xref: /openbmc/linux/fs/jffs2/scan.c (revision 87c2ce3b)
1 /*
2  * JFFS2 -- Journalling Flash File System, Version 2.
3  *
4  * Copyright (C) 2001-2003 Red Hat, Inc.
5  *
6  * Created by David Woodhouse <dwmw2@infradead.org>
7  *
8  * For licensing information, see the file 'LICENCE' in this directory.
9  *
10  * $Id: scan.c,v 1.125 2005/09/30 13:59:13 dedekind Exp $
11  *
12  */
13 #include <linux/kernel.h>
14 #include <linux/sched.h>
15 #include <linux/slab.h>
16 #include <linux/mtd/mtd.h>
17 #include <linux/pagemap.h>
18 #include <linux/crc32.h>
19 #include <linux/compiler.h>
20 #include "nodelist.h"
21 #include "summary.h"
22 #include "debug.h"
23 
24 #define DEFAULT_EMPTY_SCAN_SIZE 1024
25 
26 #define noisy_printk(noise, args...) do { \
27 	if (*(noise)) { \
28 		printk(KERN_NOTICE args); \
29 		 (*(noise))--; \
30 		 if (!(*(noise))) { \
31 			 printk(KERN_NOTICE "Further such events for this erase block will not be printed\n"); \
32 		 } \
33 	} \
34 } while(0)
35 
36 static uint32_t pseudo_random;
37 
38 static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
39 				  unsigned char *buf, uint32_t buf_size, struct jffs2_summary *s);
40 
41 /* These helper functions _must_ increase ofs and also do the dirty/used space accounting.
42  * Returning an error will abort the mount - bad checksums etc. should just mark the space
43  * as dirty.
44  */
45 static int jffs2_scan_inode_node(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
46 				 struct jffs2_raw_inode *ri, uint32_t ofs, struct jffs2_summary *s);
47 static int jffs2_scan_dirent_node(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
48 				 struct jffs2_raw_dirent *rd, uint32_t ofs, struct jffs2_summary *s);
49 
50 static inline int min_free(struct jffs2_sb_info *c)
51 {
52 	uint32_t min = 2 * sizeof(struct jffs2_raw_inode);
53 #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
54 	if (!jffs2_can_mark_obsolete(c) && min < c->wbuf_pagesize)
55 		return c->wbuf_pagesize;
56 #endif
57 	return min;
58 
59 }
60 
61 static inline uint32_t EMPTY_SCAN_SIZE(uint32_t sector_size) {
62 	if (sector_size < DEFAULT_EMPTY_SCAN_SIZE)
63 		return sector_size;
64 	else
65 		return DEFAULT_EMPTY_SCAN_SIZE;
66 }
67 
68 int jffs2_scan_medium(struct jffs2_sb_info *c)
69 {
70 	int i, ret;
71 	uint32_t empty_blocks = 0, bad_blocks = 0;
72 	unsigned char *flashbuf = NULL;
73 	uint32_t buf_size = 0;
74 	struct jffs2_summary *s = NULL; /* summary info collected by the scan process */
75 #ifndef __ECOS
76 	size_t pointlen;
77 
78 	if (c->mtd->point) {
79 		ret = c->mtd->point (c->mtd, 0, c->mtd->size, &pointlen, &flashbuf);
80 		if (!ret && pointlen < c->mtd->size) {
81 			/* Don't muck about if it won't let us point to the whole flash */
82 			D1(printk(KERN_DEBUG "MTD point returned len too short: 0x%zx\n", pointlen));
83 			c->mtd->unpoint(c->mtd, flashbuf, 0, c->mtd->size);
84 			flashbuf = NULL;
85 		}
86 		if (ret)
87 			D1(printk(KERN_DEBUG "MTD point failed %d\n", ret));
88 	}
89 #endif
90 	if (!flashbuf) {
91 		/* For NAND it's quicker to read a whole eraseblock at a time,
92 		   apparently */
93 		if (jffs2_cleanmarker_oob(c))
94 			buf_size = c->sector_size;
95 		else
96 			buf_size = PAGE_SIZE;
97 
98 		/* Respect kmalloc limitations */
99 		if (buf_size > 128*1024)
100 			buf_size = 128*1024;
101 
102 		D1(printk(KERN_DEBUG "Allocating readbuf of %d bytes\n", buf_size));
103 		flashbuf = kmalloc(buf_size, GFP_KERNEL);
104 		if (!flashbuf)
105 			return -ENOMEM;
106 	}
107 
108 	if (jffs2_sum_active()) {
109 		s = kmalloc(sizeof(struct jffs2_summary), GFP_KERNEL);
110 		if (!s) {
111 			JFFS2_WARNING("Can't allocate memory for summary\n");
112 			return -ENOMEM;
113 		}
114 		memset(s, 0, sizeof(struct jffs2_summary));
115 	}
116 
117 	for (i=0; i<c->nr_blocks; i++) {
118 		struct jffs2_eraseblock *jeb = &c->blocks[i];
119 
120 		/* reset summary info for next eraseblock scan */
121 		jffs2_sum_reset_collected(s);
122 
123 		ret = jffs2_scan_eraseblock(c, jeb, buf_size?flashbuf:(flashbuf+jeb->offset),
124 						buf_size, s);
125 
126 		if (ret < 0)
127 			goto out;
128 
129 		jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
130 
131 		/* Now decide which list to put it on */
132 		switch(ret) {
133 		case BLK_STATE_ALLFF:
134 			/*
135 			 * Empty block.   Since we can't be sure it
136 			 * was entirely erased, we just queue it for erase
137 			 * again.  It will be marked as such when the erase
138 			 * is complete.  Meanwhile we still count it as empty
139 			 * for later checks.
