fs/jffs2/readinode.c

   1 /*
   2  * JFFS2 -- Journalling Flash File System, Version 2.
   3  *
   4  * Copyright © 2001-2007 Red Hat, Inc.
   5  *
   6  * Created by David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * For licensing information, see the file 'LICENCE' in this directory.
   9  *
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/sched.h>
  14 #include <linux/slab.h>
  15 #include <linux/fs.h>
  16 #include <linux/crc32.h>
  17 #include <linux/pagemap.h>
  18 #include <linux/mtd/mtd.h>
  19 #include <linux/compiler.h>
  20 #include "nodelist.h"
  21
  22 /*
  23  * Check the data CRC of the node.
  24  *
  25  * Returns: 0 if the data CRC is correct;
  26  *          1 - if incorrect;
  27  *          error code if an error occured.
  28  */
  29 static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
  30 {
  31         struct jffs2_raw_node_ref *ref = tn->fn->raw;
  32         int err = 0, pointed = 0;
  33         struct jffs2_eraseblock *jeb;
  34         unsigned char *buffer;
  35         uint32_t crc, ofs, len;
  36         size_t retlen;
  37
  38         BUG_ON(tn->csize == 0);
  39
  40         if (!jffs2_is_writebuffered(c))
  41                 goto adj_acc;
  42
  43         /* Calculate how many bytes were already checked */
  44         ofs = ref_offset(ref) + sizeof(struct jffs2_raw_inode);
  45         len = ofs % c->wbuf_pagesize;
  46         if (likely(len))
  47                 len = c->wbuf_pagesize - len;
  48
  49         if (len >= tn->csize) {
  50                 dbg_readinode("no need to check node at %#08x, data length %u, data starts at %#08x - it has already been checked.\n",
  51                         ref_offset(ref), tn->csize, ofs);
  52                 goto adj_acc;
  53         }
  54
  55         ofs += len;
  56         len = tn->csize - len;
  57
  58         dbg_readinode("check node at %#08x, data length %u, partial CRC %#08x, correct CRC %#08x, data starts at %#08x, start checking from %#08x - %u bytes.\n",
  59                 ref_offset(ref), tn->csize, tn->partial_crc, tn->data_crc, ofs - len, ofs, len);
  60
  61 #ifndef __ECOS
  62         /* TODO: instead, incapsulate point() stuff to jffs2_flash_read(),
  63          * adding and jffs2_flash_read_end() interface. */
  64         if (c->mtd->point) {
  65                 err = c->mtd->point(c->mtd, ofs, len, &retlen, &buffer);
  66                 if (!err && retlen < tn->csize) {
  67                         JFFS2_WARNING("MTD point returned len too short: %zu instead of %u.\n", retlen, tn->csize);
  68                         c->mtd->unpoint(c->mtd, buffer, ofs, len);
  69                 } else if (err)
  70                         JFFS2_WARNING("MTD point failed: error code %d.\n", err);
  71                 else
  72                         pointed = 1; /* succefully pointed to device */
  73         }
  74 #endif
  75
  76         if (!pointed) {
  77                 buffer = kmalloc(len, GFP_KERNEL);
  78                 if (unlikely(!buffer))
  79                         return -ENOMEM;
  80
  81                 /* TODO: this is very frequent pattern, make it a separate
  82                  * routine */
  83                 err = jffs2_flash_read(c, ofs, len, &retlen, buffer);
  84                 if (err) {
  85                         JFFS2_ERROR("can not read %d bytes from 0x%08x, error code: %d.\n", len, ofs, err);
  86                         goto free_out;
  87                 }
  88
  89                 if (retlen != len) {
  90                         JFFS2_ERROR("short read at %#08x: %zd instead of %d.\n", ofs, retlen, len);
  91                         err = -EIO;
  92                         goto free_out;
  93                 }
  94         }
  95
  96         /* Continue calculating CRC */
  97         crc = crc32(tn->partial_crc, buffer, len);
  98         if(!pointed)
  99                 kfree(buffer);
 100 #ifndef __ECOS
 101         else
 102                 c->mtd->unpoint(c->mtd, buffer, ofs, len);
 103 #endif
 104
 105         if (crc != tn->data_crc) {
 106                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 107                         ofs, tn->data_crc, crc);
 108                 return 1;
 109         }
 110
 111 adj_acc:
 112         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 113         len = ref_totlen(c, jeb, ref);
 114         /* If it should be REF_NORMAL, it'll get marked as such when
 115            we build the fragtree, shortly. No need to worry about GC
 116            moving it while it's marked REF_PRISTINE -- GC won't happen
 117            till we've finished checking every inode anyway. */
 118         ref->flash_offset |= REF_PRISTINE;
 119         /*
 120          * Mark the node as having been checked and fix the
 121          * accounting accordingly.
 122          */
 123         spin_lock(&c->erase_completion_lock);
 124         jeb->used_size += len;
 125         jeb->unchecked_size -= len;
 126         c->used_size += len;
 127         c->unchecked_size -= len;
 128         jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
 129         spin_unlock(&c->erase_completion_lock);
 130
 131         return 0;
 132
 133 free_out:
 134         if(!pointed)
 135                 kfree(buffer);
 136 #ifndef __ECOS
 137         else
 138                 c->mtd->unpoint(c->mtd, buffer, ofs, len);
 139 #endif
 140         return err;
 141 }
 142
 143 /*
 144  * Helper function for jffs2_add_older_frag_to_fragtree().
 145  *
 146  * Checks the node if we are in the checking stage.
 147  */
 148 static int check_tn_node(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 149 {
 150         int ret;
 151
 152         BUG_ON(ref_obsolete(tn->fn->raw));
 153
 154         /* We only check the data CRC of unchecked nodes */
 155         if (ref_flags(tn->fn->raw) != REF_UNCHECKED)
 156                 return 0;
 157
 158         dbg_readinode("check node %#04x-%#04x, phys offs %#08x\n",
 159                       tn->fn->ofs, tn->fn->ofs + tn->fn->size, ref_offset(tn->fn->raw));
 160
 161         ret = check_node_data(c, tn);
 162         if (unlikely(ret < 0)) {
 163                 JFFS2_ERROR("check_node_data() returned error: %d.\n",
 164                         ret);
 165         } else if (unlikely(ret > 0)) {
 166                 dbg_readinode("CRC error, mark it obsolete.\n");
 167                 jffs2_mark_node_obsolete(c, tn->fn->raw);
 168         }
 169
 170         return ret;
 171 }
 172
 173 static struct jffs2_tmp_dnode_info *jffs2_lookup_tn(struct rb_root *tn_root, uint32_t offset)
 174 {
 175         struct rb_node *next;
 176         struct jffs2_tmp_dnode_info *tn = NULL;
 177
 178         dbg_readinode("root %p, offset %d\n", tn_root, offset);
 179
 180         next = tn_root->rb_node;
 181
 182         while (next) {
 183                 tn = rb_entry(next, struct jffs2_tmp_dnode_info, rb);
 184
 185                 if (tn->fn->ofs < offset)
 186                         next = tn->rb.rb_right;
 187                 else if (tn->fn->ofs >= offset)
 188                         next = tn->rb.rb_left;
 189                 else
 190                         break;
 191         }
 192
 193         return tn;
 194 }
 195
 196
 197 static void jffs2_kill_tn(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 198 {
 199         jffs2_mark_node_obsolete(c, tn->fn->raw);
 200         jffs2_free_full_dnode(tn->fn);
 201         jffs2_free_tmp_dnode_info(tn);
 202 }
 203 /*
 204  * This function is used when we read an inode. Data nodes arrive in
 205  * arbitrary order -- they may be older or newer than the nodes which
 206  * are already in the tree. Where overlaps occur, the older node can
 207  * be discarded as long as the newer passes the CRC check. We don't
 208  * bother to keep track of holes in this rbtree, and neither do we deal
 209  * with frags -- we can have multiple entries starting at the same
 210  * offset, and the one with the smallest length will come first in the
 211  * ordering.
