fs/jffs2/readinode.c

   1 /*
   2  * JFFS2 -- Journalling Flash File System, Version 2.
   3  *
   4  * Copyright © 2001-2007 Red Hat, Inc.
   5  *
   6  * Created by David Woodhouse <dwmw2@infradead.org>
   7  *
   8  * For licensing information, see the file 'LICENCE' in this directory.
   9  *
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/sched.h>
  14 #include <linux/slab.h>
  15 #include <linux/fs.h>
  16 #include <linux/crc32.h>
  17 #include <linux/pagemap.h>
  18 #include <linux/mtd/mtd.h>
  19 #include <linux/compiler.h>
  20 #include "nodelist.h"
  21
  22 /*
  23  * Check the data CRC of the node.
  24  *
  25  * Returns: 0 if the data CRC is correct;
  26  *          1 - if incorrect;
  27  *          error code if an error occured.
  28  */
  29 static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
  30 {
  31         struct jffs2_raw_node_ref *ref = tn->fn->raw;
  32         int err = 0, pointed = 0;
  33         struct jffs2_eraseblock *jeb;
  34         unsigned char *buffer;
  35         uint32_t crc, ofs, len;
  36         size_t retlen;
  37
  38         BUG_ON(tn->csize == 0);
  39
  40         /* Calculate how many bytes were already checked */
  41         ofs = ref_offset(ref) + sizeof(struct jffs2_raw_inode);
  42         len = tn->csize;
  43
  44         if (jffs2_is_writebuffered(c)) {
  45                 int adj = ofs % c->wbuf_pagesize;
  46                 if (likely(adj))
  47                         adj = c->wbuf_pagesize - adj;
  48
  49                 if (adj >= tn->csize) {
  50                         dbg_readinode("no need to check node at %#08x, data length %u, data starts at %#08x - it has already been checked.\n",
  51                                       ref_offset(ref), tn->csize, ofs);
  52                         goto adj_acc;
  53                 }
  54
  55                 ofs += adj;
  56                 len -= adj;
  57         }
  58
  59         dbg_readinode("check node at %#08x, data length %u, partial CRC %#08x, correct CRC %#08x, data starts at %#08x, start checking from %#08x - %u bytes.\n",
  60                 ref_offset(ref), tn->csize, tn->partial_crc, tn->data_crc, ofs - len, ofs, len);
  61
  62 #ifndef __ECOS
  63         /* TODO: instead, incapsulate point() stuff to jffs2_flash_read(),
  64          * adding and jffs2_flash_read_end() interface. */
  65         if (c->mtd->point) {
  66                 err = c->mtd->point(c->mtd, ofs, len, &retlen, &buffer);
  67                 if (!err && retlen < len) {
  68                         JFFS2_WARNING("MTD point returned len too short: %zu instead of %u.\n", retlen, tn->csize);
  69                         c->mtd->unpoint(c->mtd, buffer, ofs, retlen);
  70                 } else if (err)
  71                         JFFS2_WARNING("MTD point failed: error code %d.\n", err);
  72                 else
  73                         pointed = 1; /* succefully pointed to device */
  74         }
  75 #endif
  76
  77         if (!pointed) {
  78                 buffer = kmalloc(len, GFP_KERNEL);
  79                 if (unlikely(!buffer))
  80                         return -ENOMEM;
  81
  82                 /* TODO: this is very frequent pattern, make it a separate
  83                  * routine */
  84                 err = jffs2_flash_read(c, ofs, len, &retlen, buffer);
  85                 if (err) {
  86                         JFFS2_ERROR("can not read %d bytes from 0x%08x, error code: %d.\n", len, ofs, err);
  87                         goto free_out;
  88                 }
  89
  90                 if (retlen != len) {
  91                         JFFS2_ERROR("short read at %#08x: %zd instead of %d.\n", ofs, retlen, len);
  92                         err = -EIO;
  93                         goto free_out;
  94                 }
  95         }
  96
  97         /* Continue calculating CRC */
  98         crc = crc32(tn->partial_crc, buffer, len);
  99         if(!pointed)
 100                 kfree(buffer);
 101 #ifndef __ECOS
 102         else
 103                 c->mtd->unpoint(c->mtd, buffer, ofs, len);
 104 #endif
 105
 106         if (crc != tn->data_crc) {
 107                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 108                              ref_offset(ref), tn->data_crc, crc);
 109                 return 1;
 110         }
 111
 112 adj_acc:
 113         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 114         len = ref_totlen(c, jeb, ref);
 115         /* If it should be REF_NORMAL, it'll get marked as such when
 116            we build the fragtree, shortly. No need to worry about GC
 117            moving it while it's marked REF_PRISTINE -- GC won't happen
 118            till we've finished checking every inode anyway. */
 119         ref->flash_offset |= REF_PRISTINE;
 120         /*
 121          * Mark the node as having been checked and fix the
 122          * accounting accordingly.
 123          */
 124         spin_lock(&c->erase_completion_lock);
 125         jeb->used_size += len;
 126         jeb->unchecked_size -= len;
 127         c->used_size += len;
 128         c->unchecked_size -= len;
 129         jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
 130         spin_unlock(&c->erase_completion_lock);
 131
 132         return 0;
 133
 134 free_out:
 135         if(!pointed)
 136                 kfree(buffer);
 137 #ifndef __ECOS
 138         else
 139                 c->mtd->unpoint(c->mtd, buffer, ofs, len);
 140 #endif
 141         return err;
 142 }
 143
 144 /*
 145  * Helper function for jffs2_add_older_frag_to_fragtree().
 146  *
 147  * Checks the node if we are in the checking stage.
 148  */
 149 static int check_tn_node(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 150 {
 151         int ret;
 152
 153         BUG_ON(ref_obsolete(tn->fn->raw));
 154
 155         /* We only check the data CRC of unchecked nodes */
 156         if (ref_flags(tn->fn->raw) != REF_UNCHECKED)
 157                 return 0;
 158
 159         dbg_readinode("check node %#04x-%#04x, phys offs %#08x\n",
 160                       tn->fn->ofs, tn->fn->ofs + tn->fn->size, ref_offset(tn->fn->raw));
 161
 162         ret = check_node_data(c, tn);
 163         if (unlikely(ret < 0)) {
 164                 JFFS2_ERROR("check_node_data() returned error: %d.\n",
 165                         ret);
 166         } else if (unlikely(ret > 0)) {
 167                 dbg_readinode("CRC error, mark it obsolete.\n");
 168                 jffs2_mark_node_obsolete(c, tn->fn->raw);
 169         }
 170
 171         return ret;
 172 }
 173
 174 static struct jffs2_tmp_dnode_info *jffs2_lookup_tn(struct rb_root *tn_root, uint32_t offset)
 175 {
 176         struct rb_node *next;
 177         struct jffs2_tmp_dnode_info *tn = NULL;
 178
 179         dbg_readinode("root %p, offset %d\n", tn_root, offset);
 180
 181         next = tn_root->rb_node;
 182
 183         while (next) {
 184                 tn = rb_entry(next, struct jffs2_tmp_dnode_info, rb);
 185
 186                 if (tn->fn->ofs < offset)
 187                         next = tn->rb.rb_right;
 188                 else if (tn->fn->ofs >= offset)
 189                         next = tn->rb.rb_left;
 190                 else
 191                         break;
 192         }
 193
 194         return tn;
 195 }
 196
 197
 198 static void jffs2_kill_tn(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 199 {
 200         jffs2_mark_node_obsolete(c, tn->fn->raw);
 201         jffs2_free_full_dnode(tn->fn);
 202         jffs2_free_tmp_dnode_info(tn);
 203 }
 204 /*
 205  * This function is used when we read an inode. Data nodes arrive in
 206  * arbitrary order -- they may be older or newer than the nodes which
 207  * are already in the tree. Where overlaps occur, the older node can
 208  * be discarded as long as the newer passes the CRC check. We don't
 209  * bother to keep track of holes in this rbtree, and neither do we deal
 210  * with frags -- we can have multiple entries starting at the same
 211  * offset, and the one with the smallest length will come first in the
 212  * ordering.