140 			 */
141 			empty_blocks++;
142 			list_add(&jeb->list, &c->erase_pending_list);
143 			c->nr_erasing_blocks++;
144 			break;
145 
146 		case BLK_STATE_CLEANMARKER:
147 			/* Only a CLEANMARKER node is valid */
148 			if (!jeb->dirty_size) {
149 				/* It's actually free */
150 				list_add(&jeb->list, &c->free_list);
151 				c->nr_free_blocks++;
152 			} else {
153 				/* Dirt */
154 				D1(printk(KERN_DEBUG "Adding all-dirty block at 0x%08x to erase_pending_list\n", jeb->offset));
155 				list_add(&jeb->list, &c->erase_pending_list);
156 				c->nr_erasing_blocks++;
157 			}
158 			break;
159 
160 		case BLK_STATE_CLEAN:
161 			/* Full (or almost full) of clean data. Clean list */
162 			list_add(&jeb->list, &c->clean_list);
163 			break;
164 
165 		case BLK_STATE_PARTDIRTY:
166 			/* Some data, but not full. Dirty list. */
167 			/* We want to remember the block with most free space
168 			and stick it in the 'nextblock' position to start writing to it. */
169 			if (jeb->free_size > min_free(c) &&
170 					(!c->nextblock || c->nextblock->free_size < jeb->free_size)) {
171 				/* Better candidate for the next writes to go to */
172 				if (c->nextblock) {
173 					c->nextblock->dirty_size += c->nextblock->free_size + c->nextblock->wasted_size;
174 					c->dirty_size += c->nextblock->free_size + c->nextblock->wasted_size;
175 					c->free_size -= c->nextblock->free_size;
176 					c->wasted_size -= c->nextblock->wasted_size;
177 					c->nextblock->free_size = c->nextblock->wasted_size = 0;
178 					if (VERYDIRTY(c, c->nextblock->dirty_size)) {
179 						list_add(&c->nextblock->list, &c->very_dirty_list);
180 					} else {
181 						list_add(&c->nextblock->list, &c->dirty_list);
182 					}
183 					/* deleting summary information of the old nextblock */
184 					jffs2_sum_reset_collected(c->summary);
185 				}
186 				/* update collected summary infromation for the current nextblock */
187 				jffs2_sum_move_collected(c, s);
188 				D1(printk(KERN_DEBUG "jffs2_scan_medium(): new nextblock = 0x%08x\n", jeb->offset));
189 				c->nextblock = jeb;
190 			} else {
191 				jeb->dirty_size += jeb->free_size + jeb->wasted_size;
192 				c->dirty_size += jeb->free_size + jeb->wasted_size;
193 				c->free_size -= jeb->free_size;
194 				c->wasted_size -= jeb->wasted_size;
195 				jeb->free_size = jeb->wasted_size = 0;
196 				if (VERYDIRTY(c, jeb->dirty_size)) {
197 					list_add(&jeb->list, &c->very_dirty_list);
198 				} else {
199 					list_add(&jeb->list, &c->dirty_list);
200 				}
201 			}
202 			break;
203 
204 		case BLK_STATE_ALLDIRTY:
205 			/* Nothing valid - not even a clean marker. Needs erasing. */
206 			/* For now we just put it on the erasing list. We'll start the erases later */
207 			D1(printk(KERN_NOTICE "JFFS2: Erase block at 0x%08x is not formatted. It will be erased\n", jeb->offset));
208 			list_add(&jeb->list, &c->erase_pending_list);
209 			c->nr_erasing_blocks++;
210 			break;
211 
212 		case BLK_STATE_BADBLOCK:
213 			D1(printk(KERN_NOTICE "JFFS2: Block at 0x%08x is bad\n", jeb->offset));
214 			list_add(&jeb->list, &c->bad_list);
215 			c->bad_size += c->sector_size;
216 			c->free_size -= c->sector_size;
217 			bad_blocks++;
218 			break;
219 		default:
220 			printk(KERN_WARNING "jffs2_scan_medium(): unknown block state\n");
221 			BUG();
222 		}
223 	}
224 
225 	if (jffs2_sum_active() && s)
226 		kfree(s);
227 
228 	/* Nextblock dirty is always seen as wasted, because we cannot recycle it now */
229 	if (c->nextblock && (c->nextblock->dirty_size)) {
230 		c->nextblock->wasted_size += c->nextblock->dirty_size;
231 		c->wasted_size += c->nextblock->dirty_size;
232 		c->dirty_size -= c->nextblock->dirty_size;
233 		c->nextblock->dirty_size = 0;
234 	}
235 #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
236 	if (!jffs2_can_mark_obsolete(c) && c->nextblock && (c->nextblock->free_size % c->wbuf_pagesize)) {
237 		/* If we're going to start writing into a block which already
238 		   contains data, and the end of the data isn't page-aligned,
239 		   skip a little and align it. */
240 
241 		uint32_t skip = c->nextblock->free_size % c->wbuf_pagesize;
242 