 212  *
 213  * Returns 0 if the node was inserted
 214  *         1 if the node is obsolete (because we can't mark it so yet)
 215  *         < 0 an if error occurred
 216  */
 217 static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
 218                                 struct jffs2_readinode_info *rii,
 219                                 struct jffs2_tmp_dnode_info *tn)
 220 {
 221         uint32_t fn_end = tn->fn->ofs + tn->fn->size;
 222         struct jffs2_tmp_dnode_info *this;
 223
 224         dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
 225
 226         /* If a node has zero dsize, we only have to keep if it if it might be the
 227            node with highest version -- i.e. the one which will end up as f->metadata.
 228            Note that such nodes won't be REF_UNCHECKED since there are no data to
 229            check anyway. */
 230         if (!tn->fn->size) {
 231                 if (rii->mdata_tn) {
 232                         /* We had a candidate mdata node already */
 233                         dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
 234                         jffs2_kill_tn(c, rii->mdata_tn);
 235                 }
 236                 rii->mdata_tn = tn;
 237                 dbg_readinode("keep new mdata with ver %d\n", tn->version);
 238                 return 0;
 239         }
 240
 241         /* Find the earliest node which _may_ be relevant to this one */
 242         this = jffs2_lookup_tn(&rii->tn_root, tn->fn->ofs);
 243         if (this) {
 244                 /* If the node is coincident with another at a lower address,
 245                    back up until the other node is found. It may be relevant */
 246                 while (this->overlapped)
 247                         this = tn_prev(this);
 248
 249                 /* First node should never be marked overlapped */
 250                 BUG_ON(!this);
 251                 dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
 252         }
 253
 254         while (this) {
 255                 if (this->fn->ofs > fn_end)
 256                         break;
 257                 dbg_readinode("Ponder this ver %d, 0x%x-0x%x\n",
 258                               this->version, this->fn->ofs, this->fn->size);
 259
 260                 if (this->version == tn->version) {
 261                         /* Version number collision means REF_PRISTINE GC. Accept either of them
 262                            as long as the CRC is correct. Check the one we have already...  */
 263                         if (!check_tn_node(c, this)) {
 264                                 /* The one we already had was OK. Keep it and throw away the new one */
 265                                 dbg_readinode("Like old node. Throw away new\n");
 266                                 jffs2_kill_tn(c, tn);
 267                                 return 0;
 268                         } else {
 269                                 /* Who cares if the new one is good; keep it for now anyway. */
 270                                 dbg_readinode("Like new node. Throw away old\n");
 271                                 rb_replace_node(&this->rb, &tn->rb, &rii->tn_root);
 272                                 jffs2_kill_tn(c, this);
 273                                 /* Same overlapping from in front and behind */
 274                                 return 0;
 275                         }
 276                 }
 277                 if (this->version < tn->version &&
 278                     this->fn->ofs >= tn->fn->ofs &&
 279                     this->fn->ofs + this->fn->size <= fn_end) {
 280                         /* New node entirely overlaps 'this' */
 281                         if (check_tn_node(c, tn)) {
 282                                 dbg_readinode("new node bad CRC\n");
 283                                 jffs2_kill_tn(c, tn);
 284                                 return 0;
 285                         }
 286                         /* ... and is good. Kill 'this' and any subsequent nodes which are also overlapped */
 287                         while (this && this->fn->ofs + this->fn->size <= fn_end) {
 288                                 struct jffs2_tmp_dnode_info *next = tn_next(this);
 289                                 if (this->version < tn->version) {
 290                                         tn_erase(this, &rii->tn_root);
 291                                         dbg_readinode("Kill overlapped ver %d, 0x%x-0x%x\n",
 292                                                       this->version, this->fn->ofs,
 293                                                       this->fn->ofs+this->fn->size);
 294                                         jffs2_kill_tn(c, this);
 295                                 }
 296                                 this = next;
 297                         }
 298                         dbg_readinode("Done killing overlapped nodes\n");
 299                         continue;
 300                 }
 301                 if (this->version > tn->version &&
 302                     this->fn->ofs <= tn->fn->ofs &&
 303                     this->fn->ofs+this->fn->size >= fn_end) {
 304                         /* New node entirely overlapped by 'this' */
 305                         if (!check_tn_node(c, this)) {
 306                                 dbg_readinode("Good CRC on old node. Kill new\n");
 307                                 jffs2_kill_tn(c, tn);
 308                                 return 0;
 309                         }
 310                         /* ... but 'this' was bad. Replace it... */
 311                         dbg_readinode("Bad CRC on old overlapping node. Kill it\n");
 312                         tn_erase(this, &rii->tn_root);
 313                         jffs2_kill_tn(c, this);
 314                         break;
 315                 }
 316
 317                 this = tn_next(this);
 318         }
 319
 320         /* We neither completely obsoleted nor were completely
 321            obsoleted by an earlier node. Insert into the tree */
 322         {
 323                 struct rb_node *parent;
 324                 struct rb_node **link = &rii->tn_root.rb_node;
 325                 struct jffs2_tmp_dnode_info *insert_point = NULL;
 326
 327                 while (*link) {
 328                         parent = *link;
 329                         insert_point = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 330                         if (tn->fn->ofs > insert_point->fn->ofs)
 331                                 link = &insert_point->rb.rb_right;
 332                         else if (tn->fn->ofs < insert_point->fn->ofs ||
 333                                  tn->fn->size < insert_point->fn->size)
 334                                 link = &insert_point->rb.rb_left;
 335                         else
 336                                 link = &insert_point->rb.rb_right;
 337                 }
 338                 rb_link_node(&tn->rb, &insert_point->rb, link);
 339                 rb_insert_color(&tn->rb, &rii->tn_root);
 340         }
 341
 342         /* If there's anything behind that overlaps us, note it */
 343         this = tn_prev(tn);
 344         if (this) {
 345                 while (1) {
 346                         if (this->fn->ofs + this->fn->size > tn->fn->ofs) {
 347                                 dbg_readinode("Node is overlapped by %p (v %d, 0x%x-0x%x)\n",
 348                                               this, this->version, this->fn->ofs,
 349                                               this->fn->ofs+this->fn->size);
 350                                 tn->overlapped = 1;
 351                                 break;
 352                         }
 353                         if (!this->overlapped)
 354                                 break;
 355                         this = tn_prev(this);
 356                 }
 357         }
 358
 359         /* If the new node overlaps anything ahead, note it */
 360         this = tn_next(tn);
 361         while (this && this->fn->ofs < fn_end) {
 362                 this->overlapped = 1;
 363                 dbg_readinode("Node ver %d, 0x%x-0x%x is overlapped\n",
 364                               this->version, this->fn->ofs,
 365                               this->fn->ofs+this->fn->size);
 366                 this = tn_next(this);
 367         }
 368         return 0;
 369 }
 370
 371 /* Trivial function to remove the last node in the tree. Which by definition
 372    has no right-hand -- so can be removed just by making its only child (if
 373    any) take its place under its parent. */
 374 static void eat_last(struct rb_root *root, struct rb_node *node)
 375 {
 376         struct rb_node *parent = rb_parent(node);
