fs/jffs2/readinode.c

   1 /*
   2  * JFFS2 -- Journalling Flash File System, Version 2.
   3  *
   4  * Copyright © 2001-2007 Red Hat, Inc.
   5  *
   6  * Created by David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * For licensing information, see the file 'LICENCE' in this directory.
   9  *
  10  */
  11
  12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  13
  14 #include <linux/kernel.h>
  15 #include <linux/sched.h>
  16 #include <linux/slab.h>
  17 #include <linux/fs.h>
  18 #include <linux/crc32.h>
  19 #include <linux/pagemap.h>
  20 #include <linux/mtd/mtd.h>
  21 #include <linux/compiler.h>
  22 #include "nodelist.h"
  23
  24 /*
  25  * Check the data CRC of the node.
  26  *
  27  * Returns: 0 if the data CRC is correct;
  28  *          1 - if incorrect;
  29  *          error code if an error occurred.
  30  */
  31 static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
  32 {
  33         struct jffs2_raw_node_ref *ref = tn->fn->raw;
  34         int err = 0, pointed = 0;
  35         struct jffs2_eraseblock *jeb;
  36         unsigned char *buffer;
  37         uint32_t crc, ofs, len;
  38         size_t retlen;
  39
  40         BUG_ON(tn->csize == 0);
  41
  42         /* Calculate how many bytes were already checked */
  43         ofs = ref_offset(ref) + sizeof(struct jffs2_raw_inode);
  44         len = tn->csize;
  45
  46         if (jffs2_is_writebuffered(c)) {
  47                 int adj = ofs % c->wbuf_pagesize;
  48                 if (likely(adj))
  49                         adj = c->wbuf_pagesize - adj;
  50
  51                 if (adj >= tn->csize) {
  52                         dbg_readinode("no need to check node at %#08x, data length %u, data starts at %#08x - it has already been checked.\n",
  53                                       ref_offset(ref), tn->csize, ofs);
  54                         goto adj_acc;
  55                 }
  56
  57                 ofs += adj;
  58                 len -= adj;
  59         }
  60
  61         dbg_readinode("check node at %#08x, data length %u, partial CRC %#08x, correct CRC %#08x, data starts at %#08x, start checking from %#08x - %u bytes.\n",
  62                 ref_offset(ref), tn->csize, tn->partial_crc, tn->data_crc, ofs - len, ofs, len);
  63
  64 #ifndef __ECOS
  65         /* TODO: instead, incapsulate point() stuff to jffs2_flash_read(),
  66          * adding and jffs2_flash_read_end() interface. */
  67         err = mtd_point(c->mtd, ofs, len, &retlen, (void **)&buffer, NULL);
  68         if (!err && retlen < len) {
  69                 JFFS2_WARNING("MTD point returned len too short: %zu instead of %u.\n", retlen, tn->csize);
  70                 mtd_unpoint(c->mtd, ofs, retlen);
  71         } else if (err) {
  72                 if (err != -EOPNOTSUPP)
  73                         JFFS2_WARNING("MTD point failed: error code %d.\n", err);
  74         } else
  75                 pointed = 1; /* succefully pointed to device */
  76 #endif
  77
  78         if (!pointed) {
  79                 buffer = kmalloc(len, GFP_KERNEL);
  80                 if (unlikely(!buffer))
  81                         return -ENOMEM;
  82
  83                 /* TODO: this is very frequent pattern, make it a separate
  84                  * routine */
  85                 err = jffs2_flash_read(c, ofs, len, &retlen, buffer);
  86                 if (err) {
  87                         JFFS2_ERROR("can not read %d bytes from 0x%08x, error code: %d.\n", len, ofs, err);
  88                         goto free_out;
  89                 }
  90
  91                 if (retlen != len) {
  92                         JFFS2_ERROR("short read at %#08x: %zd instead of %d.\n", ofs, retlen, len);
  93                         err = -EIO;
  94                         goto free_out;
  95                 }
  96         }
  97
  98         /* Continue calculating CRC */
  99         crc = crc32(tn->partial_crc, buffer, len);
 100         if(!pointed)
 101                 kfree(buffer);
 102 #ifndef __ECOS
 103         else
 104                 mtd_unpoint(c->mtd, ofs, len);
 105 #endif
 106
 107         if (crc != tn->data_crc) {
 108                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 109                              ref_offset(ref), tn->data_crc, crc);
 110                 return 1;
 111         }
 112
 113 adj_acc:
 114         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 115         len = ref_totlen(c, jeb, ref);
 116         /* If it should be REF_NORMAL, it'll get marked as such when
 117            we build the fragtree, shortly. No need to worry about GC
 118            moving it while it's marked REF_PRISTINE -- GC won't happen
 119            till we've finished checking every inode anyway. */
 120         ref->flash_offset |= REF_PRISTINE;
 121         /*
 122          * Mark the node as having been checked and fix the
 123          * accounting accordingly.
 124          */
 125         spin_lock(&c->erase_completion_lock);
 126         jeb->used_size += len;
 127         jeb->unchecked_size -= len;
 128         c->used_size += len;
 129         c->unchecked_size -= len;
 130         jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
 131         spin_unlock(&c->erase_completion_lock);
 132
 133         return 0;
 134
 135 free_out:
 136         if(!pointed)
 137                 kfree(buffer);
 138 #ifndef __ECOS
 139         else
 140                 mtd_unpoint(c->mtd, ofs, len);
 141 #endif
 142         return err;
 143 }
 144
 145 /*
 146  * Helper function for jffs2_add_older_frag_to_fragtree().
 147  *
 148  * Checks the node if we are in the checking stage.
 149  */
 150 static int check_tn_node(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 151 {
 152         int ret;
 153
 154         BUG_ON(ref_obsolete(tn->fn->raw));
 155
 156         /* We only check the data CRC of unchecked nodes */
 157         if (ref_flags(tn->fn->raw) != REF_UNCHECKED)
 158                 return 0;
 159
 160         dbg_readinode("check node %#04x-%#04x, phys offs %#08x\n",
 161                       tn->fn->ofs, tn->fn->ofs + tn->fn->size, ref_offset(tn->fn->raw));
 162
 163         ret = check_node_data(c, tn);
 164         if (unlikely(ret < 0)) {
 165                 JFFS2_ERROR("check_node_data() returned error: %d.\n",
 166                         ret);
 167         } else if (unlikely(ret > 0)) {
 168                 dbg_readinode("CRC error, mark it obsolete.\n");
 169                 jffs2_mark_node_obsolete(c, tn->fn->raw);
 170         }
 171
 172         return ret;
 173 }
 174
 175 static struct jffs2_tmp_dnode_info *jffs2_lookup_tn(struct rb_root *tn_root, uint32_t offset)
 176 {
 177         struct rb_node *next;
 178         struct jffs2_tmp_dnode_info *tn = NULL;
 179
 180         dbg_readinode("root %p, offset %d\n", tn_root, offset);
 181
 182         next = tn_root->rb_node;
 183
 184         while (next) {
 185                 tn = rb_entry(next, struct jffs2_tmp_dnode_info, rb);
 186
 187                 if (tn->fn->ofs < offset)
 188                         next = tn->rb.rb_right;
 189                 else if (tn->fn->ofs >= offset)
 190                         next = tn->rb.rb_left;
 191                 else
 192                         break;
 193         }
 194
 195         return tn;
 196 }
 197
 198
 199 static void jffs2_kill_tn(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 200 {
 201         jffs2_mark_node_obsolete(c, tn->fn->raw);
 202         jffs2_free_full_dnode(tn->fn);
 203         jffs2_free_tmp_dnode_info(tn);
 204 }
 205 /*
 206  * This function is used when we read an inode. Data nodes arrive in
 207  * arbitrary order -- they may be older or newer than the nodes which
 208  * are already in the tree. Where overlaps occur, the older node can
 209  * be discarded as long as the newer passes the CRC check. We don't
 210  * bother to keep track of holes in this rbtree, and neither do we deal
 211  * with frags -- we can have multiple entries starting at the same
 212  * offset, and the one with the smallest length will come first in the
 213  * ordering.