 213  *
 214  * Returns 0 if the node was handled (including marking it obsolete)
 215  *       < 0 an if error occurred
 216  */
 217 static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
 218                                 struct jffs2_readinode_info *rii,
 219                                 struct jffs2_tmp_dnode_info *tn)
 220 {
 221         uint32_t fn_end = tn->fn->ofs + tn->fn->size;
 222         struct jffs2_tmp_dnode_info *this;
 223
 224         dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
 225
 226         /* If a node has zero dsize, we only have to keep if it if it might be the
 227            node with highest version -- i.e. the one which will end up as f->metadata.
 228            Note that such nodes won't be REF_UNCHECKED since there are no data to
 229            check anyway. */
 230         if (!tn->fn->size) {
 231                 if (rii->mdata_tn) {
 232                         if (rii->mdata_tn->version < tn->version) {
 233                                 /* We had a candidate mdata node already */
 234                                 dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
 235                                 jffs2_kill_tn(c, rii->mdata_tn);
 236                         } else {
 237                                 dbg_readinode("kill new mdata with ver %d (older than existing %d\n",
 238                                               tn->version, rii->mdata_tn->version);
 239                                 jffs2_kill_tn(c, tn);
 240                                 return 0;
 241                         }
 242                 }
 243                 rii->mdata_tn = tn;
 244                 dbg_readinode("keep new mdata with ver %d\n", tn->version);
 245                 return 0;
 246         }
 247
 248         /* Find the earliest node which _may_ be relevant to this one */
 249         this = jffs2_lookup_tn(&rii->tn_root, tn->fn->ofs);
 250         if (this) {
 251                 /* If the node is coincident with another at a lower address,
 252                    back up until the other node is found. It may be relevant */
 253                 while (this->overlapped)
 254                         this = tn_prev(this);
 255
 256                 /* First node should never be marked overlapped */
 257                 BUG_ON(!this);
 258                 dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
 259         }
 260
 261         while (this) {
 262                 if (this->fn->ofs > fn_end)
 263                         break;
 264                 dbg_readinode("Ponder this ver %d, 0x%x-0x%x\n",
 265                               this->version, this->fn->ofs, this->fn->size);
 266
 267                 if (this->version == tn->version) {
 268                         /* Version number collision means REF_PRISTINE GC. Accept either of them
 269                            as long as the CRC is correct. Check the one we have already...  */
 270                         if (!check_tn_node(c, this)) {
 271                                 /* The one we already had was OK. Keep it and throw away the new one */
 272                                 dbg_readinode("Like old node. Throw away new\n");
 273                                 jffs2_kill_tn(c, tn);
 274                                 return 0;
 275                         } else {
 276                                 /* Who cares if the new one is good; keep it for now anyway. */
 277                                 dbg_readinode("Like new node. Throw away old\n");
 278                                 rb_replace_node(&this->rb, &tn->rb, &rii->tn_root);
 279                                 jffs2_kill_tn(c, this);
 280                                 /* Same overlapping from in front and behind */
 281                                 return 0;
 282                         }
 283                 }
 284                 if (this->version < tn->version &&
 285                     this->fn->ofs >= tn->fn->ofs &&
 286                     this->fn->ofs + this->fn->size <= fn_end) {
 287                         /* New node entirely overlaps 'this' */
 288                         if (check_tn_node(c, tn)) {
 289                                 dbg_readinode("new node bad CRC\n");
 290                                 jffs2_kill_tn(c, tn);
 291                                 return 0;
 292                         }
 293                         /* ... and is good. Kill 'this' and any subsequent nodes which are also overlapped */
 294                         while (this && this->fn->ofs + this->fn->size <= fn_end) {
 295                                 struct jffs2_tmp_dnode_info *next = tn_next(this);
 296                                 if (this->version < tn->version) {
 297                                         tn_erase(this, &rii->tn_root);
 298                                         dbg_readinode("Kill overlapped ver %d, 0x%x-0x%x\n",
 299                                                       this->version, this->fn->ofs,
 300                                                       this->fn->ofs+this->fn->size);
 301                                         jffs2_kill_tn(c, this);
 302                                 }
 303                                 this = next;
 304                         }
 305                         dbg_readinode("Done killing overlapped nodes\n");
 306                         continue;
 307                 }
 308                 if (this->version > tn->version &&
 309                     this->fn->ofs <= tn->fn->ofs &&
 310                     this->fn->ofs+this->fn->size >= fn_end) {
 311                         /* New node entirely overlapped by 'this' */
 312                         if (!check_tn_node(c, this)) {
 313                                 dbg_readinode("Good CRC on old node. Kill new\n");
 314                                 jffs2_kill_tn(c, tn);
 315                                 return 0;
 316                         }
 317                         /* ... but 'this' was bad. Replace it... */
 318                         dbg_readinode("Bad CRC on old overlapping node. Kill it\n");
 319                         tn_erase(this, &rii->tn_root);
 320                         jffs2_kill_tn(c, this);
 321                         break;
 322                 }
 323
 324                 this = tn_next(this);
 325         }
 326
 327         /* We neither completely obsoleted nor were completely
 328            obsoleted by an earlier node. Insert into the tree */
 329         {
 330                 struct rb_node *parent;
 331                 struct rb_node **link = &rii->tn_root.rb_node;
 332                 struct jffs2_tmp_dnode_info *insert_point = NULL;
 333
 334                 while (*link) {
 335                         parent = *link;
 336                         insert_point = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 337                         if (tn->fn->ofs > insert_point->fn->ofs)
 338                                 link = &insert_point->rb.rb_right;
 339                         else if (tn->fn->ofs < insert_point->fn->ofs ||
 340                                  tn->fn->size < insert_point->fn->size)
 341                                 link = &insert_point->rb.rb_left;
 342                         else
 343                                 link = &insert_point->rb.rb_right;
 344                 }
 345                 rb_link_node(&tn->rb, &insert_point->rb, link);
 346                 rb_insert_color(&tn->rb, &rii->tn_root);
 347         }
 348
 349         /* If there's anything behind that overlaps us, note it */
 350         this = tn_prev(tn);
 351         if (this) {
 352                 while (1) {
 353                         if (this->fn->ofs + this->fn->size > tn->fn->ofs) {
 354                                 dbg_readinode("Node is overlapped by %p (v %d, 0x%x-0x%x)\n",
 355                                               this, this->version, this->fn->ofs,
 356                                               this->fn->ofs+this->fn->size);
 357                                 tn->overlapped = 1;
 358                                 break;
 359                         }
 360                         if (!this->overlapped)
 361                                 break;
 362                         this = tn_prev(this);
 363                 }
 364         }
 365
 366         /* If the new node overlaps anything ahead, note it */
 367         this = tn_next(tn);
 368         while (this && this->fn->ofs < fn_end) {
 369                 this->overlapped = 1;
 370                 dbg_readinode("Node ver %d, 0x%x-0x%x is overlapped\n",
 371                               this->version, this->fn->ofs,
 372                               this->fn->ofs+this->fn->size);
 373                 this = tn_next(this);
 374         }
 375         return 0;
 376 }
 377
 378 /* Trivial function to remove the last node in the tree. Which by definition
 379    has no right-hand -- so can be removed just by making its only child (if