 377         struct rb_node **link;
 378
 379         /* LAST! */
 380         BUG_ON(node->rb_right);
 381
 382         if (!parent)
 383                 link = &root->rb_node;
 384         else if (node == parent->rb_left)
 385                 link = &parent->rb_left;
 386         else
 387                 link = &parent->rb_right;
 388
 389         *link = node->rb_left;
 390         /* Colour doesn't matter now. Only the parent pointer. */
 391         if (node->rb_left)
 392                 node->rb_left->rb_parent_color = node->rb_parent_color;
 393 }
 394
 395 /* We put this in reverse order, so we can just use eat_last */
 396 static void ver_insert(struct rb_root *ver_root, struct jffs2_tmp_dnode_info *tn)
 397 {
 398         struct rb_node **link = &ver_root->rb_node;
 399         struct rb_node *parent = NULL;
 400         struct jffs2_tmp_dnode_info *this_tn;
 401
 402         while (*link) {
 403                 parent = *link;
 404                 this_tn = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 405
 406                 if (tn->version > this_tn->version)
 407                         link = &parent->rb_left;
 408                 else
 409                         link = &parent->rb_right;
 410         }
 411         dbg_readinode("Link new node at %p (root is %p)\n", link, ver_root);
 412         rb_link_node(&tn->rb, parent, link);
 413         rb_insert_color(&tn->rb, ver_root);
 414 }
 415
 416 /* Build final, normal fragtree from tn tree. It doesn't matter which order
 417    we add nodes to the real fragtree, as long as they don't overlap. And
 418    having thrown away the majority of overlapped nodes as we went, there
 419    really shouldn't be many sets of nodes which do overlap. If we start at
 420    the end, we can use the overlap markers -- we can just eat nodes which
 421    aren't overlapped, and when we encounter nodes which _do_ overlap we
 422    sort them all into a temporary tree in version order before replaying them. */
 423 static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
 424                                       struct jffs2_inode_info *f,
 425                                       struct jffs2_readinode_info *rii)
 426 {
 427         struct jffs2_tmp_dnode_info *pen, *last, *this;
 428         struct rb_root ver_root = RB_ROOT;
 429         uint32_t high_ver = 0;
 430
 431         if (rii->mdata_tn) {
 432                 dbg_readinode("potential mdata is ver %d at %p\n", rii->mdata_tn->version, rii->mdata_tn);
 433                 high_ver = rii->mdata_tn->version;
 434                 rii->latest_ref = rii->mdata_tn->fn->raw;
 435         }
 436 #ifdef JFFS2_DBG_READINODE_MESSAGES
 437         this = tn_last(&rii->tn_root);
 438         while (this) {
 439                 dbg_readinode("tn %p ver %d range 0x%x-0x%x ov %d\n", this, this->version, this->fn->ofs,
 440                               this->fn->ofs+this->fn->size, this->overlapped);
 441                 this = tn_prev(this);
 442         }
 443 #endif
 444         pen = tn_last(&rii->tn_root);
 445         while ((last = pen)) {
 446                 pen = tn_prev(last);
 447
 448                 eat_last(&rii->tn_root, &last->rb);
 449                 ver_insert(&ver_root, last);
 450
 451                 if (unlikely(last->overlapped))
 452                         continue;
 453
 454                 /* Now we have a bunch of nodes in reverse version
 455                    order, in the tree at ver_root. Most of the time,
 456                    there'll actually be only one node in the 'tree',
 457                    in fact. */
 458                 this = tn_last(&ver_root);
 459
 460                 while (this) {
 461                         struct jffs2_tmp_dnode_info *vers_next;
 462                         int ret;
 463                         vers_next = tn_prev(this);
 464                         eat_last(&ver_root, &this->rb);
 465                         if (check_tn_node(c, this)) {
 466                                 dbg_readinode("node ver %d, 0x%x-0x%x failed CRC\n",
 467                                              this->version, this->fn->ofs,
 468                                              this->fn->ofs+this->fn->size);
 469                                 jffs2_kill_tn(c, this);
 470                         } else {
 471                                 if (this->version > high_ver) {
 472                                         /* Note that this is different from the other
 473                                            highest_version, because this one is only
 474                                            counting _valid_ nodes which could give the
 475                                            latest inode metadata */
 476                                         high_ver = this->version;
 477                                         rii->latest_ref = this->fn->raw;
 478                                 }
 479                                 dbg_readinode("Add %p (v %d, 0x%x-0x%x, ov %d) to fragtree\n",
 480                                              this, this->version, this->fn->ofs,
 481                                              this->fn->ofs+this->fn->size, this->overlapped);
 482
 483                                 ret = jffs2_add_full_dnode_to_inode(c, f, this->fn);
 484                                 if (ret) {
 485                                         /* Free the nodes in vers_root; let the caller
 486                                            deal with the rest */
 487                                         JFFS2_ERROR("Add node to tree failed %d\n", ret);
 488                                         while (1) {
 489                                                 vers_next = tn_prev(this);
 490                                                 if (check_tn_node(c, this))
 491                                                         jffs2_mark_node_obsolete(c, this->fn->raw);
 492                                                 jffs2_free_full_dnode(this->fn);
 493                                                 jffs2_free_tmp_dnode_info(this);
 494                                                 this = vers_next;
 495                                                 if (!this)
 496                                                         break;
 497                                                 eat_last(&ver_root, &vers_next->rb);
 498                                         }
 499                                         return ret;
 500                                 }
 501                                 jffs2_free_tmp_dnode_info(this);
 502                         }
 503                         this = vers_next;
 504                 }
 505         }
 506         return 0;
 507 }
 508
 509 static void jffs2_free_tmp_dnode_info_list(struct rb_root *list)
 510 {
 511         struct rb_node *this;
 512         struct jffs2_tmp_dnode_info *tn;
 513
 514         this = list->rb_node;
 515
 516         /* Now at bottom of tree */
 517         while (this) {
 518                 if (this->rb_left)
 519                         this = this->rb_left;
 520                 else if (this->rb_right)
 521                         this = this->rb_right;
 522                 else {
 523                         tn = rb_entry(this, struct jffs2_tmp_dnode_info, rb);
 524                         jffs2_free_full_dnode(tn->fn);
 525                         jffs2_free_tmp_dnode_info(tn);
 526
 527                         this = rb_parent(this);
 528                         if (!this)
 529                                 break;
 530
 531                         if (this->rb_left == &tn->rb)
 532                                 this->rb_left = NULL;
 533                         else if (this->rb_right == &tn->rb)
 534                                 this->rb_right = NULL;
 535                         else BUG();
 536                 }
 537         }
 538         list->rb_node = NULL;
 539 }
 540
 541 static void jffs2_free_full_dirent_list(struct jffs2_full_dirent *fd)
 542 {
 543         struct jffs2_full_dirent *next;
 544
 545         while (fd) {
 546                 next = fd->next;
 547                 jffs2_free_full_dirent(fd);
 548                 fd = next;
 549         }
 550 }
 551
 552 /* Returns first valid node after 'ref'. May return 'ref' */
 553 static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_ref *ref)
 554 {
 555         while (ref && ref->next_in_ino) {
 556                 if (!ref_obsolete(ref))
 557                         return ref;
 558                 dbg_noderef("node at 0x%08x is obsoleted. Ignoring.\n", ref_offset(ref));
 559                 ref = ref->next_in_ino;
 560         }
 561         return NULL;
 562 }
 563
 564 /*
 565  * Helper function for jffs2_get_inode_nodes().