243 		D1(printk(KERN_DEBUG "jffs2_scan_medium(): Skipping %d bytes in nextblock to ensure page alignment\n",
244 			  skip));
245 		c->nextblock->wasted_size += skip;
246 		c->wasted_size += skip;
247 
248 		c->nextblock->free_size -= skip;
249 		c->free_size -= skip;
250 	}
251 #endif
252 	if (c->nr_erasing_blocks) {
253 		if ( !c->used_size && ((c->nr_free_blocks+empty_blocks+bad_blocks)!= c->nr_blocks || bad_blocks == c->nr_blocks) ) {
254 			printk(KERN_NOTICE "Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes\n");
255 			printk(KERN_NOTICE "empty_blocks %d, bad_blocks %d, c->nr_blocks %d\n",empty_blocks,bad_blocks,c->nr_blocks);
256 			ret = -EIO;
257 			goto out;
258 		}
259 		jffs2_erase_pending_trigger(c);
260 	}
261 	ret = 0;
262  out:
263 	if (buf_size)
264 		kfree(flashbuf);
265 #ifndef __ECOS
266 	else
267 		c->mtd->unpoint(c->mtd, flashbuf, 0, c->mtd->size);
268 #endif
269 	return ret;
270 }
271 
272 int jffs2_fill_scan_buf (struct jffs2_sb_info *c, void *buf,
273 				uint32_t ofs, uint32_t len)
274 {
275 	int ret;
276 	size_t retlen;
277 
278 	ret = jffs2_flash_read(c, ofs, len, &retlen, buf);
279 	if (ret) {
280 		D1(printk(KERN_WARNING "mtd->read(0x%x bytes from 0x%x) returned %d\n", len, ofs, ret));
281 		return ret;
282 	}
283 	if (retlen < len) {
284 		D1(printk(KERN_WARNING "Read at 0x%x gave only 0x%zx bytes\n", ofs, retlen));
285 		return -EIO;
286 	}
287 	return 0;
288 }
289 
290 int jffs2_scan_classify_jeb(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb)
291 {
292 	if ((jeb->used_size + jeb->unchecked_size) == PAD(c->cleanmarker_size) && !jeb->dirty_size
293 		&& (!jeb->first_node || !jeb->first_node->next_phys) )
294 		return BLK_STATE_CLEANMARKER;
295 
296 	/* move blocks with max 4 byte dirty space to cleanlist */
297 	else if (!ISDIRTY(c->sector_size - (jeb->used_size + jeb->unchecked_size))) {
298 		c->dirty_size -= jeb->dirty_size;
299 		c->wasted_size += jeb->dirty_size;
300 		jeb->wasted_size += jeb->dirty_size;
301 		jeb->dirty_size = 0;
302 		return BLK_STATE_CLEAN;
303 	} else if (jeb->used_size || jeb->unchecked_size)
304 		return BLK_STATE_PARTDIRTY;
305 	else
306 		return BLK_STATE_ALLDIRTY;
307 }
308 
309 static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
310 				unsigned char *buf, uint32_t buf_size, struct jffs2_summary *s) {
311 	struct jffs2_unknown_node *node;
312 	struct jffs2_unknown_node crcnode;
313 	struct jffs2_sum_marker *sm;
314 	uint32_t ofs, prevofs;
315 	uint32_t hdr_crc, buf_ofs, buf_len;
316 	int err;
317 	int noise = 0;
318 
319 
320 #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
321 	int cleanmarkerfound = 0;
322 #endif
323 
324 	ofs = jeb->offset;
325 	prevofs = jeb->offset - 1;
326 
327 	D1(printk(KERN_DEBUG "jffs2_scan_eraseblock(): Scanning block at 0x%x\n", ofs));
328 
329 #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
330 	if (jffs2_cleanmarker_oob(c)) {
331 		int ret = jffs2_check_nand_cleanmarker(c, jeb);
332 		D2(printk(KERN_NOTICE "jffs_check_nand_cleanmarker returned %d\n",ret));
333 		/* Even if it's not found, we still scan to see
334 		   if the block is empty. We use this information
335 		   to decide whether to erase it or not. */
336 		switch (ret) {
337 		case 0:		cleanmarkerfound = 1; break;
338 		case 1: 	break;
339 		case 2: 	return BLK_STATE_BADBLOCK;
340 		case 3:		return BLK_STATE_ALLDIRTY; /* Block has failed to erase min. once */
341 		default: 	return ret;
342 		}
343 	}
344 #endif
345 
346 	if (jffs2_sum_active()) {
347 		sm = kmalloc(sizeof(struct jffs2_sum_marker), GFP_KERNEL);
348 		if (!sm) {
349 			return -ENOMEM;
350 		}
351 
352 		err = jffs2_fill_scan_buf(c, (unsigned char *) sm, jeb->offset + c->sector_size -
353 					sizeof(struct jffs2_sum_marker), sizeof(struct jffs2_sum_marker));
354 		if (err) {
355 			kfree(sm);
356 			return err;
357 		}
358 
359 		if (je32_to_cpu(sm->magic) == JFFS2_SUM_MAGIC ) {
360 			err = jffs2_sum_scan_sumnode(c, jeb, je32_to_cpu(sm->offset), &pseudo_random);
361 			if (err) {
362 				kfree(sm);
363 				return err;
364 			}
365 		}
366 
367 		kfree(sm);
368 
369 		ofs = jeb->offset;
370 		prevofs = jeb->offset - 1;
371 	}
372 
373 	buf_ofs = jeb->offset;
