xref: /linux/fs/jffs2/readinode.c (revision eb2bce7f5e7ac1ca6da434461217fadf3c688d2c)
1 /*
2  * JFFS2 -- Journalling Flash File System, Version 2.
3  *
4  * Copyright © 2001-2007 Red Hat, Inc.
5  *
6  * Created by David Woodhouse <dwmw2@infradead.org>
7  *
8  * For licensing information, see the file 'LICENCE' in this directory.
9  *
10  */
11 
12 #include <linux/kernel.h>
13 #include <linux/sched.h>
14 #include <linux/slab.h>
15 #include <linux/fs.h>
16 #include <linux/crc32.h>
17 #include <linux/pagemap.h>
18 #include <linux/mtd/mtd.h>
19 #include <linux/compiler.h>
20 #include "nodelist.h"
21 
22 /*
23  * Check the data CRC of the node.
24  *
25  * Returns: 0 if the data CRC is correct;
26  * 	    1 - if incorrect;
27  *	    error code if an error occured.
28  */
29 static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
30 {
31 	struct jffs2_raw_node_ref *ref = tn->fn->raw;
32 	int err = 0, pointed = 0;
33 	struct jffs2_eraseblock *jeb;
34 	unsigned char *buffer;
35 	uint32_t crc, ofs, len;
36 	size_t retlen;
37 
38 	BUG_ON(tn->csize == 0);
39 
40 	if (!jffs2_is_writebuffered(c))
41 		goto adj_acc;
42 
43 	/* Calculate how many bytes were already checked */
44 	ofs = ref_offset(ref) + sizeof(struct jffs2_raw_inode);
45 	len = ofs % c->wbuf_pagesize;
46 	if (likely(len))
47 		len = c->wbuf_pagesize - len;
48 
49 	if (len >= tn->csize) {
50 		dbg_readinode("no need to check node at %#08x, data length %u, data starts at %#08x - it has already been checked.\n",
51 			ref_offset(ref), tn->csize, ofs);
52 		goto adj_acc;
53 	}
54 
55 	ofs += len;
56 	len = tn->csize - len;
57 
58 	dbg_readinode("check node at %#08x, data length %u, partial CRC %#08x, correct CRC %#08x, data starts at %#08x, start checking from %#08x - %u bytes.\n",
59 		ref_offset(ref), tn->csize, tn->partial_crc, tn->data_crc, ofs - len, ofs, len);
60 
61 #ifndef __ECOS
62 	/* TODO: instead, incapsulate point() stuff to jffs2_flash_read(),
63 	 * adding and jffs2_flash_read_end() interface. */
64 	if (c->mtd->point) {
65 		err = c->mtd->point(c->mtd, ofs, len, &retlen, &buffer);
66 		if (!err && retlen < tn->csize) {
67 			JFFS2_WARNING("MTD point returned len too short: %zu instead of %u.\n", retlen, tn->csize);
68 			c->mtd->unpoint(c->mtd, buffer, ofs, len);
69 		} else if (err)
70 			JFFS2_WARNING("MTD point failed: error code %d.\n", err);
71 		else
72 			pointed = 1; /* succefully pointed to device */
73 	}
74 #endif
75 
76 	if (!pointed) {
77 		buffer = kmalloc(len, GFP_KERNEL);
78 		if (unlikely(!buffer))
79 			return -ENOMEM;
80 
81 		/* TODO: this is very frequent pattern, make it a separate
82 		 * routine */
83 		err = jffs2_flash_read(c, ofs, len, &retlen, buffer);
84 		if (err) {
85 			JFFS2_ERROR("can not read %d bytes from 0x%08x, error code: %d.\n", len, ofs, err);
86 			goto free_out;
87 		}
88 
89 		if (retlen != len) {
90 			JFFS2_ERROR("short read at %#08x: %zd instead of %d.\n", ofs, retlen, len);
91 			err = -EIO;
92 			goto free_out;
93 		}
94 	}
95 
96 	/* Continue calculating CRC */
97 	crc = crc32(tn->partial_crc, buffer, len);
98 	if(!pointed)
99 		kfree(buffer);
100 #ifndef __ECOS
101 	else
102 		c->mtd->unpoint(c->mtd, buffer, ofs, len);
103 #endif
104 
105 	if (crc != tn->data_crc) {
106 		JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
107 			ofs, tn->data_crc, crc);
108 		return 1;
109 	}
110 
111 adj_acc:
112 	jeb = &c->blocks[ref->flash_offset / c->sector_size];
113 	len = ref_totlen(c, jeb, ref);
114 	/* If it should be REF_NORMAL, it'll get marked as such when
115 	   we build the fragtree, shortly. No need to worry about GC
116 	   moving it while it's marked REF_PRISTINE -- GC won't happen
117 	   till we've finished checking every inode anyway. */
118 	ref->flash_offset |= REF_PRISTINE;
119 	/*
120 	 * Mark the node as having been checked and fix the
121 	 * accounting accordingly.
