fs/jffs2/readinode.c

   1 /*
   2  * JFFS2 -- Journalling Flash File System, Version 2.
   3  *
   4  * Copyright © 2001-2007 Red Hat, Inc.
   5  *
   6  * Created by David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * For licensing information, see the file 'LICENCE' in this directory.
   9  *
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/sched.h>
  14 #include <linux/slab.h>
  15 #include <linux/fs.h>
  16 #include <linux/crc32.h>
  17 #include <linux/pagemap.h>
  18 #include <linux/mtd/mtd.h>
  19 #include <linux/compiler.h>
  20 #include "nodelist.h"
  21
  22 /*
  23  * Check the data CRC of the node.
  24  *
  25  * Returns: 0 if the data CRC is correct;
  26  *          1 - if incorrect;
  27  *          error code if an error occured.
  28  */
  29 static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
  30 {
  31         struct jffs2_raw_node_ref *ref = tn->fn->raw;
  32         int err = 0, pointed = 0;
  33         struct jffs2_eraseblock *jeb;
  34         unsigned char *buffer;
  35         uint32_t crc, ofs, len;
  36         size_t retlen;
  37
  38         BUG_ON(tn->csize == 0);
  39
  40         if (!jffs2_is_writebuffered(c))
  41                 goto adj_acc;
  42
  43         /* Calculate how many bytes were already checked */
  44         ofs = ref_offset(ref) + sizeof(struct jffs2_raw_inode);
  45         len = ofs % c->wbuf_pagesize;
  46         if (likely(len))
  47                 len = c->wbuf_pagesize - len;
  48
  49         if (len >= tn->csize) {
  50                 dbg_readinode("no need to check node at %#08x, data length %u, data starts at %#08x - it has already been checked.\n",
  51                         ref_offset(ref), tn->csize, ofs);
  52                 goto adj_acc;
  53         }
  54
  55         ofs += len;
  56         len = tn->csize - len;
  57
  58         dbg_readinode("check node at %#08x, data length %u, partial CRC %#08x, correct CRC %#08x, data starts at %#08x, start checking from %#08x - %u bytes.\n",
  59                 ref_offset(ref), tn->csize, tn->partial_crc, tn->data_crc, ofs - len, ofs, len);
  60
  61 #ifndef __ECOS
  62         /* TODO: instead, incapsulate point() stuff to jffs2_flash_read(),
  63          * adding and jffs2_flash_read_end() interface. */
  64         if (c->mtd->point) {
  65                 err = c->mtd->point(c->mtd, ofs, len, &retlen, &buffer);
  66                 if (!err && retlen < tn->csize) {
  67                         JFFS2_WARNING("MTD point returned len too short: %zu instead of %u.\n", retlen, tn->csize);
  68                         c->mtd->unpoint(c->mtd, buffer, ofs, retlen);
  69                 } else if (err)
  70                         JFFS2_WARNING("MTD point failed: error code %d.\n", err);
  71                 else
  72                         pointed = 1; /* succefully pointed to device */
  73         }
  74 #endif
  75
  76         if (!pointed) {
  77                 buffer = kmalloc(len, GFP_KERNEL);
  78                 if (unlikely(!buffer))
  79                         return -ENOMEM;
  80
  81                 /* TODO: this is very frequent pattern, make it a separate
  82                  * routine */
  83                 err = jffs2_flash_read(c, ofs, len, &retlen, buffer);
  84                 if (err) {
  85                         JFFS2_ERROR("can not read %d bytes from 0x%08x, error code: %d.\n", len, ofs, err);
  86                         goto free_out;
  87                 }
  88
  89                 if (retlen != len) {
  90                         JFFS2_ERROR("short read at %#08x: %zd instead of %d.\n", ofs, retlen, len);
  91                         err = -EIO;
  92                         goto free_out;
  93                 }
  94         }
  95
  96         /* Continue calculating CRC */
  97         crc = crc32(tn->partial_crc, buffer, len);
  98         if(!pointed)
  99                 kfree(buffer);
 100 #ifndef __ECOS
 101         else
 102                 c->mtd->unpoint(c->mtd, buffer, ofs, len);
 103 #endif
 104
 105         if (crc != tn->data_crc) {
 106                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 107                              ref_offset(ref), tn->data_crc, crc);
 108                 return 1;
 109         }
 110
 111 adj_acc:
 112         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 113         len = ref_totlen(c, jeb, ref);
 114         /* If it should be REF_NORMAL, it'll get marked as such when
 115            we build the fragtree, shortly. No need to worry about GC
 116            moving it while it's marked REF_PRISTINE -- GC won't happen
 117            till we've finished checking every inode anyway. */
 118         ref->flash_offset |= REF_PRISTINE;
 119         /*
 120          * Mark the node as having been checked and fix the
 121          * accounting accordingly.
 122          */
 123         spin_lock(&c->erase_completion_lock);
 124         jeb->used_size += len;
 125         jeb->unchecked_size -= len;
 126         c->used_size += len;
 127         c->unchecked_size -= len;
 128         jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
 129         spin_unlock(&c->erase_completion_lock);
 130
 131         return 0;
 132
 133 free_out:
 134         if(!pointed)
 135                 kfree(buffer);
 136 #ifndef __ECOS
 137         else
 138                 c->mtd->unpoint(c->mtd, buffer, ofs, len);
 139 #endif
 140         return err;
 141 }
 142
 143 /*
 144  * Helper function for jffs2_add_older_frag_to_fragtree().
 145  *
 146  * Checks the node if we are in the checking stage.
 147  */
 148 static int check_tn_node(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 149 {
 150         int ret;
 151
 152         BUG_ON(ref_obsolete(tn->fn->raw));
 153
 154         /* We only check the data CRC of unchecked nodes */
 155         if (ref_flags(tn->fn->raw) != REF_UNCHECKED)
 156                 return 0;
 157
 158         dbg_readinode("check node %#04x-%#04x, phys offs %#08x\n",
 159                       tn->fn->ofs, tn->fn->ofs + tn->fn->size, ref_offset(tn->fn->raw));
 160
 161         ret = check_node_data(c, tn);
 162         if (unlikely(ret < 0)) {
 163                 JFFS2_ERROR("check_node_data() returned error: %d.\n",
 164                         ret);
 165         } else if (unlikely(ret > 0)) {
 166                 dbg_readinode("CRC error, mark it obsolete.\n");
 167                 jffs2_mark_node_obsolete(c, tn->fn->raw);
 168         }
 169
 170         return ret;
 171 }
 172
 173 static struct jffs2_tmp_dnode_info *jffs2_lookup_tn(struct rb_root *tn_root, uint32_t offset)
 174 {
 175         struct rb_node *next;
 176         struct jffs2_tmp_dnode_info *tn = NULL;
 177
 178         dbg_readinode("root %p, offset %d\n", tn_root, offset);
 179
 180         next = tn_root->rb_node;
 181
 182         while (next) {
 183                 tn = rb_entry(next, struct jffs2_tmp_dnode_info, rb);
 184
 185                 if (tn->fn->ofs < offset)
 186                         next = tn->rb.rb_right;
 187                 else if (tn->fn->ofs >= offset)
 188                         next = tn->rb.rb_left;
 189                 else
 190                         break;
 191         }
 192
 193         return tn;
 194 }
 195
 196
 197 static void jffs2_kill_tn(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 198 {
 199         jffs2_mark_node_obsolete(c, tn->fn->raw);
 200         jffs2_free_full_dnode(tn->fn);
 201         jffs2_free_tmp_dnode_info(tn);
 202 }
 203 /*
 204  * This function is used when we read an inode. Data nodes arrive in
 205  * arbitrary order -- they may be older or newer than the nodes which
 206  * are already in the tree. Where overlaps occur, the older node can
 207  * be discarded as long as the newer passes the CRC check. We don't
 208  * bother to keep track of holes in this rbtree, and neither do we deal
 209  * with frags -- we can have multiple entries starting at the same
 210  * offset, and the one with the smallest length will come first in the
 211  * ordering.