374 
375 	if (!buf_size) {
376 		buf_len = c->sector_size;
377 
378 		if (jffs2_sum_active()) {
379 			/* must reread because of summary test */
380 			err = jffs2_fill_scan_buf(c, buf, buf_ofs, buf_len);
381 			if (err)
382 				return err;
383 		}
384 
385 	} else {
386 		buf_len = EMPTY_SCAN_SIZE(c->sector_size);
387 		err = jffs2_fill_scan_buf(c, buf, buf_ofs, buf_len);
388 		if (err)
389 			return err;
390 	}
391 
392 	/* We temporarily use 'ofs' as a pointer into the buffer/jeb */
393 	ofs = 0;
394 
395 	/* Scan only 4KiB of 0xFF before declaring it's empty */
396 	while(ofs < EMPTY_SCAN_SIZE(c->sector_size) && *(uint32_t *)(&buf[ofs]) == 0xFFFFFFFF)
397 		ofs += 4;
398 
399 	if (ofs == EMPTY_SCAN_SIZE(c->sector_size)) {
400 #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
401 		if (jffs2_cleanmarker_oob(c)) {
402 			/* scan oob, take care of cleanmarker */
403 			int ret = jffs2_check_oob_empty(c, jeb, cleanmarkerfound);
404 			D2(printk(KERN_NOTICE "jffs2_check_oob_empty returned %d\n",ret));
405 			switch (ret) {
406 			case 0:		return cleanmarkerfound ? BLK_STATE_CLEANMARKER : BLK_STATE_ALLFF;
407 			case 1: 	return BLK_STATE_ALLDIRTY;
408 			default: 	return ret;
409 			}
410 		}
411 #endif
412 		D1(printk(KERN_DEBUG "Block at 0x%08x is empty (erased)\n", jeb->offset));
413 		if (c->cleanmarker_size == 0)
414 			return BLK_STATE_CLEANMARKER;	/* don't bother with re-erase */
415 		else
416 			return BLK_STATE_ALLFF;	/* OK to erase if all blocks are like this */
417 	}
418 	if (ofs) {
419 		D1(printk(KERN_DEBUG "Free space at %08x ends at %08x\n", jeb->offset,
420 			  jeb->offset + ofs));
421 		DIRTY_SPACE(ofs);
422 	}
423 
424 	/* Now ofs is a complete physical flash offset as it always was... */
425 	ofs += jeb->offset;
426 
427 	noise = 10;
428 
429 	dbg_summary("no summary found in jeb 0x%08x. Apply original scan.\n",jeb->offset);
430 
431 scan_more:
432 	while(ofs < jeb->offset + c->sector_size) {
433 
434 		jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
435 
436 		cond_resched();
437 
438 		if (ofs & 3) {
439 			printk(KERN_WARNING "Eep. ofs 0x%08x not word-aligned!\n", ofs);
440 			ofs = PAD(ofs);
441 			continue;
442 		}
443 		if (ofs == prevofs) {
444 			printk(KERN_WARNING "ofs 0x%08x has already been seen. Skipping\n", ofs);
445 			DIRTY_SPACE(4);
446 			ofs += 4;
447 			continue;
448 		}
449 		prevofs = ofs;
450 
451 		if (jeb->offset + c->sector_size < ofs + sizeof(*node)) {
452 			D1(printk(KERN_DEBUG "Fewer than %zd bytes left to end of block. (%x+%x<%x+%zx) Not reading\n", sizeof(struct jffs2_unknown_node),
453 				  jeb->offset, c->sector_size, ofs, sizeof(*node)));
454 			DIRTY_SPACE((jeb->offset + c->sector_size)-ofs);
455 			break;
456 		}
457 
458 		if (buf_ofs + buf_len < ofs + sizeof(*node)) {
459 			buf_len = min_t(uint32_t, buf_size, jeb->offset + c->sector_size - ofs);
460 			D1(printk(KERN_DEBUG "Fewer than %zd bytes (node header) left to end of buf. Reading 0x%x at 0x%08x\n",
461 				  sizeof(struct jffs2_unknown_node), buf_len, ofs));
462 			err = jffs2_fill_scan_buf(c, buf, ofs, buf_len);
463 			if (err)
464 				return err;
465 			buf_ofs = ofs;
466 		}
467 
468 		node = (struct jffs2_unknown_node *)&buf[ofs-buf_ofs];
469 
470 		if (*(uint32_t *)(&buf[ofs-buf_ofs]) == 0xffffffff) {
471 			uint32_t inbuf_ofs;
472 			uint32_t empty_start;
473 
474 			empty_start = ofs;
475 			ofs += 4;
476 
477 			D1(printk(KERN_DEBUG "Found empty flash at 0x%08x\n", ofs));
478 		more_empty:
479 			inbuf_ofs = ofs - buf_ofs;
480 			while (inbuf_ofs < buf_len) {
481 				if (*(uint32_t *)(&buf[inbuf_ofs]) != 0xffffffff) {
482 					printk(KERN_WARNING "Empty flash at 0x%08x ends at 0x%08x\n",
483 					       empty_start, ofs);
484 					DIRTY_SPACE(ofs-empty_start);
485 					goto scan_more;
486 				}
487 
488 				inbuf_ofs+=4;
489 				ofs += 4;
490 			}
491 			/* Ran off end. */
492 			D1(printk(KERN_DEBUG "Empty flash to end of buffer at 0x%08x\n", ofs));
493 
494 			/* If we're only checking the beginning of a block with a cleanmarker,
495 			   bail now */
496 			if (buf_ofs == jeb->offset && jeb->used_size == PAD(c->cleanmarker_size) &&