 566  * It is called every time an directory entry node is found.
 567  *
 568  * Returns: 0 on succes;
 569  *          1 if the node should be marked obsolete;
 570  *          negative error code on failure.
 571  */
 572 static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 573                                 struct jffs2_raw_dirent *rd, size_t read,
 574                                 struct jffs2_readinode_info *rii)
 575 {
 576         struct jffs2_full_dirent *fd;
 577         uint32_t crc;
 578
 579         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 580         BUG_ON(ref_obsolete(ref));
 581
 582         crc = crc32(0, rd, sizeof(*rd) - 8);
 583         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 584                 JFFS2_NOTICE("header CRC failed on dirent node at %#08x: read %#08x, calculated %#08x\n",
 585                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 586                 jffs2_mark_node_obsolete(c, ref);
 587                 return 0;
 588         }
 589
 590         /* If we've never checked the CRCs on this node, check them now */
 591         if (ref_flags(ref) == REF_UNCHECKED) {
 592                 struct jffs2_eraseblock *jeb;
 593                 int len;
 594
 595                 /* Sanity check */
 596                 if (unlikely(PAD((rd->nsize + sizeof(*rd))) != PAD(je32_to_cpu(rd->totlen)))) {
 597                         JFFS2_ERROR("illegal nsize in node at %#08x: nsize %#02x, totlen %#04x\n",
 598                                     ref_offset(ref), rd->nsize, je32_to_cpu(rd->totlen));
 599                         jffs2_mark_node_obsolete(c, ref);
 600                         return 0;
 601                 }
 602
 603                 jeb = &c->blocks[ref->flash_offset / c->sector_size];
 604                 len = ref_totlen(c, jeb, ref);
 605
 606                 spin_lock(&c->erase_completion_lock);
 607                 jeb->used_size += len;
 608                 jeb->unchecked_size -= len;
 609                 c->used_size += len;
 610                 c->unchecked_size -= len;
 611                 ref->flash_offset = ref_offset(ref) | REF_PRISTINE;
 612                 spin_unlock(&c->erase_completion_lock);
 613         }
 614
 615         fd = jffs2_alloc_full_dirent(rd->nsize + 1);
 616         if (unlikely(!fd))
 617                 return -ENOMEM;
 618
 619         fd->raw = ref;
 620         fd->version = je32_to_cpu(rd->version);
 621         fd->ino = je32_to_cpu(rd->ino);
 622         fd->type = rd->type;
 623
 624         if (fd->version > rii->highest_version)
 625                 rii->highest_version = fd->version;
 626
 627         /* Pick out the mctime of the latest dirent */
 628         if(fd->version > rii->mctime_ver && je32_to_cpu(rd->mctime)) {
 629                 rii->mctime_ver = fd->version;
 630                 rii->latest_mctime = je32_to_cpu(rd->mctime);
 631         }
 632
 633         /*
 634          * Copy as much of the name as possible from the raw
 635          * dirent we've already read from the flash.
 636          */
 637         if (read > sizeof(*rd))
 638                 memcpy(&fd->name[0], &rd->name[0],
 639                        min_t(uint32_t, rd->nsize, (read - sizeof(*rd)) ));
 640
 641         /* Do we need to copy any more of the name directly from the flash? */
 642         if (rd->nsize + sizeof(*rd) > read) {
 643                 /* FIXME: point() */
 644                 int err;
 645                 int already = read - sizeof(*rd);
 646
 647                 err = jffs2_flash_read(c, (ref_offset(ref)) + read,
 648                                 rd->nsize - already, &read, &fd->name[already]);
 649                 if (unlikely(read != rd->nsize - already) && likely(!err))
 650                         return -EIO;
 651
 652                 if (unlikely(err)) {
 653                         JFFS2_ERROR("read remainder of name: error %d\n", err);
 654                         jffs2_free_full_dirent(fd);
 655                         return -EIO;
 656                 }
 657         }
 658
 659         fd->nhash = full_name_hash(fd->name, rd->nsize);
 660         fd->next = NULL;
 661         fd->name[rd->nsize] = '\0';
 662
 663         /*
 664          * Wheee. We now have a complete jffs2_full_dirent structure, with
 665          * the name in it and everything. Link it into the list
 666          */
 667         jffs2_add_fd_to_list(c, fd, &rii->fds);
 668
 669         return 0;
 670 }
 671
 672 /*
 673  * Helper function for jffs2_get_inode_nodes().
 674  * It is called every time an inode node is found.
 675  *
 676  * Returns: 0 on success;
 677  *          1 if the node should be marked obsolete;
 678  *          negative error code on failure.
 679  */
 680 static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 681                              struct jffs2_raw_inode *rd, int rdlen,
 682                              struct jffs2_readinode_info *rii)
 683 {
 684         struct jffs2_tmp_dnode_info *tn;
 685         uint32_t len, csize;
 686         int ret = 1;
 687         uint32_t crc;
 688
 689         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 690         BUG_ON(ref_obsolete(ref));
 691
 692         crc = crc32(0, rd, sizeof(*rd) - 8);
 693         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 694                 JFFS2_NOTICE("node CRC failed on dnode at %#08x: read %#08x, calculated %#08x\n",
 695                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 696                 jffs2_mark_node_obsolete(c, ref);
 697                 return 0;
 698         }
 699
 700         tn = jffs2_alloc_tmp_dnode_info();
 701         if (!tn) {
 702                 JFFS2_ERROR("failed to allocate tn (%zu bytes).\n", sizeof(*tn));
 703                 return -ENOMEM;
 704         }
 705
 706         tn->partial_crc = 0;
 707         csize = je32_to_cpu(rd->csize);
 708
 709         /* If we've never checked the CRCs on this node, check them now */
 710         if (ref_flags(ref) == REF_UNCHECKED) {
 711
 712                 /* Sanity checks */
 713                 if (unlikely(je32_to_cpu(rd->offset) > je32_to_cpu(rd->isize)) ||
 714                     unlikely(PAD(je32_to_cpu(rd->csize) + sizeof(*rd)) != PAD(je32_to_cpu(rd->totlen)))) {
 715                                 JFFS2_WARNING("inode node header CRC is corrupted at %#08x\n", ref_offset(ref));
 716                                 jffs2_dbg_dump_node(c, ref_offset(ref));
 717                         goto free_out;
 718                 }
 719
 720                 if (jffs2_is_writebuffered(c) && csize != 0) {
 721                         /* At this point we are supposed to check the data CRC
 722                          * of our unchecked node. But thus far, we do not
 723                          * know whether the node is valid or obsolete. To
 724                          * figure this out, we need to walk all the nodes of
 725                          * the inode and build the inode fragtree. We don't
 726                          * want to spend time checking data of nodes which may
 727                          * later be found to be obsolete. So we put off the full
 728                          * data CRC checking until we have read all the inode
 729                          * nodes and have started building the fragtree.
 730                          *
 731                          * The fragtree is being built starting with nodes
 732                          * having the highest version number, so we'll be able
 733                          * to detect whether a node is valid (i.e., it is not
 734                          * overlapped by a node with higher version) or not.