 212  *
 213  * Returns 0 if the node was handled (including marking it obsolete)
 214  *       < 0 an if error occurred
 215  */
 216 static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
 217                                 struct jffs2_readinode_info *rii,
 218                                 struct jffs2_tmp_dnode_info *tn)
 219 {
 220         uint32_t fn_end = tn->fn->ofs + tn->fn->size;
 221         struct jffs2_tmp_dnode_info *this;
 222
 223         dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
 224
 225         /* If a node has zero dsize, we only have to keep if it if it might be the
 226            node with highest version -- i.e. the one which will end up as f->metadata.
 227            Note that such nodes won't be REF_UNCHECKED since there are no data to
 228            check anyway. */
 229         if (!tn->fn->size) {
 230                 if (rii->mdata_tn) {
 231                         if (rii->mdata_tn->version < tn->version) {
 232                                 /* We had a candidate mdata node already */
 233                                 dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
 234                                 jffs2_kill_tn(c, rii->mdata_tn);
 235                         } else {
 236                                 dbg_readinode("kill new mdata with ver %d (older than existing %d\n",
 237                                               tn->version, rii->mdata_tn->version);
 238                                 jffs2_kill_tn(c, tn);
 239                                 return 0;
 240                         }
 241                 }
 242                 rii->mdata_tn = tn;
 243                 dbg_readinode("keep new mdata with ver %d\n", tn->version);
 244                 return 0;
 245         }
 246
 247         /* Find the earliest node which _may_ be relevant to this one */
 248         this = jffs2_lookup_tn(&rii->tn_root, tn->fn->ofs);
 249         if (this) {
 250                 /* If the node is coincident with another at a lower address,
 251                    back up until the other node is found. It may be relevant */
 252                 while (this->overlapped)
 253                         this = tn_prev(this);
 254
 255                 /* First node should never be marked overlapped */
 256                 BUG_ON(!this);
 257                 dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
 258         }
 259
 260         while (this) {
 261                 if (this->fn->ofs > fn_end)
 262                         break;
 263                 dbg_readinode("Ponder this ver %d, 0x%x-0x%x\n",
 264                               this->version, this->fn->ofs, this->fn->size);
 265
 266                 if (this->version == tn->version) {
 267                         /* Version number collision means REF_PRISTINE GC. Accept either of them
 268                            as long as the CRC is correct. Check the one we have already...  */
 269                         if (!check_tn_node(c, this)) {
 270                                 /* The one we already had was OK. Keep it and throw away the new one */
 271                                 dbg_readinode("Like old node. Throw away new\n");
 272                                 jffs2_kill_tn(c, tn);
 273                                 return 0;
 274                         } else {
 275                                 /* Who cares if the new one is good; keep it for now anyway. */
 276                                 dbg_readinode("Like new node. Throw away old\n");
 277                                 rb_replace_node(&this->rb, &tn->rb, &rii->tn_root);
 278                                 jffs2_kill_tn(c, this);
 279                                 /* Same overlapping from in front and behind */
 280                                 return 0;
 281                         }
 282                 }
 283                 if (this->version < tn->version &&
 284                     this->fn->ofs >= tn->fn->ofs &&
 285                     this->fn->ofs + this->fn->size <= fn_end) {
 286                         /* New node entirely overlaps 'this' */
 287                         if (check_tn_node(c, tn)) {
 288                                 dbg_readinode("new node bad CRC\n");
 289                                 jffs2_kill_tn(c, tn);
 290                                 return 0;
 291                         }
 292                         /* ... and is good. Kill 'this' and any subsequent nodes which are also overlapped */
 293                         while (this && this->fn->ofs + this->fn->size <= fn_end) {
 294                                 struct jffs2_tmp_dnode_info *next = tn_next(this);
 295                                 if (this->version < tn->version) {
 296                                         tn_erase(this, &rii->tn_root);
 297                                         dbg_readinode("Kill overlapped ver %d, 0x%x-0x%x\n",
 298                                                       this->version, this->fn->ofs,
 299                                                       this->fn->ofs+this->fn->size);
 300                                         jffs2_kill_tn(c, this);
 301                                 }
 302                                 this = next;
 303                         }
 304                         dbg_readinode("Done killing overlapped nodes\n");
 305                         continue;
 306                 }
 307                 if (this->version > tn->version &&
 308                     this->fn->ofs <= tn->fn->ofs &&
 309                     this->fn->ofs+this->fn->size >= fn_end) {
 310                         /* New node entirely overlapped by 'this' */
 311                         if (!check_tn_node(c, this)) {
 312                                 dbg_readinode("Good CRC on old node. Kill new\n");
 313                                 jffs2_kill_tn(c, tn);
 314                                 return 0;
 315                         }
 316                         /* ... but 'this' was bad. Replace it... */
 317                         dbg_readinode("Bad CRC on old overlapping node. Kill it\n");
 318                         tn_erase(this, &rii->tn_root);
 319                         jffs2_kill_tn(c, this);
 320                         break;
 321                 }
 322
 323                 this = tn_next(this);
 324         }
 325
 326         /* We neither completely obsoleted nor were completely
 327            obsoleted by an earlier node. Insert into the tree */
 328         {
 329                 struct rb_node *parent;
 330                 struct rb_node **link = &rii->tn_root.rb_node;
 331                 struct jffs2_tmp_dnode_info *insert_point = NULL;
 332
 333                 while (*link) {
 334                         parent = *link;
 335                         insert_point = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 336                         if (tn->fn->ofs > insert_point->fn->ofs)
 337                                 link = &insert_point->rb.rb_right;
 338                         else if (tn->fn->ofs < insert_point->fn->ofs ||
 339                                  tn->fn->size < insert_point->fn->size)
 340                                 link = &insert_point->rb.rb_left;
 341                         else
 342                                 link = &insert_point->rb.rb_right;
 343                 }
 344                 rb_link_node(&tn->rb, &insert_point->rb, link);
 345                 rb_insert_color(&tn->rb, &rii->tn_root);
 346         }
 347
 348         /* If there's anything behind that overlaps us, note it */
 349         this = tn_prev(tn);
 350         if (this) {
 351                 while (1) {
 352                         if (this->fn->ofs + this->fn->size > tn->fn->ofs) {
 353                                 dbg_readinode("Node is overlapped by %p (v %d, 0x%x-0x%x)\n",
 354                                               this, this->version, this->fn->ofs,
 355                                               this->fn->ofs+this->fn->size);
 356                                 tn->overlapped = 1;
 357                                 break;
 358                         }
 359                         if (!this->overlapped)
 360                                 break;
 361                         this = tn_prev(this);
 362                 }
 363         }
 364
 365         /* If the new node overlaps anything ahead, note it */
 366         this = tn_next(tn);
 367         while (this && this->fn->ofs < fn_end) {
 368                 this->overlapped = 1;
 369                 dbg_readinode("Node ver %d, 0x%x-0x%x is overlapped\n",
 370                               this->version, this->fn->ofs,
 371                               this->fn->ofs+this->fn->size);
 372                 this = tn_next(this);
 373         }
 374         return 0;
 375 }
 376
 377 /* Trivial function to remove the last node in the tree. Which by definition
 378    has no right-hand -- so can be removed just by making its only child (if