 380    any) take its place under its parent. */
 381 static void eat_last(struct rb_root *root, struct rb_node *node)
 382 {
 383         struct rb_node *parent = rb_parent(node);
 384         struct rb_node **link;
 385
 386         /* LAST! */
 387         BUG_ON(node->rb_right);
 388
 389         if (!parent)
 390                 link = &root->rb_node;
 391         else if (node == parent->rb_left)
 392                 link = &parent->rb_left;
 393         else
 394                 link = &parent->rb_right;
 395
 396         *link = node->rb_left;
 397         /* Colour doesn't matter now. Only the parent pointer. */
 398         if (node->rb_left)
 399                 node->rb_left->rb_parent_color = node->rb_parent_color;
 400 }
 401
 402 /* We put this in reverse order, so we can just use eat_last */
 403 static void ver_insert(struct rb_root *ver_root, struct jffs2_tmp_dnode_info *tn)
 404 {
 405         struct rb_node **link = &ver_root->rb_node;
 406         struct rb_node *parent = NULL;
 407         struct jffs2_tmp_dnode_info *this_tn;
 408
 409         while (*link) {
 410                 parent = *link;
 411                 this_tn = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
 412
 413                 if (tn->version > this_tn->version)
 414                         link = &parent->rb_left;
 415                 else
 416                         link = &parent->rb_right;
 417         }
 418         dbg_readinode("Link new node at %p (root is %p)\n", link, ver_root);
 419         rb_link_node(&tn->rb, parent, link);
 420         rb_insert_color(&tn->rb, ver_root);
 421 }
 422
 423 /* Build final, normal fragtree from tn tree. It doesn't matter which order
 424    we add nodes to the real fragtree, as long as they don't overlap. And
 425    having thrown away the majority of overlapped nodes as we went, there
 426    really shouldn't be many sets of nodes which do overlap. If we start at
 427    the end, we can use the overlap markers -- we can just eat nodes which
 428    aren't overlapped, and when we encounter nodes which _do_ overlap we
 429    sort them all into a temporary tree in version order before replaying them. */
 430 static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
 431                                       struct jffs2_inode_info *f,
 432                                       struct jffs2_readinode_info *rii)
 433 {
 434         struct jffs2_tmp_dnode_info *pen, *last, *this;
 435         struct rb_root ver_root = RB_ROOT;
 436         uint32_t high_ver = 0;
 437
 438         if (rii->mdata_tn) {
 439                 dbg_readinode("potential mdata is ver %d at %p\n", rii->mdata_tn->version, rii->mdata_tn);
 440                 high_ver = rii->mdata_tn->version;
 441                 rii->latest_ref = rii->mdata_tn->fn->raw;
 442         }
 443 #ifdef JFFS2_DBG_READINODE_MESSAGES
 444         this = tn_last(&rii->tn_root);
 445         while (this) {
 446                 dbg_readinode("tn %p ver %d range 0x%x-0x%x ov %d\n", this, this->version, this->fn->ofs,
 447                               this->fn->ofs+this->fn->size, this->overlapped);
 448                 this = tn_prev(this);
 449         }
 450 #endif
 451         pen = tn_last(&rii->tn_root);
 452         while ((last = pen)) {
 453                 pen = tn_prev(last);
 454
 455                 eat_last(&rii->tn_root, &last->rb);
 456                 ver_insert(&ver_root, last);
 457
 458                 if (unlikely(last->overlapped))
 459                         continue;
 460
 461                 /* Now we have a bunch of nodes in reverse version
 462                    order, in the tree at ver_root. Most of the time,
 463                    there'll actually be only one node in the 'tree',
 464                    in fact. */
 465                 this = tn_last(&ver_root);
 466
 467                 while (this) {
 468                         struct jffs2_tmp_dnode_info *vers_next;
 469                         int ret;
 470                         vers_next = tn_prev(this);
 471                         eat_last(&ver_root, &this->rb);
 472                         if (check_tn_node(c, this)) {
 473                                 dbg_readinode("node ver %d, 0x%x-0x%x failed CRC\n",
 474                                              this->version, this->fn->ofs,
 475                                              this->fn->ofs+this->fn->size);
 476                                 jffs2_kill_tn(c, this);
 477                         } else {
 478                                 if (this->version > high_ver) {
 479                                         /* Note that this is different from the other
 480                                            highest_version, because this one is only
 481                                            counting _valid_ nodes which could give the
 482                                            latest inode metadata */
 483                                         high_ver = this->version;
 484                                         rii->latest_ref = this->fn->raw;
 485                                 }
 486                                 dbg_readinode("Add %p (v %d, 0x%x-0x%x, ov %d) to fragtree\n",
 487                                              this, this->version, this->fn->ofs,
 488                                              this->fn->ofs+this->fn->size, this->overlapped);
 489
 490                                 ret = jffs2_add_full_dnode_to_inode(c, f, this->fn);
 491                                 if (ret) {
 492                                         /* Free the nodes in vers_root; let the caller
 493                                            deal with the rest */
 494                                         JFFS2_ERROR("Add node to tree failed %d\n", ret);
 495                                         while (1) {
 496                                                 vers_next = tn_prev(this);
 497                                                 if (check_tn_node(c, this))
 498                                                         jffs2_mark_node_obsolete(c, this->fn->raw);
 499                                                 jffs2_free_full_dnode(this->fn);
 500                                                 jffs2_free_tmp_dnode_info(this);
 501                                                 this = vers_next;
 502                                                 if (!this)
 503                                                         break;
 504                                                 eat_last(&ver_root, &vers_next->rb);
 505                                         }
 506                                         return ret;
 507                                 }
 508                                 jffs2_free_tmp_dnode_info(this);
 509                         }
 510                         this = vers_next;
 511                 }
 512         }
 513         return 0;
 514 }
 515
 516 static void jffs2_free_tmp_dnode_info_list(struct rb_root *list)
 517 {
 518         struct rb_node *this;
 519         struct jffs2_tmp_dnode_info *tn;
 520
 521         this = list->rb_node;
 522
 523         /* Now at bottom of tree */
 524         while (this) {
 525                 if (this->rb_left)
 526                         this = this->rb_left;
 527                 else if (this->rb_right)
 528                         this = this->rb_right;
 529                 else {
 530                         tn = rb_entry(this, struct jffs2_tmp_dnode_info, rb);
 531                         jffs2_free_full_dnode(tn->fn);
 532                         jffs2_free_tmp_dnode_info(tn);
 533
 534                         this = rb_parent(this);
 535                         if (!this)
 536                                 break;
 537
 538                         if (this->rb_left == &tn->rb)
 539                                 this->rb_left = NULL;
 540                         else if (this->rb_right == &tn->rb)
 541                                 this->rb_right = NULL;
 542                         else BUG();
 543                 }
 544         }
 545         list->rb_node = NULL;
 546 }
 547
 548 static void jffs2_free_full_dirent_list(struct jffs2_full_dirent *fd)
 549 {
 550         struct jffs2_full_dirent *next;
 551
 552         while (fd) {
 553                 next = fd->next;
 554                 jffs2_free_full_dirent(fd);
 555                 fd = next;
 556         }
 557 }
 558
 559 /* Returns first valid node after 'ref'. May return 'ref' */
 560 static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_ref *ref)
 561 {
 562         while (ref && ref->next_in_ino) {
 563                 if (!ref_obsolete(ref))
 564                         return ref;
 565                 dbg_noderef("node at 0x%08x is obsoleted. Ignoring.\n", ref_offset(ref));
 566                 ref = ref->next_in_ino;
 567         }
 568         return NULL;
 569 }
 570
 571 /*
 572  * Helper function for jffs2_get_inode_nodes().