122 	 */
123 	spin_lock(&c->erase_completion_lock);
124 	jeb->used_size += len;
125 	jeb->unchecked_size -= len;
126 	c->used_size += len;
127 	c->unchecked_size -= len;
128 	jffs2_dbg_acct_paranoia_check_nolock(c, jeb);
129 	spin_unlock(&c->erase_completion_lock);
130 
131 	return 0;
132 
133 free_out:
134 	if(!pointed)
135 		kfree(buffer);
136 #ifndef __ECOS
137 	else
138 		c->mtd->unpoint(c->mtd, buffer, ofs, len);
139 #endif
140 	return err;
141 }
142 
143 /*
144  * Helper function for jffs2_add_older_frag_to_fragtree().
145  *
146  * Checks the node if we are in the checking stage.
147  */
148 static int check_tn_node(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
149 {
150 	int ret;
151 
152 	BUG_ON(ref_obsolete(tn->fn->raw));
153 
154 	/* We only check the data CRC of unchecked nodes */
155 	if (ref_flags(tn->fn->raw) != REF_UNCHECKED)
156 		return 0;
157 
158 	dbg_readinode("check node %#04x-%#04x, phys offs %#08x\n",
159 		      tn->fn->ofs, tn->fn->ofs + tn->fn->size, ref_offset(tn->fn->raw));
160 
161 	ret = check_node_data(c, tn);
162 	if (unlikely(ret < 0)) {
163 		JFFS2_ERROR("check_node_data() returned error: %d.\n",
164 			ret);
165 	} else if (unlikely(ret > 0)) {
166 		dbg_readinode("CRC error, mark it obsolete.\n");
167 		jffs2_mark_node_obsolete(c, tn->fn->raw);
168 	}
169 
170 	return ret;
171 }
172 
173 static struct jffs2_tmp_dnode_info *jffs2_lookup_tn(struct rb_root *tn_root, uint32_t offset)
174 {
175 	struct rb_node *next;
176 	struct jffs2_tmp_dnode_info *tn = NULL;
177 
178 	dbg_readinode("root %p, offset %d\n", tn_root, offset);
179 
180 	next = tn_root->rb_node;
181 
182 	while (next) {
183 		tn = rb_entry(next, struct jffs2_tmp_dnode_info, rb);
184 
185 		if (tn->fn->ofs < offset)
186 			next = tn->rb.rb_right;
187 		else if (tn->fn->ofs >= offset)
188 			next = tn->rb.rb_left;
189 		else
190 			break;
191 	}
192 
193 	return tn;
194 }
195 
196 
197 static void jffs2_kill_tn(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
198 {
199 	jffs2_mark_node_obsolete(c, tn->fn->raw);
200 	jffs2_free_full_dnode(tn->fn);
201 	jffs2_free_tmp_dnode_info(tn);
202 }
203 /*
204  * This function is used when we read an inode. Data nodes arrive in
205  * arbitrary order -- they may be older or newer than the nodes which
206  * are already in the tree. Where overlaps occur, the older node can
207  * be discarded as long as the newer passes the CRC check. We don't
208  * bother to keep track of holes in this rbtree, and neither do we deal
209  * with frags -- we can have multiple entries starting at the same
210  * offset, and the one with the smallest length will come first in the
211  * ordering.
212  *
213  * Returns 0 if the node was inserted
214  *         1 if the node is obsolete (because we can't mark it so yet)
215  *         < 0 an if error occurred
216  */
217 static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
218 				struct jffs2_readinode_info *rii,
219 				struct jffs2_tmp_dnode_info *tn)
220 {
221 	uint32_t fn_end = tn->fn->ofs + tn->fn->size;
222 	struct jffs2_tmp_dnode_info *insert_point = NULL, *this;
223 
224 	dbg_readinode("insert fragment %#04x-%#04x, ver %u\n", tn->fn->ofs, fn_end, tn->version);
225 
226 	/* If a node has zero dsize, we only have to keep if it if it might be the
227 	   node with highest version -- i.e. the one which will end up as f->metadata.