 379    any) take its place under its parent. */
 380 static void eat_last(struct rb_root *root, struct rb_node *node)
 381 {
 382         struct rb_node *parent = rb_parent(node);
 383         struct rb_node **link;
 384
 385         /* LAST! */
 386         BUG_ON(node->rb_right);
 387
 388         if (!parent)
 389                 link = &root->rb_node;
 390         else if (node == parent->rb_left)
 391                 link = &parent->rb_left;
 392         else
 393                 link = &parent->rb_right;
 394
 395         *link = node->rb_left;
 396         /* Colour doesn't matter now. Only the parent pointer. */
 397         if (node->rb_left)
 398                 node->rb_left->rb_parent_color = node->rb_parent_color;
 399 }
 400
 401 /* We put this in reverse order, so we can just use eat_last */
 402 static void ver_insert(struct rb_root *ver_root, struct jffs2_tmp_dnode_info *tn)
 403 {
 404         struct rb_node **link = &ver_root->rb_node;
 405         struct rb_node *parent = NULL;
 406         struct jffs2_tmp_dnode_info *this_tn;
 407
 408         while (*link) {
 409                 parent = *link;
 410                 this_tn = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 411
 412                 if (tn->version > this_tn->version)
 413                         link = &parent->rb_left;
 414                 else
 415                         link = &parent->rb_right;
 416         }
 417         dbg_readinode("Link new node at %p (root is %p)\n", link, ver_root);
 418         rb_link_node(&tn->rb, parent, link);
 419         rb_insert_color(&tn->rb, ver_root);
 420 }
 421
 422 /* Build final, normal fragtree from tn tree. It doesn't matter which order
 423    we add nodes to the real fragtree, as long as they don't overlap. And
 424    having thrown away the majority of overlapped nodes as we went, there
 425    really shouldn't be many sets of nodes which do overlap. If we start at
 426    the end, we can use the overlap markers -- we can just eat nodes which
 427    aren't overlapped, and when we encounter nodes which _do_ overlap we
 428    sort them all into a temporary tree in version order before replaying them. */
 429 static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
 430                                       struct jffs2_inode_info *f,
 431                                       struct jffs2_readinode_info *rii)
 432 {
 433         struct jffs2_tmp_dnode_info *pen, *last, *this;
 434         struct rb_root ver_root = RB_ROOT;
 435         uint32_t high_ver = 0;
 436
 437         if (rii->mdata_tn) {
 438                 dbg_readinode("potential mdata is ver %d at %p\n", rii->mdata_tn->version, rii->mdata_tn);
 439                 high_ver = rii->mdata_tn->version;
 440                 rii->latest_ref = rii->mdata_tn->fn->raw;
 441         }
 442 #ifdef JFFS2_DBG_READINODE_MESSAGES
 443         this = tn_last(&rii->tn_root);
 444         while (this) {
 445                 dbg_readinode("tn %p ver %d range 0x%x-0x%x ov %d\n", this, this->version, this->fn->ofs,
 446                               this->fn->ofs+this->fn->size, this->overlapped);
 447                 this = tn_prev(this);
 448         }
 449 #endif
 450         pen = tn_last(&rii->tn_root);
 451         while ((last = pen)) {
 452                 pen = tn_prev(last);
 453
 454                 eat_last(&rii->tn_root, &last->rb);
 455                 ver_insert(&ver_root, last);
 456
 457                 if (unlikely(last->overlapped))
 458                         continue;
 459
 460                 /* Now we have a bunch of nodes in reverse version
 461                    order, in the tree at ver_root. Most of the time,
 462                    there'll actually be only one node in the 'tree',
 463                    in fact. */
 464                 this = tn_last(&ver_root);
 465
 466                 while (this) {
 467                         struct jffs2_tmp_dnode_info *vers_next;
 468                         int ret;
 469                         vers_next = tn_prev(this);
 470                         eat_last(&ver_root, &this->rb);
 471                         if (check_tn_node(c, this)) {
 472                                 dbg_readinode("node ver %d, 0x%x-0x%x failed CRC\n",
 473                                              this->version, this->fn->ofs,
 474                                              this->fn->ofs+this->fn->size);
 475                                 jffs2_kill_tn(c, this);
 476                         } else {
 477                                 if (this->version > high_ver) {
 478                                         /* Note that this is different from the other
 479                                            highest_version, because this one is only
 480                                            counting _valid_ nodes which could give the
 481                                            latest inode metadata */
 482                                         high_ver = this->version;
 483                                         rii->latest_ref = this->fn->raw;
 484                                 }
 485                                 dbg_readinode("Add %p (v %d, 0x%x-0x%x, ov %d) to fragtree\n",
 486                                              this, this->version, this->fn->ofs,
 487                                              this->fn->ofs+this->fn->size, this->overlapped);
 488
 489                                 ret = jffs2_add_full_dnode_to_inode(c, f, this->fn);
 490                                 if (ret) {
 491                                         /* Free the nodes in vers_root; let the caller
 492                                            deal with the rest */
 493                                         JFFS2_ERROR("Add node to tree failed %d\n", ret);
 494                                         while (1) {
 495                                                 vers_next = tn_prev(this);
 496                                                 if (check_tn_node(c, this))
 497                                                         jffs2_mark_node_obsolete(c, this->fn->raw);
 498                                                 jffs2_free_full_dnode(this->fn);
 499                                                 jffs2_free_tmp_dnode_info(this);
 500                                                 this = vers_next;
 501                                                 if (!this)
 502                                                         break;
 503                                                 eat_last(&ver_root, &vers_next->rb);
 504                                         }
 505                                         return ret;
 506                                 }
 507                                 jffs2_free_tmp_dnode_info(this);
 508                         }
 509                         this = vers_next;
 510                 }
 511         }
 512         return 0;
 513 }
 514
 515 static void jffs2_free_tmp_dnode_info_list(struct rb_root *list)
 516 {
 517         struct rb_node *this;
 518         struct jffs2_tmp_dnode_info *tn;
 519
 520         this = list->rb_node;
 521
 522         /* Now at bottom of tree */
 523         while (this) {
 524                 if (this->rb_left)
 525                         this = this->rb_left;
 526                 else if (this->rb_right)
 527                         this = this->rb_right;
 528                 else {
 529                         tn = rb_entry(this, struct jffs2_tmp_dnode_info, rb);
 530                         jffs2_free_full_dnode(tn->fn);
 531                         jffs2_free_tmp_dnode_info(tn);
 532
 533                         this = rb_parent(this);
 534                         if (!this)
 535                                 break;
 536
 537                         if (this->rb_left == &tn->rb)
 538                                 this->rb_left = NULL;
 539                         else if (this->rb_right == &tn->rb)
 540                                 this->rb_right = NULL;
 541                         else BUG();
 542                 }
 543         }
 544         list->rb_node = NULL;
 545 }
 546
 547 static void jffs2_free_full_dirent_list(struct jffs2_full_dirent *fd)
 548 {
 549         struct jffs2_full_dirent *next;
 550
 551         while (fd) {
 552                 next = fd->next;
 553                 jffs2_free_full_dirent(fd);
 554                 fd = next;
 555         }
 556 }
 557
 558 /* Returns first valid node after 'ref'. May return 'ref' */
 559 static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_ref *ref)
 560 {
 561         while (ref && ref->next_in_ino) {
 562                 if (!ref_obsolete(ref))
 563                         return ref;
 564                 dbg_noderef("node at 0x%08x is obsoleted. Ignoring.\n", ref_offset(ref));
 565                 ref = ref->next_in_ino;
 566         }
 567         return NULL;
 568 }
 569
 570 /*
 571  * Helper function for jffs2_get_inode_nodes().
