (!je32_to_cpu(latest_node->isize))
1237                         latest_node->isize = latest_node->dsize;
1238
1239                 if (f->inocache->state != INO_STATE_CHECKING) {
1240                         /* Symlink's inode data is the target path. Read it and
1241                          * keep in RAM to facilitate quick follow symlink
1242                          * operation. */
1243                         f->target = kmalloc(je32_to_cpu(latest_node->csize) + 1, GFP_KERNEL);
1244                         if (!f->target) {
1245                                 JFFS2_ERROR("can't allocate %d bytes of memory for the symlink target path cache\n", je32_to_cpu(latest_node->csize));
1246                                 mutex_unlock(&f->sem);
1247                                 jffs2_do_clear_inode(c, f);
1248                                 return -ENOMEM;
1249                         }
1250
1251                         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref) + sizeof(*latest_node),
1252                                                 je32_to_cpu(latest_node->csize), &retlen, (char *)f->target);
1253
1254                         if (ret  || retlen != je32_to_cpu(latest_node->csize)) {
1255                                 if (retlen != je32_to_cpu(latest_node->csize))
1256                                         ret = -EIO;
1257                                 kfree(f->target);
1258                                 f->target = NULL;
1259                                 mutex_unlock(&f->sem);
1260                                 jffs2_do_clear_inode(c, f);
1261                                 return -ret;
1262                         }
1263
1264                         f->target[je32_to_cpu(latest_node->csize)] = '\0';
1265                         dbg_readinode("symlink's target '%s' cached\n", f->target);
1266                 }
1267
1268                 /* fall through... */
1269
1270         case S_IFBLK:
1271         case S_IFCHR:
1272                 /* Certain inode types should have only one data node, and it's
1273                    kept as the metadata node */
1274                 if (f->metadata) {
1275                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o had metadata node\n",
1276                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1277                         mutex_unlock(&f->sem);
1278                         jffs2_do_clear_inode(c, f);
1279                         return -EIO;
1280                 }
1281                 if (!frag_first(&f->fragtree)) {
1282                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o has no fragments\n",
1283                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1284                         mutex_unlock(&f->sem);
1285                         jffs2_do_clear_inode(c, f);
1286                         return -EIO;
1287                 }
1288                 /* ASSERT: f->fraglist != NULL */
1289                 if (frag_next(frag_first(&f->fragtree))) {
1290                         JFFS2_ERROR("Argh. Special inode #%u with mode 0x%x had more than one node\n",
1291                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1292                         /* FIXME: Deal with it - check crc32, check for duplicate node, check times and discard the older one */
1293                         mutex_unlock(&f->sem);
1294                         jffs2_do_clear_inode(c, f);
1295                         return -EIO;
1296                 }
1297                 /* OK. We're happy */
1298                 f->metadata = frag_first(&f->fragtree)->node;
1299                 jffs2_free_node_frag(frag_first(&f->fragtree));
1300                 f->fragtree = RB_ROOT;
1301                 break;
1302         }
1303         if (f->inocache->state == INO_STATE_READING)
1304                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1305
1306         return 0;
1307 }
1308
1309 /* Scan the list of all nodes present for this ino, build map of versions, etc. */
1310 int jffs2_do_read_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
1311                         uint32_t ino, struct jffs2_raw_inode *latest_node)
1312 {
1313         dbg_readinode("read inode #%u\n", ino);
1314
1315  retry_inocache:
1316         spin_lock(&c->inocache_lock);
1317         f->inocache = jffs2_get_ino_cache(c, ino);
1318
1319         if (f->inocache) {
1320                 /* Check its state. We may need to wait before we can use it */
1321                 switch(f->inocache->state) {
1322                 case INO_STATE_UNCHECKED:
1323                 case INO_STATE_CHECKEDABSENT:
1324                         f->inocache->state = INO_STATE_READING;
1325                         break;
1326
1327                 case INO_STATE_CHECKING:
1328                 case INO_STATE_GC:
1329                         /* If it's in either of these states, we need
1330                            to wait for whoever's got it to finish and
1331                            put it back. */
1332                         dbg_readinode("waiting for ino #%u in state %d\n", ino, f->inocache->state);
1333                         sleep_on_spinunlock(&c->inocache_wq, &c->inocache_lock);
1334                         goto retry_inocache;
1335
1336                 case INO_STATE_READING:
1337                 case INO_STATE_PRESENT:
1338                         /* Eep. This should never happen. It can
1339                         happen if Linux calls read_inode() again
1340                         before clear_inode() has finished though. */
1341                         JFFS2_ERROR("Eep. Trying to read_inode #%u when it's already in state %d!\n", ino, f->inocache->state);
1342                         /* Fail. That's probably better than allowing it to succeed */
1343                         f->inocache = NULL;
1344                         break;
1345
1346                 default:
1347                         BUG();
1348                 }
1349         }
1350         spin_unlock(&c->inocache_lock);
1351
1352         if (!f->inocache && ino == 1) {
1353                 /* Special case - no root inode on medium */
1354                 f->inocache = jffs2_alloc_inode_cache();
1355                 if (!f->inocache) {
1356                         JFFS2_ERROR("cannot allocate inocache for root inode\n");
1357                         return -ENOMEM;
1358                 }
1359                 dbg_readinode("creating inocache for root inode\n");
1360                 memset(f->inocache, 0, sizeof(struct jffs2_inode_cache));
1361                 f->inocache->ino = f->inocache->nlink = 1;
1362                 f->inocache->nodes = (struct jffs2_raw_node_ref *)f->inocache;
1363                 f->inocache->state = INO_STATE_READING;
1364                 jffs2_add_ino_cache(c, f->inocache);
1365         }
1366         if (!f->inocache) {
1367                 JFFS2_ERROR("requestied to read an nonexistent ino %u\n", ino);
1368                 return -ENOENT;
1369         }
1370
1371         return jffs2_do_read_inode_internal(c, f, latest_node);
1372 }
1373
1374 int jffs2_do_crccheck_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
1375 {
1376         struct jffs2_raw_inode n;
1377         struct jffs2_inode_info *f = kzalloc(sizeof(*f), GFP_KERNEL);
1378         int ret;
1379
1380         if (!f)
1381                 return -ENOMEM;
1382
1383         mutex_init(&f->sem);
1384         mutex_lock(&f->sem);
1385         f->inocache = ic;
1386
1387         ret = jffs2_do_read_inode_internal(c, f, &n);
1388         if (!ret) {
1389                 mutex_unlock(&f->sem);
1390                 jffs2_do_clear_inode(c, f);
1391         }
1392         kfree (f);
1393         return ret;
1394 }
1395
1396 void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
1397 {
1398         struct jffs2_full_dirent *fd, *fds;
1399         int deleted;
1400
1401         jffs2_clear_acl(f);
1402         jffs2_xattr_delete_inode(c, f->inocache);
1403         mutex_lock(&f->sem);
1404         deleted = f->inocache && !f->inocache->nlink;
1405
1406         if (f->inocache && f->inocache->state != INO_STATE_CHECKING)
1407                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CLEARING);
1408
1409         if (f->metadata) {
1410                 if (deleted)
1411                         jffs2_mark_node_obsolete(c, f->metadata->raw);
1412                 jffs2_free_full_dnode(f->metadata);
1413         }
1414
1415         jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
1416
1417         if (f->target) {
1418                 kfree(f->target);
1419                 f->target = NULL;
1420         }
1421
1422         fds = f->dents;
1423         while(fds) {
1424                 fd = fds;
1425                 fds = fd->next;
1426                 jffs2_free_full_dirent(fd);
1427         }
1428
1429         if (f->inocache && f->inocache->state != INO_STATE_CHECKING) {
1430                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1431                 if (f->inocache->nodes == (void *)f->inocache)
1432                         jffs2_del_ino_cache(c, f->inocache);
1433         }
1434
1435         mutex_unlock(&f->sem);
1436 }