 214  *
 215  * Returns 0 if the node was handled (including marking it obsolete)
 216  *       < 0 an if error occurred
 217  */
 218 static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
 219                                 struct jffs2_readinode_info *rii,
 220                                 struct jffs2_tmp_dnode_info *tn)
 221 {
 222         uint32_t fn_end = tn->fn->ofs + tn->fn->size;
 223         struct jffs2_tmp_dnode_info *this, *ptn;
 224
 225         dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
 226
 227         /* If a node has zero dsize, we only have to keep if it if it might be the
 228            node with highest version -- i.e. the one which will end up as f->metadata.
 229            Note that such nodes won't be REF_UNCHECKED since there are no data to
 230            check anyway. */
 231         if (!tn->fn->size) {
 232                 if (rii->mdata_tn) {
 233                         if (rii->mdata_tn->version < tn->version) {
 234                                 /* We had a candidate mdata node already */
 235                                 dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
 236                                 jffs2_kill_tn(c, rii->mdata_tn);
 237                         } else {
 238                                 dbg_readinode("kill new mdata with ver %d (older than existing %d\n",
 239                                               tn->version, rii->mdata_tn->version);
 240                                 jffs2_kill_tn(c, tn);
 241                                 return 0;
 242                         }
 243                 }
 244                 rii->mdata_tn = tn;
 245                 dbg_readinode("keep new mdata with ver %d\n", tn->version);
 246                 return 0;
 247         }
 248
 249         /* Find the earliest node which _may_ be relevant to this one */
 250         this = jffs2_lookup_tn(&rii->tn_root, tn->fn->ofs);
 251         if (this) {
 252                 /* If the node is coincident with another at a lower address,
 253                    back up until the other node is found. It may be relevant */
 254                 while (this->overlapped) {
 255                         ptn = tn_prev(this);
 256                         if (!ptn) {
 257                                 /*
 258                                  * We killed a node which set the overlapped
 259                                  * flags during the scan. Fix it up.
 260                                  */
 261                                 this->overlapped = 0;
 262                                 break;
 263                         }
 264                         this = ptn;
 265                 }
 266                 dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
 267         }
 268
 269         while (this) {
 270                 if (this->fn->ofs > fn_end)
 271                         break;
 272                 dbg_readinode("Ponder this ver %d, 0x%x-0x%x\n",
 273                               this->version, this->fn->ofs, this->fn->size);
 274
 275                 if (this->version == tn->version) {
 276                         /* Version number collision means REF_PRISTINE GC. Accept either of them
 277                            as long as the CRC is correct. Check the one we have already...  */
 278                         if (!check_tn_node(c, this)) {
 279                                 /* The one we already had was OK. Keep it and throw away the new one */
 280                                 dbg_readinode("Like old node. Throw away new\n");
 281                                 jffs2_kill_tn(c, tn);
 282                                 return 0;
 283                         } else {
 284                                 /* Who cares if the new one is good; keep it for now anyway. */
 285                                 dbg_readinode("Like new node. Throw away old\n");
 286                                 rb_replace_node(&this->rb, &tn->rb, &rii->tn_root);
 287                                 jffs2_kill_tn(c, this);
 288                                 /* Same overlapping from in front and behind */
 289                                 return 0;
 290                         }
 291                 }
 292                 if (this->version < tn->version &&
 293                     this->fn->ofs >= tn->fn->ofs &&
 294                     this->fn->ofs + this->fn->size <= fn_end) {
 295                         /* New node entirely overlaps 'this' */
 296                         if (check_tn_node(c, tn)) {
 297                                 dbg_readinode("new node bad CRC\n");
 298                                 jffs2_kill_tn(c, tn);
 299                                 return 0;
 300                         }
 301                         /* ... and is good. Kill 'this' and any subsequent nodes which are also overlapped */
 302                         while (this && this->fn->ofs + this->fn->size <= fn_end) {
 303                                 struct jffs2_tmp_dnode_info *next = tn_next(this);
 304                                 if (this->version < tn->version) {
 305                                         tn_erase(this, &rii->tn_root);
 306                                         dbg_readinode("Kill overlapped ver %d, 0x%x-0x%x\n",
 307                                                       this->version, this->fn->ofs,
 308                                                       this->fn->ofs+this->fn->size);
 309                                         jffs2_kill_tn(c, this);
 310                                 }
 311                                 this = next;
 312                         }
 313                         dbg_readinode("Done killing overlapped nodes\n");
 314                         continue;
 315                 }
 316                 if (this->version > tn->version &&
 317                     this->fn->ofs <= tn->fn->ofs &&
 318                     this->fn->ofs+this->fn->size >= fn_end) {
 319                         /* New node entirely overlapped by 'this' */
 320                         if (!check_tn_node(c, this)) {
 321                                 dbg_readinode("Good CRC on old node. Kill new\n");
 322                                 jffs2_kill_tn(c, tn);
 323                                 return 0;
 324                         }
 325                         /* ... but 'this' was bad. Replace it... */
 326                         dbg_readinode("Bad CRC on old overlapping node. Kill it\n");
 327                         tn_erase(this, &rii->tn_root);
 328                         jffs2_kill_tn(c, this);
 329                         break;
 330                 }
 331
 332                 this = tn_next(this);
 333         }
 334
 335         /* We neither completely obsoleted nor were completely
 336            obsoleted by an earlier node. Insert into the tree */
 337         {
 338                 struct rb_node *parent;
 339                 struct rb_node **link = &rii->tn_root.rb_node;
 340                 struct jffs2_tmp_dnode_info *insert_point = NULL;
 341
 342                 while (*link) {
 343                         parent = *link;
 344                         insert_point = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 345                         if (tn->fn->ofs > insert_point->fn->ofs)
 346                                 link = &insert_point->rb.rb_right;
 347                         else if (tn->fn->ofs < insert_point->fn->ofs ||
 348                                  tn->fn->size < insert_point->fn->size)
 349                                 link = &insert_point->rb.rb_left;
 350                         else
 351                                 link = &insert_point->rb.rb_right;
 352                 }
 353                 rb_link_node(&tn->rb, &insert_point->rb, link);
 354                 rb_insert_color(&tn->rb, &rii->tn_root);
 355         }
 356
 357         /* If there's anything behind that overlaps us, note it */
 358         this = tn_prev(tn);
 359         if (this) {
 360                 while (1) {
 361                         if (this->fn->ofs + this->fn->size > tn->fn->ofs) {
 362                                 dbg_readinode("Node is overlapped by %p (v %d, 0x%x-0x%x)\n",
 363                                               this, this->version, this->fn->ofs,
 364                                               this->fn->ofs+this->fn->size);
 365                                 tn->overlapped = 1;
 366                                 break;
 367                         }
 368                         if (!this->overlapped)
 369                                 break;
 370
 371                         ptn = tn_prev(this);
 372                         if (!ptn) {
 373                                 /*
 374                                  * We killed a node which set the overlapped
 375                                  * flags during the scan. Fix it up.