 572  * It is called every time an directory entry node is found.
 573  *
 574  * Returns: 0 on success;
 575  *          negative error code on failure.
 576  */
 577 static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 578                                 struct jffs2_raw_dirent *rd, size_t read,
 579                                 struct jffs2_readinode_info *rii)
 580 {
 581         struct jffs2_full_dirent *fd;
 582         uint32_t crc;
 583
 584         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 585         BUG_ON(ref_obsolete(ref));
 586
 587         crc = crc32(0, rd, sizeof(*rd) - 8);
 588         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 589                 JFFS2_NOTICE("header CRC failed on dirent node at %#08x: read %#08x, calculated %#08x\n",
 590                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 591                 jffs2_mark_node_obsolete(c, ref);
 592                 return 0;
 593         }
 594
 595         /* If we've never checked the CRCs on this node, check them now */
 596         if (ref_flags(ref) == REF_UNCHECKED) {
 597                 struct jffs2_eraseblock *jeb;
 598                 int len;
 599
 600                 /* Sanity check */
 601                 if (unlikely(PAD((rd->nsize + sizeof(*rd))) != PAD(je32_to_cpu(rd->totlen)))) {
 602                         JFFS2_ERROR("illegal nsize in node at %#08x: nsize %#02x, totlen %#04x\n",
 603                                     ref_offset(ref), rd->nsize, je32_to_cpu(rd->totlen));
 604                         jffs2_mark_node_obsolete(c, ref);
 605                         return 0;
 606                 }
 607
 608                 jeb = &c->blocks[ref->flash_offset / c->sector_size];
 609                 len = ref_totlen(c, jeb, ref);
 610
 611                 spin_lock(&c->erase_completion_lock);
 612                 jeb->used_size += len;
 613                 jeb->unchecked_size -= len;
 614                 c->used_size += len;
 615                 c->unchecked_size -= len;
 616                 ref->flash_offset = ref_offset(ref) | dirent_node_state(rd);
 617                 spin_unlock(&c->erase_completion_lock);
 618         }
 619
 620         fd = jffs2_alloc_full_dirent(rd->nsize + 1);
 621         if (unlikely(!fd))
 622                 return -ENOMEM;
 623
 624         fd->raw = ref;
 625         fd->version = je32_to_cpu(rd->version);
 626         fd->ino = je32_to_cpu(rd->ino);
 627         fd->type = rd->type;
 628
 629         if (fd->version > rii->highest_version)
 630                 rii->highest_version = fd->version;
 631
 632         /* Pick out the mctime of the latest dirent */
 633         if(fd->version > rii->mctime_ver && je32_to_cpu(rd->mctime)) {
 634                 rii->mctime_ver = fd->version;
 635                 rii->latest_mctime = je32_to_cpu(rd->mctime);
 636         }
 637
 638         /*
 639          * Copy as much of the name as possible from the raw
 640          * dirent we've already read from the flash.
 641          */
 642         if (read > sizeof(*rd))
 643                 memcpy(&fd->name[0], &rd->name[0],
 644                        min_t(uint32_t, rd->nsize, (read - sizeof(*rd)) ));
 645
 646         /* Do we need to copy any more of the name directly from the flash? */
 647         if (rd->nsize + sizeof(*rd) > read) {
 648                 /* FIXME: point() */
 649                 int err;
 650                 int already = read - sizeof(*rd);
 651
 652                 err = jffs2_flash_read(c, (ref_offset(ref)) + read,
 653                                 rd->nsize - already, &read, &fd->name[already]);
 654                 if (unlikely(read != rd->nsize - already) && likely(!err))
 655                         return -EIO;
 656
 657                 if (unlikely(err)) {
 658                         JFFS2_ERROR("read remainder of name: error %d\n", err);
 659                         jffs2_free_full_dirent(fd);
 660                         return -EIO;
 661                 }
 662         }
 663
 664         fd->nhash = full_name_hash(fd->name, rd->nsize);
 665         fd->next = NULL;
 666         fd->name[rd->nsize] = '\0';
 667
 668         /*
 669          * Wheee. We now have a complete jffs2_full_dirent structure, with
 670          * the name in it and everything. Link it into the list
 671          */
 672         jffs2_add_fd_to_list(c, fd, &rii->fds);
 673
 674         return 0;
 675 }
 676
 677 /*
 678  * Helper function for jffs2_get_inode_nodes().
 679  * It is called every time an inode node is found.
 680  *
 681  * Returns: 0 on success (possibly after marking a bad node obsolete);
 682  *          negative error code on failure.
 683  */
 684 static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 685                              struct jffs2_raw_inode *rd, int rdlen,
 686                              struct jffs2_readinode_info *rii)
 687 {
 688         struct jffs2_tmp_dnode_info *tn;
 689         uint32_t len, csize;
 690         int ret = 0;
 691         uint32_t crc;
 692
 693         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 694         BUG_ON(ref_obsolete(ref));
 695
 696         crc = crc32(0, rd, sizeof(*rd) - 8);
 697         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 698                 JFFS2_NOTICE("node CRC failed on dnode at %#08x: read %#08x, calculated %#08x\n",
 699                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 700                 jffs2_mark_node_obsolete(c, ref);
 701                 return 0;
 702         }
 703
 704         tn = jffs2_alloc_tmp_dnode_info();
 705         if (!tn) {
 706                 JFFS2_ERROR("failed to allocate tn (%zu bytes).\n", sizeof(*tn));
 707                 return -ENOMEM;
 708         }
 709
 710         tn->partial_crc = 0;
 711         csize = je32_to_cpu(rd->csize);
 712
 713         /* If we've never checked the CRCs on this node, check them now */
 714         if (ref_flags(ref) == REF_UNCHECKED) {
 715
 716                 /* Sanity checks */
 717                 if (unlikely(je32_to_cpu(rd->offset) > je32_to_cpu(rd->isize)) ||
 718                     unlikely(PAD(je32_to_cpu(rd->csize) + sizeof(*rd)) != PAD(je32_to_cpu(rd->totlen)))) {
 719                         JFFS2_WARNING("inode node header CRC is corrupted at %#08x\n", ref_offset(ref));
 720                         jffs2_dbg_dump_node(c, ref_offset(ref));
 721                         jffs2_mark_node_obsolete(c, ref);
 722                         goto free_out;
 723                 }
 724
 725                 if (jffs2_is_writebuffered(c) && csize != 0) {
 726                         /* At this point we are supposed to check the data CRC
 727                          * of our unchecked node. But thus far, we do not
 728                          * know whether the node is valid or obsolete. To
 729                          * figure this out, we need to walk all the nodes of
 730                          * the inode and build the inode fragtree. We don't
 731                          * want to spend time checking data of nodes which may
 732                          * later be found to be obsolete. So we put off the full
 733                          * data CRC checking until we have read all the inode
 734                          * nodes and have started building the fragtree.