 735                          * And we'll be able to check only those nodes, which
 736                          * are not obsolete.
 737                          *
 738                          * Of course, this optimization only makes sense in case
 739                          * of NAND flashes (or other flashes whith
 740                          * !jffs2_can_mark_obsolete()), since on NOR flashes
 741                          * nodes are marked obsolete physically.
 742                          *
 743                          * Since NAND flashes (or other flashes with
 744                          * jffs2_is_writebuffered(c)) are anyway read by
 745                          * fractions of c->wbuf_pagesize, and we have just read
 746                          * the node header, it is likely that the starting part
 747                          * of the node data is also read when we read the
 748                          * header. So we don't mind to check the CRC of the
 749                          * starting part of the data of the node now, and check
 750                          * the second part later (in jffs2_check_node_data()).
 751                          * Of course, we will not need to re-read and re-check
 752                          * the NAND page which we have just read. This is why we
 753                          * read the whole NAND page at jffs2_get_inode_nodes(),
 754                          * while we needed only the node header.
 755                          */
 756                         unsigned char *buf;
 757
 758                         /* 'buf' will point to the start of data */
 759                         buf = (unsigned char *)rd + sizeof(*rd);
 760                         /* len will be the read data length */
 761                         len = min_t(uint32_t, rdlen - sizeof(*rd), csize);
 762                         tn->partial_crc = crc32(0, buf, len);
 763
 764                         dbg_readinode("Calculates CRC (%#08x) for %d bytes, csize %d\n", tn->partial_crc, len, csize);
 765
 766                         /* If we actually calculated the whole data CRC
 767                          * and it is wrong, drop the node. */
 768                         if (len >= csize && unlikely(tn->partial_crc != je32_to_cpu(rd->data_crc))) {
 769                                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 770                                         ref_offset(ref), tn->partial_crc, je32_to_cpu(rd->data_crc));
 771                                 goto free_out;
 772                         }
 773
 774                 } else if (csize == 0) {
 775                         /*
 776                          * We checked the header CRC. If the node has no data, adjust
 777                          * the space accounting now. For other nodes this will be done
 778                          * later either when the node is marked obsolete or when its
 779                          * data is checked.
 780                          */
 781                         struct jffs2_eraseblock *jeb;
 782
 783                         dbg_readinode("the node has no data.\n");
 784                         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 785                         len = ref_totlen(c, jeb, ref);
 786
 787                         spin_lock(&c->erase_completion_lock);
 788                         jeb->used_size += len;
 789                         jeb->unchecked_size -= len;
 790                         c->used_size += len;
 791                         c->unchecked_size -= len;
 792                         ref->flash_offset = ref_offset(ref) | REF_NORMAL;
 793                         spin_unlock(&c->erase_completion_lock);
 794                 }
 795         }
 796
 797         tn->fn = jffs2_alloc_full_dnode();
 798         if (!tn->fn) {
 799                 JFFS2_ERROR("alloc fn failed\n");
 800                 ret = -ENOMEM;
 801                 goto free_out;
 802         }
 803
 804         tn->version = je32_to_cpu(rd->version);
 805         tn->fn->ofs = je32_to_cpu(rd->offset);
 806         tn->data_crc = je32_to_cpu(rd->data_crc);
 807         tn->csize = csize;
 808         tn->fn->raw = ref;
 809         tn->overlapped = 0;
 810
 811         if (tn->version > rii->highest_version)
 812                 rii->highest_version = tn->version;
 813
 814         /* There was a bug where we wrote hole nodes out with
 815            csize/dsize swapped. Deal with it */
 816         if (rd->compr == JFFS2_COMPR_ZERO && !je32_to_cpu(rd->dsize) && csize)
 817                 tn->fn->size = csize;
 818         else // normal case...
 819                 tn->fn->size = je32_to_cpu(rd->dsize);
 820
 821         dbg_readinode("dnode @%08x: ver %u, offset %#04x, dsize %#04x, csize %#04x\n",
 822                   ref_offset(ref), je32_to_cpu(rd->version), je32_to_cpu(rd->offset), je32_to_cpu(rd->dsize), csize);
 823
 824         ret = jffs2_add_tn_to_tree(c, rii, tn);
 825
 826         if (ret) {
 827                 jffs2_free_full_dnode(tn->fn);
 828         free_out:
 829                 jffs2_free_tmp_dnode_info(tn);
 830                 return ret;
 831         }
 832 #ifdef JFFS2_DBG_READINODE_MESSAGES
 833         dbg_readinode("After adding ver %d:\n", je32_to_cpu(rd->version));
 834         tn = tn_first(&rii->tn_root);
 835         while (tn) {
 836                 dbg_readinode("%p: v %d r 0x%x-0x%x ov %d\n",
 837                              tn, tn->version, tn->fn->ofs,
 838                              tn->fn->ofs+tn->fn->size, tn->overlapped);
 839                 tn = tn_next(tn);
 840         }
 841 #endif
 842         return 0;
 843 }
 844
 845 /*
 846  * Helper function for jffs2_get_inode_nodes().
 847  * It is called every time an unknown node is found.
 848  *
 849  * Returns: 0 on success;
 850  *          1 if the node should be marked obsolete;
 851  *          negative error code on failure.
 852  */
 853 static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref, struct jffs2_unknown_node *un)
 854 {
 855         /* We don't mark unknown nodes as REF_UNCHECKED */
 856         if (ref_flags(ref) == REF_UNCHECKED) {
 857                 JFFS2_ERROR("REF_UNCHECKED but unknown node at %#08x\n",
 858                             ref_offset(ref));
 859                 JFFS2_ERROR("Node is {%04x,%04x,%08x,%08x}. Please report this error.\n",
 860                             je16_to_cpu(un->magic), je16_to_cpu(un->nodetype),
 861                             je32_to_cpu(un->totlen), je32_to_cpu(un->hdr_crc));
 862                 jffs2_mark_node_obsolete(c, ref);
 863                 return 0;
 864         }
 865
 866         un->nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(un->nodetype));
 867
 868         switch(je16_to_cpu(un->nodetype) & JFFS2_COMPAT_MASK) {
 869
 870         case JFFS2_FEATURE_INCOMPAT:
 871                 JFFS2_ERROR("unknown INCOMPAT nodetype %#04X at %#08x\n",
 872                             je16_to_cpu(un->nodetype), ref_offset(ref));
 873                 /* EEP */
 874                 BUG();
 875                 break;
 876
 877         case JFFS2_FEATURE_ROCOMPAT:
 878                 JFFS2_ERROR("unknown ROCOMPAT nodetype %#04X at %#08x\n",
 879                             je16_to_cpu(un->nodetype), ref_offset(ref));
 880                 BUG_ON(!(c->flags & JFFS2_SB_FLAG_RO));
 881                 break;
 882
 883         case JFFS2_FEATURE_RWCOMPAT_COPY:
 884                 JFFS2_NOTICE("unknown RWCOMPAT_COPY nodetype %#04X at %#08x\n",
 885                              je16_to_cpu(un->nodetype), ref_offset(ref));
 886                 break;
 887
 888         case JFFS2_FEATURE_RWCOMPAT_DELETE:
 889                 JFFS2_NOTICE("unknown RWCOMPAT_DELETE nodetype %#04X at %#08x\n",
 890                              je16_to_cpu(un->nodetype), ref_offset(ref));
 891                 jffs2_mark_node_obsolete(c, ref);
 892                 return 0;
 893         }
 894
 895         return 0;
 896 }
 897
 898 /*
 899  * Helper function for jffs2_get_inode_nodes().
