xref: /openbmc/linux/fs/jffs2/readinode.c (revision 22246614)
1 /*
2  * JFFS2 -- Journalling Flash File System, Version 2.
3  *
4  * Copyright © 2001-2007 Red Hat, Inc.
5  *
6  * Created by David Woodhouse <dwmw2@infradead.org>
7  *
8  * For licensing information, see the file 'LICENCE' in this directory.
9  *
10  */
11 
12 #include <linux/kernel.h>
13 #include <linux/sched.h>
14 #include <linux/slab.h>
15 #include <linux/fs.h>
16 #include <linux/crc32.h>
17 #include <linux/pagemap.h>
18 #include <linux/mtd/mtd.h>
19 #include <linux/compiler.h>
20 #include "nodelist.h"
21 
22 /*
23  * Check the data CRC of the node.
24  *
25  * Returns: 0 if the data CRC is correct;
26  * 	    1 - if incorrect;
27  *	    error code if an error occured.
28  */
29 static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
30 {
31 	struct jffs2_raw_node_ref *ref = tn->fn->raw;
32 	int err = 0, pointed = 0;
33 	struct jffs2_eraseblock *jeb;
34 	unsigned char *buffer;
35 	uint32_t crc, ofs, len;
36 	size_t retlen;
37 
38 	BUG_ON(tn->csize == 0);
39 
40 	/* Calculate how many bytes were already checked */
41 	ofs = ref_offset(ref) + sizeof(struct jffs2_raw_inode);
42 	len = tn->csize;
43 
44 	if (jffs2_is_writebuffered(c)) {
45 		int adj = ofs % c->wbuf_pagesize;
46 		if (likely(adj))
47 			adj = c->wbuf_pagesize - adj;
48 
49 		if (adj >= tn->csize) {
50 			dbg_readinode("no need to check node at %#08x, data length %u, data starts at %#08x - it has already been checked.\n",
51 				      ref_offset(ref), tn->csize, ofs);
52 			goto adj_acc;
53 		}
54 
55 		ofs += adj;
56 		len -= adj;
57 	}
58 
59 	dbg_readinode("check node at %#08x, data length %u, partial CRC %#08x, correct CRC %#08x, data starts at %#08x, start checking from %#08x - %u bytes.\n",
60 		ref_offset(ref), tn->csize, tn->partial_crc, tn->data_crc, ofs - len, ofs, len);
61 
62 #ifndef __ECOS
63 	/* TODO: instead, incapsulate point() stuff to jffs2_flash_read(),
64 	 * adding and jffs2_flash_read_end() interface. */
65 	if (c->mtd->point) {
66 		err = c->mtd->point(c->mtd, ofs, len, &retlen,
67 				    (void **)&buffer, NULL);
68 		if (!err && retlen < len) {
69 			JFFS2_WARNING("MTD point returned len too short: %zu instead of %u.\n", retlen, tn->csize);
70 			c->mtd->unpoint(c->mtd, ofs, retlen);
71 		} else if (err)
72 			JFFS2_WARNING("MTD point failed: error code %d.\n", err);
73 		else
74 			pointed = 1; /* succefully pointed to device */
75 	}
76 #endif
77 
78 	if (!pointed) {
79 		buffer = kmalloc(len, GFP_KERNEL);
80 		if (unlikely(!buffer))
81 			return -ENOMEM;
82 
83 		/* TODO: this is very frequent pattern, make it a separate
84 		 * routine */
85 		err = jffs2_flash_read(c, ofs, len, &retlen, buffer);
86 		if (err) {
87 			JFFS2_ERROR("can not read %d bytes from 0x%08x, error code: %d.\n", len, ofs, err);
88 			goto free_out;
89 		}
90 
91 		if (retlen != len) {
92 			JFFS2_ERROR("short read at %#08x: %zd instead of %d.\n", ofs, retlen, len);
93 			err = -EIO;
94 			goto free_out;
95 		}
96 	}
97 
98 	/* Continue calculating CRC */
99 	crc = crc32(tn->partial_crc, buffer, len);
100 	if(!pointed)
101 		kfree(buffer);
102 #ifndef __ECOS
103 	else
104 		c->mtd->unpoint(c->mtd, ofs, len);
105 #endif
106 
107 	if (crc != tn->data_crc) {
108 		JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
109 			     ref_offset(ref), tn->data_crc, crc);
110 		return 1;
111 	}
112 
113 adj_acc:
114 	jeb = &c->blocks[ref->flash_offset / c->sector_size];
115 	len = ref_totlen(c, jeb, ref);
116 	/* If it should be REF_NORMAL, it'll get marked as such when
117 	   we build the fragtree, shortly. No need to worry about GC
118 	   moving it while it's marked REF_PRISTINE -- GC won't happen
119 	   till we've finished checking every inode anyway. */
120 	ref->flash_offset |= REF_PRISTINE;
121 	/*
122 	 * Mark the node as having been checked and fix the
123 	 * accounting accordingly.
124 	 */
125 	spin_lock(&c->erase_completion_lock);
126 	jeb->used_size += len;
127 	jeb->unchecked_size -= len;
128 	c->used_size += len;
129 	c->unchecked_size -= len;
130 	jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
131 	spin_unlock(&c->erase_completion_lock);
132 
133 	return 0;
134 
135 free_out:
136 	if(!pointed)
137 		kfree(buffer);
138 #ifndef __ECOS
139 	else
140 		c->mtd->unpoint(c->mtd, ofs, len);
141 #endif
142 	return err;
143 }
144 
145 /*
146  * Helper function for jffs2_add_older_frag_to_fragtree().
147  *
148  * Checks the node if we are in the checking stage.
149  */
150 static int check_tn_node(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
151 {
152 	int ret;
153 
154 	BUG_ON(ref_obsolete(tn->fn->raw));
155 
156 	/* We only check the data CRC of unchecked nodes */
157 	if (ref_flags(tn->fn->raw) != REF_UNCHECKED)
158 		return 0;
159 
160 	dbg_readinode("check node %#04x-%#04x, phys offs %#08x\n",
161 		      tn->fn->ofs, tn->fn->ofs + tn->fn->size, ref_offset(tn->fn->raw));
162 
163 	ret = check_node_data(c, tn);
164 	if (unlikely(ret < 0)) {
165 		JFFS2_ERROR("check_node_data() returned error: %d.\n",
166 			ret);
167 	} else if (unlikely(ret > 0)) {
168 		dbg_readinode("CRC error, mark it obsolete.\n");
169 		jffs2_mark_node_obsolete(c, tn->fn->raw);
170 	}
171 
172 	return ret;
173 }
174 
175 static struct jffs2_tmp_dnode_info *jffs2_lookup_tn(struct rb_root *tn_root, uint32_t offset)
176 {
177 	struct rb_node *next;
178 	struct jffs2_tmp_dnode_info *tn = NULL;
179 
180 	dbg_readinode("root %p, offset %d\n", tn_root, offset);
181 
182 	next = tn_root->rb_node;
183 
184 	while (next) {
185 		tn = rb_entry(next, struct jffs2_tmp_dnode_info, rb);
186 
187 		if (tn->fn->ofs < offset)
188 			next = tn->rb.rb_right;
189 		else if (tn->fn->ofs >= offset)
190 			next = tn->rb.rb_left;
191 		else
192 			break;
193 	}
194 
195 	return tn;
196 }
197 
198 
199 static void jffs2_kill_tn(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
200 {
201 	jffs2_mark_node_obsolete(c, tn->fn->raw);
202 	jffs2_free_full_dnode(tn->fn);
203 	jffs2_free_tmp_dnode_info(tn);
204 }
205 /*
206  * This function is used when we read an inode. Data nodes arrive in
207  * arbitrary order -- they may be older or newer than the nodes which
208  * are already in the tree. Where overlaps occur, the older node can
209  * be discarded as long as the newer passes the CRC check. We don't
210  * bother to keep track of holes in this rbtree, and neither do we deal
211  * with frags -- we can have multiple entries starting at the same
212  * offset, and the one with the smallest length will come first in the
213  * ordering.