 573  * It is called every time an directory entry node is found.
 574  *
 575  * Returns: 0 on success;
 576  *          negative error code on failure.
 577  */
 578 static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 579                                 struct jffs2_raw_dirent *rd, size_t read,
 580                                 struct jffs2_readinode_info *rii)
 581 {
 582         struct jffs2_full_dirent *fd;
 583         uint32_t crc;
 584
 585         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 586         BUG_ON(ref_obsolete(ref));
 587
 588         crc = crc32(0, rd, sizeof(*rd) - 8);
 589         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 590                 JFFS2_NOTICE("header CRC failed on dirent node at %#08x: read %#08x, calculated %#08x\n",
 591                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 592                 jffs2_mark_node_obsolete(c, ref);
 593                 return 0;
 594         }
 595
 596         /* If we've never checked the CRCs on this node, check them now */
 597         if (ref_flags(ref) == REF_UNCHECKED) {
 598                 struct jffs2_eraseblock *jeb;
 599                 int len;
 600
 601                 /* Sanity check */
 602                 if (unlikely(PAD((rd->nsize + sizeof(*rd))) != PAD(je32_to_cpu(rd->totlen)))) {
 603                         JFFS2_ERROR("illegal nsize in node at %#08x: nsize %#02x, totlen %#04x\n",
 604                                     ref_offset(ref), rd->nsize, je32_to_cpu(rd->totlen));
 605                         jffs2_mark_node_obsolete(c, ref);
 606                         return 0;
 607                 }
 608
 609                 jeb = &c->blocks[ref->flash_offset / c->sector_size];
 610                 len = ref_totlen(c, jeb, ref);
 611
 612                 spin_lock(&c->erase_completion_lock);
 613                 jeb->used_size += len;
 614                 jeb->unchecked_size -= len;
 615                 c->used_size += len;
 616                 c->unchecked_size -= len;
 617                 ref->flash_offset = ref_offset(ref) | dirent_node_state(rd);
 618                 spin_unlock(&c->erase_completion_lock);
 619         }
 620
 621         fd = jffs2_alloc_full_dirent(rd->nsize + 1);
 622         if (unlikely(!fd))
 623                 return -ENOMEM;
 624
 625         fd->raw = ref;
 626         fd->version = je32_to_cpu(rd->version);
 627         fd->ino = je32_to_cpu(rd->ino);
 628         fd->type = rd->type;
 629
 630         if (fd->version > rii->highest_version)
 631                 rii->highest_version = fd->version;
 632
 633         /* Pick out the mctime of the latest dirent */
 634         if(fd->version > rii->mctime_ver && je32_to_cpu(rd->mctime)) {
 635                 rii->mctime_ver = fd->version;
 636                 rii->latest_mctime = je32_to_cpu(rd->mctime);
 637         }
 638
 639         /*
 640          * Copy as much of the name as possible from the raw
 641          * dirent we've already read from the flash.
 642          */
 643         if (read > sizeof(*rd))
 644                 memcpy(&fd->name[0], &rd->name[0],
 645                        min_t(uint32_t, rd->nsize, (read - sizeof(*rd)) ));
 646
 647         /* Do we need to copy any more of the name directly from the flash? */
 648         if (rd->nsize + sizeof(*rd) > read) {
 649                 /* FIXME: point() */
 650                 int err;
 651                 int already = read - sizeof(*rd);
 652
 653                 err = jffs2_flash_read(c, (ref_offset(ref)) + read,
 654                                 rd->nsize - already, &read, &fd->name[already]);
 655                 if (unlikely(read != rd->nsize - already) && likely(!err))
 656                         return -EIO;
 657
 658                 if (unlikely(err)) {
 659                         JFFS2_ERROR("read remainder of name: error %d\n", err);
 660                         jffs2_free_full_dirent(fd);
 661                         return -EIO;
 662                 }
 663         }
 664
 665         fd->nhash = full_name_hash(fd->name, rd->nsize);
 666         fd->next = NULL;
 667         fd->name[rd->nsize] = '\0';
 668
 669         /*
 670          * Wheee. We now have a complete jffs2_full_dirent structure, with
 671          * the name in it and everything. Link it into the list
 672          */
 673         jffs2_add_fd_to_list(c, fd, &rii->fds);
 674
 675         return 0;
 676 }
 677
 678 /*
 679  * Helper function for jffs2_get_inode_nodes().
 680  * It is called every time an inode node is found.
 681  *
 682  * Returns: 0 on success (possibly after marking a bad node obsolete);
 683  *          negative error code on failure.
 684  */
 685 static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 686                              struct jffs2_raw_inode *rd, int rdlen,
 687                              struct jffs2_readinode_info *rii)
 688 {
 689         struct jffs2_tmp_dnode_info *tn;
 690         uint32_t len, csize;
 691         int ret = 0;
 692         uint32_t crc;
 693
 694         /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
 695         BUG_ON(ref_obsolete(ref));
 696
 697         crc = crc32(0, rd, sizeof(*rd) - 8);
 698         if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
 699                 JFFS2_NOTICE("node CRC failed on dnode at %#08x: read %#08x, calculated %#08x\n",
 700                              ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
 701                 jffs2_mark_node_obsolete(c, ref);
 702                 return 0;
 703         }
 704
 705         tn = jffs2_alloc_tmp_dnode_info();
 706         if (!tn) {
 707                 JFFS2_ERROR("failed to allocate tn (%zu bytes).\n", sizeof(*tn));
 708                 return -ENOMEM;
 709         }
 710
 711         tn->partial_crc = 0;
 712         csize = je32_to_cpu(rd->csize);
 713
 714         /* If we've never checked the CRCs on this node, check them now */
 715         if (ref_flags(ref) == REF_UNCHECKED) {
 716
 717                 /* Sanity checks */
 718                 if (unlikely(je32_to_cpu(rd->offset) > je32_to_cpu(rd->isize)) ||
 719                     unlikely(PAD(je32_to_cpu(rd->csize) + sizeof(*rd)) != PAD(je32_to_cpu(rd->totlen)))) {
 720                         JFFS2_WARNING("inode node header CRC is corrupted at %#08x\n", ref_offset(ref));
 721                         jffs2_dbg_dump_node(c, ref_offset(ref));
 722                         jffs2_mark_node_obsolete(c, ref);
 723                         goto free_out;
 724                 }
 725
 726                 if (jffs2_is_writebuffered(c) && csize != 0) {
 727                         /* At this point we are supposed to check the data CRC
 728                          * of our unchecked node. But thus far, we do not
 729                          * know whether the node is valid or obsolete. To
 730                          * figure this out, we need to walk all the nodes of
 731                          * the inode and build the inode fragtree. We don't
 732                          * want to spend time checking data of nodes which may
 733                          * later be found to be obsolete. So we put off the full
 734                          * data CRC checking until we have read all the inode
 735                          * nodes and have started building the fragtree.