 376                                  */
 377                                 this->overlapped = 0;
 378                                 break;
 379                         }
 380                         this = ptn;
 381                 }
 382         }
 383
 384         /* If the new node overlaps anything ahead, note it */
 385         this = tn_next(tn);
 386         while (this && this->fn->ofs < fn_end) {
 387                 this->overlapped = 1;
 388                 dbg_readinode("Node ver %d, 0x%x-0x%x is overlapped\n",
 389                               this->version, this->fn->ofs,
 390                               this->fn->ofs+this->fn->size);
 391                 this = tn_next(this);
 392         }
 393         return 0;
 394 }
 395
 396 /* Trivial function to remove the last node in the tree. Which by definition
 397    has no right-hand -- so can be removed just by making its only child (if
 398    any) take its place under its parent. */
 399 static void eat_last(struct rb_root *root, struct rb_node *node)
 400 {
 401         struct rb_node *parent = rb_parent(node);
 402         struct rb_node **link;
 403
 404         /* LAST! */
 405         BUG_ON(node->rb_right);
 406
 407         if (!parent)
 408                 link = &root->rb_node;
 409         else if (node == parent->rb_left)
 410                 link = &parent->rb_left;
 411         else
 412                 link = &parent->rb_right;
 413
 414         *link = node->rb_left;
 415         /* Colour doesn't matter now. Only the parent pointer. */
 416         if (node->rb_left)
 417                 node->rb_left->rb_parent_color = node->rb_parent_color;
 418 }
 419
 420 /* We put this in reverse order, so we can just use eat_last */
 421 static void ver_insert(struct rb_root *ver_root, struct jffs2_tmp_dnode_info *tn)
 422 {
 423         struct rb_node **link = &ver_root->rb_node;
 424         struct rb_node *parent = NULL;
 425         struct jffs2_tmp_dnode_info *this_tn;
 426
 427         while (*link) {
 428                 parent = *link;
 429                 this_tn = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 430
 431                 if (tn->version > this_tn->version)
 432                         link = &parent->rb_left;
 433                 else
 434                         link = &parent->rb_right;
 435         }
 436         dbg_readinode("Link new node at %p (root is %p)\n", link, ver_root);
 437         rb_link_node(&tn->rb, parent, link);
 438         rb_insert_color(&tn->rb, ver_root);
 439 }
 440
 441 /* Build final, normal fragtree from tn tree. It doesn't matter which order
 442    we add nodes to the real fragtree, as long as they don't overlap. And
 443    having thrown away the majority of overlapped nodes as we went, there
 444    really shouldn't be many sets of nodes which do overlap. If we start at
 445    the end, we can use the overlap markers -- we can just eat nodes which
 446    aren't overlapped, and when we encounter nodes which _do_ overlap we
 447    sort them all into a temporary tree in version order before replaying them. */
 448 static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
 449                                       struct jffs2_inode_info *f,
 450                                       struct jffs2_readinode_info *rii)
 451 {
 452         struct jffs2_tmp_dnode_info *pen, *last, *this;
 453         struct rb_root ver_root = RB_ROOT;
 454         uint32_t high_ver = 0;
 455
 456         if (rii->mdata_tn) {
 457                 dbg_readinode("potential mdata is ver %d at %p\n", rii->mdata_tn->version, rii->mdata_tn);
 458                 high_ver = rii->mdata_tn->version;
 459                 rii->latest_ref = rii->mdata_tn->fn->raw;
 460         }
 461 #ifdef JFFS2_DBG_READINODE_MESSAGES
 462         this = tn_last(&rii->tn_root);
 463         while (this) {
 464                 dbg_readinode("tn %p ver %d range 0x%x-0x%x ov %d\n", this, this->version, this->fn->ofs,
 465                               this->fn->ofs+this->fn->size, this->overlapped);
 466                 this = tn_prev(this);
 467         }
 468 #endif
 469         pen = tn_last(&rii->tn_root);
 470         while ((last = pen)) {
 471                 pen = tn_prev(last);
 472
 473                 eat_last(&rii->tn_root, &last->rb);
 474                 ver_insert(&ver_root, last);
 475
 476                 if (unlikely(last->overlapped)) {
 477                         if (pen)
 478                                 continue;
 479                         /*
 480                          * We killed a node which set the overlapped
 481                          * flags during the scan. Fix it up.
 482                          */
 483                         last->overlapped = 0;
 484                 }
 485
 486                 /* Now we have a bunch of nodes in reverse version
 487                    order, in the tree at ver_root. Most of the time,
 488                    there'll actually be only one node in the 'tree',
 489                    in fact. */
 490                 this = tn_last(&ver_root);
 491
 492                 while (this) {
 493                         struct jffs2_tmp_dnode_info *vers_next;
 494                         int ret;
 495                         vers_next = tn_prev(this);
 496                         eat_last(&ver_root, &this->rb);
 497                         if (check_tn_node(c, this)) {
 498                                 dbg_readinode("node ver %d, 0x%x-0x%x failed CRC\n",
 499                                              this->version, this->fn->ofs,
 500                                              this->fn->ofs+this->fn->size);
 501                                 jffs2_kill_tn(c, this);
 502                         } else {
 503                                 if (this->version > high_ver) {
 504                                         /* Note that this is different from the other
 505                                            highest_version, because this one is only
 506                                            counting _valid_ nodes which could give the
 507                                            latest inode metadata */
 508                                         high_ver = this->version;
 509                                         rii->latest_ref = this->fn->raw;
 510                                 }
 511                                 dbg_readinode("Add %p (v %d, 0x%x-0x%x, ov %d) to fragtree\n",
 512                                              this, this->version, this->fn->ofs,
 513                                              this->fn->ofs+this->fn->size, this->overlapped);
 514
 515                                 ret = jffs2_add_full_dnode_to_inode(c, f, this->fn);
 516                                 if (ret) {
 517                                         /* Free the nodes in vers_root; let the caller
 518                                            deal with the rest */
 519                                         JFFS2_ERROR("Add node to tree failed %d\n", ret);
 520                                         while (1) {
 521                                                 vers_next = tn_prev(this);
 522                                                 if (check_tn_node(c, this))
 523                                                         jffs2_mark_node_obsolete(c, this->fn->raw);
 524                                                 jffs2_free_full_dnode(this->fn);
 525                                                 jffs2_free_tmp_dnode_info(this);
 526                                                 this = vers_next;
 527                                                 if (!this)
 528                                                         break;
 529                                                 eat_last(&ver_root, &vers_next->rb);
 530                                         }
 531                                         return ret;
 532                                 }
 533                                 jffs2_free_tmp_dnode_info(this);
 534                         }
 535                         this = vers_next;
 536                 }
 537         }
 538         return 0;
 539 }
 540
 541 static void jffs2_free_tmp_dnode_info_list(struct rb_root *list)
 542 {
 543         struct rb_node *this;
 544         struct jffs2_tmp_dnode_info *tn;
 545
 546         this = list->rb_node;
 547
 548         /* Now at bottom of tree */
 549         while (this) {
 550                 if (this->rb_left)
 551                         this = this->rb_left;
 552                 else if (this->rb_right)
 553                         this = this->rb_right;
 554                 else {
 555                         tn = rb_entry(this, struct jffs2_tmp_dnode_info, rb);
 556                         jffs2_free_full_dnode(tn->fn);
 557                         jffs2_free_tmp_dnode_info(tn);
 558
 559                         this = rb_parent(this);
 560                         if (!this)
 561                                 break;
 562
 563                         if (this->rb_left == &tn->rb)
 564                                 this->rb_left = NULL;
 565                         else if (this->rb_right == &tn->rb)
 566                                 this->rb_right = NULL;
 567                         else BUG();
 568                 }
 569         }
 570         *list = RB_ROOT;
 571 }
 572
 573 static void jffs2_free_full_dirent_list(struct jffs2_full_dirent *fd)
 574 {
 575         struct jffs2_full_dirent *next;
 576
 577         while (fd) {
 578                 next = fd->next;
 579                 jffs2_free_full_dirent(fd);
 580                 fd = next;
 581         }
 582 }
 583
 584 /* Returns first valid node after 'ref'. May return 'ref' */
 585 static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_ref *ref)
 586 {
 587         while (ref && ref->next_in_ino) {
 588                 if (!ref_obsolete(ref))
 589                         return ref;
 590                 dbg_noderef("node at 0x%08x is obsoleted. Ignoring.\n", ref_offset(ref));
 591                 ref = ref->next_in_ino;
 592         }
 593         return NULL;
 594 }
 595
 596 /*
 597  * Helper function for jffs2_get_inode_nodes().