497 			    c->cleanmarker_size && !jeb->dirty_size && !jeb->first_node->next_phys) {
498 				D1(printk(KERN_DEBUG "%d bytes at start of block seems clean... assuming all clean\n", EMPTY_SCAN_SIZE(c->sector_size)));
499 				return BLK_STATE_CLEANMARKER;
500 			}
501 
502 			/* See how much more there is to read in this eraseblock... */
503 			buf_len = min_t(uint32_t, buf_size, jeb->offset + c->sector_size - ofs);
504 			if (!buf_len) {
505 				/* No more to read. Break out of main loop without marking
506 				   this range of empty space as dirty (because it's not) */
507 				D1(printk(KERN_DEBUG "Empty flash at %08x runs to end of block. Treating as free_space\n",
508 					  empty_start));
509 				break;
510 			}
511 			D1(printk(KERN_DEBUG "Reading another 0x%x at 0x%08x\n", buf_len, ofs));
512 			err = jffs2_fill_scan_buf(c, buf, ofs, buf_len);
513 			if (err)
514 				return err;
515 			buf_ofs = ofs;
516 			goto more_empty;
517 		}
518 
519 		if (ofs == jeb->offset && je16_to_cpu(node->magic) == KSAMTIB_CIGAM_2SFFJ) {
520 			printk(KERN_WARNING "Magic bitmask is backwards at offset 0x%08x. Wrong endian filesystem?\n", ofs);
521 			DIRTY_SPACE(4);
522 			ofs += 4;
523 			continue;
524 		}
525 		if (je16_to_cpu(node->magic) == JFFS2_DIRTY_BITMASK) {
526 			D1(printk(KERN_DEBUG "Dirty bitmask at 0x%08x\n", ofs));
527 			DIRTY_SPACE(4);
528 			ofs += 4;
529 			continue;
530 		}
531 		if (je16_to_cpu(node->magic) == JFFS2_OLD_MAGIC_BITMASK) {
532 			printk(KERN_WARNING "Old JFFS2 bitmask found at 0x%08x\n", ofs);
533 			printk(KERN_WARNING "You cannot use older JFFS2 filesystems with newer kernels\n");
534 			DIRTY_SPACE(4);
535 			ofs += 4;
536 			continue;
537 		}
538 		if (je16_to_cpu(node->magic) != JFFS2_MAGIC_BITMASK) {
539 			/* OK. We're out of possibilities. Whinge and move on */
540 			noisy_printk(&noise, "jffs2_scan_eraseblock(): Magic bitmask 0x%04x not found at 0x%08x: 0x%04x instead\n",
541 				     JFFS2_MAGIC_BITMASK, ofs,
542 				     je16_to_cpu(node->magic));
543 			DIRTY_SPACE(4);
544 			ofs += 4;
545 			continue;
546 		}
547 		/* We seem to have a node of sorts. Check the CRC */
548 		crcnode.magic = node->magic;
549 		crcnode.nodetype = cpu_to_je16( je16_to_cpu(node->nodetype) | JFFS2_NODE_ACCURATE);
550 		crcnode.totlen = node->totlen;
551 		hdr_crc = crc32(0, &crcnode, sizeof(crcnode)-4);
552 
553 		if (hdr_crc != je32_to_cpu(node->hdr_crc)) {
554 			noisy_printk(&noise, "jffs2_scan_eraseblock(): Node at 0x%08x {0x%04x, 0x%04x, 0x%08x) has invalid CRC 0x%08x (calculated 0x%08x)\n",
555 				     ofs, je16_to_cpu(node->magic),
556 				     je16_to_cpu(node->nodetype),
557 				     je32_to_cpu(node->totlen),
558 				     je32_to_cpu(node->hdr_crc),
559 				     hdr_crc);
560 			DIRTY_SPACE(4);
561 			ofs += 4;
562 			continue;
563 		}
564 
565 		if (ofs + je32_to_cpu(node->totlen) >
566 		    jeb->offset + c->sector_size) {
567 			/* Eep. Node goes over the end of the erase block. */
568 			printk(KERN_WARNING "Node at 0x%08x with length 0x%08x would run over the end of the erase block\n",
569 			       ofs, je32_to_cpu(node->totlen));
570 			printk(KERN_WARNING "Perhaps the file system was created with the wrong erase size?\n");
571 			DIRTY_SPACE(4);
572 			ofs += 4;
573 			continue;
574 		}
575 
576 		if (!(je16_to_cpu(node->nodetype) & JFFS2_NODE_ACCURATE)) {
577 			/* Wheee. This is an obsoleted node */
578 			D2(printk(KERN_DEBUG "Node at 0x%08x is obsolete. Skipping\n", ofs));
579 			DIRTY_SPACE(PAD(je32_to_cpu(node->totlen)));
580 			ofs += PAD(je32_to_cpu(node->totlen));
581 			continue;
582 		}
583 
584 		switch(je16_to_cpu(node->nodetype)) {
585 		case JFFS2_NODETYPE_INODE:
586 			if (buf_ofs + buf_len < ofs + sizeof(struct jffs2_raw_inode)) {
587 				buf_len = min_t(uint32_t, buf_size, jeb->offset + c->sector_size - ofs);
588 				D1(printk(KERN_DEBUG "Fewer than %zd bytes (inode node) left to end of buf. Reading 0x%x at 0x%08x\n",
589 					  sizeof(struct jffs2_raw_inode), buf_len, ofs));
590 				err = jffs2_fill_scan_buf(c, buf, ofs, buf_len);
591 				if (err)
592 					return err;
593 				buf_ofs = ofs;
594 				node = (void *)buf;
595 			}