 736                          *
 737                          * The fragtree is being built starting with nodes
 738                          * having the highest version number, so we'll be able
 739                          * to detect whether a node is valid (i.e., it is not
 740                          * overlapped by a node with higher version) or not.
 741                          * And we'll be able to check only those nodes, which
 742                          * are not obsolete.
 743                          *
 744                          * Of course, this optimization only makes sense in case
 745                          * of NAND flashes (or other flashes with
 746                          * !jffs2_can_mark_obsolete()), since on NOR flashes
 747                          * nodes are marked obsolete physically.
 748                          *
 749                          * Since NAND flashes (or other flashes with
 750                          * jffs2_is_writebuffered(c)) are anyway read by
 751                          * fractions of c->wbuf_pagesize, and we have just read
 752                          * the node header, it is likely that the starting part
 753                          * of the node data is also read when we read the
 754                          * header. So we don't mind to check the CRC of the
 755                          * starting part of the data of the node now, and check
 756                          * the second part later (in jffs2_check_node_data()).
 757                          * Of course, we will not need to re-read and re-check
 758                          * the NAND page which we have just read. This is why we
 759                          * read the whole NAND page at jffs2_get_inode_nodes(),
 760                          * while we needed only the node header.
 761                          */
 762                         unsigned char *buf;
 763
 764                         /* 'buf' will point to the start of data */
 765                         buf = (unsigned char *)rd + sizeof(*rd);
 766                         /* len will be the read data length */
 767                         len = min_t(uint32_t, rdlen - sizeof(*rd), csize);
 768                         tn->partial_crc = crc32(0, buf, len);
 769
 770                         dbg_readinode("Calculates CRC (%#08x) for %d bytes, csize %d\n", tn->partial_crc, len, csize);
 771
 772                         /* If we actually calculated the whole data CRC
 773                          * and it is wrong, drop the node. */
 774                         if (len >= csize && unlikely(tn->partial_crc != je32_to_cpu(rd->data_crc))) {
 775                                 JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
 776                                         ref_offset(ref), tn->partial_crc, je32_to_cpu(rd->data_crc));
 777                                 jffs2_mark_node_obsolete(c, ref);
 778                                 goto free_out;
 779                         }
 780
 781                 } else if (csize == 0) {
 782                         /*
 783                          * We checked the header CRC. If the node has no data, adjust
 784                          * the space accounting now. For other nodes this will be done
 785                          * later either when the node is marked obsolete or when its
 786                          * data is checked.
 787                          */
 788                         struct jffs2_eraseblock *jeb;
 789
 790                         dbg_readinode("the node has no data.\n");
 791                         jeb = &c->blocks[ref->flash_offset / c->sector_size];
 792                         len = ref_totlen(c, jeb, ref);
 793
 794                         spin_lock(&c->erase_completion_lock);
 795                         jeb->used_size += len;
 796                         jeb->unchecked_size -= len;
 797                         c->used_size += len;
 798                         c->unchecked_size -= len;
 799                         ref->flash_offset = ref_offset(ref) | REF_NORMAL;
 800                         spin_unlock(&c->erase_completion_lock);
 801                 }
 802         }
 803
 804         tn->fn = jffs2_alloc_full_dnode();
 805         if (!tn->fn) {
 806                 JFFS2_ERROR("alloc fn failed\n");
 807                 ret = -ENOMEM;
 808                 goto free_out;
 809         }
 810
 811         tn->version = je32_to_cpu(rd->version);
 812         tn->fn->ofs = je32_to_cpu(rd->offset);
 813         tn->data_crc = je32_to_cpu(rd->data_crc);
 814         tn->csize = csize;
 815         tn->fn->raw = ref;
 816         tn->overlapped = 0;
 817
 818         if (tn->version > rii->highest_version)
 819                 rii->highest_version = tn->version;
 820
 821         /* There was a bug where we wrote hole nodes out with
 822            csize/dsize swapped. Deal with it */
 823         if (rd->compr == JFFS2_COMPR_ZERO && !je32_to_cpu(rd->dsize) && csize)
 824                 tn->fn->size = csize;
 825         else // normal case...
 826                 tn->fn->size = je32_to_cpu(rd->dsize);
 827
 828         dbg_readinode("dnode @%08x: ver %u, offset %#04x, dsize %#04x, csize %#04x\n",
 829                   ref_offset(ref), je32_to_cpu(rd->version), je32_to_cpu(rd->offset), je32_to_cpu(rd->dsize), csize);
 830
 831         ret = jffs2_add_tn_to_tree(c, rii, tn);
 832
 833         if (ret) {
 834                 jffs2_free_full_dnode(tn->fn);
 835         free_out:
 836                 jffs2_free_tmp_dnode_info(tn);
 837                 return ret;
 838         }
 839 #ifdef JFFS2_DBG_READINODE_MESSAGES
 840         dbg_readinode("After adding ver %d:\n", je32_to_cpu(rd->version));
 841         tn = tn_first(&rii->tn_root);
 842         while (tn) {
 843                 dbg_readinode("%p: v %d r 0x%x-0x%x ov %d\n",
 844                              tn, tn->version, tn->fn->ofs,
 845                              tn->fn->ofs+tn->fn->size, tn->overlapped);
 846                 tn = tn_next(tn);
 847         }
 848 #endif
 849         return 0;
 850 }
 851
 852 /*
 853  * Helper function for jffs2_get_inode_nodes().
 854  * It is called every time an unknown node is found.
 855  *
 856  * Returns: 0 on success;
 857  *          negative error code on failure.
 858  */
 859 static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref, struct jffs2_unknown_node *un)
 860 {
 861         /* We don't mark unknown nodes as REF_UNCHECKED */
 862         if (ref_flags(ref) == REF_UNCHECKED) {
 863                 JFFS2_ERROR("REF_UNCHECKED but unknown node at %#08x\n",
 864                             ref_offset(ref));
 865                 JFFS2_ERROR("Node is {%04x,%04x,%08x,%08x}. Please report this error.\n",
 866                             je16_to_cpu(un->magic), je16_to_cpu(un->nodetype),
 867                             je32_to_cpu(un->totlen), je32_to_cpu(un->hdr_crc));
 868                 jffs2_mark_node_obsolete(c, ref);
 869                 return 0;
 870         }
 871
 872         un->nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(un->nodetype));
 873
 874         switch(je16_to_cpu(un->nodetype) & JFFS2_COMPAT_MASK) {
 875
 876         case JFFS2_FEATURE_INCOMPAT:
 877                 JFFS2_ERROR("unknown INCOMPAT nodetype %#04X at %#08x\n",
 878                             je16_to_cpu(un->nodetype), ref_offset(ref));
 879                 /* EEP */
 880                 BUG();
 881                 break;
 882
 883         case JFFS2_FEATURE_ROCOMPAT:
 884                 JFFS2_ERROR("unknown ROCOMPAT nodetype %#04X at %#08x\n",
 885                             je16_to_cpu(un->nodetype), ref_offset(ref));
 886                 BUG_ON(!(c->flags & JFFS2_SB_FLAG_RO));
 887                 break;
 888
 889         case JFFS2_FEATURE_RWCOMPAT_COPY:
 890                 JFFS2_NOTICE("unknown RWCOMPAT_COPY nodetype %#04X at %#08x\n",
 891                              je16_to_cpu(un->nodetype), ref_offset(ref));
 892                 break;
 893
 894         case JFFS2_FEATURE_RWCOMPAT_DELETE:
 895                 JFFS2_NOTICE("unknown RWCOMPAT_DELETE nodetype %#04X at %#08x\n",
 896                              je16_to_cpu(un->nodetype), ref_offset(ref));
 897                 jffs2_mark_node_obsolete(c, ref);
 898                 return 0;
 899         }
 900
 901         return 0;
 902 }
 903
 904 /*
 905  * Helper function for jffs2_get_inode_nodes().