214  *
215  * Returns 0 if the node was handled (including marking it obsolete)
216  *	 < 0 an if error occurred
217  */
218 static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
219 				struct jffs2_readinode_info *rii,
220 				struct jffs2_tmp_dnode_info *tn)
221 {
222 	uint32_t fn_end = tn->fn->ofs + tn->fn->size;
223 	struct jffs2_tmp_dnode_info *this;
224 
225 	dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
226 
227 	/* If a node has zero dsize, we only have to keep if it if it might be the
228 	   node with highest version -- i.e. the one which will end up as f->metadata.
229 	   Note that such nodes won't be REF_UNCHECKED since there are no data to
230 	   check anyway. */
231 	if (!tn->fn->size) {
232 		if (rii->mdata_tn) {
233 			if (rii->mdata_tn->version < tn->version) {
234 				/* We had a candidate mdata node already */
235 				dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
236 				jffs2_kill_tn(c, rii->mdata_tn);
237 			} else {
238 				dbg_readinode("kill new mdata with ver %d (older than existing %d\n",
239 					      tn->version, rii->mdata_tn->version);
240 				jffs2_kill_tn(c, tn);
241 				return 0;
242 			}
243 		}
244 		rii->mdata_tn = tn;
245 		dbg_readinode("keep new mdata with ver %d\n", tn->version);
246 		return 0;
247 	}
248 
249 	/* Find the earliest node which _may_ be relevant to this one */
250 	this = jffs2_lookup_tn(&rii->tn_root, tn->fn->ofs);
251 	if (this) {
252 		/* If the node is coincident with another at a lower address,
253 		   back up until the other node is found. It may be relevant */
254 		while (this->overlapped)
255 			this = tn_prev(this);
256 
257 		/* First node should never be marked overlapped */
258 		BUG_ON(!this);
259 		dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
260 	}
261 
262 	while (this) {
263 		if (this->fn->ofs > fn_end)
264 			break;
265 		dbg_readinode("Ponder this ver %d, 0x%x-0x%x\n",
266 			      this->version, this->fn->ofs, this->fn->size);
267 
268 		if (this->version == tn->version) {
269 			/* Version number collision means REF_PRISTINE GC. Accept either of them
270 			   as long as the CRC is correct. Check the one we have already...  */
271 			if (!check_tn_node(c, this)) {
272 				/* The one we already had was OK. Keep it and throw away the new one */
273 				dbg_readinode("Like old node. Throw away new\n");
274 				jffs2_kill_tn(c, tn);
275 				return 0;
276 			} else {
277 				/* Who cares if the new one is good; keep it for now anyway. */
278 				dbg_readinode("Like new node. Throw away old\n");
279 				rb_replace_node(&this->rb, &tn->rb, &rii->tn_root);
280 				jffs2_kill_tn(c, this);
281 				/* Same overlapping from in front and behind */
282 				return 0;
283 			}
284 		}
285 		if (this->version < tn->version &&
286 		    this->fn->ofs >= tn->fn->ofs &&
287 		    this->fn->ofs + this->fn->size <= fn_end) {
288 			/* New node entirely overlaps 'this' */
289 			if (check_tn_node(c, tn)) {
290 				dbg_readinode("new node bad CRC\n");
291 				jffs2_kill_tn(c, tn);
292 				return 0;
293 			}
294 			/* ... and is good. Kill 'this' and any subsequent nodes which are also overlapped */
295 			while (this && this->fn->ofs + this->fn->size <= fn_end) {
296 				struct jffs2_tmp_dnode_info *next = tn_next(this);
297 				if (this->version < tn->version) {
298 					tn_erase(this, &rii->tn_root);
299 					dbg_readinode("Kill overlapped ver %d, 0x%x-0x%x\n",
300 						      this->version, this->fn->ofs,
301 						      this->fn->ofs+this->fn->size);
302 					jffs2_kill_tn(c, this);
303 				}
304 				this = next;
305 			}
306 			dbg_readinode("Done killing overlapped nodes\n");
307 			continue;
308 		}
309 		if (this->version > tn->version &&
310 		    this->fn->ofs <= tn->fn->ofs &&
311 		    this->fn->ofs+this->fn->size >= fn_end) {
312 			/* New node entirely overlapped by 'this' */
313 			if (!check_tn_node(c, this)) {
314 				dbg_readinode("Good CRC on old node. Kill new\n");
315 				jffs2_kill_tn(c, tn);
316 				return 0;
317 			}
318 			/* ... but 'this' was bad. Replace it... */
319 			dbg_readinode("Bad CRC on old overlapping node. Kill it\n");
320 			tn_erase(this, &rii->tn_root);
321 			jffs2_kill_tn(c, this);
322 			break;
323 		}
324 
325 		this = tn_next(this);
326 	}
327 
328 	/* We neither completely obsoleted nor were completely
329 	   obsoleted by an earlier node. Insert into the tree */
330 	{
331 		struct rb_node *parent;
332 		struct rb_node **link = &rii->tn_root.rb_node;
333 		struct jffs2_tmp_dnode_info *insert_point = NULL;
334 
335 		while (*link) {
336 			parent = *link;
337 			insert_point = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
338 			if (tn->fn->ofs > insert_point->fn->ofs)
339 				link = &insert_point->rb.rb_right;
340 			else if (tn->fn->ofs < insert_point->fn->ofs ||
341 				 tn->fn->size < insert_point->fn->size)
342 				link = &insert_point->rb.rb_left;
343 			else
344 				link = &insert_point->rb.rb_right;
345 		}
346 		rb_link_node(&tn->rb, &insert_point->rb, link);
347 		rb_insert_color(&tn->rb, &rii->tn_root);
348 	}
349 
350 	/* If there's anything behind that overlaps us, note it */
351 	this = tn_prev(tn);
352 	if (this) {
353 		while (1) {
354 			if (this->fn->ofs + this->fn->size > tn->fn->ofs) {
355 				dbg_readinode("Node is overlapped by %p (v %d, 0x%x-0x%x)\n",
356 					      this, this->version, this->fn->ofs,
357 					      this->fn->ofs+this->fn->size);
358 				tn->overlapped = 1;
359 				break;
360 			}
361 			if (!this->overlapped)
362 				break;
363 			this = tn_prev(this);
364 		}
365 	}
366 
367 	/* If the new node overlaps anything ahead, note it */
368 	this = tn_next(tn);
369 	while (this && this->fn->ofs < fn_end) {
370 		this->overlapped = 1;
371 		dbg_readinode("Node ver %d, 0x%x-0x%x is overlapped\n",
372 			      this->version, this->fn->ofs,
373 			      this->fn->ofs+this->fn->size);
374 		this = tn_next(this);
375 	}
376 	return 0;
377 }
378 
379 /* Trivial function to remove the last node in the tree. Which by definition
380    has no right-hand -- so can be removed just by making its only child (if
381    any) take its place under its parent. */
382 static void eat_last(struct rb_root *root, struct rb_node *node)
383 {