 900  * The function detects whether more data should be read and reads it if yes.
 901  *
 902  * Returns: 0 on succes;
 903  *          negative error code on failure.
 904  */
 905 static int read_more(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 906                      int needed_len, int *rdlen, unsigned char *buf)
 907 {
 908         int err, to_read = needed_len - *rdlen;
 909         size_t retlen;
 910         uint32_t offs;
 911
 912         if (jffs2_is_writebuffered(c)) {
 913                 int rem = to_read % c->wbuf_pagesize;
 914
 915                 if (rem)
 916                         to_read += c->wbuf_pagesize - rem;
 917         }
 918
 919         /* We need to read more data */
 920         offs = ref_offset(ref) + *rdlen;
 921
 922         dbg_readinode("read more %d bytes\n", to_read);
 923
 924         err = jffs2_flash_read(c, offs, to_read, &retlen, buf + *rdlen);
 925         if (err) {
 926                 JFFS2_ERROR("can not read %d bytes from 0x%08x, "
 927                         "error code: %d.\n", to_read, offs, err);
 928                 return err;
 929         }
 930
 931         if (retlen < to_read) {
 932                 JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n",
 933                                 offs, retlen, to_read);
 934                 return -EIO;
 935         }
 936
 937         *rdlen += to_read;
 938         return 0;
 939 }
 940
 941 /* Get tmp_dnode_info and full_dirent for all non-obsolete nodes associated
 942    with this ino. Perform a preliminary ordering on data nodes, throwing away
 943    those which are completely obsoleted by newer ones. The naïve approach we
 944    use to take of just returning them _all_ in version order will cause us to
 945    run out of memory in certain degenerate cases. */
 946 static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 947                                  struct jffs2_readinode_info *rii)
 948 {
 949         struct jffs2_raw_node_ref *ref, *valid_ref;
 950         unsigned char *buf = NULL;
 951         union jffs2_node_union *node;
 952         size_t retlen;
 953         int len, err;
 954
 955         rii->mctime_ver = 0;
 956
 957         dbg_readinode("ino #%u\n", f->inocache->ino);
 958
 959         /* FIXME: in case of NOR and available ->point() this
 960          * needs to be fixed. */
 961         len = sizeof(union jffs2_node_union) + c->wbuf_pagesize;
 962         buf = kmalloc(len, GFP_KERNEL);
 963         if (!buf)
 964                 return -ENOMEM;
 965
 966         spin_lock(&c->erase_completion_lock);
 967         valid_ref = jffs2_first_valid_node(f->inocache->nodes);
 968         if (!valid_ref && f->inocache->ino != 1)
 969                 JFFS2_WARNING("Eep. No valid nodes for ino #%u.\n", f->inocache->ino);
 970         while (valid_ref) {
 971                 /* We can hold a pointer to a non-obsolete node without the spinlock,
 972                    but _obsolete_ nodes may disappear at any time, if the block
 973                    they're in gets erased. So if we mark 'ref' obsolete while we're
 974                    not holding the lock, it can go away immediately. For that reason,
 975                    we find the next valid node first, before processing 'ref'.
 976                 */
 977                 ref = valid_ref;
 978                 valid_ref = jffs2_first_valid_node(ref->next_in_ino);
 979                 spin_unlock(&c->erase_completion_lock);
 980
 981                 cond_resched();
 982
 983                 /*
 984                  * At this point we don't know the type of the node we're going
 985                  * to read, so we do not know the size of its header. In order
 986                  * to minimize the amount of flash IO we assume the header is
 987                  * of size = JFFS2_MIN_NODE_HEADER.
 988                  */
 989                 len = JFFS2_MIN_NODE_HEADER;
 990                 if (jffs2_is_writebuffered(c)) {
 991                         int end, rem;
 992
 993                         /*
 994                          * We are about to read JFFS2_MIN_NODE_HEADER bytes,
 995                          * but this flash has some minimal I/O unit. It is
 996                          * possible that we'll need to read more soon, so read
 997                          * up to the next min. I/O unit, in order not to
 998                          * re-read the same min. I/O unit twice.
 999                          */
1000                         end = ref_offset(ref) + len;
1001                         rem = end % c->wbuf_pagesize;
1002                         if (rem)
1003                                 end += c->wbuf_pagesize - rem;
1004                         len = end - ref_offset(ref);
1005                 }
1006
1007                 dbg_readinode("read %d bytes at %#08x(%d).\n", len, ref_offset(ref), ref_flags(ref));
1008
1009                 /* FIXME: point() */
1010                 err = jffs2_flash_read(c, ref_offset(ref), len, &retlen, buf);
1011                 if (err) {
1012                         JFFS2_ERROR("can not read %d bytes from 0x%08x, " "error code: %d.\n", len, ref_offset(ref), err);
1013                         goto free_out;
1014                 }
1015
1016                 if (retlen < len) {
1017                         JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n", ref_offset(ref), retlen, len);
1018                         err = -EIO;
1019                         goto free_out;
1020                 }
1021
1022                 node = (union jffs2_node_union *)buf;
1023
1024                 /* No need to mask in the valid bit; it shouldn't be invalid */
1025                 if (je32_to_cpu(node->u.hdr_crc) != crc32(0, node, sizeof(node->u)-4)) {
1026                         JFFS2_NOTICE("Node header CRC failed at %#08x. {%04x,%04x,%08x,%08x}\n",
1027                                      ref_offset(ref), je16_to_cpu(node->u.magic),
1028                                      je16_to_cpu(node->u.nodetype),
1029                                      je32_to_cpu(node->u.totlen),
1030                                      je32_to_cpu(node->u.hdr_crc));
1031                         jffs2_dbg_dump_node(c, ref_offset(ref));
1032                         jffs2_mark_node_obsolete(c, ref);
1033                         goto cont;
1034                 }
1035                 if (je16_to_cpu(node->u.magic) != JFFS2_MAGIC_BITMASK) {
1036                         /* Not a JFFS2 node, whinge and move on */
1037                         JFFS2_NOTICE("Wrong magic bitmask 0x%04x in node header at %#08x.\n",
1038                                      je16_to_cpu(node->u.magic), ref_offset(ref));
1039                         jffs2_mark_node_obsolete(c, ref);
1040                         goto cont;
1041                 }
1042
1043                 switch (je16_to_cpu(node->u.nodetype)) {
1044
1045                 case JFFS2_NODETYPE_DIRENT:
1046
1047                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent) &&
1048                             len < sizeof(struct jffs2_raw_dirent)) {
1049                                 err = read_more(c, ref, sizeof(struct jffs2_raw_dirent), &len, buf);
1050                                 if (unlikely(err))
1051                                         goto free_out;
1052                         }
1053
1054                         err = read_direntry(c, ref, &node->d, retlen, rii);
1055                         if (unlikely(err))
1056                                 goto free_out;
1057
1058                         break;
1059
1060                 case JFFS2_NODETYPE_INODE:
1061
1062                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode) &&
1063                             len < sizeof(struct jffs2_raw_inode)) {