228 	   Note that such nodes won't be REF_UNCHECKED since there are no data to
229 	   check anyway. */
230 	if (!tn->fn->size) {
231 		if (rii->mdata_tn) {
232 			/* We had a candidate mdata node already */
233 			dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
234 			jffs2_kill_tn(c, rii->mdata_tn);
235 		}
236 		rii->mdata_tn = tn;
237 		dbg_readinode("keep new mdata with ver %d\n", tn->version);
238 		return 0;
239 	}
240 
241 	/* Find the earliest node which _may_ be relevant to this one */
242 	this = jffs2_lookup_tn(&rii->tn_root, tn->fn->ofs);
243 	if (!this) {
244 		/* First addition to empty tree. $DEITY how I love the easy cases */
245 		rb_link_node(&tn->rb, NULL, &rii->tn_root.rb_node);
246 		rb_insert_color(&tn->rb, &rii->tn_root);
247 		dbg_readinode("keep new frag\n");
248 		return 0;
249 	}
250 
251 	/* If we add a new node it'll be somewhere under here. */
252 	insert_point = this;
253 
254 	/* If the node is coincident with another at a lower address,
255 	   back up until the other node is found. It may be relevant */
256 	while (tn->overlapped)
257 		tn = tn_prev(tn);
258 
259 	dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
260 
261 	while (this) {
262 		if (this->fn->ofs > fn_end)
263 			break;
264 		dbg_readinode("Ponder this ver %d, 0x%x-0x%x\n",
265 			      this->version, this->fn->ofs, this->fn->size);
266 
267 		if (this->version == tn->version) {
268 			/* Version number collision means REF_PRISTINE GC. Accept either of them
269 			   as long as the CRC is correct. Check the one we have already...  */
270 			if (!check_tn_node(c, this)) {
271 				/* The one we already had was OK. Keep it and throw away the new one */
272 				dbg_readinode("Like old node. Throw away new\n");
273 				jffs2_kill_tn(c, tn);
274 				return 0;
275 			} else {
276 				/* Who cares if the new one is good; keep it for now anyway. */
277 				rb_replace_node(&this->rb, &tn->rb, &rii->tn_root);
278 				/* Same overlapping from in front and behind */
279 				tn->overlapped = this->overlapped;
280 				jffs2_kill_tn(c, this);
281 				dbg_readinode("Like new node. Throw away old\n");
282 				return 0;
283 			}
284 		}
285 		if (this->version < tn->version &&
286 		    this->fn->ofs >= tn->fn->ofs &&
287 		    this->fn->ofs + this->fn->size <= fn_end) {
288 			/* New node entirely overlaps 'this' */
289 			if (check_tn_node(c, tn)) {
290 				dbg_readinode("new node bad CRC\n");
291 				jffs2_kill_tn(c, tn);
292 				return 0;
293 			}
294 			/* ... and is good. Kill 'this'... */
295 			rb_replace_node(&this->rb, &tn->rb, &rii->tn_root);
296 			tn->overlapped = this->overlapped;
297 			jffs2_kill_tn(c, this);
298 			/* ... and any subsequent nodes which are also overlapped */
299 			this = tn_next(tn);
300 			while (this && this->fn->ofs + this->fn->size < fn_end) {
301 				struct jffs2_tmp_dnode_info *next = tn_next(this);
302 				if (this->version < tn->version) {
303 					tn_erase(this, &rii->tn_root);
304 					dbg_readinode("Kill overlapped ver %d, 0x%x-0x%x\n",
305 						      this->version, this->fn->ofs,
306 						      this->fn->ofs+this->fn->size);
307 					jffs2_kill_tn(c, this);
308 				}
309 				this = next;
310 			}
311 			dbg_readinode("Done inserting new\n");
312 			return 0;
313 		}
314 		if (this->version > tn->version &&
315 		    this->fn->ofs <= tn->fn->ofs &&
316 		    this->fn->ofs+this->fn->size >= fn_end) {
317 			/* New node entirely overlapped by 'this' */
318 			if (!check_tn_node(c, this)) {
319 				dbg_readinode("Good CRC on old node. Kill new\n");
320 				jffs2_kill_tn(c, tn);
321 				return 0;
322 			}
323 			/* ... but 'this' was bad. Replace it... */
324 			rb_replace_node(&this->rb, &tn->rb, &rii->tn_root);
325 			dbg_readinode("Bad CRC on old overlapping node. Kill it\n");
326 			jffs2_kill_tn(c, this);
327 			return 0;
328 		}
329 		/* We want to be inserted under the last node which is
330 		   either at a lower offset _or_ has a smaller range */
331 		if (this->fn->ofs < tn->fn->ofs ||
332 		    (this->fn->ofs == tn->fn->ofs &&
333 		     this->fn->size <= tn->fn->size))
334 			insert_point = this;
335 
336 		this = tn_next(this);
337 	}
338 	dbg_readinode("insert_point %p, ver %d, 0x%x-0x%x, ov %d\n",
339 		      insert_point, insert_point->version, insert_point->fn->ofs,
340 		      insert_point->fn->ofs+insert_point->fn->size,
341 		      insert_point->overlapped);
342 	/* We neither completely obsoleted nor were completely
343 	   obsoleted by an earlier node. Insert under insert_point */
344 	{
345 		struct rb_node *parent = &insert_point->rb;
346 		struct rb_node **link = &parent;
347 
348 		while (*link) {
349 			parent = *link;
350 			insert_point = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
351 			if (tn->fn->ofs > insert_point->fn->ofs)
352 				link = &insert_point->rb.rb_right;
353 			else if (tn->fn->ofs < insert_point->fn->ofs ||
354 				 tn->fn->size < insert_point->fn->size)