384 	struct rb_node *parent = rb_parent(node);
385 	struct rb_node **link;
386 
387 	/* LAST! */
388 	BUG_ON(node->rb_right);
389 
390 	if (!parent)
391 		link = &root->rb_node;
392 	else if (node == parent->rb_left)
393 		link = &parent->rb_left;
394 	else
395 		link = &parent->rb_right;
396 
397 	*link = node->rb_left;
398 	/* Colour doesn't matter now. Only the parent pointer. */
399 	if (node->rb_left)
400 		node->rb_left->rb_parent_color = node->rb_parent_color;
401 }
402 
403 /* We put this in reverse order, so we can just use eat_last */
404 static void ver_insert(struct rb_root *ver_root, struct jffs2_tmp_dnode_info *tn)
405 {
406 	struct rb_node **link = &ver_root->rb_node;
407 	struct rb_node *parent = NULL;
408 	struct jffs2_tmp_dnode_info *this_tn;
409 
410 	while (*link) {
411 		parent = *link;
412 		this_tn = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
413 
414 		if (tn->version > this_tn->version)
415 			link = &parent->rb_left;
416 		else
417 			link = &parent->rb_right;
418 	}
419 	dbg_readinode("Link new node at %p (root is %p)\n", link, ver_root);
420 	rb_link_node(&tn->rb, parent, link);
421 	rb_insert_color(&tn->rb, ver_root);
422 }
423 
424 /* Build final, normal fragtree from tn tree. It doesn't matter which order
425    we add nodes to the real fragtree, as long as they don't overlap. And
426    having thrown away the majority of overlapped nodes as we went, there
427    really shouldn't be many sets of nodes which do overlap. If we start at
428    the end, we can use the overlap markers -- we can just eat nodes which
429    aren't overlapped, and when we encounter nodes which _do_ overlap we
430    sort them all into a temporary tree in version order before replaying them. */
431 static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
432 				      struct jffs2_inode_info *f,
433 				      struct jffs2_readinode_info *rii)
434 {
435 	struct jffs2_tmp_dnode_info *pen, *last, *this;
436 	struct rb_root ver_root = RB_ROOT;
437 	uint32_t high_ver = 0;
438 
439 	if (rii->mdata_tn) {
440 		dbg_readinode("potential mdata is ver %d at %p\n", rii->mdata_tn->version, rii->mdata_tn);
441 		high_ver = rii->mdata_tn->version;
442 		rii->latest_ref = rii->mdata_tn->fn->raw;
443 	}
444 #ifdef JFFS2_DBG_READINODE_MESSAGES
445 	this = tn_last(&rii->tn_root);
446 	while (this) {
447 		dbg_readinode("tn %p ver %d range 0x%x-0x%x ov %d\n", this, this->version, this->fn->ofs,
448 			      this->fn->ofs+this->fn->size, this->overlapped);
449 		this = tn_prev(this);
450 	}
451 #endif
452 	pen = tn_last(&rii->tn_root);
453 	while ((last = pen)) {
454 		pen = tn_prev(last);
455 
456 		eat_last(&rii->tn_root, &last->rb);
457 		ver_insert(&ver_root, last);
458 
459 		if (unlikely(last->overlapped))
460 			continue;
461 
462 		/* Now we have a bunch of nodes in reverse version
463 		   order, in the tree at ver_root. Most of the time,
464 		   there'll actually be only one node in the 'tree',
465 		   in fact. */
466 		this = tn_last(&ver_root);
467 
468 		while (this) {
469 			struct jffs2_tmp_dnode_info *vers_next;
470 			int ret;
471 			vers_next = tn_prev(this);
472 			eat_last(&ver_root, &this->rb);
473 			if (check_tn_node(c, this)) {
474 				dbg_readinode("node ver %d, 0x%x-0x%x failed CRC\n",
475 					     this->version, this->fn->ofs,
476 					     this->fn->ofs+this->fn->size);
477 				jffs2_kill_tn(c, this);
478 			} else {
479 				if (this->version > high_ver) {
480 					/* Note that this is different from the other
481 					   highest_version, because this one is only
482 					   counting _valid_ nodes which could give the
483 					   latest inode metadata */
484 					high_ver = this->version;
485 					rii->latest_ref = this->fn->raw;
486 				}
487 				dbg_readinode("Add %p (v %d, 0x%x-0x%x, ov %d) to fragtree\n",
488 					     this, this->version, this->fn->ofs,
489 					     this->fn->ofs+this->fn->size, this->overlapped);
490 
491 				ret = jffs2_add_full_dnode_to_inode(c, f, this->fn);
492 				if (ret) {
493 					/* Free the nodes in vers_root; let the caller
494 					   deal with the rest */
495 					JFFS2_ERROR("Add node to tree failed %d\n", ret);
496 					while (1) {
497 						vers_next = tn_prev(this);
498 						if (check_tn_node(c, this))
499 							jffs2_mark_node_obsolete(c, this->fn->raw);
500 						jffs2_free_full_dnode(this->fn);
501 						jffs2_free_tmp_dnode_info(this);
502 						this = vers_next;
503 						if (!this)
504 							break;
505 						eat_last(&ver_root, &vers_next->rb);
506 					}
507 					return ret;
508 				}
509 				jffs2_free_tmp_dnode_info(this);
510 			}
511 			this = vers_next;
512 		}
513 	}
514 	return 0;
515 }
516 
517 static void jffs2_free_tmp_dnode_info_list(struct rb_root *list)
518 {
519 	struct rb_node *this;
520 	struct jffs2_tmp_dnode_info *tn;
521 
522 	this = list->rb_node;
523 
524 	/* Now at bottom of tree */
525 	while (this) {
526 		if (this->rb_left)
527 			this = this->rb_left;
528 		else if (this->rb_right)
529 			this = this->rb_right;
530 		else {
531 			tn = rb_entry(this, struct jffs2_tmp_dnode_info, rb);
532 			jffs2_free_full_dnode(tn->fn);
533 			jffs2_free_tmp_dnode_info(tn);
534 
535 			this = rb_parent(this);
536 			if (!this)
537 				break;
538 
539 			if (this->rb_left == &tn->rb)
540 				this->rb_left = NULL;
541 			else if (this->rb_right == &tn->rb)
542 				this->rb_right = NULL;
543 			else BUG();
544 		}
545 	}
546 	list->rb_node = NULL;
547 }
548 
549 static void jffs2_free_full_dirent_list(struct jffs2_full_dirent *fd)
550 {
551 	struct jffs2_full_dirent *next;
552 
553 	while (fd) {
554 		next = fd->next;
555 		jffs2_free_full_dirent(fd);
556 		fd = next;
557 	}
558 }
559 
560 /* Returns first valid node after 'ref'. May return 'ref' */
561 static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_ref *ref)
562 {
563 	while (ref && ref->next_in_ino) {
564 		if (!ref_obsolete(ref))
565 			return ref;
566 		dbg_noderef("node at 0x%08x is obsoleted. Ignoring.\n", ref_offset(ref));
567 		ref = ref->next_in_ino;
568 	}
569 	return NULL;
570 }
571 
572 /*
573  * Helper function for jffs2_get_inode_nodes().
574  * It is called every time an directory entry node is found.
575  *
576  * Returns: 0 on success;
577  * 	    negative error code on failure.