 906  * The function detects whether more data should be read and reads it if yes.
 907  *
 908  * Returns: 0 on succes;
 909  *          negative error code on failure.
 910  */
 911 static int read_more(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
 912                      int needed_len, int *rdlen, unsigned char *buf)
 913 {
 914         int err, to_read = needed_len - *rdlen;
 915         size_t retlen;
 916         uint32_t offs;
 917
 918         if (jffs2_is_writebuffered(c)) {
 919                 int rem = to_read % c->wbuf_pagesize;
 920
 921                 if (rem)
 922                         to_read += c->wbuf_pagesize - rem;
 923         }
 924
 925         /* We need to read more data */
 926         offs = ref_offset(ref) + *rdlen;
 927
 928         dbg_readinode("read more %d bytes\n", to_read);
 929
 930         err = jffs2_flash_read(c, offs, to_read, &retlen, buf + *rdlen);
 931         if (err) {
 932                 JFFS2_ERROR("can not read %d bytes from 0x%08x, "
 933                         "error code: %d.\n", to_read, offs, err);
 934                 return err;
 935         }
 936
 937         if (retlen < to_read) {
 938                 JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n",
 939                                 offs, retlen, to_read);
 940                 return -EIO;
 941         }
 942
 943         *rdlen += to_read;
 944         return 0;
 945 }
 946
 947 /* Get tmp_dnode_info and full_dirent for all non-obsolete nodes associated
 948    with this ino. Perform a preliminary ordering on data nodes, throwing away
 949    those which are completely obsoleted by newer ones. The naïve approach we
 950    use to take of just returning them _all_ in version order will cause us to
 951    run out of memory in certain degenerate cases. */
 952 static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
 953                                  struct jffs2_readinode_info *rii)
 954 {
 955         struct jffs2_raw_node_ref *ref, *valid_ref;
 956         unsigned char *buf = NULL;
 957         union jffs2_node_union *node;
 958         size_t retlen;
 959         int len, err;
 960
 961         rii->mctime_ver = 0;
 962
 963         dbg_readinode("ino #%u\n", f->inocache->ino);
 964
 965         /* FIXME: in case of NOR and available ->point() this
 966          * needs to be fixed. */
 967         len = sizeof(union jffs2_node_union) + c->wbuf_pagesize;
 968         buf = kmalloc(len, GFP_KERNEL);
 969         if (!buf)
 970                 return -ENOMEM;
 971
 972         spin_lock(&c->erase_completion_lock);
 973         valid_ref = jffs2_first_valid_node(f->inocache->nodes);
 974         if (!valid_ref && f->inocache->ino != 1)
 975                 JFFS2_WARNING("Eep. No valid nodes for ino #%u.\n", f->inocache->ino);
 976         while (valid_ref) {
 977                 /* We can hold a pointer to a non-obsolete node without the spinlock,
 978                    but _obsolete_ nodes may disappear at any time, if the block
 979                    they're in gets erased. So if we mark 'ref' obsolete while we're
 980                    not holding the lock, it can go away immediately. For that reason,
 981                    we find the next valid node first, before processing 'ref'.
 982                 */
 983                 ref = valid_ref;
 984                 valid_ref = jffs2_first_valid_node(ref->next_in_ino);
 985                 spin_unlock(&c->erase_completion_lock);
 986
 987                 cond_resched();
 988
 989                 /*
 990                  * At this point we don't know the type of the node we're going
 991                  * to read, so we do not know the size of its header. In order
 992                  * to minimize the amount of flash IO we assume the header is
 993                  * of size = JFFS2_MIN_NODE_HEADER.
 994                  */
 995                 len = JFFS2_MIN_NODE_HEADER;
 996                 if (jffs2_is_writebuffered(c)) {
 997                         int end, rem;
 998
 999                         /*
1000                          * We are about to read JFFS2_MIN_NODE_HEADER bytes,
1001                          * but this flash has some minimal I/O unit. It is
1002                          * possible that we'll need to read more soon, so read
1003                          * up to the next min. I/O unit, in order not to
1004                          * re-read the same min. I/O unit twice.
1005                          */
1006                         end = ref_offset(ref) + len;
1007                         rem = end % c->wbuf_pagesize;
1008                         if (rem)
1009                                 end += c->wbuf_pagesize - rem;
1010                         len = end - ref_offset(ref);
1011                 }
1012
1013                 dbg_readinode("read %d bytes at %#08x(%d).\n", len, ref_offset(ref), ref_flags(ref));
1014
1015                 /* FIXME: point() */
1016                 err = jffs2_flash_read(c, ref_offset(ref), len, &retlen, buf);
1017                 if (err) {
1018                         JFFS2_ERROR("can not read %d bytes from 0x%08x, " "error code: %d.\n", len, ref_offset(ref), err);
1019                         goto free_out;
1020                 }
1021
1022                 if (retlen < len) {
1023                         JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n", ref_offset(ref), retlen, len);
1024                         err = -EIO;
1025                         goto free_out;
1026                 }
1027
1028                 node = (union jffs2_node_union *)buf;
1029
1030                 /* No need to mask in the valid bit; it shouldn't be invalid */
1031                 if (je32_to_cpu(node->u.hdr_crc) != crc32(0, node, sizeof(node->u)-4)) {
1032                         JFFS2_NOTICE("Node header CRC failed at %#08x. {%04x,%04x,%08x,%08x}\n",
1033                                      ref_offset(ref), je16_to_cpu(node->u.magic),
1034                                      je16_to_cpu(node->u.nodetype),
1035                                      je32_to_cpu(node->u.totlen),
1036                                      je32_to_cpu(node->u.hdr_crc));
1037                         jffs2_dbg_dump_node(c, ref_offset(ref));
1038                         jffs2_mark_node_obsolete(c, ref);
1039                         goto cont;
1040                 }
1041                 if (je16_to_cpu(node->u.magic) != JFFS2_MAGIC_BITMASK) {
1042                         /* Not a JFFS2 node, whinge and move on */
1043                         JFFS2_NOTICE("Wrong magic bitmask 0x%04x in node header at %#08x.\n",
1044                                      je16_to_cpu(node->u.magic), ref_offset(ref));
1045                         jffs2_mark_node_obsolete(c, ref);
1046                         goto cont;
1047                 }
1048
1049                 switch (je16_to_cpu(node->u.nodetype)) {
1050
1051                 case JFFS2_NODETYPE_DIRENT:
1052
1053                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent) &&
1054                             len < sizeof(struct jffs2_raw_dirent)) {
1055                                 err = read_more(c, ref, sizeof(struct jffs2_raw_dirent), &len, buf);
1056                                 if (unlikely(err))
1057                                         goto free_out;
1058                         }
1059
1060                         err = read_direntry(c, ref, &node->d, retlen, rii);
1061                         if (unlikely(err))
1062                                 goto free_out;
1063
1064                         break;
1065
1066                 case JFFS2_NODETYPE_INODE:
1067
1068                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode) &&