355 				link = &insert_point->rb.rb_left;
356 			else
357 				link = &insert_point->rb.rb_right;
358 		}
359 		rb_link_node(&tn->rb, &insert_point->rb, link);
360 		rb_insert_color(&tn->rb, &rii->tn_root);
361 	}
362 	/* If there's anything behind that overlaps us, note it */
363 	this = tn_prev(tn);
364 	if (this) {
365 		while (1) {
366 			if (this->fn->ofs + this->fn->size > tn->fn->ofs) {
367 				dbg_readinode("Node is overlapped by %p (v %d, 0x%x-0x%x)\n",
368 					      this, this->version, this->fn->ofs,
369 					      this->fn->ofs+this->fn->size);
370 				tn->overlapped = 1;
371 				break;
372 			}
373 			if (!this->overlapped)
374 				break;
375 			this = tn_prev(this);
376 		}
377 	}
378 
379 	/* If the new node overlaps anything ahead, note it */
380 	this = tn_next(tn);
381 	while (this && this->fn->ofs < fn_end) {
382 		this->overlapped = 1;
383 		dbg_readinode("Node ver %d, 0x%x-0x%x is overlapped\n",
384 			      this->version, this->fn->ofs,
385 			      this->fn->ofs+this->fn->size);
386 		this = tn_next(this);
387 	}
388 	return 0;
389 }
390 
391 /* Trivial function to remove the last node in the tree. Which by definition
392    has no right-hand -- so can be removed just by making its only child (if
393    any) take its place under its parent. */
394 static void eat_last(struct rb_root *root, struct rb_node *node)
395 {
396 	struct rb_node *parent = rb_parent(node);
397 	struct rb_node **link;
398 
399 	/* LAST! */
400 	BUG_ON(node->rb_right);
401 
402 	if (!parent)
403 		link = &root->rb_node;
404 	else if (node == parent->rb_left)
405 		link = &parent->rb_left;
406 	else
407 		link = &parent->rb_right;
408 
409 	*link = node->rb_left;
410 	/* Colour doesn't matter now. Only the parent pointer. */
411 	if (node->rb_left)
412 		node->rb_left->rb_parent_color = node->rb_parent_color;
413 }
414 
415 /* We put this in reverse order, so we can just use eat_last */
416 static void ver_insert(struct rb_root *ver_root, struct jffs2_tmp_dnode_info *tn)
417 {
418 	struct rb_node **link = &ver_root->rb_node;
419 	struct rb_node *parent = NULL;
420 	struct jffs2_tmp_dnode_info *this_tn;
421 
422 	while (*link) {
423 		parent = *link;
424 		this_tn = rb_entry(parent, struct jffs2_tmp_dnode_info, rb);
425 
426 		if (tn->version > this_tn->version)
427 			link = &parent->rb_left;
428 		else
429 			link = &parent->rb_right;
430 	}
431 	dbg_readinode("Link new node at %p (root is %p)\n", link, ver_root);
432 	rb_link_node(&tn->rb, parent, link);
433 	rb_insert_color(&tn->rb, ver_root);
434 }
435 
436 /* Build final, normal fragtree from tn tree. It doesn't matter which order
437    we add nodes to the real fragtree, as long as they don't overlap. And
438    having thrown away the majority of overlapped nodes as we went, there
439    really shouldn't be many sets of nodes which do overlap. If we start at
440    the end, we can use the overlap markers -- we can just eat nodes which
441    aren't overlapped, and when we encounter nodes which _do_ overlap we
442    sort them all into a temporary tree in version order before replaying them. */
443 static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
444 				      struct jffs2_inode_info *f,
445 				      struct jffs2_readinode_info *rii)
446 {
447 	struct jffs2_tmp_dnode_info *pen, *last, *this;
448 	struct rb_root ver_root = RB_ROOT;
449 	uint32_t high_ver = 0;
450 
451 	if (rii->mdata_tn) {
452 		dbg_readinode("potential mdata is ver %d at %p\n", rii->mdata_tn->version, rii->mdata_tn);
453 		high_ver = rii->mdata_tn->version;
454 		rii->latest_ref = rii->mdata_tn->fn->raw;
455 	}
456 #ifdef JFFS2_DBG_READINODE_MESSAGES
457 	this = tn_last(&rii->tn_root);
458 	while (this) {
459 		dbg_readinode("tn %p ver %d range 0x%x-0x%x ov %d\n", this, this->version, this->fn->ofs,
460 			     this->fn->ofs+this->fn->size, this->overlapped);
461 		this = tn_prev(this);
462 	}
463 #endif
464 	pen = tn_last(&rii->tn_root);
465 	while ((last = pen)) {
466 		pen = tn_prev(last);
467 
468 		eat_last(&rii->tn_root, &last->rb);
469 		ver_insert(&ver_root, last);
470 
471 		if (unlikely(last->overlapped))
472 			continue;
473 
474 		/* Now we have a bunch of nodes in reverse version
475 		   order, in the tree at ver_root. Most of the time,
476 		   there'll actually be only one node in the 'tree',
477 		   in fact. */
478 		this = tn_last(&ver_root);
479 
480 		while (this) {
481 			struct jffs2_tmp_dnode_info *vers_next;
482 			int ret;
483 			vers_next = tn_prev(this);
484 			eat_last(&ver_root, &this->rb);
485 			if (check_tn_node(c, this)) {
486 				dbg_readinode("node ver %x, 0x%x-0x%x failed CRC\n",
487 					     this->version, this->fn->ofs,
488 					     this->fn->ofs+this->fn->size);
489 				jffs2_kill_tn(c, this);
490 			} else {
491 				if (this->version > high_ver) {
492 					/* Note that this is different from the other
493 					   highest_version, because this one is only