578  */
579 static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
580 				struct jffs2_raw_dirent *rd, size_t read,
581 				struct jffs2_readinode_info *rii)
582 {
583 	struct jffs2_full_dirent *fd;
584 	uint32_t crc;
585 
586 	/* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
587 	BUG_ON(ref_obsolete(ref));
588 
589 	crc = crc32(0, rd, sizeof(*rd) - 8);
590 	if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
591 		JFFS2_NOTICE("header CRC failed on dirent node at %#08x: read %#08x, calculated %#08x\n",
592 			     ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
593 		jffs2_mark_node_obsolete(c, ref);
594 		return 0;
595 	}
596 
597 	/* If we've never checked the CRCs on this node, check them now */
598 	if (ref_flags(ref) == REF_UNCHECKED) {
599 		struct jffs2_eraseblock *jeb;
600 		int len;
601 
602 		/* Sanity check */
603 		if (unlikely(PAD((rd->nsize + sizeof(*rd))) != PAD(je32_to_cpu(rd->totlen)))) {
604 			JFFS2_ERROR("illegal nsize in node at %#08x: nsize %#02x, totlen %#04x\n",
605 				    ref_offset(ref), rd->nsize, je32_to_cpu(rd->totlen));
606 			jffs2_mark_node_obsolete(c, ref);
607 			return 0;
608 		}
609 
610 		jeb = &c->blocks[ref->flash_offset / c->sector_size];
611 		len = ref_totlen(c, jeb, ref);
612 
613 		spin_lock(&c->erase_completion_lock);
614 		jeb->used_size += len;
615 		jeb->unchecked_size -= len;
616 		c->used_size += len;
617 		c->unchecked_size -= len;
618 		ref->flash_offset = ref_offset(ref) | dirent_node_state(rd);
619 		spin_unlock(&c->erase_completion_lock);
620 	}
621 
622 	fd = jffs2_alloc_full_dirent(rd->nsize + 1);
623 	if (unlikely(!fd))
624 		return -ENOMEM;
625 
626 	fd->raw = ref;
627 	fd->version = je32_to_cpu(rd->version);
628 	fd->ino = je32_to_cpu(rd->ino);
629 	fd->type = rd->type;
630 
631 	if (fd->version > rii->highest_version)
632 		rii->highest_version = fd->version;
633 
634 	/* Pick out the mctime of the latest dirent */
635 	if(fd->version > rii->mctime_ver && je32_to_cpu(rd->mctime)) {
636 		rii->mctime_ver = fd->version;
637 		rii->latest_mctime = je32_to_cpu(rd->mctime);
638 	}
639 
640 	/*
641 	 * Copy as much of the name as possible from the raw
642 	 * dirent we've already read from the flash.
643 	 */
644 	if (read > sizeof(*rd))
645 		memcpy(&fd->name[0], &rd->name[0],
646 		       min_t(uint32_t, rd->nsize, (read - sizeof(*rd)) ));
647 
648 	/* Do we need to copy any more of the name directly from the flash? */
649 	if (rd->nsize + sizeof(*rd) > read) {
650 		/* FIXME: point() */
651 		int err;
652 		int already = read - sizeof(*rd);
653 
654 		err = jffs2_flash_read(c, (ref_offset(ref)) + read,
655 				rd->nsize - already, &read, &fd->name[already]);
656 		if (unlikely(read != rd->nsize - already) && likely(!err))
657 			return -EIO;
658 
659 		if (unlikely(err)) {
660 			JFFS2_ERROR("read remainder of name: error %d\n", err);
661 			jffs2_free_full_dirent(fd);
662 			return -EIO;
663 		}
664 	}
665 
666 	fd->nhash = full_name_hash(fd->name, rd->nsize);
667 	fd->next = NULL;
668 	fd->name[rd->nsize] = '\0';
669 
670 	/*
671 	 * Wheee. We now have a complete jffs2_full_dirent structure, with
672 	 * the name in it and everything. Link it into the list
673 	 */
674 	jffs2_add_fd_to_list(c, fd, &rii->fds);
675 
676 	return 0;
677 }
678 
679 /*
680  * Helper function for jffs2_get_inode_nodes().
681  * It is called every time an inode node is found.
682  *
683  * Returns: 0 on success (possibly after marking a bad node obsolete);
684  * 	    negative error code on failure.
685  */
686 static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
687 			     struct jffs2_raw_inode *rd, int rdlen,
688 			     struct jffs2_readinode_info *rii)
689 {
690 	struct jffs2_tmp_dnode_info *tn;
691 	uint32_t len, csize;
692 	int ret = 0;
693 	uint32_t crc;
694 
695 	/* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
696 	BUG_ON(ref_obsolete(ref));
697 
698 	crc = crc32(0, rd, sizeof(*rd) - 8);
699 	if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
700 		JFFS2_NOTICE("node CRC failed on dnode at %#08x: read %#08x, calculated %#08x\n",
701 			     ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
702 		jffs2_mark_node_obsolete(c, ref);
703 		return 0;
704 	}
705 
706 	tn = jffs2_alloc_tmp_dnode_info();
707 	if (!tn) {
708 		JFFS2_ERROR("failed to allocate tn (%zu bytes).\n", sizeof(*tn));
709 		return -ENOMEM;
710 	}
711 
712 	tn->partial_crc = 0;
713 	csize = je32_to_cpu(rd->csize);
714 
715 	/* If we've never checked the CRCs on this node, check them now */
716 	if (ref_flags(ref) == REF_UNCHECKED) {
717 
718 		/* Sanity checks */
719 		if (unlikely(je32_to_cpu(rd->offset) > je32_to_cpu(rd->isize)) ||
720 		    unlikely(PAD(je32_to_cpu(rd->csize) + sizeof(*rd)) != PAD(je32_to_cpu(rd->totlen)))) {
721 			JFFS2_WARNING("inode node header CRC is corrupted at %#08x\n", ref_offset(ref));
722 			jffs2_dbg_dump_node(c, ref_offset(ref));
723 			jffs2_mark_node_obsolete(c, ref);
724 			goto free_out;
725 		}
726 
727 		if (jffs2_is_writebuffered(c) && csize != 0) {
728 			/* At this point we are supposed to check the data CRC
729 			 * of our unchecked node. But thus far, we do not
730 			 * know whether the node is valid or obsolete. To
731 			 * figure this out, we need to walk all the nodes of
732 			 * the inode and build the inode fragtree. We don't
733 			 * want to spend time checking data of nodes which may
734 			 * later be found to be obsolete. So we put off the full
735 			 * data CRC checking until we have read all the inode
736 			 * nodes and have started building the fragtree.
737 			 *
738 			 * The fragtree is being built starting with nodes
739 			 * having the highest version number, so we'll be able
740 			 * to detect whether a node is valid (i.e., it is not
741 			 * overlapped by a node with higher version) or not.
742 			 * And we'll be able to check only those nodes, which
743 			 * are not obsolete.
744 			 *
745 			 * Of course, this optimization only makes sense in case
746 			 * of NAND flashes (or other flashes with
747 			 * !jffs2_can_mark_obsolete()), since on NOR flashes
748 			 * nodes are marked obsolete physically.
749 			 *
750 			 * Since NAND flashes (or other flashes with
751 			 * jffs2_is_writebuffered(c)) are anyway read by
752 			 * fractions of c->wbuf_pagesize, and we have just read
753 			 * the node header, it is likely that the starting part
754 			 * of the node data is also read when we read the
755 			 * header. So we don't mind to check the CRC of the
756 			 * starting part of the data of the node now, and check
757 			 * the second part later (in jffs2_check_node_data()).