596 			err = jffs2_scan_inode_node(c, jeb, (void *)node, ofs, s);
597 			if (err) return err;
598 			ofs += PAD(je32_to_cpu(node->totlen));
599 			break;
600 
601 		case JFFS2_NODETYPE_DIRENT:
602 			if (buf_ofs + buf_len < ofs + je32_to_cpu(node->totlen)) {
603 				buf_len = min_t(uint32_t, buf_size, jeb->offset + c->sector_size - ofs);
604 				D1(printk(KERN_DEBUG "Fewer than %d bytes (dirent node) left to end of buf. Reading 0x%x at 0x%08x\n",
605 					  je32_to_cpu(node->totlen), buf_len, ofs));
606 				err = jffs2_fill_scan_buf(c, buf, ofs, buf_len);
607 				if (err)
608 					return err;
609 				buf_ofs = ofs;
610 				node = (void *)buf;
611 			}
612 			err = jffs2_scan_dirent_node(c, jeb, (void *)node, ofs, s);
613 			if (err) return err;
614 			ofs += PAD(je32_to_cpu(node->totlen));
615 			break;
616 
617 		case JFFS2_NODETYPE_CLEANMARKER:
618 			D1(printk(KERN_DEBUG "CLEANMARKER node found at 0x%08x\n", ofs));
619 			if (je32_to_cpu(node->totlen) != c->cleanmarker_size) {
620 				printk(KERN_NOTICE "CLEANMARKER node found at 0x%08x has totlen 0x%x != normal 0x%x\n",
621 				       ofs, je32_to_cpu(node->totlen), c->cleanmarker_size);
622 				DIRTY_SPACE(PAD(sizeof(struct jffs2_unknown_node)));
623 				ofs += PAD(sizeof(struct jffs2_unknown_node));
624 			} else if (jeb->first_node) {
625 				printk(KERN_NOTICE "CLEANMARKER node found at 0x%08x, not first node in block (0x%08x)\n", ofs, jeb->offset);
626 				DIRTY_SPACE(PAD(sizeof(struct jffs2_unknown_node)));
627 				ofs += PAD(sizeof(struct jffs2_unknown_node));
628 			} else {
629 				struct jffs2_raw_node_ref *marker_ref = jffs2_alloc_raw_node_ref();
630 				if (!marker_ref) {
631 					printk(KERN_NOTICE "Failed to allocate node ref for clean marker\n");
632 					return -ENOMEM;
633 				}
634 				marker_ref->next_in_ino = NULL;
635 				marker_ref->next_phys = NULL;
636 				marker_ref->flash_offset = ofs | REF_NORMAL;
637 				marker_ref->__totlen = c->cleanmarker_size;
638 				jeb->first_node = jeb->last_node = marker_ref;
639 
640 				USED_SPACE(PAD(c->cleanmarker_size));
641 				ofs += PAD(c->cleanmarker_size);
642 			}
643 			break;
644 
645 		case JFFS2_NODETYPE_PADDING:
646 			if (jffs2_sum_active())
647 				jffs2_sum_add_padding_mem(s, je32_to_cpu(node->totlen));
648 			DIRTY_SPACE(PAD(je32_to_cpu(node->totlen)));
649 			ofs += PAD(je32_to_cpu(node->totlen));
650 			break;
651 
652 		default:
653 			switch (je16_to_cpu(node->nodetype) & JFFS2_COMPAT_MASK) {
654 			case JFFS2_FEATURE_ROCOMPAT:
655 				printk(KERN_NOTICE "Read-only compatible feature node (0x%04x) found at offset 0x%08x\n", je16_to_cpu(node->nodetype), ofs);
656 			        c->flags |= JFFS2_SB_FLAG_RO;
657 				if (!(jffs2_is_readonly(c)))
658 					return -EROFS;
659 				DIRTY_SPACE(PAD(je32_to_cpu(node->totlen)));
660 				ofs += PAD(je32_to_cpu(node->totlen));
661 				break;
662 
663 			case JFFS2_FEATURE_INCOMPAT:
664 				printk(KERN_NOTICE "Incompatible feature node (0x%04x) found at offset 0x%08x\n", je16_to_cpu(node->nodetype), ofs);
665 				return -EINVAL;
666 
667 			case JFFS2_FEATURE_RWCOMPAT_DELETE:
668 				D1(printk(KERN_NOTICE "Unknown but compatible feature node (0x%04x) found at offset 0x%08x\n", je16_to_cpu(node->nodetype), ofs));
669 				DIRTY_SPACE(PAD(je32_to_cpu(node->totlen)));
670 				ofs += PAD(je32_to_cpu(node->totlen));
671 				break;
672 
673 			case JFFS2_FEATURE_RWCOMPAT_COPY:
674 				D1(printk(KERN_NOTICE "Unknown but compatible feature node (0x%04x) found at offset 0x%08x\n", je16_to_cpu(node->nodetype), ofs));
675 				USED_SPACE(PAD(je32_to_cpu(node->totlen)));
676 				ofs += PAD(je32_to_cpu(node->totlen));
677 				break;
678 			}
679 		}
680 	}
681 
682 	if (jffs2_sum_active()) {
683 		if (PAD(s->sum_size + JFFS2_SUMMARY_FRAME_SIZE) > jeb->free_size) {
684 			dbg_summary("There is not enough space for "
685 				"summary information, disabling for this jeb!\n");
686 			jffs2_sum_disable_collecting(s);
687 		}
688 	}
689 
690 	D1(printk(KERN_DEBUG "Block at 0x%08x: free 0x%08x, dirty 0x%08x, unchecked 0x%08x, used 0x%08x\n", jeb->offset,
691 		  jeb->free_size, jeb->dirty_size, jeb->unchecked_size, jeb->used_size));
692 
693 	/* mark_node_obsolete can add to wasted !! */