494 					   counting _valid_ nodes which could give the
495 					   latest inode metadata */
496 					high_ver = this->version;
497 					rii->latest_ref = this->fn->raw;
498 				}
499 				dbg_readinode("Add %p (v %x, 0x%x-0x%x, ov %d) to fragtree\n",
500 					     this, this->version, this->fn->ofs,
501 					     this->fn->ofs+this->fn->size, this->overlapped);
502 
503 				ret = jffs2_add_full_dnode_to_inode(c, f, this->fn);
504 				if (ret) {
505 					/* Free the nodes in vers_root; let the caller
506 					   deal with the rest */
507 					JFFS2_ERROR("Add node to tree failed %d\n", ret);
508 					while (1) {
509 						vers_next = tn_prev(this);
510 						if (check_tn_node(c, this))
511 							jffs2_mark_node_obsolete(c, this->fn->raw);
512 						jffs2_free_full_dnode(this->fn);
513 						jffs2_free_tmp_dnode_info(this);
514 						this = vers_next;
515 						if (!this)
516 							break;
517 						eat_last(&ver_root, &vers_next->rb);
518 					}
519 					return ret;
520 				}
521 				jffs2_free_tmp_dnode_info(this);
522 			}
523 			this = vers_next;
524 		}
525 	}
526 	return 0;
527 }
528 
529 static void jffs2_free_tmp_dnode_info_list(struct rb_root *list)
530 {
531 	struct rb_node *this;
532 	struct jffs2_tmp_dnode_info *tn;
533 
534 	this = list->rb_node;
535 
536 	/* Now at bottom of tree */
537 	while (this) {
538 		if (this->rb_left)
539 			this = this->rb_left;
540 		else if (this->rb_right)
541 			this = this->rb_right;
542 		else {
543 			tn = rb_entry(this, struct jffs2_tmp_dnode_info, rb);
544 			jffs2_free_full_dnode(tn->fn);
545 			jffs2_free_tmp_dnode_info(tn);
546 
547 			this = rb_parent(this);
548 			if (!this)
549 				break;
550 
551 			if (this->rb_left == &tn->rb)
552 				this->rb_left = NULL;
553 			else if (this->rb_right == &tn->rb)
554 				this->rb_right = NULL;
555 			else BUG();
556 		}
557 	}
558 	list->rb_node = NULL;
559 }
560 
561 static void jffs2_free_full_dirent_list(struct jffs2_full_dirent *fd)
562 {
563 	struct jffs2_full_dirent *next;
564 
565 	while (fd) {
566 		next = fd->next;
567 		jffs2_free_full_dirent(fd);
568 		fd = next;
569 	}
570 }
571 
572 /* Returns first valid node after 'ref'. May return 'ref' */
573 static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_ref *ref)
574 {
575 	while (ref && ref->next_in_ino) {
576 		if (!ref_obsolete(ref))
577 			return ref;
578 		dbg_noderef("node at 0x%08x is obsoleted. Ignoring.\n", ref_offset(ref));
579 		ref = ref->next_in_ino;
580 	}
581 	return NULL;
582 }
583 
584 /*
585  * Helper function for jffs2_get_inode_nodes().
586  * It is called every time an directory entry node is found.
587  *
588  * Returns: 0 on succes;
589  * 	    1 if the node should be marked obsolete;
590  * 	    negative error code on failure.
591  */
592 static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
593 				struct jffs2_raw_dirent *rd, size_t read,
594 				struct jffs2_readinode_info *rii)
595 {
596 	struct jffs2_full_dirent *fd;
597 	uint32_t crc;
598 
599 	/* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
600 	BUG_ON(ref_obsolete(ref));
601 
602 	crc = crc32(0, rd, sizeof(*rd) - 8);
603 	if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
604 		JFFS2_NOTICE("header CRC failed on dirent node at %#08x: read %#08x, calculated %#08x\n",
605 			     ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
606 		jffs2_mark_node_obsolete(c, ref);
607 		return 0;
608 	}
609 
610 	/* If we've never checked the CRCs on this node, check them now */
611 	if (ref_flags(ref) == REF_UNCHECKED) {
612 		struct jffs2_eraseblock *jeb;
613 		int len;
614 
615 		/* Sanity check */
616 		if (unlikely(PAD((rd->nsize + sizeof(*rd))) != PAD(je32_to_cpu(rd->totlen)))) {
617 			JFFS2_ERROR("illegal nsize in node at %#08x: nsize %#02x, totlen %#04x\n",
618 				    ref_offset(ref), rd->nsize, je32_to_cpu(rd->totlen));
619 			jffs2_mark_node_obsolete(c, ref);
620 			return 0;
621 		}
622 
623 		jeb = &c->blocks[ref->flash_offset / c->sector_size];
624 		len = ref_totlen(c, jeb, ref);
625 
626 		spin_lock(&c->erase_completion_lock);
627 		jeb->used_size += len;
628 		jeb->unchecked_size -= len;
629 		c->used_size += len;
630 		c->unchecked_size -= len;
631 		ref->flash_offset = ref_offset(ref) | REF_PRISTINE;
632 		spin_unlock(&c->erase_completion_lock);
633 	}
634 
635 	fd = jffs2_alloc_full_dirent(rd->nsize + 1);
636 	if (unlikely(!fd))
637 		return -ENOMEM;
638 
639 	fd->raw = ref;
640 	fd->version = je32_to_cpu(rd->version);
641 	fd->ino = je32_to_cpu(rd->ino);
642 	fd->type = rd->type;
643 
644 	if (fd->version > rii->highest_version)
645 		rii->highest_version = fd->version;
646 
647 	/* Pick out the mctime of the latest dirent */
648 	if(fd->version > rii->mctime_ver && je32_to_cpu(rd->mctime)) {
649 		rii->mctime_ver = fd->version;
650 		rii->latest_mctime = je32_to_cpu(rd->mctime);
651 	}
652 
653 	/*
654 	 * Copy as much of the name as possible from the raw
655 	 * dirent we've already read from the flash.