758 			 * Of course, we will not need to re-read and re-check
759 			 * the NAND page which we have just read. This is why we
760 			 * read the whole NAND page at jffs2_get_inode_nodes(),
761 			 * while we needed only the node header.
762 			 */
763 			unsigned char *buf;
764 
765 			/* 'buf' will point to the start of data */
766 			buf = (unsigned char *)rd + sizeof(*rd);
767 			/* len will be the read data length */
768 			len = min_t(uint32_t, rdlen - sizeof(*rd), csize);
769 			tn->partial_crc = crc32(0, buf, len);
770 
771 			dbg_readinode("Calculates CRC (%#08x) for %d bytes, csize %d\n", tn->partial_crc, len, csize);
772 
773 			/* If we actually calculated the whole data CRC
774 			 * and it is wrong, drop the node. */
775 			if (len >= csize && unlikely(tn->partial_crc != je32_to_cpu(rd->data_crc))) {
776 				JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
777 					ref_offset(ref), tn->partial_crc, je32_to_cpu(rd->data_crc));
778 				jffs2_mark_node_obsolete(c, ref);
779 				goto free_out;
780 			}
781 
782 		} else if (csize == 0) {
783 			/*
784 			 * We checked the header CRC. If the node has no data, adjust
785 			 * the space accounting now. For other nodes this will be done
786 			 * later either when the node is marked obsolete or when its
787 			 * data is checked.
788 			 */
789 			struct jffs2_eraseblock *jeb;
790 
791 			dbg_readinode("the node has no data.\n");
792 			jeb = &c->blocks[ref->flash_offset / c->sector_size];
793 			len = ref_totlen(c, jeb, ref);
794 
795 			spin_lock(&c->erase_completion_lock);
796 			jeb->used_size += len;
797 			jeb->unchecked_size -= len;
798 			c->used_size += len;
799 			c->unchecked_size -= len;
800 			ref->flash_offset = ref_offset(ref) | REF_NORMAL;
801 			spin_unlock(&c->erase_completion_lock);
802 		}
803 	}
804 
805 	tn->fn = jffs2_alloc_full_dnode();
806 	if (!tn->fn) {
807 		JFFS2_ERROR("alloc fn failed\n");
808 		ret = -ENOMEM;
809 		goto free_out;
810 	}
811 
812 	tn->version = je32_to_cpu(rd->version);
813 	tn->fn->ofs = je32_to_cpu(rd->offset);
814 	tn->data_crc = je32_to_cpu(rd->data_crc);
815 	tn->csize = csize;
816 	tn->fn->raw = ref;
817 	tn->overlapped = 0;
818 
819 	if (tn->version > rii->highest_version)
820 		rii->highest_version = tn->version;
821 
822 	/* There was a bug where we wrote hole nodes out with
823 	   csize/dsize swapped. Deal with it */
824 	if (rd->compr == JFFS2_COMPR_ZERO && !je32_to_cpu(rd->dsize) && csize)
825 		tn->fn->size = csize;
826 	else // normal case...
827 		tn->fn->size = je32_to_cpu(rd->dsize);
828 
829 	dbg_readinode2("dnode @%08x: ver %u, offset %#04x, dsize %#04x, csize %#04x\n",
830 		       ref_offset(ref), je32_to_cpu(rd->version),
831 		       je32_to_cpu(rd->offset), je32_to_cpu(rd->dsize), csize);
832 
833 	ret = jffs2_add_tn_to_tree(c, rii, tn);
834 
835 	if (ret) {
836 		jffs2_free_full_dnode(tn->fn);
837 	free_out:
838 		jffs2_free_tmp_dnode_info(tn);
839 		return ret;
840 	}
841 #ifdef JFFS2_DBG_READINODE2_MESSAGES
842 	dbg_readinode2("After adding ver %d:\n", je32_to_cpu(rd->version));
843 	tn = tn_first(&rii->tn_root);
844 	while (tn) {
845 		dbg_readinode2("%p: v %d r 0x%x-0x%x ov %d\n",
846 			       tn, tn->version, tn->fn->ofs,
847 			       tn->fn->ofs+tn->fn->size, tn->overlapped);
848 		tn = tn_next(tn);
849 	}
850 #endif
851 	return 0;
852 }
853 
854 /*
855  * Helper function for jffs2_get_inode_nodes().
856  * It is called every time an unknown node is found.
857  *
858  * Returns: 0 on success;
859  * 	    negative error code on failure.
860  */
861 static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref, struct jffs2_unknown_node *un)
862 {
863 	/* We don't mark unknown nodes as REF_UNCHECKED */
864 	if (ref_flags(ref) == REF_UNCHECKED) {
865 		JFFS2_ERROR("REF_UNCHECKED but unknown node at %#08x\n",
866 			    ref_offset(ref));
867 		JFFS2_ERROR("Node is {%04x,%04x,%08x,%08x}. Please report this error.\n",
868 			    je16_to_cpu(un->magic), je16_to_cpu(un->nodetype),
869 			    je32_to_cpu(un->totlen), je32_to_cpu(un->hdr_crc));
870 		jffs2_mark_node_obsolete(c, ref);
871 		return 0;
872 	}
873 
874 	un->nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(un->nodetype));
875 
876 	switch(je16_to_cpu(un->nodetype) & JFFS2_COMPAT_MASK) {
877 
878 	case JFFS2_FEATURE_INCOMPAT:
879 		JFFS2_ERROR("unknown INCOMPAT nodetype %#04X at %#08x\n",
880 			    je16_to_cpu(un->nodetype), ref_offset(ref));
881 		/* EEP */
882 		BUG();
883 		break;
884 
885 	case JFFS2_FEATURE_ROCOMPAT:
886 		JFFS2_ERROR("unknown ROCOMPAT nodetype %#04X at %#08x\n",
887 			    je16_to_cpu(un->nodetype), ref_offset(ref));
888 		BUG_ON(!(c->flags & JFFS2_SB_FLAG_RO));
889 		break;
890 
891 	case JFFS2_FEATURE_RWCOMPAT_COPY:
892 		JFFS2_NOTICE("unknown RWCOMPAT_COPY nodetype %#04X at %#08x\n",
893 			     je16_to_cpu(un->nodetype), ref_offset(ref));
894 		break;
895 
896 	case JFFS2_FEATURE_RWCOMPAT_DELETE:
897 		JFFS2_NOTICE("unknown RWCOMPAT_DELETE nodetype %#04X at %#08x\n",
898 			     je16_to_cpu(un->nodetype), ref_offset(ref));
899 		jffs2_mark_node_obsolete(c, ref);
900 		return 0;
901 	}
902 
903 	return 0;
904 }
905 
906 /*
907  * Helper function for jffs2_get_inode_nodes().
908  * The function detects whether more data should be read and reads it if yes.
909  *
910  * Returns: 0 on succes;
911  * 	    negative error code on failure.