 598  * It is called every time an directory entry node is found.
 599  *
 600  * Returns: 0 on success;
 601  *          negative error code on failure.
 602  */
 603 static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 604                                 struct jffs2_raw_dirent *rd, size_t read,
 605                                 struct jffs2_readinode_info *rii)
 606 {
 607         struct jffs2_full_dirent *fd;
 608         uint32_t crc;
 609
 610         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 611         BUG_ON(ref_obsolete(ref));
 612
 613         crc = crc32(0, rd, sizeof(*rd) - 8);
 614         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 615                 JFFS2_NOTICE("header CRC failed on dirent node at %#08x: read %#08x, calculated %#08x\n",
 616                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 617                 jffs2_mark_node_obsolete(c, ref);
 618                 return 0;
 619         }
 620
 621         /* If we've never checked the CRCs on this node, check them now */
 622         if (ref_flags(ref) == REF_UNCHECKED) {
 623                 struct jffs2_eraseblock *jeb;
 624                 int len;
 625
 626                 /* Sanity check */
 627                 if (unlikely(PAD((rd->nsize + sizeof(*rd))) != PAD(je32_to_cpu(rd->totlen)))) {
 628                         JFFS2_ERROR("illegal nsize in node at %#08x: nsize %#02x, totlen %#04x\n",
 629                                     ref_offset(ref), rd->nsize, je32_to_cpu(rd->totlen));
 630                         jffs2_mark_node_obsolete(c, ref);
 631                         return 0;
 632                 }
 633
 634                 jeb = &c->blocks[ref->flash_offset / c->sector_size];
 635                 len = ref_totlen(c, jeb, ref);
 636
 637                 spin_lock(&c->erase_completion_lock);
 638                 jeb->used_size += len;
 639                 jeb->unchecked_size -= len;
 640                 c->used_size += len;
 641                 c->unchecked_size -= len;
 642                 ref->flash_offset = ref_offset(ref) | dirent_node_state(rd);
 643                 spin_unlock(&c->erase_completion_lock);
 644         }
 645
 646         fd = jffs2_alloc_full_dirent(rd->nsize + 1);
 647         if (unlikely(!fd))
 648                 return -ENOMEM;
 649
 650         fd->raw = ref;
 651         fd->version = je32_to_cpu(rd->version);
 652         fd->ino = je32_to_cpu(rd->ino);
 653         fd->type = rd->type;
 654
 655         if (fd->version > rii->highest_version)
 656                 rii->highest_version = fd->version;
 657
 658         /* Pick out the mctime of the latest dirent */
 659         if(fd->version > rii->mctime_ver && je32_to_cpu(rd->mctime)) {
 660                 rii->mctime_ver = fd->version;
 661                 rii->latest_mctime = je32_to_cpu(rd->mctime);
 662         }
 663
 664         /*
 665          * Copy as much of the name as possible from the raw
 666          * dirent we've already read from the flash.
 667          */
 668         if (read > sizeof(*rd))
 669                 memcpy(&fd->name[0], &rd->name[0],
 670                        min_t(uint32_t, rd->nsize, (read - sizeof(*rd)) ));
 671
 672         /* Do we need to copy any more of the name directly from the flash? */
 673         if (rd->nsize + sizeof(*rd) > read) {
 674                 /* FIXME: point() */
 675                 int err;
 676                 int already = read - sizeof(*rd);
 677
 678                 err = jffs2_flash_read(c, (ref_offset(ref)) + read,
 679                                 rd->nsize - already, &read, &fd->name[already]);
 680                 if (unlikely(read != rd->nsize - already) && likely(!err))
 681                         return -EIO;
 682
 683                 if (unlikely(err)) {
 684                         JFFS2_ERROR("read remainder of name: error %d\n", err);
 685                         jffs2_free_full_dirent(fd);
 686                         return -EIO;
 687                 }
 688         }
 689
 690         fd->nhash = full_name_hash(fd->name, rd->nsize);
 691         fd->next = NULL;
 692         fd->name[rd->nsize] = '\0';
 693
 694         /*
 695          * Wheee. We now have a complete jffs2_full_dirent structure, with
 696          * the name in it and everything. Link it into the list
 697          */
 698         jffs2_add_fd_to_list(c, fd, &rii->fds);
 699
 700         return 0;
 701 }
 702
 703 /*
 704  * Helper function for jffs2_get_inode_nodes().
 705  * It is called every time an inode node is found.
 706  *
 707  * Returns: 0 on success (possibly after marking a bad node obsolete);
 708  *          negative error code on failure.
 709  */
 710 static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 711                              struct jffs2_raw_inode *rd, int rdlen,
 712                              struct jffs2_readinode_info *rii)
 713 {
 714         struct jffs2_tmp_dnode_info *tn;
 715         uint32_t len, csize;
 716         int ret = 0;
 717         uint32_t crc;
 718
 719         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 720         BUG_ON(ref_obsolete(ref));
 721
 722         crc = crc32(0, rd, sizeof(*rd) - 8);
 723         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 724                 JFFS2_NOTICE("node CRC failed on dnode at %#08x: read %#08x, calculated %#08x\n",
 725                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 726                 jffs2_mark_node_obsolete(c, ref);
 727                 return 0;
 728         }
 729
 730         tn = jffs2_alloc_tmp_dnode_info();
 731         if (!tn) {
 732                 JFFS2_ERROR("failed to allocate tn (%zu bytes).\n", sizeof(*tn));
 733                 return -ENOMEM;
 734         }
 735
 736         tn->partial_crc = 0;
 737         csize = je32_to_cpu(rd->csize);
 738
 739         /* If we've never checked the CRCs on this node, check them now */
 740         if (ref_flags(ref) == REF_UNCHECKED) {
 741
 742                 /* Sanity checks */
 743                 if (unlikely(je32_to_cpu(rd->offset) > je32_to_cpu(rd->isize)) ||
 744                     unlikely(PAD(je32_to_cpu(rd->csize) + sizeof(*rd)) != PAD(je32_to_cpu(rd->totlen)))) {
 745                         JFFS2_WARNING("inode node header CRC is corrupted at %#08x\n", ref_offset(ref));
 746                         jffs2_dbg_dump_node(c, ref_offset(ref));
 747                         jffs2_mark_node_obsolete(c, ref);
 748                         goto free_out;
 749                 }
 750
 751                 if (jffs2_is_writebuffered(c) && csize != 0) {
 752                         /* At this point we are supposed to check the data CRC
 753                          * of our unchecked node. But thus far, we do not
 754                          * know whether the node is valid or obsolete. To
 755                          * figure this out, we need to walk all the nodes of
 756                          * the inode and build the inode fragtree. We don't
 757                          * want to spend time checking data of nodes which may
 758                          * later be found to be obsolete. So we put off the full
 759                          * data CRC checking until we have read all the inode
 760                          * nodes and have started building the fragtree.