656 	 */
657 	if (read > sizeof(*rd))
658 		memcpy(&fd->name[0], &rd->name[0],
659 		       min_t(uint32_t, rd->nsize, (read - sizeof(*rd)) ));
660 
661 	/* Do we need to copy any more of the name directly from the flash? */
662 	if (rd->nsize + sizeof(*rd) > read) {
663 		/* FIXME: point() */
664 		int err;
665 		int already = read - sizeof(*rd);
666 
667 		err = jffs2_flash_read(c, (ref_offset(ref)) + read,
668 				rd->nsize - already, &read, &fd->name[already]);
669 		if (unlikely(read != rd->nsize - already) && likely(!err))
670 			return -EIO;
671 
672 		if (unlikely(err)) {
673 			JFFS2_ERROR("read remainder of name: error %d\n", err);
674 			jffs2_free_full_dirent(fd);
675 			return -EIO;
676 		}
677 	}
678 
679 	fd->nhash = full_name_hash(fd->name, rd->nsize);
680 	fd->next = NULL;
681 	fd->name[rd->nsize] = '\0';
682 
683 	/*
684 	 * Wheee. We now have a complete jffs2_full_dirent structure, with
685 	 * the name in it and everything. Link it into the list
686 	 */
687 	jffs2_add_fd_to_list(c, fd, &rii->fds);
688 
689 	return 0;
690 }
691 
692 /*
693  * Helper function for jffs2_get_inode_nodes().
694  * It is called every time an inode node is found.
695  *
696  * Returns: 0 on success;
697  * 	    1 if the node should be marked obsolete;
698  * 	    negative error code on failure.
699  */
700 static inline int read_dnode(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
701 			     struct jffs2_raw_inode *rd, int rdlen,
702 			     struct jffs2_readinode_info *rii)
703 {
704 	struct jffs2_tmp_dnode_info *tn;
705 	uint32_t len, csize;
706 	int ret = 1;
707 	uint32_t crc;
708 
709 	/* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
710 	BUG_ON(ref_obsolete(ref));
711 
712 	crc = crc32(0, rd, sizeof(*rd) - 8);
713 	if (unlikely(crc != je32_to_cpu(rd->node_crc))) {
714 		JFFS2_NOTICE("node CRC failed on dnode at %#08x: read %#08x, calculated %#08x\n",
715 			     ref_offset(ref), je32_to_cpu(rd->node_crc), crc);
716 		jffs2_mark_node_obsolete(c, ref);
717 		return 0;
718 	}
719 
720 	tn = jffs2_alloc_tmp_dnode_info();
721 	if (!tn) {
722 		JFFS2_ERROR("failed to allocate tn (%zu bytes).\n", sizeof(*tn));
723 		return -ENOMEM;
724 	}
725 
726 	tn->partial_crc = 0;
727 	csize = je32_to_cpu(rd->csize);
728 
729 	/* If we've never checked the CRCs on this node, check them now */
730 	if (ref_flags(ref) == REF_UNCHECKED) {
731 
732 		/* Sanity checks */
733 		if (unlikely(je32_to_cpu(rd->offset) > je32_to_cpu(rd->isize)) ||
734 		    unlikely(PAD(je32_to_cpu(rd->csize) + sizeof(*rd)) != PAD(je32_to_cpu(rd->totlen)))) {
735 				JFFS2_WARNING("inode node header CRC is corrupted at %#08x\n", ref_offset(ref));
736 				jffs2_dbg_dump_node(c, ref_offset(ref));
737 			goto free_out;
738 		}
739 
740 		if (jffs2_is_writebuffered(c) && csize != 0) {
741 			/* At this point we are supposed to check the data CRC
742 			 * of our unchecked node. But thus far, we do not
743 			 * know whether the node is valid or obsolete. To
744 			 * figure this out, we need to walk all the nodes of
745 			 * the inode and build the inode fragtree. We don't
746 			 * want to spend time checking data of nodes which may
747 			 * later be found to be obsolete. So we put off the full
748 			 * data CRC checking until we have read all the inode
749 			 * nodes and have started building the fragtree.
750 			 *
751 			 * The fragtree is being built starting with nodes
752 			 * having the highest version number, so we'll be able
753 			 * to detect whether a node is valid (i.e., it is not
754 			 * overlapped by a node with higher version) or not.
755 			 * And we'll be able to check only those nodes, which
756 			 * are not obsolete.
757 			 *
758 			 * Of course, this optimization only makes sense in case
759 			 * of NAND flashes (or other flashes whith
760 			 * !jffs2_can_mark_obsolete()), since on NOR flashes
761 			 * nodes are marked obsolete physically.
762 			 *
763 			 * Since NAND flashes (or other flashes with
764 			 * jffs2_is_writebuffered(c)) are anyway read by
765 			 * fractions of c->wbuf_pagesize, and we have just read
766 			 * the node header, it is likely that the starting part
767 			 * of the node data is also read when we read the
768 			 * header. So we don't mind to check the CRC of the
769 			 * starting part of the data of the node now, and check
770 			 * the second part later (in jffs2_check_node_data()).