912  */
913 static int read_more(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
914 		     int needed_len, int *rdlen, unsigned char *buf)
915 {
916 	int err, to_read = needed_len - *rdlen;
917 	size_t retlen;
918 	uint32_t offs;
919 
920 	if (jffs2_is_writebuffered(c)) {
921 		int rem = to_read % c->wbuf_pagesize;
922 
923 		if (rem)
924 			to_read += c->wbuf_pagesize - rem;
925 	}
926 
927 	/* We need to read more data */
928 	offs = ref_offset(ref) + *rdlen;
929 
930 	dbg_readinode("read more %d bytes\n", to_read);
931 
932 	err = jffs2_flash_read(c, offs, to_read, &retlen, buf + *rdlen);
933 	if (err) {
934 		JFFS2_ERROR("can not read %d bytes from 0x%08x, "
935 			"error code: %d.\n", to_read, offs, err);
936 		return err;
937 	}
938 
939 	if (retlen < to_read) {
940 		JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n",
941 				offs, retlen, to_read);
942 		return -EIO;
943 	}
944 
945 	*rdlen += to_read;
946 	return 0;
947 }
948 
949 /* Get tmp_dnode_info and full_dirent for all non-obsolete nodes associated
950    with this ino. Perform a preliminary ordering on data nodes, throwing away
951    those which are completely obsoleted by newer ones. The naïve approach we
952    use to take of just returning them _all_ in version order will cause us to
953    run out of memory in certain degenerate cases. */
954 static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
955 				 struct jffs2_readinode_info *rii)
956 {
957 	struct jffs2_raw_node_ref *ref, *valid_ref;
958 	unsigned char *buf = NULL;
959 	union jffs2_node_union *node;
960 	size_t retlen;
961 	int len, err;
962 
963 	rii->mctime_ver = 0;
964 
965 	dbg_readinode("ino #%u\n", f->inocache->ino);
966 
967 	/* FIXME: in case of NOR and available ->point() this
968 	 * needs to be fixed. */
969 	len = sizeof(union jffs2_node_union) + c->wbuf_pagesize;
970 	buf = kmalloc(len, GFP_KERNEL);
971 	if (!buf)
972 		return -ENOMEM;
973 
974 	spin_lock(&c->erase_completion_lock);
975 	valid_ref = jffs2_first_valid_node(f->inocache->nodes);
976 	if (!valid_ref && f->inocache->ino != 1)
977 		JFFS2_WARNING("Eep. No valid nodes for ino #%u.\n", f->inocache->ino);
978 	while (valid_ref) {
979 		/* We can hold a pointer to a non-obsolete node without the spinlock,
980 		   but _obsolete_ nodes may disappear at any time, if the block
981 		   they're in gets erased. So if we mark 'ref' obsolete while we're
982 		   not holding the lock, it can go away immediately. For that reason,
983 		   we find the next valid node first, before processing 'ref'.
984 		*/
985 		ref = valid_ref;
986 		valid_ref = jffs2_first_valid_node(ref->next_in_ino);
987 		spin_unlock(&c->erase_completion_lock);
988 
989 		cond_resched();
990 
991 		/*
992 		 * At this point we don't know the type of the node we're going
993 		 * to read, so we do not know the size of its header. In order
994 		 * to minimize the amount of flash IO we assume the header is
995 		 * of size = JFFS2_MIN_NODE_HEADER.
996 		 */
997 		len = JFFS2_MIN_NODE_HEADER;
998 		if (jffs2_is_writebuffered(c)) {
999 			int end, rem;
1000 
1001 			/*
1002 			 * We are about to read JFFS2_MIN_NODE_HEADER bytes,
1003 			 * but this flash has some minimal I/O unit. It is
1004 			 * possible that we'll need to read more soon, so read
1005 			 * up to the next min. I/O unit, in order not to
1006 			 * re-read the same min. I/O unit twice.
1007 			 */
1008 			end = ref_offset(ref) + len;
1009 			rem = end % c->wbuf_pagesize;
1010 			if (rem)
1011 				end += c->wbuf_pagesize - rem;
1012 			len = end - ref_offset(ref);
1013 		}
1014 
1015 		dbg_readinode("read %d bytes at %#08x(%d).\n", len, ref_offset(ref), ref_flags(ref));
1016 
1017 		/* FIXME: point() */
1018 		err = jffs2_flash_read(c, ref_offset(ref), len, &retlen, buf);
1019 		if (err) {
1020 			JFFS2_ERROR("can not read %d bytes from 0x%08x, " "error code: %d.\n", len, ref_offset(ref), err);
1021 			goto free_out;
1022 		}
1023 
1024 		if (retlen < len) {
1025 			JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n", ref_offset(ref), retlen, len);
1026 			err = -EIO;
1027 			goto free_out;
1028 		}
1029 
1030 		node = (union jffs2_node_union *)buf;
1031 
1032 		/* No need to mask in the valid bit; it shouldn't be invalid */
1033 		if (je32_to_cpu(node->u.hdr_crc) != crc32(0, node, sizeof(node->u)-4)) {
1034 			JFFS2_NOTICE("Node header CRC failed at %#08x. {%04x,%04x,%08x,%08x}\n",
1035 				     ref_offset(ref), je16_to_cpu(node->u.magic),
1036 				     je16_to_cpu(node->u.nodetype),
1037 				     je32_to_cpu(node->u.totlen),
1038 				     je32_to_cpu(node->u.hdr_crc));
1039 			jffs2_dbg_dump_node(c, ref_offset(ref));
1040 			jffs2_mark_node_obsolete(c, ref);
1041 			goto cont;
1042 		}
1043 		if (je16_to_cpu(node->u.magic) != JFFS2_MAGIC_BITMASK) {
1044 			/* Not a JFFS2 node, whinge and move on */
1045 			JFFS2_NOTICE("Wrong magic bitmask 0x%04x in node header at %#08x.\n",
1046 				     je16_to_cpu(node->u.magic), ref_offset(ref));
1047 			jffs2_mark_node_obsolete(c, ref);
1048 			goto cont;
1049 		}
1050 
1051 		switch (je16_to_cpu(node->u.nodetype)) {
1052 
1053 		case JFFS2_NODETYPE_DIRENT:
1054 
1055 			if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent) &&
1056 			    len < sizeof(struct jffs2_raw_dirent)) {
1057 				err = read_more(c, ref, sizeof(struct jffs2_raw_dirent), &len, buf);
1058 				if (unlikely(err))
1059 					goto free_out;
1060 			}
1061 
1062 			err = read_direntry(c, ref, &node->d, retlen, rii);
1063 			if (unlikely(err))
1064 				goto free_out;
1065 
1066 			break;
1067 
1068 		case JFFS2_NODETYPE_INODE:
1069 
1070 			if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode) &&
1071 			    len < sizeof(struct jffs2_raw_inode)) {
1072 				err = read_more(c, ref, sizeof(struct jffs2_raw_inode), &len, buf);