1069                             len < sizeof(struct jffs2_raw_inode)) {
1070                                 err = read_more(c, ref, sizeof(struct jffs2_raw_inode), &len, buf);
1071                                 if (unlikely(err))
1072                                         goto free_out;
1073                         }
1074
1075                         err = read_dnode(c, ref, &node->i, len, rii);
1076                         if (unlikely(err))
1077                                 goto free_out;
1078
1079                         break;
1080
1081                 default:
1082                         if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node) &&
1083                             len < sizeof(struct jffs2_unknown_node)) {
1084                                 err = read_more(c, ref, sizeof(struct jffs2_unknown_node), &len, buf);
1085                                 if (unlikely(err))
1086                                         goto free_out;
1087                         }
1088
1089                         err = read_unknown(c, ref, &node->u);
1090                         if (unlikely(err))
1091                                 goto free_out;
1092
1093                 }
1094         cont:
1095                 spin_lock(&c->erase_completion_lock);
1096         }
1097
1098         spin_unlock(&c->erase_completion_lock);
1099         kfree(buf);
1100
1101         f->highest_version = rii->highest_version;
1102
1103         dbg_readinode("nodes of inode #%u were read, the highest version is %u, latest_mctime %u, mctime_ver %u.\n",
1104                       f->inocache->ino, rii->highest_version, rii->latest_mctime,
1105                       rii->mctime_ver);
1106         return 0;
1107
1108  free_out:
1109         jffs2_free_tmp_dnode_info_list(&rii->tn_root);
1110         jffs2_free_full_dirent_list(rii->fds);
1111         rii->fds = NULL;
1112         kfree(buf);
1113         return err;
1114 }
1115
1116 static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
1117                                         struct jffs2_inode_info *f,
1118                                         struct jffs2_raw_inode *latest_node)
1119 {
1120         struct jffs2_readinode_info rii;
1121         uint32_t crc, new_size;
1122         size_t retlen;
1123         int ret;
1124
1125         dbg_readinode("ino #%u nlink is %d\n", f->inocache->ino, f->inocache->nlink);
1126
1127         memset(&rii, 0, sizeof(rii));
1128
1129         /* Grab all nodes relevant to this ino */
1130         ret = jffs2_get_inode_nodes(c, f, &rii);
1131
1132         if (ret) {
1133                 JFFS2_ERROR("cannot read nodes for ino %u, returned error is %d\n", f->inocache->ino, ret);
1134                 if (f->inocache->state == INO_STATE_READING)
1135                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1136                 return ret;
1137         }
1138
1139         ret = jffs2_build_inode_fragtree(c, f, &rii);
1140         if (ret) {
1141                 JFFS2_ERROR("Failed to build final fragtree for inode #%u: error %d\n",
1142                             f->inocache->ino, ret);
1143                 if (f->inocache->state == INO_STATE_READING)
1144                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1145                 jffs2_free_tmp_dnode_info_list(&rii.tn_root);
1146                 /* FIXME: We could at least crc-check them all */
1147                 if (rii.mdata_tn) {
1148                         jffs2_free_full_dnode(rii.mdata_tn->fn);
1149                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1150                         rii.mdata_tn = NULL;
1151                 }
1152                 return ret;
1153         }
1154
1155         if (rii.mdata_tn) {
1156                 if (rii.mdata_tn->fn->raw == rii.latest_ref) {
1157                         f->metadata = rii.mdata_tn->fn;
1158                         jffs2_free_tmp_dnode_info(rii.mdata_tn);
1159                 } else {
1160                         jffs2_kill_tn(c, rii.mdata_tn);
1161                 }
1162                 rii.mdata_tn = NULL;
1163         }
1164
1165         f->dents = rii.fds;
1166
1167         jffs2_dbg_fragtree_paranoia_check_nolock(f);
1168
1169         if (unlikely(!rii.latest_ref)) {
1170                 /* No data nodes for this inode. */
1171                 if (f->inocache->ino != 1) {
1172                         JFFS2_WARNING("no data nodes found for ino #%u\n", f->inocache->ino);
1173                         if (!rii.fds) {
1174                                 if (f->inocache->state == INO_STATE_READING)
1175                                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1176                                 return -EIO;
1177                         }
1178                         JFFS2_NOTICE("but it has children so we fake some modes for it\n");
1179                 }
1180                 latest_node->mode = cpu_to_jemode(S_IFDIR|S_IRUGO|S_IWUSR|S_IXUGO);
1181                 latest_node->version = cpu_to_je32(0);
1182                 latest_node->atime = latest_node->ctime = latest_node->mtime = cpu_to_je32(0);
1183                 latest_node->isize = cpu_to_je32(0);
1184                 latest_node->gid = cpu_to_je16(0);
1185                 latest_node->uid = cpu_to_je16(0);
1186                 if (f->inocache->state == INO_STATE_READING)
1187                         jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1188                 return 0;
1189         }
1190
1191         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref), sizeof(*latest_node), &retlen, (void *)latest_node);
1192         if (ret || retlen != sizeof(*latest_node)) {
1193                 JFFS2_ERROR("failed to read from flash: error %d, %zd of %zd bytes read\n",
1194                         ret, retlen, sizeof(*latest_node));
1195                 /* FIXME: If this fails, there seems to be a memory leak. Find it. */
1196                 up(&f->sem);
1197                 jffs2_do_clear_inode(c, f);
1198                 return ret?ret:-EIO;
1199         }
1200
1201         crc = crc32(0, latest_node, sizeof(*latest_node)-8);
1202         if (crc != je32_to_cpu(latest_node->node_crc)) {
1203                 JFFS2_ERROR("CRC failed for read_inode of inode %u at physical location 0x%x\n",
1204                         f->inocache->ino, ref_offset(rii.latest_ref));
1205                 up(&f->sem);
1206                 jffs2_do_clear_inode(c, f);
1207                 return -EIO;
1208         }
1209
1210         switch(jemode_to_cpu(latest_node->mode) & S_IFMT) {
1211         case S_IFDIR:
1212                 if (rii.mctime_ver > je32_to_cpu(latest_node->version)) {
1213                         /* The times in the latest_node are actually older than
1214                            mctime in the latest dirent. Cheat. */
1215                         latest_node->ctime = latest_node->mtime = cpu_to_je32(rii.latest_mctime);
1216                 }
1217                 break;
1218
1219
1220         case S_IFREG:
1221                 /* If it was a regular file, truncate it to the latest node's isize */
1222                 new_size = jffs2_truncate_fragtree(c, &f->fragtree, je32_to_cpu(latest_node->isize));
1223                 if (new_size != je32_to_cpu(latest_node->isize)) {
1224                         JFFS2_WARNING("Truncating ino #%u to %d bytes failed because it only had %d bytes to start with!\n",
1225                                       f->inocache->ino, je32_to_cpu(latest_node->isize), new_size);
1226                         latest_node->isize = cpu_to_je32(new_size);
1227                 }
1228                 break;
1229
1230         case S_IFLNK:
1231                 /* Hack to work around broken isize in old symlink code.