694 	if (jeb->wasted_size) {
695 		jeb->dirty_size += jeb->wasted_size;
696 		c->dirty_size += jeb->wasted_size;
697 		c->wasted_size -= jeb->wasted_size;
698 		jeb->wasted_size = 0;
699 	}
700 
701 	return jffs2_scan_classify_jeb(c, jeb);
702 }
703 
704 struct jffs2_inode_cache *jffs2_scan_make_ino_cache(struct jffs2_sb_info *c, uint32_t ino)
705 {
706 	struct jffs2_inode_cache *ic;
707 
708 	ic = jffs2_get_ino_cache(c, ino);
709 	if (ic)
710 		return ic;
711 
712 	if (ino > c->highest_ino)
713 		c->highest_ino = ino;
714 
715 	ic = jffs2_alloc_inode_cache();
716 	if (!ic) {
717 		printk(KERN_NOTICE "jffs2_scan_make_inode_cache(): allocation of inode cache failed\n");
718 		return NULL;
719 	}
720 	memset(ic, 0, sizeof(*ic));
721 
722 	ic->ino = ino;
723 	ic->nodes = (void *)ic;
724 	jffs2_add_ino_cache(c, ic);
725 	if (ino == 1)
726 		ic->nlink = 1;
727 	return ic;
728 }
729 
730 static int jffs2_scan_inode_node(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
731 				 struct jffs2_raw_inode *ri, uint32_t ofs, struct jffs2_summary *s)
732 {
733 	struct jffs2_raw_node_ref *raw;
734 	struct jffs2_inode_cache *ic;
735 	uint32_t ino = je32_to_cpu(ri->ino);
736 
737 	D1(printk(KERN_DEBUG "jffs2_scan_inode_node(): Node at 0x%08x\n", ofs));
738 
739 	/* We do very little here now. Just check the ino# to which we should attribute
740 	   this node; we can do all the CRC checking etc. later. There's a tradeoff here --
741 	   we used to scan the flash once only, reading everything we want from it into
742 	   memory, then building all our in-core data structures and freeing the extra
743 	   information. Now we allow the first part of the mount to complete a lot quicker,
744 	   but we have to go _back_ to the flash in order to finish the CRC checking, etc.
745 	   Which means that the _full_ amount of time to get to proper write mode with GC
746 	   operational may actually be _longer_ than before. Sucks to be me. */
747 
748 	raw = jffs2_alloc_raw_node_ref();
749 	if (!raw) {
750 		printk(KERN_NOTICE "jffs2_scan_inode_node(): allocation of node reference failed\n");
751 		return -ENOMEM;
752 	}
753 
754 	ic = jffs2_get_ino_cache(c, ino);
755 	if (!ic) {
756 		/* Inocache get failed. Either we read a bogus ino# or it's just genuinely the
757 		   first node we found for this inode. Do a CRC check to protect against the former
758 		   case */
759 		uint32_t crc = crc32(0, ri, sizeof(*ri)-8);
760 
761 		if (crc != je32_to_cpu(ri->node_crc)) {
762 			printk(KERN_NOTICE "jffs2_scan_inode_node(): CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
763 			       ofs, je32_to_cpu(ri->node_crc), crc);
764 			/* We believe totlen because the CRC on the node _header_ was OK, just the node itself failed. */
765 			DIRTY_SPACE(PAD(je32_to_cpu(ri->totlen)));
766 			jffs2_free_raw_node_ref(raw);
767 			return 0;
768 		}
769 		ic = jffs2_scan_make_ino_cache(c, ino);
770 		if (!ic) {
771 			jffs2_free_raw_node_ref(raw);
772 			return -ENOMEM;
773 		}
774 	}
775 
776 	/* Wheee. It worked */
777 
778 	raw->flash_offset = ofs | REF_UNCHECKED;
779 	raw->__totlen = PAD(je32_to_cpu(ri->totlen));
780 	raw->next_phys = NULL;
781 	raw->next_in_ino = ic->nodes;
782 
783 	ic->nodes = raw;
784 	if (!jeb->first_node)
785 		jeb->first_node = raw;
786 	if (jeb->last_node)
787 		jeb->last_node->next_phys = raw;
788 	jeb->last_node = raw;
789 
790 	D1(printk(KERN_DEBUG "Node is ino #%u, version %d. Range 0x%x-0x%x\n",
791 		  je32_to_cpu(ri->ino), je32_to_cpu(ri->version),
792 		  je32_to_cpu(ri->offset),
793 		  je32_to_cpu(ri->offset)+je32_to_cpu(ri->dsize)));
794 
795 	pseudo_random += je32_to_cpu(ri->version);
796 
797 	UNCHECKED_SPACE(PAD(je32_to_cpu(ri->totlen)));
798 
799 	if (jffs2_sum_active()) {
800 		jffs2_sum_add_inode_mem(s, ri, ofs - jeb->offset);
801 	}
802 
803 	return 0;
804 }
805 
806 static int jffs2_scan_dirent_node(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
807 				  struct jffs2_raw_dirent *rd, uint32_t ofs, struct jffs2_summary *s)
808 {
809 	struct jffs2_raw_node_ref *raw;
810 	struct jffs2_full_dirent *fd;
811 	struct jffs2_inode_cache *ic;
812 	uint32_t crc;
813 