1073 				if (unlikely(err))
1074 					goto free_out;
1075 			}
1076 
1077 			err = read_dnode(c, ref, &node->i, len, rii);
1078 			if (unlikely(err))
1079 				goto free_out;
1080 
1081 			break;
1082 
1083 		default:
1084 			if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node) &&
1085 			    len < sizeof(struct jffs2_unknown_node)) {
1086 				err = read_more(c, ref, sizeof(struct jffs2_unknown_node), &len, buf);
1087 				if (unlikely(err))
1088 					goto free_out;
1089 			}
1090 
1091 			err = read_unknown(c, ref, &node->u);
1092 			if (unlikely(err))
1093 				goto free_out;
1094 
1095 		}
1096 	cont:
1097 		spin_lock(&c->erase_completion_lock);
1098 	}
1099 
1100 	spin_unlock(&c->erase_completion_lock);
1101 	kfree(buf);
1102 
1103 	f->highest_version = rii->highest_version;
1104 
1105 	dbg_readinode("nodes of inode #%u were read, the highest version is %u, latest_mctime %u, mctime_ver %u.\n",
1106 		      f->inocache->ino, rii->highest_version, rii->latest_mctime,
1107 		      rii->mctime_ver);
1108 	return 0;
1109 
1110  free_out:
1111 	jffs2_free_tmp_dnode_info_list(&rii->tn_root);
1112 	jffs2_free_full_dirent_list(rii->fds);
1113 	rii->fds = NULL;
1114 	kfree(buf);
1115 	return err;
1116 }
1117 
1118 static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
1119 					struct jffs2_inode_info *f,
1120 					struct jffs2_raw_inode *latest_node)
1121 {
1122 	struct jffs2_readinode_info rii;
1123 	uint32_t crc, new_size;
1124 	size_t retlen;
1125 	int ret;
1126 
1127 	dbg_readinode("ino #%u pino/nlink is %d\n", f->inocache->ino,
1128 		      f->inocache->pino_nlink);
1129 
1130 	memset(&rii, 0, sizeof(rii));
1131 
1132 	/* Grab all nodes relevant to this ino */
1133 	ret = jffs2_get_inode_nodes(c, f, &rii);
1134 
1135 	if (ret) {
1136 		JFFS2_ERROR("cannot read nodes for ino %u, returned error is %d\n", f->inocache->ino, ret);
1137 		if (f->inocache->state == INO_STATE_READING)
1138 			jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1139 		return ret;
1140 	}
1141 
1142 	ret = jffs2_build_inode_fragtree(c, f, &rii);
1143 	if (ret) {
1144 		JFFS2_ERROR("Failed to build final fragtree for inode #%u: error %d\n",
1145 			    f->inocache->ino, ret);
1146 		if (f->inocache->state == INO_STATE_READING)
1147 			jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1148 		jffs2_free_tmp_dnode_info_list(&rii.tn_root);
1149 		/* FIXME: We could at least crc-check them all */
1150 		if (rii.mdata_tn) {
1151 			jffs2_free_full_dnode(rii.mdata_tn->fn);
1152 			jffs2_free_tmp_dnode_info(rii.mdata_tn);
1153 			rii.mdata_tn = NULL;
1154 		}
1155 		return ret;
1156 	}
1157 
1158 	if (rii.mdata_tn) {
1159 		if (rii.mdata_tn->fn->raw == rii.latest_ref) {
1160 			f->metadata = rii.mdata_tn->fn;
1161 			jffs2_free_tmp_dnode_info(rii.mdata_tn);
1162 		} else {
1163 			jffs2_kill_tn(c, rii.mdata_tn);
1164 		}
1165 		rii.mdata_tn = NULL;
1166 	}
1167 
1168 	f->dents = rii.fds;
1169 
1170 	jffs2_dbg_fragtree_paranoia_check_nolock(f);
1171 
1172 	if (unlikely(!rii.latest_ref)) {
1173 		/* No data nodes for this inode. */
1174 		if (f->inocache->ino != 1) {
1175 			JFFS2_WARNING("no data nodes found for ino #%u\n", f->inocache->ino);
1176 			if (!rii.fds) {
1177 				if (f->inocache->state == INO_STATE_READING)
1178 					jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1179 				return -EIO;
1180 			}
1181 			JFFS2_NOTICE("but it has children so we fake some modes for it\n");
1182 		}
1183 		latest_node->mode = cpu_to_jemode(S_IFDIR|S_IRUGO|S_IWUSR|S_IXUGO);
1184 		latest_node->version = cpu_to_je32(0);
1185 		latest_node->atime = latest_node->ctime = latest_node->mtime = cpu_to_je32(0);
1186 		latest_node->isize = cpu_to_je32(0);
1187 		latest_node->gid = cpu_to_je16(0);
1188 		latest_node->uid = cpu_to_je16(0);
1189 		if (f->inocache->state == INO_STATE_READING)
1190 			jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1191 		return 0;
1192 	}
1193 
1194 	ret = jffs2_flash_read(c, ref_offset(rii.latest_ref), sizeof(*latest_node), &retlen, (void *)latest_node);
1195 	if (ret || retlen != sizeof(*latest_node)) {
1196 		JFFS2_ERROR("failed to read from flash: error %d, %zd of %zd bytes read\n",
1197 			ret, retlen, sizeof(*latest_node));
1198 		/* FIXME: If this fails, there seems to be a memory leak. Find it. */
1199 		mutex_unlock(&f->sem);
1200 		jffs2_do_clear_inode(c, f);
1201 		return ret?ret:-EIO;
1202 	}
1203 
1204 	crc = crc32(0, latest_node, sizeof(*latest_node)-8);
1205 	if (crc != je32_to_cpu(latest_node->node_crc)) {
1206 		JFFS2_ERROR("CRC failed for read_inode of inode %u at physical location 0x%x\n",
1207 			f->inocache->ino, ref_offset(rii.latest_ref));
1208 		mutex_unlock(&f->sem);
1209 		jffs2_do_clear_inode(c, f);
1210 		return -EIO;
1211 	}
1212 
1213 	switch(jemode_to_cpu(latest_node->mode) & S_IFMT) {
1214 	case S_IFDIR:
1215 		if (rii.mctime_ver > je32_to_cpu(latest_node->version)) {
1216 			/* The times in the latest_node are actually older than
1217 			   mctime in the latest dirent. Cheat. */
1218 			latest_node->ctime = latest_node->mtime = cpu_to_je32(rii.latest_mctime);
1219 		}
1220 		break;
1221 
1222 
1223 	case S_IFREG:
1224 		/* If it was a regular file, truncate it to the latest node's isize */
1225 		new_size = jffs2_truncate_fragtree(c, &f->fragtree, je32_to_cpu(latest_node->isize));
1226 		if (new_size != je32_to_cpu(latest_node->isize)) {
1227 			JFFS2_WARNING("Truncating ino #%u to %d bytes failed because it only had %d bytes to start with!\n",
1228 				      f->inocache->ino, je32_to_cpu(latest_node->isize), new_size);
1229 			latest_node->isize = cpu_to_je32(new_size);
1230 		}
1231 		break;
1232 
1233 	case S_IFLNK:
1234 		/* Hack to work around broken isize in old symlink code.