1064                                 err = read_more(c, ref, sizeof(struct jffs2_raw_inode), &len, buf);
1065                                 if (unlikely(err))
1066                                         goto free_out;
1067                         }
1068
1069                         err = read_dnode(c, ref, &node->i, len, rii);
1070                         if (unlikely(err))
1071                                 goto free_out;
1072
1073                         break;
1074
1075                 default:
1076                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node) &&
1077                             len < sizeof(struct jffs2_unknown_node)) {
1078                                 err = read_more(c, ref, sizeof(struct jffs2_unknown_node), &len, buf);
1079                                 if (unlikely(err))
1080                                         goto free_out;
1081                         }
1082
1083                         err = read_unknown(c, ref, &node->u);
1084                         if (err == 1) {
1085                                 jffs2_mark_node_obsolete(c, ref);
1086                                 break;
1087                         } else if (unlikely(err))
1088                                 goto free_out;
1089
1090                 }
1091         cont:
1092                 spin_lock(&c->erase_completion_lock);
1093         }
1094
1095         spin_unlock(&c->erase_completion_lock);
1096         kfree(buf);
1097
1098         f->highest_version = rii->highest_version;
1099
1100         dbg_readinode("nodes of inode #%u were read, the highest version is %u, latest_mctime %u, mctime_ver %u.\n",
1101                       f->inocache->ino, rii->highest_version, rii->latest_mctime,
1102                       rii->mctime_ver);
1103         return 0;
1104
1105  free_out:
1106         jffs2_free_tmp_dnode_info_list(&rii->tn_root);
1107         jffs2_free_full_dirent_list(rii->fds);
1108         rii->fds = NULL;
1109         kfree(buf);
1110         return err;
1111 }
1112
1113 static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
1114                                         struct jffs2_inode_info *f,
1115                                         struct jffs2_raw_inode *latest_node)
1116 {
1117         struct jffs2_readinode_info rii;
1118         uint32_t crc, new_size;
1119         size_t retlen;
1120         int ret;
1121
1122         dbg_readinode("ino #%u nlink is %d\n", f->inocache->ino, f->inocache->nlink);
1123
1124         memset(&rii, 0, sizeof(rii));
1125
1126         /* Grab all nodes relevant to this ino */
1127         ret = jffs2_get_inode_nodes(c, f, &rii);
1128
1129         if (ret) {
1130                 JFFS2_ERROR("cannot read nodes for ino %u, returned error is %d\n", f->inocache->ino, ret);
1131                 if (f->inocache->state == INO_STATE_READING)
1132                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1133                 return ret;
1134         }
1135
1136         ret = jffs2_build_inode_fragtree(c, f, &rii);
1137         if (ret) {
1138                 JFFS2_ERROR("Failed to build final fragtree for inode #%u: error %d\n",
1139                             f->inocache->ino, ret);
1140                 if (f->inocache->state == INO_STATE_READING)
1141                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1142                 jffs2_free_tmp_dnode_info_list(&rii.tn_root);
1143                 /* FIXME: We could at least crc-check them all */
1144                 if (rii.mdata_tn) {
1145                         jffs2_free_full_dnode(rii.mdata_tn->fn);
1146                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1147                         rii.mdata_tn = NULL;
1148                 }
1149                 return ret;
1150         }
1151
1152         if (rii.mdata_tn) {
1153                 if (rii.mdata_tn->fn->raw == rii.latest_ref) {
1154                         f->metadata = rii.mdata_tn->fn;
1155                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1156                 } else {
1157                         jffs2_kill_tn(c, rii.mdata_tn);
1158                 }
1159                 rii.mdata_tn = NULL;
1160         }
1161
1162         f->dents = rii.fds;
1163
1164         jffs2_dbg_fragtree_paranoia_check_nolock(f);
1165
1166         if (unlikely(!rii.latest_ref)) {
1167                 /* No data nodes for this inode. */
1168                 if (f->inocache->ino != 1) {
1169                         JFFS2_WARNING("no data nodes found for ino #%u\n", f->inocache->ino);
1170                         if (!rii.fds) {
1171                                 if (f->inocache->state == INO_STATE_READING)
1172                                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1173                                 return -EIO;
1174                         }
1175                         JFFS2_NOTICE("but it has children so we fake some modes for it\n");
1176                 }
1177                 latest_node->mode = cpu_to_jemode(S_IFDIR|S_IRUGO|S_IWUSR|S_IXUGO);
1178                 latest_node->version = cpu_to_je32(0);
1179                 latest_node->atime = latest_node->ctime = latest_node->mtime = cpu_to_je32(0);
1180                 latest_node->isize = cpu_to_je32(0);
1181                 latest_node->gid = cpu_to_je16(0);
1182                 latest_node->uid = cpu_to_je16(0);
1183                 if (f->inocache->state == INO_STATE_READING)
1184                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1185                 return 0;
1186         }
1187
1188         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref), sizeof(*latest_node), &retlen, (void *)latest_node);
1189         if (ret || retlen != sizeof(*latest_node)) {
1190                 JFFS2_ERROR("failed to read from flash: error %d, %zd of %zd bytes read\n",
1191                         ret, retlen, sizeof(*latest_node));
1192                 /* FIXME: If this fails, there seems to be a memory leak. Find it. */
1193                 up(&f->sem);
1194                 jffs2_do_clear_inode(c, f);
1195                 return ret?ret:-EIO;
1196         }
1197
1198         crc = crc32(0, latest_node, sizeof(*latest_node)-8);
1199         if (crc != je32_to_cpu(latest_node->node_crc)) {
1200                 JFFS2_ERROR("CRC failed for read_inode of inode %u at physical location 0x%x\n",
1201                         f->inocache->ino, ref_offset(rii.latest_ref));
1202                 up(&f->sem);
1203                 jffs2_do_clear_inode(c, f);
1204                 return -EIO;
1205         }
1206
1207         switch(jemode_to_cpu(latest_node->mode) & S_IFMT) {
1208         case S_IFDIR:
1209                 if (rii.mctime_ver > je32_to_cpu(latest_node->version)) {
1210                         /* The times in the latest_node are actually older than
1211                            mctime in the latest dirent. Cheat. */
1212                         latest_node->ctime = latest_node->mtime = cpu_to_je32(rii.latest_mctime);
1213                 }
1214                 break;
1215
1216
1217         case S_IFREG:
1218                 /* If it was a regular file, truncate it to the latest node's isize */
1219                 new_size = jffs2_truncate_fragtree(c, &f->fragtree, je32_to_cpu(latest_node->isize));
1220                 if (new_size != je32_to_cpu(latest_node->isize)) {
1221                         JFFS2_WARNING("Truncating ino #%u to %d bytes failed because it only had %d bytes to start with!\n",
1222                                       f->inocache->ino, je32_to_cpu(latest_node->isize), new_size);
1223                         latest_node->isize = cpu_to_je32(new_size);
1224                 }
1225                 break;
1226
1227         case S_IFLNK:
1228                 /* Hack to work around broken isize in old symlink code.