 761                          *
 762                          * The fragtree is being built starting with nodes
 763                          * having the highest version number, so we'll be able
 764                          * to detect whether a node is valid (i.e., it is not
 765                          * overlapped by a node with higher version) or not.
 766                          * And we'll be able to check only those nodes, which
 767                          * are not obsolete.
 768                          *
 769                          * Of course, this optimization only makes sense in case
 770                          * of NAND flashes (or other flashes with
 771                          * !jffs2_can_mark_obsolete()), since on NOR flashes
 772                          * nodes are marked obsolete physically.
 773                          *
 774                          * Since NAND flashes (or other flashes with
 775                          * jffs2_is_writebuffered(c)) are anyway read by
 776                          * fractions of c->wbuf_pagesize, and we have just read
 777                          * the node header, it is likely that the starting part
 778                          * of the node data is also read when we read the
 779                          * header. So we don't mind to check the CRC of the
 780                          * starting part of the data of the node now, and check
 781                          * the second part later (in jffs2_check_node_data()).
 782                          * Of course, we will not need to re-read and re-check
 783                          * the NAND page which we have just read. This is why we
 784                          * read the whole NAND page at jffs2_get_inode_nodes(),
 785                          * while we needed only the node header.
 786                          */
 787                         unsigned char *buf;
 788
 789                         /* 'buf' will point to the start of data */
 790                         buf = (unsigned char *)rd + sizeof(*rd);
 791                         /* len will be the read data length */
 792                         len = min_t(uint32_t, rdlen - sizeof(*rd), csize);
 793                         tn->partial_crc = crc32(0, buf, len);
 794
 795                         dbg_readinode("Calculates CRC (%#08x) for %d bytes, csize %d\n", tn->partial_crc, len, csize);
 796
 797                         /* If we actually calculated the whole data CRC
 798                          * and it is wrong, drop the node. */
 799                         if (len >= csize && unlikely(tn->partial_crc != je32_to_cpu(rd->data_crc))) {
 800                                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 801                                         ref_offset(ref), tn->partial_crc, je32_to_cpu(rd->data_crc));
 802                                 jffs2_mark_node_obsolete(c, ref);
 803                                 goto free_out;
 804                         }
 805
 806                 } else if (csize == 0) {
 807                         /*
 808                          * We checked the header CRC. If the node has no data, adjust
 809                          * the space accounting now. For other nodes this will be done
 810                          * later either when the node is marked obsolete or when its
 811                          * data is checked.
 812                          */
 813                         struct jffs2_eraseblock *jeb;
 814
 815                         dbg_readinode("the node has no data.\n");
 816                         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 817                         len = ref_totlen(c, jeb, ref);
 818
 819                         spin_lock(&c->erase_completion_lock);
 820                         jeb->used_size += len;
 821                         jeb->unchecked_size -= len;
 822                         c->used_size += len;
 823                         c->unchecked_size -= len;
 824                         ref->flash_offset = ref_offset(ref) | REF_NORMAL;
 825                         spin_unlock(&c->erase_completion_lock);
 826                 }
 827         }
 828
 829         tn->fn = jffs2_alloc_full_dnode();
 830         if (!tn->fn) {
 831                 JFFS2_ERROR("alloc fn failed\n");
 832                 ret = -ENOMEM;
 833                 goto free_out;
 834         }
 835
 836         tn->version = je32_to_cpu(rd->version);
 837         tn->fn->ofs = je32_to_cpu(rd->offset);
 838         tn->data_crc = je32_to_cpu(rd->data_crc);
 839         tn->csize = csize;
 840         tn->fn->raw = ref;
 841         tn->overlapped = 0;
 842
 843         if (tn->version > rii->highest_version)
 844                 rii->highest_version = tn->version;
 845
 846         /* There was a bug where we wrote hole nodes out with
 847            csize/dsize swapped. Deal with it */
 848         if (rd->compr == JFFS2_COMPR_ZERO && !je32_to_cpu(rd->dsize) && csize)
 849                 tn->fn->size = csize;
 850         else // normal case...
 851                 tn->fn->size = je32_to_cpu(rd->dsize);
 852
 853         dbg_readinode2("dnode @%08x: ver %u, offset %#04x, dsize %#04x, csize %#04x\n",
 854                        ref_offset(ref), je32_to_cpu(rd->version),
 855                        je32_to_cpu(rd->offset), je32_to_cpu(rd->dsize), csize);
 856
 857         ret = jffs2_add_tn_to_tree(c, rii, tn);
 858
 859         if (ret) {
 860                 jffs2_free_full_dnode(tn->fn);
 861         free_out:
 862                 jffs2_free_tmp_dnode_info(tn);
 863                 return ret;
 864         }
 865 #ifdef JFFS2_DBG_READINODE2_MESSAGES
 866         dbg_readinode2("After adding ver %d:\n", je32_to_cpu(rd->version));
 867         tn = tn_first(&rii->tn_root);
 868         while (tn) {
 869                 dbg_readinode2("%p: v %d r 0x%x-0x%x ov %d\n",
 870                                tn, tn->version, tn->fn->ofs,
 871                                tn->fn->ofs+tn->fn->size, tn->overlapped);
 872                 tn = tn_next(tn);
 873         }
 874 #endif
 875         return 0;
 876 }
 877
 878 /*
 879  * Helper function for jffs2_get_inode_nodes().
 880  * It is called every time an unknown node is found.
 881  *
 882  * Returns: 0 on success;
 883  *          negative error code on failure.
 884  */
 885 static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref, struct jffs2_unknown_node *un)
 886 {
 887         /* We don't mark unknown nodes as REF_UNCHECKED */
 888         if (ref_flags(ref) == REF_UNCHECKED) {
 889                 JFFS2_ERROR("REF_UNCHECKED but unknown node at %#08x\n",
 890                             ref_offset(ref));
 891                 JFFS2_ERROR("Node is {%04x,%04x,%08x,%08x}. Please report this error.\n",
 892                             je16_to_cpu(un->magic), je16_to_cpu(un->nodetype),
 893                             je32_to_cpu(un->totlen), je32_to_cpu(un->hdr_crc));
 894                 jffs2_mark_node_obsolete(c, ref);
 895                 return 0;
 896         }
 897
 898         un->nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(un->nodetype));
 899
 900         switch(je16_to_cpu(un->nodetype) & JFFS2_COMPAT_MASK) {
 901
 902         case JFFS2_FEATURE_INCOMPAT:
 903                 JFFS2_ERROR("unknown INCOMPAT nodetype %#04X at %#08x\n",
 904                             je16_to_cpu(un->nodetype), ref_offset(ref));
 905                 /* EEP */
 906                 BUG();
 907                 break;
 908
 909         case JFFS2_FEATURE_ROCOMPAT:
 910                 JFFS2_ERROR("unknown ROCOMPAT nodetype %#04X at %#08x\n",
 911                             je16_to_cpu(un->nodetype), ref_offset(ref));
 912                 BUG_ON(!(c->flags & JFFS2_SB_FLAG_RO));
 913                 break;
 914
 915         case JFFS2_FEATURE_RWCOMPAT_COPY:
 916                 JFFS2_NOTICE("unknown RWCOMPAT_COPY nodetype %#04X at %#08x\n",
 917                              je16_to_cpu(un->nodetype), ref_offset(ref));
 918                 break;
 919
 920         case JFFS2_FEATURE_RWCOMPAT_DELETE:
 921                 JFFS2_NOTICE("unknown RWCOMPAT_DELETE nodetype %#04X at %#08x\n",
 922                              je16_to_cpu(un->nodetype), ref_offset(ref));
 923                 jffs2_mark_node_obsolete(c, ref);
 924                 return 0;
 925         }
 926
 927         return 0;
 928 }
 929
 930 /*
 931  * Helper function for jffs2_get_inode_nodes().