 735                          *
 736                          * The fragtree is being built starting with nodes
 737                          * having the highest version number, so we'll be able
 738                          * to detect whether a node is valid (i.e., it is not
 739                          * overlapped by a node with higher version) or not.
 740                          * And we'll be able to check only those nodes, which
 741                          * are not obsolete.
 742                          *
 743                          * Of course, this optimization only makes sense in case
 744                          * of NAND flashes (or other flashes with
 745                          * !jffs2_can_mark_obsolete()), since on NOR flashes
 746                          * nodes are marked obsolete physically.
 747                          *
 748                          * Since NAND flashes (or other flashes with
 749                          * jffs2_is_writebuffered(c)) are anyway read by
 750                          * fractions of c->wbuf_pagesize, and we have just read
 751                          * the node header, it is likely that the starting part
 752                          * of the node data is also read when we read the
 753                          * header. So we don't mind to check the CRC of the
 754                          * starting part of the data of the node now, and check
 755                          * the second part later (in jffs2_check_node_data()).
 756                          * Of course, we will not need to re-read and re-check
 757                          * the NAND page which we have just read. This is why we
 758                          * read the whole NAND page at jffs2_get_inode_nodes(),
 759                          * while we needed only the node header.
 760                          */
 761                         unsigned char *buf;
 762
 763                         /* 'buf' will point to the start of data */
 764                         buf = (unsigned char *)rd + sizeof(*rd);
 765                         /* len will be the read data length */
 766                         len = min_t(uint32_t, rdlen - sizeof(*rd), csize);
 767                         tn->partial_crc = crc32(0, buf, len);
 768
 769                         dbg_readinode("Calculates CRC (%#08x) for %d bytes, csize %d\n", tn->partial_crc, len, csize);
 770
 771                         /* If we actually calculated the whole data CRC
 772                          * and it is wrong, drop the node. */
 773                         if (len >= csize && unlikely(tn->partial_crc != je32_to_cpu(rd->data_crc))) {
 774                                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 775                                         ref_offset(ref), tn->partial_crc, je32_to_cpu(rd->data_crc));
 776                                 jffs2_mark_node_obsolete(c, ref);
 777                                 goto free_out;
 778                         }
 779
 780                 } else if (csize == 0) {
 781                         /*
 782                          * We checked the header CRC. If the node has no data, adjust
 783                          * the space accounting now. For other nodes this will be done
 784                          * later either when the node is marked obsolete or when its
 785                          * data is checked.
 786                          */
 787                         struct jffs2_eraseblock *jeb;
 788
 789                         dbg_readinode("the node has no data.\n");
 790                         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 791                         len = ref_totlen(c, jeb, ref);
 792
 793                         spin_lock(&c->erase_completion_lock);
 794                         jeb->used_size += len;
 795                         jeb->unchecked_size -= len;
 796                         c->used_size += len;
 797                         c->unchecked_size -= len;
 798                         ref->flash_offset = ref_offset(ref) | REF_NORMAL;
 799                         spin_unlock(&c->erase_completion_lock);
 800                 }
 801         }
 802
 803         tn->fn = jffs2_alloc_full_dnode();
 804         if (!tn->fn) {
 805                 JFFS2_ERROR("alloc fn failed\n");
 806                 ret = -ENOMEM;
 807                 goto free_out;
 808         }
 809
 810         tn->version = je32_to_cpu(rd->version);
 811         tn->fn->ofs = je32_to_cpu(rd->offset);
 812         tn->data_crc = je32_to_cpu(rd->data_crc);
 813         tn->csize = csize;
 814         tn->fn->raw = ref;
 815         tn->overlapped = 0;
 816
 817         if (tn->version > rii->highest_version)
 818                 rii->highest_version = tn->version;
 819
 820         /* There was a bug where we wrote hole nodes out with
 821            csize/dsize swapped. Deal with it */
 822         if (rd->compr == JFFS2_COMPR_ZERO && !je32_to_cpu(rd->dsize) && csize)
 823                 tn->fn->size = csize;
 824         else // normal case...
 825                 tn->fn->size = je32_to_cpu(rd->dsize);
 826
 827         dbg_readinode("dnode @%08x: ver %u, offset %#04x, dsize %#04x, csize %#04x\n",
 828                   ref_offset(ref), je32_to_cpu(rd->version), je32_to_cpu(rd->offset), je32_to_cpu(rd->dsize), csize);
 829
 830         ret = jffs2_add_tn_to_tree(c, rii, tn);
 831
 832         if (ret) {
 833                 jffs2_free_full_dnode(tn->fn);
 834         free_out:
 835                 jffs2_free_tmp_dnode_info(tn);
 836                 return ret;
 837         }
 838 #ifdef JFFS2_DBG_READINODE_MESSAGES
 839         dbg_readinode("After adding ver %d:\n", je32_to_cpu(rd->version));
 840         tn = tn_first(&rii->tn_root);
 841         while (tn) {
 842                 dbg_readinode("%p: v %d r 0x%x-0x%x ov %d\n",
 843                              tn, tn->version, tn->fn->ofs,
 844                              tn->fn->ofs+tn->fn->size, tn->overlapped);
 845                 tn = tn_next(tn);
 846         }
 847 #endif
 848         return 0;
 849 }
 850
 851 /*
 852  * Helper function for jffs2_get_inode_nodes().
 853  * It is called every time an unknown node is found.
 854  *
 855  * Returns: 0 on success;
 856  *          negative error code on failure.
 857  */
 858 static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref, struct jffs2_unknown_node *un)
 859 {
 860         /* We don't mark unknown nodes as REF_UNCHECKED */
 861         if (ref_flags(ref) == REF_UNCHECKED) {
 862                 JFFS2_ERROR("REF_UNCHECKED but unknown node at %#08x\n",
 863                             ref_offset(ref));
 864                 JFFS2_ERROR("Node is {%04x,%04x,%08x,%08x}. Please report this error.\n",
 865                             je16_to_cpu(un->magic), je16_to_cpu(un->nodetype),
 866                             je32_to_cpu(un->totlen), je32_to_cpu(un->hdr_crc));
 867                 jffs2_mark_node_obsolete(c, ref);
 868                 return 0;
 869         }
 870
 871         un->nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(un->nodetype));
 872
 873         switch(je16_to_cpu(un->nodetype) & JFFS2_COMPAT_MASK) {
 874
 875         case JFFS2_FEATURE_INCOMPAT:
 876                 JFFS2_ERROR("unknown INCOMPAT nodetype %#04X at %#08x\n",
 877                             je16_to_cpu(un->nodetype), ref_offset(ref));
 878                 /* EEP */
 879                 BUG();
 880                 break;
 881
 882         case JFFS2_FEATURE_ROCOMPAT:
 883                 JFFS2_ERROR("unknown ROCOMPAT nodetype %#04X at %#08x\n",
 884                             je16_to_cpu(un->nodetype), ref_offset(ref));
 885                 BUG_ON(!(c->flags & JFFS2_SB_FLAG_RO));
 886                 break;
 887
 888         case JFFS2_FEATURE_RWCOMPAT_COPY:
 889                 JFFS2_NOTICE("unknown RWCOMPAT_COPY nodetype %#04X at %#08x\n",
 890                              je16_to_cpu(un->nodetype), ref_offset(ref));
 891                 break;
 892
 893         case JFFS2_FEATURE_RWCOMPAT_DELETE:
 894                 JFFS2_NOTICE("unknown RWCOMPAT_DELETE nodetype %#04X at %#08x\n",
 895                              je16_to_cpu(un->nodetype), ref_offset(ref));
 896                 jffs2_mark_node_obsolete(c, ref);
 897                 return 0;
 898         }
 899
 900         return 0;
 901 }
 902
 903 /*
 904  * Helper function for jffs2_get_inode_nodes().