1229                    Remove this when dwmw2 comes to his senses and stops
1230                    symlinks from being an entirely gratuitous special
1231                    case. */
1232                 if (!je32_to_cpu(latest_node->isize))
1233                         latest_node->isize = latest_node->dsize;
1234
1235                 if (f->inocache->state != INO_STATE_CHECKING) {
1236                         /* Symlink's inode data is the target path. Read it and
1237                          * keep in RAM to facilitate quick follow symlink
1238                          * operation. */
1239                         f->target = kmalloc(je32_to_cpu(latest_node->csize) + 1, GFP_KERNEL);
1240                         if (!f->target) {
1241                                 JFFS2_ERROR("can't allocate %d bytes of memory for the symlink target path cache\n", je32_to_cpu(latest_node->csize));
1242                                 up(&f->sem);
1243                                 jffs2_do_clear_inode(c, f);
1244                                 return -ENOMEM;
1245                         }
1246
1247                         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref) + sizeof(*latest_node),
1248                                                 je32_to_cpu(latest_node->csize), &retlen, (char *)f->target);
1249
1250                         if (ret  || retlen != je32_to_cpu(latest_node->csize)) {
1251                                 if (retlen != je32_to_cpu(latest_node->csize))
1252                                         ret = -EIO;
1253                                 kfree(f->target);
1254                                 f->target = NULL;
1255                                 up(&f->sem);
1256                                 jffs2_do_clear_inode(c, f);
1257                                 return -ret;
1258                         }
1259
1260                         f->target[je32_to_cpu(latest_node->csize)] = '\0';
1261                         dbg_readinode("symlink's target '%s' cached\n", f->target);
1262                 }
1263
1264                 /* fall through... */
1265
1266         case S_IFBLK:
1267         case S_IFCHR:
1268                 /* Certain inode types should have only one data node, and it's
1269                    kept as the metadata node */
1270                 if (f->metadata) {
1271                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o had metadata node\n",
1272                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1273                         up(&f->sem);
1274                         jffs2_do_clear_inode(c, f);
1275                         return -EIO;
1276                 }
1277                 if (!frag_first(&f->fragtree)) {
1278                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o has no fragments\n",
1279                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1280                         up(&f->sem);
1281                         jffs2_do_clear_inode(c, f);
1282                         return -EIO;
1283                 }
1284                 /* ASSERT: f->fraglist != NULL */
1285                 if (frag_next(frag_first(&f->fragtree))) {
1286                         JFFS2_ERROR("Argh. Special inode #%u with mode 0x%x had more than one node\n",
1287                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1288                         /* FIXME: Deal with it - check crc32, check for duplicate node, check times and discard the older one */
1289                         up(&f->sem);
1290                         jffs2_do_clear_inode(c, f);
1291                         return -EIO;
1292                 }
1293                 /* OK. We're happy */
1294                 f->metadata = frag_first(&f->fragtree)->node;
1295                 jffs2_free_node_frag(frag_first(&f->fragtree));
1296                 f->fragtree = RB_ROOT;
1297                 break;
1298         }
1299         if (f->inocache->state == INO_STATE_READING)
1300                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1301
1302         return 0;
1303 }
1304
1305 /* Scan the list of all nodes present for this ino, build map of versions, etc. */
1306 int jffs2_do_read_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
1307                         uint32_t ino, struct jffs2_raw_inode *latest_node)
1308 {
1309         dbg_readinode("read inode #%u\n", ino);
1310
1311  retry_inocache:
1312         spin_lock(&c->inocache_lock);
1313         f->inocache = jffs2_get_ino_cache(c, ino);
1314
1315         if (f->inocache) {
1316                 /* Check its state. We may need to wait before we can use it */
1317                 switch(f->inocache->state) {
1318                 case INO_STATE_UNCHECKED:
1319                 case INO_STATE_CHECKEDABSENT:
1320                         f->inocache->state = INO_STATE_READING;
1321                         break;
1322
1323                 case INO_STATE_CHECKING:
1324                 case INO_STATE_GC:
1325                         /* If it's in either of these states, we need
1326                            to wait for whoever's got it to finish and
1327                            put it back. */
1328                         dbg_readinode("waiting for ino #%u in state %d\n", ino, f->inocache->state);
1329                         sleep_on_spinunlock(&c->inocache_wq, &c->inocache_lock);
1330                         goto retry_inocache;
1331
1332                 case INO_STATE_READING:
1333                 case INO_STATE_PRESENT:
1334                         /* Eep. This should never happen. It can
1335                         happen if Linux calls read_inode() again
1336                         before clear_inode() has finished though. */
1337                         JFFS2_ERROR("Eep. Trying to read_inode #%u when it's already in state %d!\n", ino, f->inocache->state);
1338                         /* Fail. That's probably better than allowing it to succeed */
1339                         f->inocache = NULL;
1340                         break;
1341
1342                 default:
1343                         BUG();
1344                 }
1345         }
1346         spin_unlock(&c->inocache_lock);
1347
1348         if (!f->inocache && ino == 1) {
1349                 /* Special case - no root inode on medium */
1350                 f->inocache = jffs2_alloc_inode_cache();
1351                 if (!f->inocache) {
1352                         JFFS2_ERROR("cannot allocate inocache for root inode\n");
1353                         return -ENOMEM;
1354                 }
1355                 dbg_readinode("creating inocache for root inode\n");
1356                 memset(f->inocache, 0, sizeof(struct jffs2_inode_cache));
1357                 f->inocache->ino = f->inocache->nlink = 1;
1358                 f->inocache->nodes = (struct jffs2_raw_node_ref *)f->inocache;
1359                 f->inocache->state = INO_STATE_READING;
1360                 jffs2_add_ino_cache(c, f->inocache);
1361         }
1362         if (!f->inocache) {
1363                 JFFS2_ERROR("requestied to read an nonexistent ino %u\n", ino);
1364                 return -ENOENT;
1365         }
1366
1367         return jffs2_do_read_inode_internal(c, f, latest_node);
1368 }
1369
1370 int jffs2_do_crccheck_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
1371 {
1372         struct jffs2_raw_inode n;
1373         struct jffs2_inode_info *f = kzalloc(sizeof(*f), GFP_KERNEL);
1374         int ret;
1375
1376         if (!f)
1377                 return -ENOMEM;
1378
1379         init_MUTEX_LOCKED(&f->sem);
1380         f->inocache = ic;
1381
1382         ret = jffs2_do_read_inode_internal(c, f, &n);
1383         if (!ret) {
1384                 up(&f->sem);
1385                 jffs2_do_clear_inode(c, f);
1386         }
1387         kfree (f);
1388         return ret;
1389 }
1390
1391 void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
1392 {
1393         struct jffs2_full_dirent *fd, *fds;
1394         int deleted;
1395
1396         jffs2_clear_acl(f);
1397         jffs2_xattr_delete_inode(c, f->inocache);
1398         down(&f->sem);
1399         deleted = f->inocache && !f->inocache->nlink;
1400
1401         if (f->inocache && f->inocache->state != INO_STATE_CHECKING)
1402                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CLEARING);
1403
1404         if (f->metadata) {
1405                 if (deleted)
1406                         jffs2_mark_node_obsolete(c, f->metadata->raw);
1407                 jffs2_free_full_dnode(f->metadata);
1408         }
1409
1410         jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
1411
1412         if (f->target) {
1413                 kfree(f->target);
1414                 f->target = NULL;
1415         }
1416
1417         fds = f->dents;
1418         while(fds) {
1419                 fd = fds;
1420                 fds = fd->next;
1421                 jffs2_free_full_dirent(fd);
1422         }
1423
1424         if (f->inocache && f->inocache->state != INO_STATE_CHECKING) {
1425                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1426                 if (f->inocache->nodes == (void *)f->inocache)
1427                         jffs2_del_ino_cache(c, f->inocache);
1428         }
1429
1430         up(&f->sem);
1431 }