814 	D1(printk(KERN_DEBUG "jffs2_scan_dirent_node(): Node at 0x%08x\n", ofs));
815 
816 	/* We don't get here unless the node is still valid, so we don't have to
817 	   mask in the ACCURATE bit any more. */
818 	crc = crc32(0, rd, sizeof(*rd)-8);
819 
820 	if (crc != je32_to_cpu(rd->node_crc)) {
821 		printk(KERN_NOTICE "jffs2_scan_dirent_node(): Node CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
822 		       ofs, je32_to_cpu(rd->node_crc), crc);
823 		/* We believe totlen because the CRC on the node _header_ was OK, just the node itself failed. */
824 		DIRTY_SPACE(PAD(je32_to_cpu(rd->totlen)));
825 		return 0;
826 	}
827 
828 	pseudo_random += je32_to_cpu(rd->version);
829 
830 	fd = jffs2_alloc_full_dirent(rd->nsize+1);
831 	if (!fd) {
832 		return -ENOMEM;
833 	}
834 	memcpy(&fd->name, rd->name, rd->nsize);
835 	fd->name[rd->nsize] = 0;
836 
837 	crc = crc32(0, fd->name, rd->nsize);
838 	if (crc != je32_to_cpu(rd->name_crc)) {
839 		printk(KERN_NOTICE "jffs2_scan_dirent_node(): Name CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
840 		       ofs, je32_to_cpu(rd->name_crc), crc);
841 		D1(printk(KERN_NOTICE "Name for which CRC failed is (now) '%s', ino #%d\n", fd->name, je32_to_cpu(rd->ino)));
842 		jffs2_free_full_dirent(fd);
843 		/* FIXME: Why do we believe totlen? */
844 		/* We believe totlen because the CRC on the node _header_ was OK, just the name failed. */
845 		DIRTY_SPACE(PAD(je32_to_cpu(rd->totlen)));
846 		return 0;
847 	}
848 	raw = jffs2_alloc_raw_node_ref();
849 	if (!raw) {
850 		jffs2_free_full_dirent(fd);
851 		printk(KERN_NOTICE "jffs2_scan_dirent_node(): allocation of node reference failed\n");
852 		return -ENOMEM;
853 	}
854 	ic = jffs2_scan_make_ino_cache(c, je32_to_cpu(rd->pino));
855 	if (!ic) {
856 		jffs2_free_full_dirent(fd);
857 		jffs2_free_raw_node_ref(raw);
858 		return -ENOMEM;
859 	}
860 
861 	raw->__totlen = PAD(je32_to_cpu(rd->totlen));
862 	raw->flash_offset = ofs | REF_PRISTINE;
863 	raw->next_phys = NULL;
864 	raw->next_in_ino = ic->nodes;
865 	ic->nodes = raw;
866 	if (!jeb->first_node)
867 		jeb->first_node = raw;
868 	if (jeb->last_node)
869 		jeb->last_node->next_phys = raw;
870 	jeb->last_node = raw;
871 
872 	fd->raw = raw;
873 	fd->next = NULL;
874 	fd->version = je32_to_cpu(rd->version);
875 	fd->ino = je32_to_cpu(rd->ino);
876 	fd->nhash = full_name_hash(fd->name, rd->nsize);
877 	fd->type = rd->type;
878 	USED_SPACE(PAD(je32_to_cpu(rd->totlen)));
879 	jffs2_add_fd_to_list(c, fd, &ic->scan_dents);
880 
881 	if (jffs2_sum_active()) {
882 		jffs2_sum_add_dirent_mem(s, rd, ofs - jeb->offset);
883 	}
884 
885 	return 0;
886 }
887 
888 static int count_list(struct list_head *l)
889 {
890 	uint32_t count = 0;
891 	struct list_head *tmp;
892 
893 	list_for_each(tmp, l) {
894 		count++;
895 	}
896 	return count;
897 }
898 
899 /* Note: This breaks if list_empty(head). I don't care. You
900    might, if you copy this code and use it elsewhere :) */
901 static void rotate_list(struct list_head *head, uint32_t count)
902 {
903 	struct list_head *n = head->next;
904 
905 	list_del(head);
906 	while(count--) {
907 		n = n->next;
908 	}
909 	list_add(head, n);
910 }
911 
912 void jffs2_rotate_lists(struct jffs2_sb_info *c)
913 {
914 	uint32_t x;
915 	uint32_t rotateby;
916 
917 	x = count_list(&c->clean_list);
918 	if (x) {
919 		rotateby = pseudo_random % x;
920 		rotate_list((&c->clean_list), rotateby);
921 	}
922 
923 	x = count_list(&c->very_dirty_list);
924 	if (x) {
925 		rotateby = pseudo_random % x;
926 		rotate_list((&c->very_dirty_list), rotateby);
927 	}
928 
929 	x = count_list(&c->dirty_list);
930 	if (x) {
931 		rotateby = pseudo_random % x;
932 		rotate_list((&c->dirty_list), rotateby);
933 	}
934 
935 	x = count_list(&c->erasable_list);
936 	if (x) {
937 		rotateby = pseudo_random % x;
938 		rotate_list((&c->erasable_list), rotateby);
939 	}
940 
941 	if (c->nr_erasing_blocks) {
942 		rotateby = pseudo_random % c->nr_erasing_blocks;
943 		rotate_list((&c->erase_pending_list), rotateby);
944 	}
945 
946 	if (c->nr_free_blocks) {
947 		rotateby = pseudo_random % c->nr_free_blocks;
948 		rotate_list((&c->free_list), rotateby);
949 	}
950 }
951