 905  * The function detects whether more data should be read and reads it if yes.
 906  *
 907  * Returns: 0 on succes;
 908  *          negative error code on failure.
 909  */
 910 static int read_more(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 911                      int needed_len, int *rdlen, unsigned char *buf)
 912 {
 913         int err, to_read = needed_len - *rdlen;
 914         size_t retlen;
 915         uint32_t offs;
 916
 917         if (jffs2_is_writebuffered(c)) {
 918                 int rem = to_read % c->wbuf_pagesize;
 919
 920                 if (rem)
 921                         to_read += c->wbuf_pagesize - rem;
 922         }
 923
 924         /* We need to read more data */
 925         offs = ref_offset(ref) + *rdlen;
 926
 927         dbg_readinode("read more %d bytes\n", to_read);
 928
 929         err = jffs2_flash_read(c, offs, to_read, &retlen, buf + *rdlen);
 930         if (err) {
 931                 JFFS2_ERROR("can not read %d bytes from 0x%08x, "
 932                         "error code: %d.\n", to_read, offs, err);
 933                 return err;
 934         }
 935
 936         if (retlen < to_read) {
 937                 JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n",
 938                                 offs, retlen, to_read);
 939                 return -EIO;
 940         }
 941
 942         *rdlen += to_read;
 943         return 0;
 944 }
 945
 946 /* Get tmp_dnode_info and full_dirent for all non-obsolete nodes associated
 947    with this ino. Perform a preliminary ordering on data nodes, throwing away
 948    those which are completely obsoleted by newer ones. The naïve approach we
 949    use to take of just returning them _all_ in version order will cause us to
 950    run out of memory in certain degenerate cases. */
 951 static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 952                                  struct jffs2_readinode_info *rii)
 953 {
 954         struct jffs2_raw_node_ref *ref, *valid_ref;
 955         unsigned char *buf = NULL;
 956         union jffs2_node_union *node;
 957         size_t retlen;
 958         int len, err;
 959
 960         rii->mctime_ver = 0;
 961
 962         dbg_readinode("ino #%u\n", f->inocache->ino);
 963
 964         /* FIXME: in case of NOR and available ->point() this
 965          * needs to be fixed. */
 966         len = sizeof(union jffs2_node_union) + c->wbuf_pagesize;
 967         buf = kmalloc(len, GFP_KERNEL);
 968         if (!buf)
 969                 return -ENOMEM;
 970
 971         spin_lock(&c->erase_completion_lock);
 972         valid_ref = jffs2_first_valid_node(f->inocache->nodes);
 973         if (!valid_ref && f->inocache->ino != 1)
 974                 JFFS2_WARNING("Eep. No valid nodes for ino #%u.\n", f->inocache->ino);
 975         while (valid_ref) {
 976                 /* We can hold a pointer to a non-obsolete node without the spinlock,
 977                    but _obsolete_ nodes may disappear at any time, if the block
 978                    they're in gets erased. So if we mark 'ref' obsolete while we're
 979                    not holding the lock, it can go away immediately. For that reason,
 980                    we find the next valid node first, before processing 'ref'.
 981                 */
 982                 ref = valid_ref;
 983                 valid_ref = jffs2_first_valid_node(ref->next_in_ino);
 984                 spin_unlock(&c->erase_completion_lock);
 985
 986                 cond_resched();
 987
 988                 /*
 989                  * At this point we don't know the type of the node we're going
 990                  * to read, so we do not know the size of its header. In order
 991                  * to minimize the amount of flash IO we assume the header is
 992                  * of size = JFFS2_MIN_NODE_HEADER.
 993                  */
 994                 len = JFFS2_MIN_NODE_HEADER;
 995                 if (jffs2_is_writebuffered(c)) {
 996                         int end, rem;
 997
 998                         /*
 999                          * We are about to read JFFS2_MIN_NODE_HEADER bytes,
1000                          * but this flash has some minimal I/O unit. It is
1001                          * possible that we'll need to read more soon, so read
1002                          * up to the next min. I/O unit, in order not to
1003                          * re-read the same min. I/O unit twice.
1004                          */
1005                         end = ref_offset(ref) + len;
1006                         rem = end % c->wbuf_pagesize;
1007                         if (rem)
1008                                 end += c->wbuf_pagesize - rem;
1009                         len = end - ref_offset(ref);
1010                 }
1011
1012                 dbg_readinode("read %d bytes at %#08x(%d).\n", len, ref_offset(ref), ref_flags(ref));
1013
1014                 /* FIXME: point() */
1015                 err = jffs2_flash_read(c, ref_offset(ref), len, &retlen, buf);
1016                 if (err) {
1017                         JFFS2_ERROR("can not read %d bytes from 0x%08x, " "error code: %d.\n", len, ref_offset(ref), err);
1018                         goto free_out;
1019                 }
1020
1021                 if (retlen < len) {
1022                         JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n", ref_offset(ref), retlen, len);
1023                         err = -EIO;
1024                         goto free_out;
1025                 }
1026
1027                 node = (union jffs2_node_union *)buf;
1028
1029                 /* No need to mask in the valid bit; it shouldn't be invalid */
1030                 if (je32_to_cpu(node->u.hdr_crc) != crc32(0, node, sizeof(node->u)-4)) {
1031                         JFFS2_NOTICE("Node header CRC failed at %#08x. {%04x,%04x,%08x,%08x}\n",
1032                                      ref_offset(ref), je16_to_cpu(node->u.magic),
1033                                      je16_to_cpu(node->u.nodetype),
1034                                      je32_to_cpu(node->u.totlen),
1035                                      je32_to_cpu(node->u.hdr_crc));
1036                         jffs2_dbg_dump_node(c, ref_offset(ref));
1037                         jffs2_mark_node_obsolete(c, ref);
1038                         goto cont;
1039                 }
1040                 if (je16_to_cpu(node->u.magic) != JFFS2_MAGIC_BITMASK) {
1041                         /* Not a JFFS2 node, whinge and move on */
1042                         JFFS2_NOTICE("Wrong magic bitmask 0x%04x in node header at %#08x.\n",
1043                                      je16_to_cpu(node->u.magic), ref_offset(ref));
1044                         jffs2_mark_node_obsolete(c, ref);
1045                         goto cont;
1046                 }
1047
1048                 switch (je16_to_cpu(node->u.nodetype)) {
1049
1050                 case JFFS2_NODETYPE_DIRENT:
1051
1052                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent) &&
1053                             len < sizeof(struct jffs2_raw_dirent)) {
1054                                 err = read_more(c, ref, sizeof(struct jffs2_raw_dirent), &len, buf);
1055                                 if (unlikely(err))
1056                                         goto free_out;
1057                         }
1058
1059                         err = read_direntry(c, ref, &node->d, retlen, rii);
1060                         if (unlikely(err))
1061                                 goto free_out;
1062
1063                         break;
1064
1065                 case JFFS2_NODETYPE_INODE:
1066
1067                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode) &&