1235 		   Remove this when dwmw2 comes to his senses and stops
1236 		   symlinks from being an entirely gratuitous special
1237 		   case. */
1238 		if (!je32_to_cpu(latest_node->isize))
1239 			latest_node->isize = latest_node->dsize;
1240 
1241 		if (f->inocache->state != INO_STATE_CHECKING) {
1242 			/* Symlink's inode data is the target path. Read it and
1243 			 * keep in RAM to facilitate quick follow symlink
1244 			 * operation. */
1245 			f->target = kmalloc(je32_to_cpu(latest_node->csize) + 1, GFP_KERNEL);
1246 			if (!f->target) {
1247 				JFFS2_ERROR("can't allocate %d bytes of memory for the symlink target path cache\n", je32_to_cpu(latest_node->csize));
1248 				mutex_unlock(&f->sem);
1249 				jffs2_do_clear_inode(c, f);
1250 				return -ENOMEM;
1251 			}
1252 
1253 			ret = jffs2_flash_read(c, ref_offset(rii.latest_ref) + sizeof(*latest_node),
1254 						je32_to_cpu(latest_node->csize), &retlen, (char *)f->target);
1255 
1256 			if (ret  || retlen != je32_to_cpu(latest_node->csize)) {
1257 				if (retlen != je32_to_cpu(latest_node->csize))
1258 					ret = -EIO;
1259 				kfree(f->target);
1260 				f->target = NULL;
1261 				mutex_unlock(&f->sem);
1262 				jffs2_do_clear_inode(c, f);
1263 				return -ret;
1264 			}
1265 
1266 			f->target[je32_to_cpu(latest_node->csize)] = '\0';
1267 			dbg_readinode("symlink's target '%s' cached\n", f->target);
1268 		}
1269 
1270 		/* fall through... */
1271 
1272 	case S_IFBLK:
1273 	case S_IFCHR:
1274 		/* Certain inode types should have only one data node, and it's
1275 		   kept as the metadata node */
1276 		if (f->metadata) {
1277 			JFFS2_ERROR("Argh. Special inode #%u with mode 0%o had metadata node\n",
1278 			       f->inocache->ino, jemode_to_cpu(latest_node->mode));
1279 			mutex_unlock(&f->sem);
1280 			jffs2_do_clear_inode(c, f);
1281 			return -EIO;
1282 		}
1283 		if (!frag_first(&f->fragtree)) {
1284 			JFFS2_ERROR("Argh. Special inode #%u with mode 0%o has no fragments\n",
1285 			       f->inocache->ino, jemode_to_cpu(latest_node->mode));
1286 			mutex_unlock(&f->sem);
1287 			jffs2_do_clear_inode(c, f);
1288 			return -EIO;
1289 		}
1290 		/* ASSERT: f->fraglist != NULL */
1291 		if (frag_next(frag_first(&f->fragtree))) {
1292 			JFFS2_ERROR("Argh. Special inode #%u with mode 0x%x had more than one node\n",
1293 			       f->inocache->ino, jemode_to_cpu(latest_node->mode));
1294 			/* FIXME: Deal with it - check crc32, check for duplicate node, check times and discard the older one */
1295 			mutex_unlock(&f->sem);
1296 			jffs2_do_clear_inode(c, f);
1297 			return -EIO;
1298 		}
1299 		/* OK. We're happy */
1300 		f->metadata = frag_first(&f->fragtree)->node;
1301 		jffs2_free_node_frag(frag_first(&f->fragtree));
1302 		f->fragtree = RB_ROOT;
1303 		break;
1304 	}
1305 	if (f->inocache->state == INO_STATE_READING)
1306 		jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1307 
1308 	return 0;
1309 }
1310 
1311 /* Scan the list of all nodes present for this ino, build map of versions, etc. */
1312 int jffs2_do_read_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
1313 			uint32_t ino, struct jffs2_raw_inode *latest_node)
1314 {
1315 	dbg_readinode("read inode #%u\n", ino);
1316 
1317  retry_inocache:
1318 	spin_lock(&c->inocache_lock);
1319 	f->inocache = jffs2_get_ino_cache(c, ino);
1320 
1321 	if (f->inocache) {
1322 		/* Check its state. We may need to wait before we can use it */
1323 		switch(f->inocache->state) {
1324 		case INO_STATE_UNCHECKED:
1325 		case INO_STATE_CHECKEDABSENT:
1326 			f->inocache->state = INO_STATE_READING;
1327 			break;
1328 
1329 		case INO_STATE_CHECKING:
1330 		case INO_STATE_GC:
1331 			/* If it's in either of these states, we need
1332 			   to wait for whoever's got it to finish and
1333 			   put it back. */
1334 			dbg_readinode("waiting for ino #%u in state %d\n", ino, f->inocache->state);
1335 			sleep_on_spinunlock(&c->inocache_wq, &c->inocache_lock);
1336 			goto retry_inocache;
1337 
1338 		case INO_STATE_READING:
1339 		case INO_STATE_PRESENT:
1340 			/* Eep. This should never happen. It can
1341 			happen if Linux calls read_inode() again
1342 			before clear_inode() has finished though. */
1343 			JFFS2_ERROR("Eep. Trying to read_inode #%u when it's already in state %d!\n", ino, f->inocache->state);
1344 			/* Fail. That's probably better than allowing it to succeed */
1345 			f->inocache = NULL;
1346 			break;
1347 
1348 		default:
1349 			BUG();
1350 		}
1351 	}
1352 	spin_unlock(&c->inocache_lock);
1353 
1354 	if (!f->inocache && ino == 1) {
1355 		/* Special case - no root inode on medium */
1356 		f->inocache = jffs2_alloc_inode_cache();
1357 		if (!f->inocache) {
1358 			JFFS2_ERROR("cannot allocate inocache for root inode\n");
1359 			return -ENOMEM;
1360 		}
1361 		dbg_readinode("creating inocache for root inode\n");
1362 		memset(f->inocache, 0, sizeof(struct jffs2_inode_cache));
1363 		f->inocache->ino = f->inocache->pino_nlink = 1;
1364 		f->inocache->nodes = (struct jffs2_raw_node_ref *)f->inocache;
1365 		f->inocache->state = INO_STATE_READING;
1366 		jffs2_add_ino_cache(c, f->inocache);
1367 	}
1368 	if (!f->inocache) {
1369 		JFFS2_ERROR("requestied to read an nonexistent ino %u\n", ino);
1370 		return -ENOENT;
1371 	}
1372 
1373 	return jffs2_do_read_inode_internal(c, f, latest_node);
1374 }
1375 
1376 int jffs2_do_crccheck_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
1377 {
1378 	struct jffs2_raw_inode n;
1379 	struct jffs2_inode_info *f = kzalloc(sizeof(*f), GFP_KERNEL);
1380 	int ret;
1381 
1382 	if (!f)
1383 		return -ENOMEM;
1384 
1385 	mutex_init(&f->sem);
1386 	mutex_lock(&f->sem);
1387 	f->inocache = ic;
1388 
1389 	ret = jffs2_do_read_inode_internal(c, f, &n);
1390 	if (!ret) {
1391 		mutex_unlock(&f->sem);
1392 		jffs2_do_clear_inode(c, f);
1393 	}
1394 	kfree (f);
1395 	return ret;
1396 }
1397 
1398 void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
1399 {
1400 	struct jffs2_full_dirent *fd, *fds;
1401 	int deleted;
1402 
1403 	jffs2_clear_acl(f);
1404 	jffs2_xattr_delete_inode(c, f->inocache);
1405 	mutex_lock(&f->sem);
1406 	deleted = f->inocache && !f->inocache->pino_nlink;
1407 
1408 	if (f->inocache && f->inocache->state != INO_STATE_CHECKING)
1409 		jffs2_set_inocache_state(c, f->inocache, INO_STATE_CLEARING);
1410 
1411 	if (f->metadata) {
1412 		if (deleted)
1413 			jffs2_mark_node_obsolete(c, f->metadata->raw);
1414 		jffs2_free_full_dnode(f->metadata);
1415 	}
1416 
1417 	jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
1418 
1419 	if (f->target) {
1420 		kfree(f->target);
1421 		f->target = NULL;
1422 	}
1423 
1424 	fds = f->dents;
1425 	while(fds) {
1426 		fd = fds;
1427 		fds = fd->next;
1428 		jffs2_free_full_dirent(fd);
1429 	}
1430 
1431 	if (f->inocache && f->inocache->state != INO_STATE_CHECKING) {
1432 		jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1433 		if (f->inocache->nodes == (void *)f->inocache)
1434 			jffs2_del_ino_cache(c, f->inocache);
1435 	}
1436 
1437 	mutex_unlock(&f->sem);
1438 }
1439