1232                    Remove this when dwmw2 comes to his senses and stops
1233                    symlinks from being an entirely gratuitous special
1234                    case. */
1235                 if (!je32_to_cpu(latest_node->isize))
1236                         latest_node->isize = latest_node->dsize;
1237
1238                 if (f->inocache->state != INO_STATE_CHECKING) {
1239                         /* Symlink's inode data is the target path. Read it and
1240                          * keep in RAM to facilitate quick follow symlink
1241                          * operation. */
1242                         f->target = kmalloc(je32_to_cpu(latest_node->csize) + 1, GFP_KERNEL);
1243                         if (!f->target) {
1244                                 JFFS2_ERROR("can't allocate %d bytes of memory for the symlink target path cache\n", je32_to_cpu(latest_node->csize));
1245                                 up(&f->sem);
1246                                 jffs2_do_clear_inode(c, f);
1247                                 return -ENOMEM;
1248                         }
1249
1250                         ret = jffs2_flash_read(c, ref_offset(rii.latest_ref) + sizeof(*latest_node),
1251                                                 je32_to_cpu(latest_node->csize), &retlen, (char *)f->target);
1252
1253                         if (ret  || retlen != je32_to_cpu(latest_node->csize)) {
1254                                 if (retlen != je32_to_cpu(latest_node->csize))
1255                                         ret = -EIO;
1256                                 kfree(f->target);
1257                                 f->target = NULL;
1258                                 up(&f->sem);
1259                                 jffs2_do_clear_inode(c, f);
1260                                 return -ret;
1261                         }
1262
1263                         f->target[je32_to_cpu(latest_node->csize)] = '\0';
1264                         dbg_readinode("symlink's target '%s' cached\n", f->target);
1265                 }
1266
1267                 /* fall through... */
1268
1269         case S_IFBLK:
1270         case S_IFCHR:
1271                 /* Certain inode types should have only one data node, and it's
1272                    kept as the metadata node */
1273                 if (f->metadata) {
1274                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o had metadata node\n",
1275                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1276                         up(&f->sem);
1277                         jffs2_do_clear_inode(c, f);
1278                         return -EIO;
1279                 }
1280                 if (!frag_first(&f->fragtree)) {
1281                         JFFS2_ERROR("Argh. Special inode #%u with mode 0%o has no fragments\n",
1282                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1283                         up(&f->sem);
1284                         jffs2_do_clear_inode(c, f);
1285                         return -EIO;
1286                 }
1287                 /* ASSERT: f->fraglist != NULL */
1288                 if (frag_next(frag_first(&f->fragtree))) {
1289                         JFFS2_ERROR("Argh. Special inode #%u with mode 0x%x had more than one node\n",
1290                                f->inocache->ino, jemode_to_cpu(latest_node->mode));
1291                         /* FIXME: Deal with it - check crc32, check for duplicate node, check times and discard the older one */
1292                         up(&f->sem);
1293                         jffs2_do_clear_inode(c, f);
1294                         return -EIO;
1295                 }
1296                 /* OK. We're happy */
1297                 f->metadata = frag_first(&f->fragtree)->node;
1298                 jffs2_free_node_frag(frag_first(&f->fragtree));
1299                 f->fragtree = RB_ROOT;
1300                 break;
1301         }
1302         if (f->inocache->state == INO_STATE_READING)
1303                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1304
1305         return 0;
1306 }
1307
1308 /* Scan the list of all nodes present for this ino, build map of versions, etc. */
1309 int jffs2_do_read_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
1310                         uint32_t ino, struct jffs2_raw_inode *latest_node)
1311 {
1312         dbg_readinode("read inode #%u\n", ino);
1313
1314  retry_inocache:
1315         spin_lock(&c->inocache_lock);
1316         f->inocache = jffs2_get_ino_cache(c, ino);
1317
1318         if (f->inocache) {
1319                 /* Check its state. We may need to wait before we can use it */
1320                 switch(f->inocache->state) {
1321                 case INO_STATE_UNCHECKED:
1322                 case INO_STATE_CHECKEDABSENT:
1323                         f->inocache->state = INO_STATE_READING;
1324                         break;
1325
1326                 case INO_STATE_CHECKING:
1327                 case INO_STATE_GC:
1328                         /* If it's in either of these states, we need
1329                            to wait for whoever's got it to finish and
1330                            put it back. */
1331                         dbg_readinode("waiting for ino #%u in state %d\n", ino, f->inocache->state);
1332                         sleep_on_spinunlock(&c->inocache_wq, &c->inocache_lock);
1333                         goto retry_inocache;
1334
1335                 case INO_STATE_READING:
1336                 case INO_STATE_PRESENT:
1337                         /* Eep. This should never happen. It can
1338                         happen if Linux calls read_inode() again
1339                         before clear_inode() has finished though. */
1340                         JFFS2_ERROR("Eep. Trying to read_inode #%u when it's already in state %d!\n", ino, f->inocache->state);
1341                         /* Fail. That's probably better than allowing it to succeed */
1342                         f->inocache = NULL;
1343                         break;
1344
1345                 default:
1346                         BUG();
1347                 }
1348         }
1349         spin_unlock(&c->inocache_lock);
1350
1351         if (!f->inocache && ino == 1) {
1352                 /* Special case - no root inode on medium */
1353                 f->inocache = jffs2_alloc_inode_cache();
1354                 if (!f->inocache) {
1355                         JFFS2_ERROR("cannot allocate inocache for root inode\n");
1356                         return -ENOMEM;
1357                 }
1358                 dbg_readinode("creating inocache for root inode\n");
1359                 memset(f->inocache, 0, sizeof(struct jffs2_inode_cache));
1360                 f->inocache->ino = f->inocache->nlink = 1;
1361                 f->inocache->nodes = (struct jffs2_raw_node_ref *)f->inocache;
1362                 f->inocache->state = INO_STATE_READING;
1363                 jffs2_add_ino_cache(c, f->inocache);
1364         }
1365         if (!f->inocache) {
1366                 JFFS2_ERROR("requestied to read an nonexistent ino %u\n", ino);
1367                 return -ENOENT;
1368         }
1369
1370         return jffs2_do_read_inode_internal(c, f, latest_node);
1371 }
1372
1373 int jffs2_do_crccheck_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
1374 {
1375         struct jffs2_raw_inode n;
1376         struct jffs2_inode_info *f = kzalloc(sizeof(*f), GFP_KERNEL);
1377         int ret;
1378
1379         if (!f)
1380                 return -ENOMEM;
1381
1382         init_MUTEX_LOCKED(&f->sem);
1383         f->inocache = ic;
1384
1385         ret = jffs2_do_read_inode_internal(c, f, &n);
1386         if (!ret) {
1387                 up(&f->sem);
1388                 jffs2_do_clear_inode(c, f);
1389         }
1390         kfree (f);
1391         return ret;
1392 }
1393
1394 void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
1395 {
1396         struct jffs2_full_dirent *fd, *fds;
1397         int deleted;
1398
1399         jffs2_clear_acl(f);
1400         jffs2_xattr_delete_inode(c, f->inocache);
1401         down(&f->sem);
1402         deleted = f->inocache && !f->inocache->nlink;
1403
1404         if (f->inocache && f->inocache->state != INO_STATE_CHECKING)
1405                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CLEARING);
1406
1407         if (f->metadata) {
1408                 if (deleted)
1409                         jffs2_mark_node_obsolete(c, f->metadata->raw);
1410                 jffs2_free_full_dnode(f->metadata);
1411         }
1412
1413         jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
1414
1415         if (f->target) {
1416                 kfree(f->target);
1417                 f->target = NULL;
1418         }
1419
1420         fds = f->dents;
1421         while(fds) {
1422                 fd = fds;
1423                 fds = fd->next;
1424                 jffs2_free_full_dirent(fd);
1425         }
1426
1427         if (f->inocache && f->inocache->state != INO_STATE_CHECKING) {
1428                 jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1429                 if (f->inocache->nodes == (void *)f->inocache)
1430                         jffs2_del_ino_cache(c, f->inocache);
1431         }
1432
1433         up(&f->sem);
1434 }