1068                             len < sizeof(struct jffs2_raw_inode)) {
1069                                 err = read_more(c, ref, sizeof(struct jffs2_raw_inode), &len, buf);
1070                                 if (unlikely(err))
1071                                         goto free_out;
1072                         }
1073
1074                         err = read_dnode(c, ref, &node->i, len, rii);
1075                         if (unlikely(err))
1076                                 goto free_out;
1077
1078                         break;
1079
1080                 default:
1081                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node) &&
1082                             len < sizeof(struct jffs2_unknown_node)) {
1083                                 err = read_more(c, ref, sizeof(struct jffs2_unknown_node), &len, buf);
1084                                 if (unlikely(err))
1085                                         goto free_out;
1086                         }
1087
1088                         err = read_unknown(c, ref, &node->u);
1089                         if (unlikely(err))
1090                                 goto free_out;
1091
1092                 }
1093         cont:
1094                 spin_lock(&c->erase_completion_lock);
1095         }
1096
1097         spin_unlock(&c->erase_completion_lock);
1098         kfree(buf);
1099
1100         f->highest_version = rii->highest_version;
1101
1102         dbg_readinode("nodes of inode #%u were read, the highest version is %u, latest_mctime %u, mctime_ver %u.\n",
1103                       f->inocache->ino, rii->highest_version, rii->latest_mctime,
1104                       rii->mctime_ver);
1105         return 0;
1106
1107  free_out:
1108         jffs2_free_tmp_dnode_info_list(&rii->tn_root);
1109         jffs2_free_full_dirent_list(rii->fds);
1110         rii->fds = NULL;
1111         kfree(buf);
1112         return err;
1113 }
1114
1115 static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
1116                                         struct jffs2_inode_info *f,
1117                                         struct jffs2_raw_inode *latest_node)
1118 {
1119         struct jffs2_readinode_info rii;
1120         uint32_t crc, new_size;
1121         size_t retlen;
1122         int ret;
1123
1124         dbg_readinode("ino #%u nlink is %d\n", f->inocache->ino, f->inocache->nlink);
1125
1126         memset(&rii, 0, sizeof(rii));
1127
1128         /* Grab all nodes relevant to this ino */
1129         ret = jffs2_get_inode_nodes(c, f, &rii);
1130
1131         if (ret) {
1132                 JFFS2_ERROR("cannot read nodes for ino %u, returned error is %d\n", f->inocache->ino, ret);
1133                 if (f->inocache->state == INO_STATE_READING)
1134                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1135                 return ret;
1136         }
1137
1138         ret = jffs2_build_inode_fragtree(c, f, &rii);
1139         if (ret) {
1140                 JFFS2_ERROR("Failed to build final fragtree for inode #%u: error %d\n",
1141                             f->inocache->ino, ret);
1142                 if (f->inocache->state == INO_STATE_READING)
1143                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1144                 jffs2_free_tmp_dnode_info_list(&rii.tn_root);
1145                 /* FIXME: We could at least crc-check them all */
1146                 if (rii.mdata_tn) {
1147                         jffs2_free_full_dnode(rii.mdata_tn->fn);
1148                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1149                         rii.mdata_tn = NULL;
1150                 }
1151                 return ret;
1152         }
1153
1154         if (rii.mdata_tn) {
1155                 if (rii.mdata_tn->fn->raw == rii.latest_ref) {
1156                         f->metadata = rii.mdata_tn->fn;
1157                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1158                 } else {
1159                         jffs2_kill_tn(c, rii.mdata_tn);
1160                 }
1161                 rii.mdata_tn = NULL;
1162         }
1163
1164         f->dents = rii.fds;
1165
1166         jffs2_dbg_fragtree_paranoia_check_nolock(f);
1167
1168         if (unlikely(!rii.latest_ref)) {
1169                 /* No data nodes for this inode. */
1170                 if (f->inocache->ino != 1) {
1171                         JFFS2_WARNING("no data nodes found for ino #%u\n", f->inocache->ino);
1172                         if (!rii.fds) {
1173                                 if (f->inocache->state == INO_STATE_READING)
1174                                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1175                                 return -EIO;
1176                         }
1177                         JFFS2_NOTICE("but it has children so we fake some modes for it\n");
1178                 }
1179                 latest_node->mode = cpu_to_jemode(S_IFDIR|S_IRUGO|S_IWUSR|S_IXUGO);
1180                 latest_node->version = cpu_to_je32(0);
1181                 latest_node->atime = latest_node->ctime = latest_node->mtime = cpu_to_je32(0);
1182                 latest_node->isize = cpu_to_je32(0);
1183                 latest_node->gid = cpu_to_je16(0);
1184                 latest_node->uid = cpu_to_je16(0);
1185                 if (f->inocache->state == INO_STATE_READING)
1186                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1187                 return 0;
1188         }
1189
1190         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref), sizeof(*latest_node), &retlen, (void *)latest_node);
1191         if (ret || retlen != sizeof(*latest_node)) {
1192                 JFFS2_ERROR("failed to read from flash: error %d, %zd of %zd bytes read\n",
1193                         ret, retlen, sizeof(*latest_node));
1194                 /* FIXME: If this fails, there seems to be a memory leak. Find it. */
1195                 up(&f->sem);
1196                 jffs2_do_clear_inode(c, f);
1197                 return ret?ret:-EIO;
1198         }
1199
1200         crc = crc32(0, latest_node, sizeof(*latest_node)-8);
1201         if (crc != je32_to_cpu(latest_node->node_crc)) {
1202                 JFFS2_ERROR("CRC failed for read_inode of inode %u at physical location 0x%x\n",
1203                         f->inocache->ino, ref_offset(rii.latest_ref));
1204                 up(&f->sem);
1205                 jffs2_do_clear_inode(c, f);
1206                 return -EIO;
1207         }
1208
1209         switch(jemode_to_cpu(latest_node->mode) & S_IFMT) {
1210         case S_IFDIR:
1211                 if (rii.mctime_ver > je32_to_cpu(latest_node->version)) {
1212                         /* The times in the latest_node are actually older than
1213                            mctime in the latest dirent. Cheat. */
1214                         latest_node->ctime = latest_node->mtime = cpu_to_je32(rii.latest_mctime);
1215                 }
1216                 break;
1217
1218
1219         case S_IFREG:
1220                 /* If it was a regular file, truncate it to the latest node's isize */
1221                 new_size = jffs2_truncate_fragtree(c, &f->fragtree, je32_to_cpu(latest_node->isize));
1222                 if (new_size != je32_to_cpu(latest_node->isize)) {
1223                         JFFS2_WARNING("Truncating ino #%u to %d bytes failed because it only had %d bytes to start with!\n",
1224                                       f->inocache->ino, je32_to_cpu(latest_node->isize), new_size);
1225                         latest_node->isize = cpu_to_je32(new_size);
1226                 }
1227                 break;
1228
1229         case S_IFLNK:
1230                 /* Hack to work around broken isize in old symlink code.