771 			 * Of course, we will not need to re-read and re-check
772 			 * the NAND page which we have just read. This is why we
773 			 * read the whole NAND page at jffs2_get_inode_nodes(),
774 			 * while we needed only the node header.
775 			 */
776 			unsigned char *buf;
777 
778 			/* 'buf' will point to the start of data */
779 			buf = (unsigned char *)rd + sizeof(*rd);
780 			/* len will be the read data length */
781 			len = min_t(uint32_t, rdlen - sizeof(*rd), csize);
782 			tn->partial_crc = crc32(0, buf, len);
783 
784 			dbg_readinode("Calculates CRC (%#08x) for %d bytes, csize %d\n", tn->partial_crc, len, csize);
785 
786 			/* If we actually calculated the whole data CRC
787 			 * and it is wrong, drop the node. */
788 			if (len >= csize && unlikely(tn->partial_crc != je32_to_cpu(rd->data_crc))) {
789 				JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
790 					ref_offset(ref), tn->partial_crc, je32_to_cpu(rd->data_crc));
791 				goto free_out;
792 			}
793 
794 		} else if (csize == 0) {
795 			/*
796 			 * We checked the header CRC. If the node has no data, adjust
797 			 * the space accounting now. For other nodes this will be done
798 			 * later either when the node is marked obsolete or when its
799 			 * data is checked.
800 			 */
801 			struct jffs2_eraseblock *jeb;
802 
803 			dbg_readinode("the node has no data.\n");
804 			jeb = &c->blocks[ref->flash_offset / c->sector_size];
805 			len = ref_totlen(c, jeb, ref);
806 
807 			spin_lock(&c->erase_completion_lock);
808 			jeb->used_size += len;
809 			jeb->unchecked_size -= len;
810 			c->used_size += len;
811 			c->unchecked_size -= len;
812 			ref->flash_offset = ref_offset(ref) | REF_NORMAL;
813 			spin_unlock(&c->erase_completion_lock);
814 		}
815 	}
816 
817 	tn->fn = jffs2_alloc_full_dnode();
818 	if (!tn->fn) {
819 		JFFS2_ERROR("alloc fn failed\n");
820 		ret = -ENOMEM;
821 		goto free_out;
822 	}
823 
824 	tn->version = je32_to_cpu(rd->version);
825 	tn->fn->ofs = je32_to_cpu(rd->offset);
826 	tn->data_crc = je32_to_cpu(rd->data_crc);
827 	tn->csize = csize;
828 	tn->fn->raw = ref;
829 	tn->overlapped = 0;
830 
831 	if (tn->version > rii->highest_version)
832 		rii->highest_version = tn->version;
833 
834 	/* There was a bug where we wrote hole nodes out with
835 	   csize/dsize swapped. Deal with it */
836 	if (rd->compr == JFFS2_COMPR_ZERO && !je32_to_cpu(rd->dsize) && csize)
837 		tn->fn->size = csize;
838 	else // normal case...
839 		tn->fn->size = je32_to_cpu(rd->dsize);
840 
841 	dbg_readinode("dnode @%08x: ver %u, offset %#04x, dsize %#04x, csize %#04x\n",
842 		  ref_offset(ref), je32_to_cpu(rd->version), je32_to_cpu(rd->offset), je32_to_cpu(rd->dsize), csize);
843 
844 	ret = jffs2_add_tn_to_tree(c, rii, tn);
845 
846 	if (ret) {
847 		jffs2_free_full_dnode(tn->fn);
848 	free_out:
849 		jffs2_free_tmp_dnode_info(tn);
850 		return ret;
851 	}
852 #ifdef JFFS2_DBG_READINODE_MESSAGES
853 	dbg_readinode("After adding ver %d:\n", tn->version);
854 	tn = tn_first(&rii->tn_root);
855 	while (tn) {
856 		dbg_readinode("%p: v %d r 0x%x-0x%x ov %d\n",
857 			     tn, tn->version, tn->fn->ofs,
858 			     tn->fn->ofs+tn->fn->size, tn->overlapped);
859 		tn = tn_next(tn);
860 	}
861 #endif
862 	return 0;
863 }
864 
865 /*
866  * Helper function for jffs2_get_inode_nodes().
867  * It is called every time an unknown node is found.
868  *
869  * Returns: 0 on success;
870  * 	    1 if the node should be marked obsolete;
871  * 	    negative error code on failure.