 932  * The function detects whether more data should be read and reads it if yes.
 933  *
 934  * Returns: 0 on success;
 935  *          negative error code on failure.
 936  */
 937 static int read_more(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 938                      int needed_len, int *rdlen, unsigned char *buf)
 939 {
 940         int err, to_read = needed_len - *rdlen;
 941         size_t retlen;
 942         uint32_t offs;
 943
 944         if (jffs2_is_writebuffered(c)) {
 945                 int rem = to_read % c->wbuf_pagesize;
 946
 947                 if (rem)
 948                         to_read += c->wbuf_pagesize - rem;
 949         }
 950
 951         /* We need to read more data */
 952         offs = ref_offset(ref) + *rdlen;
 953
 954         dbg_readinode("read more %d bytes\n", to_read);
 955
 956         err = jffs2_flash_read(c, offs, to_read, &retlen, buf + *rdlen);
 957         if (err) {
 958                 JFFS2_ERROR("can not read %d bytes from 0x%08x, "
 959                         "error code: %d.\n", to_read, offs, err);
 960                 return err;
 961         }
 962
 963         if (retlen < to_read) {
 964                 JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n",
 965                                 offs, retlen, to_read);
 966                 return -EIO;
 967         }
 968
 969         *rdlen += to_read;
 970         return 0;
 971 }
 972
 973 /* Get tmp_dnode_info and full_dirent for all non-obsolete nodes associated
 974    with this ino. Perform a preliminary ordering on data nodes, throwing away
 975    those which are completely obsoleted by newer ones. The naïve approach we
 976    use to take of just returning them _all_ in version order will cause us to
 977    run out of memory in certain degenerate cases. */
 978 static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 979                                  struct jffs2_readinode_info *rii)
 980 {
 981         struct jffs2_raw_node_ref *ref, *valid_ref;
 982         unsigned char *buf = NULL;
 983         union jffs2_node_union *node;
 984         size_t retlen;
 985         int len, err;
 986
 987         rii->mctime_ver = 0;
 988
 989         dbg_readinode("ino #%u\n", f->inocache->ino);
 990
 991         /* FIXME: in case of NOR and available ->point() this
 992          * needs to be fixed. */
 993         len = sizeof(union jffs2_node_union) + c->wbuf_pagesize;
 994         buf = kmalloc(len, GFP_KERNEL);
 995         if (!buf)
 996                 return -ENOMEM;
 997
 998         spin_lock(&c->erase_completion_lock);
 999         valid_ref = jffs2_first_valid_node(f->inocache->nodes);
1000         if (!valid_ref && f->inocache->ino != 1)
1001                 JFFS2_WARNING("Eep. No valid nodes for ino #%u.\n", f->inocache->ino);
1002         while (valid_ref) {
1003                 /* We can hold a pointer to a non-obsolete node without the spinlock,
1004                    but _obsolete_ nodes may disappear at any time, if the block
1005                    they're in gets erased. So if we mark 'ref' obsolete while we're
1006                    not holding the lock, it can go away immediately. For that reason,
1007                    we find the next valid node first, before processing 'ref'.
1008                 */
1009                 ref = valid_ref;
1010                 valid_ref = jffs2_first_valid_node(ref->next_in_ino);
1011                 spin_unlock(&c->erase_completion_lock);
1012
1013                 cond_resched();
1014
1015                 /*
1016                  * At this point we don't know the type of the node we're going
1017                  * to read, so we do not know the size of its header. In order
1018                  * to minimize the amount of flash IO we assume the header is
1019                  * of size = JFFS2_MIN_NODE_HEADER.
1020                  */
1021                 len = JFFS2_MIN_NODE_HEADER;
1022                 if (jffs2_is_writebuffered(c)) {
1023                         int end, rem;
1024
1025                         /*
1026                          * We are about to read JFFS2_MIN_NODE_HEADER bytes,
1027                          * but this flash has some minimal I/O unit. It is
1028                          * possible that we'll need to read more soon, so read
1029                          * up to the next min. I/O unit, in order not to
1030                          * re-read the same min. I/O unit twice.
1031                          */
1032                         end = ref_offset(ref) + len;
1033                         rem = end % c->wbuf_pagesize;
1034                         if (rem)
1035                                 end += c->wbuf_pagesize - rem;
1036                         len = end - ref_offset(ref);
1037                 }
1038
1039                 dbg_readinode("read %d bytes at %#08x(%d).\n", len, ref_offset(ref), ref_flags(ref));
1040
1041                 /* FIXME: point() */
1042                 err = jffs2_flash_read(c, ref_offset(ref), len, &retlen, buf);
1043                 if (err) {
1044                         JFFS2_ERROR("can not read %d bytes from 0x%08x, error code: %d.\n", len, ref_offset(ref), err);
1045                         goto free_out;
1046                 }
1047
1048                 if (retlen < len) {
1049                         JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n", ref_offset(ref), retlen, len);
1050                         err = -EIO;
1051                         goto free_out;
1052                 }
1053
1054                 node = (union jffs2_node_union *)buf;
1055
1056                 /* No need to mask in the valid bit; it shouldn't be invalid */
1057                 if (je32_to_cpu(node->u.hdr_crc) != crc32(0, node, sizeof(node->u)-4)) {
1058                         JFFS2_NOTICE("Node header CRC failed at %#08x. {%04x,%04x,%08x,%08x}\n",
1059                                      ref_offset(ref), je16_to_cpu(node->u.magic),
1060                                      je16_to_cpu(node->u.nodetype),
1061                                      je32_to_cpu(node->u.totlen),
1062                                      je32_to_cpu(node->u.hdr_crc));
1063                         jffs2_dbg_dump_node(c, ref_offset(ref));
1064                         jffs2_mark_node_obsolete(c, ref);
1065                         goto cont;
1066                 }
1067                 if (je16_to_cpu(node->u.magic) != JFFS2_MAGIC_BITMASK) {
1068                         /* Not a JFFS2 node, whinge and move on */
1069                         JFFS2_NOTICE("Wrong magic bitmask 0x%04x in node header at %#08x.\n",
1070                                      je16_to_cpu(node->u.magic), ref_offset(ref));
1071                         jffs2_mark_node_obsolete(c, ref);
1072                         goto cont;
1073                 }
1074
1075                 switch (je16_to_cpu(node->u.nodetype)) {
1076
1077                 case JFFS2_NODETYPE_DIRENT:
1078
1079                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent) &&
1080                             len < sizeof(struct jffs2_raw_dirent)) {
1081                                 err = read_more(c, ref, sizeof(struct jffs2_raw_dirent), &len, buf);
1082                                 if (unlikely(err))
1083                                         goto free_out;
1084                         }
1085
1086                         err = read_direntry(c, ref, &node->d, retlen, rii);
1087                         if (unlikely(err))
1088                                 goto free_out;
1089
1090                         break;
1091
1092                 case JFFS2_NODETYPE_INODE:
1093
1094                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode) &&
1095                             len < sizeof(struct jffs2_raw_inode)) {