1231                    Remove this when dwmw2 comes to his senses and stops
1232                    symlinks from being an entirely gratuitous special
1233                    case. */
1234                 if (!je32_to_cpu(latest_node->isize))
1235                         latest_node->isize = latest_node->dsize;
1236
1237                 if (f->inocache->state != INO_STATE_CHECKING) {
1238                         /* Symlink's inode data is the target path. Read it and
1239                          * keep in RAM to facilitate quick follow symlink
1240                          * operation. */
1241                         f->target = kmalloc(je32_to_cpu(latest_node->csize) + 1, GFP_KERNEL);
1242                         if (!f->target) {
1243                                 JFFS2_ERROR("can't allocate %d bytes of memory for the symlink target path cache\n", je32_to_cpu(latest_node->csize));
1244                                 up(&f->sem);
1245                                 jffs2_do_clear_inode(c, f);
1246                                 return -ENOMEM;
1247                         }
1248
1249                         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref) + sizeof(*latest_node),
1250                                                 je32_to_cpu(latest_node->csize), &retlen, (char *)f->target);
1251
1252                         if (ret  || retlen != je32_to_cpu(latest_node->csize)) {
1253                                 if (retlen != je32_to_cpu(latest_node->csize))
1254                                         ret = -EIO;
1255                                 kfree(f->target);
1256                                 f->target = NULL;
1257                                 up(&f->sem);
1258                                 jffs2_do_clear_inode(c, f);
1259                                 return -ret;
1260                         }
1261
1262                         f->target[je32_to_cpu(latest_node->csize)] = '\0';
1263                         dbg_readinode("symlink's target '%s' cached\n", f->target);
1264                 }
1265
1266                 /* fall through... */
1267
1268         case S_IFBLK:
1269         case S_IFCHR:
1270                 /* Certain inode types should have only one data node, and it's
1271                    kept as the metadata node */
1272                 if (f->metadata) {
1273                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o had metadata node\n",
1274                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1275                         up(&f->sem);
1276                         jffs2_do_clear_inode(c, f);
1277                         return -EIO;
1278                 }
1279                 if (!frag_first(&f->fragtree)) {
1280                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o has no fragments\n",
1281                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1282                         up(&f->sem);
1283                         jffs2_do_clear_inode(c, f);
1284                         return -EIO;
1285                 }
1286                 /* ASSERT: f->fraglist != NULL */
1287                 if (frag_next(frag_first(&f->fragtree))) {
1288                         JFFS2_ERROR("Argh. Special inode #%u with mode 0x%x had more than one node\n",
1289                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1290                         /* FIXME: Deal with it - check crc32, check for duplicate node, check times and discard the older one */
1291                         up(&f->sem);
1292                         jffs2_do_clear_inode(c, f);
1293                         return -EIO;
1294                 }
1295                 /* OK. We're happy */
1296                 f->metadata = frag_first(&f->fragtree)->node;
1297                 jffs2_free_node_frag(frag_first(&f->fragtree));
1298                 f->fragtree = RB_ROOT;
1299                 break;
1300         }
1301         if (f->inocache->state == INO_STATE_READING)
1302                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1303
1304         return 0;
1305 }
1306
1307 /* Scan the list of all nodes present for this ino, build map of versions, etc. */
1308 int jffs2_do_read_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
1309                         uint32_t ino, struct jffs2_raw_inode *latest_node)
1310 {
1311         dbg_readinode("read inode #%u\n", ino);
1312
1313  retry_inocache:
1314         spin_lock(&c->inocache_lock);
1315         f->inocache = jffs2_get_ino_cache(c, ino);
1316
1317         if (f->inocache) {
1318                 /* Check its state. We may need to wait before we can use it */
1319                 switch(f->inocache->state) {
1320                 case INO_STATE_UNCHECKED:
1321                 case INO_STATE_CHECKEDABSENT:
1322                         f->inocache->state = INO_STATE_READING;
1323                         break;
1324
1325                 case INO_STATE_CHECKING:
1326                 case INO_STATE_GC:
1327                         /* If it's in either of these states, we need
1328                            to wait for whoever's got it to finish and
1329                            put it back. */
1330                         dbg_readinode("waiting for ino #%u in state %d\n", ino, f->inocache->state);
1331                         sleep_on_spinunlock(&c->inocache_wq, &c->inocache_lock);
1332                         goto retry_inocache;
1333
1334                 case INO_STATE_READING:
1335                 case INO_STATE_PRESENT:
1336                         /* Eep. This should never happen. It can
1337                         happen if Linux calls read_inode() again
1338                         before clear_inode() has finished though. */
1339                         JFFS2_ERROR("Eep. Trying to read_inode #%u when it's already in state %d!\n", ino, f->inocache->state);
1340                         /* Fail. That's probably better than allowing it to succeed */
1341                         f->inocache = NULL;
1342                         break;
1343
1344                 default:
1345                         BUG();
1346                 }
1347         }
1348         spin_unlock(&c->inocache_lock);
1349
1350         if (!f->inocache && ino == 1) {
1351                 /* Special case - no root inode on medium */
1352                 f->inocache = jffs2_alloc_inode_cache();
1353                 if (!f->inocache) {
1354                         JFFS2_ERROR("cannot allocate inocache for root inode\n");
1355                         return -ENOMEM;
1356                 }
1357                 dbg_readinode("creating inocache for root inode\n");
1358                 memset(f->inocache, 0, sizeof(struct jffs2_inode_cache));
1359                 f->inocache->ino = f->inocache->nlink = 1;
1360                 f->inocache->nodes = (struct jffs2_raw_node_ref *)f->inocache;
1361                 f->inocache->state = INO_STATE_READING;
1362                 jffs2_add_ino_cache(c, f->inocache);
1363         }
1364         if (!f->inocache) {
1365                 JFFS2_ERROR("requestied to read an nonexistent ino %u\n", ino);
1366                 return -ENOENT;
1367         }
1368
1369         return jffs2_do_read_inode_internal(c, f, latest_node);
1370 }
1371
1372 int jffs2_do_crccheck_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
1373 {
1374         struct jffs2_raw_inode n;
1375         struct jffs2_inode_info *f = kzalloc(sizeof(*f), GFP_KERNEL);
1376         int ret;
1377
1378         if (!f)
1379                 return -ENOMEM;
1380
1381         init_MUTEX_LOCKED(&f->sem);
1382         f->inocache = ic;
1383
1384         ret = jffs2_do_read_inode_internal(c, f, &n);
1385         if (!ret) {
1386                 up(&f->sem);
1387                 jffs2_do_clear_inode(c, f);
1388         }
1389         kfree (f);
1390         return ret;
1391 }
1392
1393 void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
1394 {
1395         struct jffs2_full_dirent *fd, *fds;
1396         int deleted;
1397
1398         jffs2_clear_acl(f);
1399         jffs2_xattr_delete_inode(c, f->inocache);
1400         down(&f->sem);
1401         deleted = f->inocache && !f->inocache->nlink;
1402
1403         if (f->inocache && f->inocache->state != INO_STATE_CHECKING)
1404                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CLEARING);
1405
1406         if (f->metadata) {
1407                 if (deleted)
1408                         jffs2_mark_node_obsolete(c, f->metadata->raw);
1409                 jffs2_free_full_dnode(f->metadata);
1410         }
1411
1412         jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
1413
1414         if (f->target) {
1415                 kfree(f->target);
1416                 f->target = NULL;
1417         }
1418
1419         fds = f->dents;
1420         while(fds) {
1421                 fd = fds;
1422                 fds = fd->next;
1423                 jffs2_free_full_dirent(fd);
1424         }
1425
1426         if (f->inocache && f->inocache->state != INO_STATE_CHECKING) {
1427                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1428                 if (f->inocache->nodes == (void *)f->inocache)
1429                         jffs2_del_ino_cache(c, f->inocache);
1430         }
1431
1432         up(&f->sem);
1433 }