1096                                 err = read_more(c, ref, sizeof(struct jffs2_raw_inode), &len, buf);
1097                                 if (unlikely(err))
1098                                         goto free_out;
1099                         }
1100
1101                         err = read_dnode(c, ref, &node->i, len, rii);
1102                         if (unlikely(err))
1103                                 goto free_out;
1104
1105                         break;
1106
1107                 default:
1108                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node) &&
1109                             len < sizeof(struct jffs2_unknown_node)) {
1110                                 err = read_more(c, ref, sizeof(struct jffs2_unknown_node), &len, buf);
1111                                 if (unlikely(err))
1112                                         goto free_out;
1113                         }
1114
1115                         err = read_unknown(c, ref, &node->u);
1116                         if (unlikely(err))
1117                                 goto free_out;
1118
1119                 }
1120         cont:
1121                 spin_lock(&c->erase_completion_lock);
1122         }
1123
1124         spin_unlock(&c->erase_completion_lock);
1125         kfree(buf);
1126
1127         f->highest_version = rii->highest_version;
1128
1129         dbg_readinode("nodes of inode #%u were read, the highest version is %u, latest_mctime %u, mctime_ver %u.\n",
1130                       f->inocache->ino, rii->highest_version, rii->latest_mctime,
1131                       rii->mctime_ver);
1132         return 0;
1133
1134  free_out:
1135         jffs2_free_tmp_dnode_info_list(&rii->tn_root);
1136         jffs2_free_full_dirent_list(rii->fds);
1137         rii->fds = NULL;
1138         kfree(buf);
1139         return err;
1140 }
1141
1142 static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
1143                                         struct jffs2_inode_info *f,
1144                                         struct jffs2_raw_inode *latest_node)
1145 {
1146         struct jffs2_readinode_info rii;
1147         uint32_t crc, new_size;
1148         size_t retlen;
1149         int ret;
1150
1151         dbg_readinode("ino #%u pino/nlink is %d\n", f->inocache->ino,
1152                       f->inocache->pino_nlink);
1153
1154         memset(&rii, 0, sizeof(rii));
1155
1156         /* Grab all nodes relevant to this ino */
1157         ret = jffs2_get_inode_nodes(c, f, &rii);
1158
1159         if (ret) {
1160                 JFFS2_ERROR("cannot read nodes for ino %u, returned error is %d\n", f->inocache->ino, ret);
1161                 if (f->inocache->state == INO_STATE_READING)
1162                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1163                 return ret;
1164         }
1165
1166         ret = jffs2_build_inode_fragtree(c, f, &rii);
1167         if (ret) {
1168                 JFFS2_ERROR("Failed to build final fragtree for inode #%u: error %d\n",
1169                             f->inocache->ino, ret);
1170                 if (f->inocache->state == INO_STATE_READING)
1171                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1172                 jffs2_free_tmp_dnode_info_list(&rii.tn_root);
1173                 /* FIXME: We could at least crc-check them all */
1174                 if (rii.mdata_tn) {
1175                         jffs2_free_full_dnode(rii.mdata_tn->fn);
1176                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1177                         rii.mdata_tn = NULL;
1178                 }
1179                 return ret;
1180         }
1181
1182         if (rii.mdata_tn) {
1183                 if (rii.mdata_tn->fn->raw == rii.latest_ref) {
1184                         f->metadata = rii.mdata_tn->fn;
1185                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1186                 } else {
1187                         jffs2_kill_tn(c, rii.mdata_tn);
1188                 }
1189                 rii.mdata_tn = NULL;
1190         }
1191
1192         f->dents = rii.fds;
1193
1194         jffs2_dbg_fragtree_paranoia_check_nolock(f);
1195
1196         if (unlikely(!rii.latest_ref)) {
1197                 /* No data nodes for this inode. */
1198                 if (f->inocache->ino != 1) {
1199                         JFFS2_WARNING("no data nodes found for ino #%u\n", f->inocache->ino);
1200                         if (!rii.fds) {
1201                                 if (f->inocache->state == INO_STATE_READING)
1202                                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1203                                 return -EIO;
1204                         }
1205                         JFFS2_NOTICE("but it has children so we fake some modes for it\n");
1206                 }
1207                 latest_node->mode = cpu_to_jemode(S_IFDIR|S_IRUGO|S_IWUSR|S_IXUGO);
1208                 latest_node->version = cpu_to_je32(0);
1209                 latest_node->atime = latest_node->ctime = latest_node->mtime = cpu_to_je32(0);
1210                 latest_node->isize = cpu_to_je32(0);
1211                 latest_node->gid = cpu_to_je16(0);
1212                 latest_node->uid = cpu_to_je16(0);
1213                 if (f->inocache->state == INO_STATE_READING)
1214                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1215                 return 0;
1216         }
1217
1218         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref), sizeof(*latest_node), &retlen, (void *)latest_node);
1219         if (ret || retlen != sizeof(*latest_node)) {
1220                 JFFS2_ERROR("failed to read from flash: error %d, %zd of %zd bytes read\n",
1221                         ret, retlen, sizeof(*latest_node));
1222                 /* FIXME: If this fails, there seems to be a memory leak. Find it. */
1223                 mutex_unlock(&f->sem);
1224                 jffs2_do_clear_inode(c, f);
1225                 return ret?ret:-EIO;
1226         }
1227
1228         crc = crc32(0, latest_node, sizeof(*latest_node)-8);
1229         if (crc != je32_to_cpu(latest_node->node_crc)) {
1230                 JFFS2_ERROR("CRC failed for read_inode of inode %u at physical location 0x%x\n",
1231                         f->inocache->ino, ref_offset(rii.latest_ref));
1232                 mutex_unlock(&f->sem);
1233                 jffs2_do_clear_inode(c, f);
1234                 return -EIO;
1235         }
1236
1237         switch(jemode_to_cpu(latest_node->mode) & S_IFMT) {
1238         case S_IFDIR:
1239                 if (rii.mctime_ver > je32_to_cpu(latest_node->version)) {
1240                         /* The times in the latest_node are actually older than
1241                            mctime in the latest dirent. Cheat. */
1242                         latest_node->ctime = latest_node->mtime = cpu_to_je32(rii.latest_mctime);
1243                 }
1244                 break;
1245
1246
1247         case S_IFREG:
1248                 /* If it was a regular file, truncate it to the latest node's isize */
1249                 new_size = jffs2_truncate_fragtree(c, &f->fragtree, je32_to_cpu(latest_node->isize));
1250                 if (new_size != je32_to_cpu(latest_node->isize)) {
1251                         JFFS2_WARNING("Truncating ino #%u to %d bytes failed because it only had %d bytes to start with!\n",
1252                                       f->inocache->ino, je32_to_cpu(latest_node->isize), new_size);
1253                         latest_node->isize = cpu_to_je32(new_size);
1254                 }
1255                 break;
1256
1257         case S_IFLNK:
1258                 /* Hack to work around broken isize in old symlink code.
1259                    Remove this when dwmw2 comes to his senses and stops
1260                    symlinks from being an entirely gratuitous special
1261                    case. */
1262                 if (!je32_to_cpu(latest_node->isize))
1263                         latest_node->isize = latest_node->dsize;
1264
1265                 if (f->inocache->state != INO_STATE_CHECKING) {
1266                         /* Symlink's inode data is the target path. Read it and
1267                          * keep in RAM to facilitate quick follow symlink
1268                          * operation. */
1269                         uint32_t csize = je32_to_cpu(latest_node->csize);
1270                         if (csize > JFFS2_MAX_NAME_LEN) {
1271                                 mutex_unlock(&f->sem);
1272                                 jffs2_do_clear_inode(c, f);
1273                                 return -ENAMETOOLONG;
1274                         }
1275                         f->target = kmalloc(csize + 1, GFP_KERNEL);
1276                         if (!f->target) {
1277                                 JFFS2_ERROR("can't allocate %u bytes of memory for the symlink target path cache\n", csize);
1278                                 mutex_unlock(&f->sem);
1279                                 jffs2_do_clear_inode(c, f);
1280                                 return -ENOMEM;
1281                         }
1282
1283                         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref) + sizeof(*latest_node),
1284                                                csize, &retlen, (char *)f->target);
1285
1286                         if (ret || retlen != csize) {
1287                                 if (retlen != csize)
1288                                         ret = -EIO;
1289                                 kfree(f->target);
1290                                 f->target = NULL;
1291                                 mutex_unlock(&f->sem);
1292                                 jffs2_do_clear_inode(c, f);
1293                                 return ret;
1294                         }
1295
1296                         f->target[csize] = '\0';
1297                         dbg_readinode("symlink's target '%s' cached\n", f->target);
1298                 }
1299
1300                 /* fall through... */
1301
1302         case S_IFBLK:
1303         case S_IFCHR:
1304                 /* Certain inode types should have only one data node, and it's
1305                    kept as the metadata node */
1306                 if (f->metadata) {
1307                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o had metadata node\n",
1308                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1309                         mutex_unlock(&f->sem);
1310                         jffs2_do_clear_inode(c, f);
1311                         return -EIO;
1312                 }
1313                 if (!frag_first(&f->fragtree)) {
1314                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o has no fragments\n",
1315                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1316                         mutex_unlock(&f->sem);
1317                         jffs2_do_clear_inode(c, f);
1318                         return -EIO;
1319                 }
1320                 /* ASSERT: f->fraglist != NULL */
1321                 if (frag_next(frag_first(&f->fragtree))) {
1322                         JFFS2_ERROR("Argh. Special inode #%u with mode 0x%x had more than one node\n",
1323                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1324                         /* FIXME: Deal with it - check crc32, check for duplicate node, check times and discard the older one */
1325                         mutex_unlock(&f->sem);
1326                         jffs2_do_clear_inode(c, f);
1327                         return -EIO;
1328                 }
1329                 /* OK. We're happy */
1330                 f->metadata = frag_first(&f->fragtree)->node;
1331                 jffs2_free_node_frag(frag_first(&f->fragtree));
1332                 f->fragtree = RB_ROOT;
1333                 break;
1334         }
1335         if (f->inocache->state == INO_STATE_READING)
1336                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1337
1338         return 0;
1339 }
1340
1341 /* Scan the list of all nodes present for this ino, build map of versions, etc. */
1342 int jffs2_do_read_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
1343                         uint32_t ino, struct jffs2_raw_inode *latest_node)
1344 {
1345         dbg_readinode("read inode #%u\n", ino);
1346
1347  retry_inocache:
1348         spin_lock(&c->inocache_lock);
1349         f->inocache = jffs2_get_ino_cache(c, ino);
1350
1351         if (f->inocache) {
1352                 /* Check its state. We may need to wait before we can use it */
1353                 switch(f->inocache->state) {
1354                 case INO_STATE_UNCHECKED:
1355                 case INO_STATE_CHECKEDABSENT:
1356                         f->inocache->state = INO_STATE_READING;
1357                         break;
1358
1359                 case INO_STATE_CHECKING:
1360                 case INO_STATE_GC:
1361                         /* If it's in either of these states, we need
1362                            to wait for whoever's got it to finish and
1363                            put it back. */
1364                         dbg_readinode("waiting for ino #%u in state %d\n", ino, f->inocache->state);
1365                         sleep_on_spinunlock(&c->inocache_wq, &c->inocache_lock);
1366                         goto retry_inocache;
1367
1368                 case INO_STATE_READING:
1369                 case INO_STATE_PRESENT:
1370                         /* Eep. This should never happen. It can
1371                         happen if Linux calls read_inode() again
1372                         before clear_inode() has finished though. */
1373                         JFFS2_ERROR("Eep. Trying to read_inode #%u when it's already in state %d!\n", ino, f->inocache->state);
1374                         /* Fail. That's probably better than allowing it to succeed */
1375                         f->inocache = NULL;
1376                         break;
1377
1378                 default:
1379                         BUG();
1380                 }
1381         }
1382         spin_unlock(&c->inocache_lock);
1383
1384         if (!f->inocache && ino == 1) {
1385                 /* Special case - no root inode on medium */
1386                 f->inocache = jffs2_alloc_inode_cache();
1387                 if (!f->inocache) {
1388                         JFFS2_ERROR("cannot allocate inocache for root inode\n");
1389                         return -ENOMEM;
1390                 }
1391                 dbg_readinode("creating inocache for root inode\n");
1392                 memset(f->inocache, 0, sizeof(struct jffs2_inode_cache));
1393                 f->inocache->ino = f->inocache->pino_nlink = 1;
1394                 f->inocache->nodes = (struct jffs2_raw_node_ref *)f->inocache;
1395                 f->inocache->state = INO_STATE_READING;
1396                 jffs2_add_ino_cache(c, f->inocache);
1397         }
1398         if (!f->inocache) {
1399                 JFFS2_ERROR("requestied to read an nonexistent ino %u\n", ino);
1400                 return -ENOENT;
1401         }
1402
1403         return jffs2_do_read_inode_internal(c, f, latest_node);
1404 }
1405
1406 int jffs2_do_crccheck_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
1407 {
1408         struct jffs2_raw_inode n;
1409         struct jffs2_inode_info *f = kzalloc(sizeof(*f), GFP_KERNEL);
1410         int ret;
1411
1412         if (!f)
1413                 return -ENOMEM;
1414
1415         mutex_init(&f->sem);
1416         mutex_lock(&f->sem);
1417         f->inocache = ic;
1418
1419         ret = jffs2_do_read_inode_internal(c, f, &n);
1420         if (!ret) {
1421                 mutex_unlock(&f->sem);
1422                 jffs2_do_clear_inode(c, f);
1423         }
1424         jffs2_xattr_do_crccheck_inode(c, ic);
1425         kfree (f);
1426         return ret;
1427 }
1428
1429 void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
1430 {
1431         struct jffs2_full_dirent *fd, *fds;
1432         int deleted;
1433
1434         jffs2_xattr_delete_inode(c, f->inocache);
1435         mutex_lock(&f->sem);
1436         deleted = f->inocache && !f->inocache->pino_nlink;
1437
1438         if (f->inocache && f->inocache->state != INO_STATE_CHECKING)
1439                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CLEARING);
1440
1441         if (f->metadata) {
1442                 if (deleted)
1443                         jffs2_mark_node_obsolete(c, f->metadata->raw);
1444                 jffs2_free_full_dnode(f->metadata);
1445         }
1446
1447         jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
1448
1449         if (f->target) {
1450                 kfree(f->target);
1451                 f->target = NULL;
1452         }
1453
1454         fds = f->dents;
1455         while(fds) {
1456                 fd = fds;
1457                 fds = fd->next;
1458                 jffs2_free_full_dirent(fd);
1459         }
1460
1461         if (f->inocache && f->inocache->state != INO_STATE_CHECKING) {
1462                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1463                 if (f->inocache->nodes == (void *)f->inocache)
1464                         jffs2_del_ino_cache(c, f->inocache);
1465         }
1466
1467         mutex_unlock(&f->sem);
1468 }