872  */
873 static inline int read_unknown(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref, struct jffs2_unknown_node *un)
874 {
875 	/* We don't mark unknown nodes as REF_UNCHECKED */
876 	if (ref_flags(ref) == REF_UNCHECKED) {
877 		JFFS2_ERROR("REF_UNCHECKED but unknown node at %#08x\n",
878 			    ref_offset(ref));
879 		JFFS2_ERROR("Node is {%04x,%04x,%08x,%08x}. Please report this error.\n",
880                             je16_to_cpu(un->magic), je16_to_cpu(un->nodetype),
881                             je32_to_cpu(un->totlen), je32_to_cpu(un->hdr_crc));
882 		jffs2_mark_node_obsolete(c, ref);
883 		return 0;
884 	}
885 
886 	un->nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(un->nodetype));
887 
888 	switch(je16_to_cpu(un->nodetype) & JFFS2_COMPAT_MASK) {
889 
890 	case JFFS2_FEATURE_INCOMPAT:
891 		JFFS2_ERROR("unknown INCOMPAT nodetype %#04X at %#08x\n",
892 			    je16_to_cpu(un->nodetype), ref_offset(ref));
893 		/* EEP */
894 		BUG();
895 		break;
896 
897 	case JFFS2_FEATURE_ROCOMPAT:
898 		JFFS2_ERROR("unknown ROCOMPAT nodetype %#04X at %#08x\n",
899 			    je16_to_cpu(un->nodetype), ref_offset(ref));
900 		BUG_ON(!(c->flags & JFFS2_SB_FLAG_RO));
901 		break;
902 
903 	case JFFS2_FEATURE_RWCOMPAT_COPY:
904 		JFFS2_NOTICE("unknown RWCOMPAT_COPY nodetype %#04X at %#08x\n",
905 			     je16_to_cpu(un->nodetype), ref_offset(ref));
906 		break;
907 
908 	case JFFS2_FEATURE_RWCOMPAT_DELETE:
909 		JFFS2_NOTICE("unknown RWCOMPAT_DELETE nodetype %#04X at %#08x\n",
910 			     je16_to_cpu(un->nodetype), ref_offset(ref));
911 		jffs2_mark_node_obsolete(c, ref);
912 		return 0;
913 	}
914 
915 	return 0;
916 }
917 
918 /*
919  * Helper function for jffs2_get_inode_nodes().
920  * The function detects whether more data should be read and reads it if yes.
921  *
922  * Returns: 0 on succes;
923  * 	    negative error code on failure.
924  */
925 static int read_more(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
926 		     int needed_len, int *rdlen, unsigned char *buf)
927 {
928 	int err, to_read = needed_len - *rdlen;
929 	size_t retlen;
930 	uint32_t offs;
931 
932 	if (jffs2_is_writebuffered(c)) {
933 		int rem = to_read % c->wbuf_pagesize;
934 
935 		if (rem)
936 			to_read += c->wbuf_pagesize - rem;
937 	}
938 
939 	/* We need to read more data */
940 	offs = ref_offset(ref) + *rdlen;
941 
942 	dbg_readinode("read more %d bytes\n", to_read);
943 
944 	err = jffs2_flash_read(c, offs, to_read, &retlen, buf + *rdlen);
945 	if (err) {
946 		JFFS2_ERROR("can not read %d bytes from 0x%08x, "
947 			"error code: %d.\n", to_read, offs, err);
948 		return err;
949 	}
950 
951 	if (retlen < to_read) {
952 		JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n",
953 				offs, retlen, to_read);
954 		return -EIO;
955 	}
956 
957 	*rdlen += to_read;
958 	return 0;
959 }
960 
961 /* Get tmp_dnode_info and full_dirent for all non-obsolete nodes associated
962    with this ino. Perform a preliminary ordering on data nodes, throwing away
963    those which are completely obsoleted by newer ones. The naïve approach we
964    use to take of just returning them _all_ in version order will cause us to
965    run out of memory in certain degenerate cases. */
966 static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
967 				 struct jffs2_readinode_info *rii)
968 {
969 	struct jffs2_raw_node_ref *ref, *valid_ref;
970 	unsigned char *buf = NULL;
971 	union jffs2_node_union *node;
972 	size_t retlen;
973 	int len, err;
974 
975 	rii->mctime_ver = 0;
976 
977 	dbg_readinode("ino #%u\n", f->inocache->ino);
978 
979 	/* FIXME: in case of NOR and available ->point() this
980 	 * needs to be fixed. */
981 	len = sizeof(union jffs2_node_union) + c->wbuf_pagesize;
982 	buf = kmalloc(len, GFP_KERNEL);
983 	if (!buf)
984 		return -ENOMEM;
985 
986 	spin_lock(&c->erase_completion_lock);
987 	valid_ref = jffs2_first_valid_node(f->inocache->nodes);
988 	if (!valid_ref && f->inocache->ino != 1)
989 		JFFS2_WARNING("Eep. No valid nodes for ino #%u.\n", f->inocache->ino);
990 	while (valid_ref) {
991 		/* We can hold a pointer to a non-obsolete node without the spinlock,
992 		   but _obsolete_ nodes may disappear at any time, if the block
993 		   they're in gets erased. So if we mark 'ref' obsolete while we're
994 		   not holding the lock, it can go away immediately. For that reason,
995 		   we find the next valid node first, before processing 'ref'.
996 		*/
997 		ref = valid_ref;
998 		valid_ref = jffs2_first_valid_node(ref->next_in_ino);
999 		spin_unlock(&c->erase_completion_lock);
1000 
1001 		cond_resched();
1002 
1003 		/*
1004 		 * At this point we don't know the type of the node we're going
1005 		 * to read, so we do not know the size of its header. In order
1006 		 * to minimize the amount of flash IO we assume the header is
1007 		 * of size = JFFS2_MIN_NODE_HEADER.
1008 		 */
1009 		len = JFFS2_MIN_NODE_HEADER;
1010 		if (jffs2_is_writebuffered(c)) {
1011 			int end, rem;
1012 
1013 			/*
1014 			 * We are about to read JFFS2_MIN_NODE_HEADER bytes,
1015 			 * but this flash has some minimal I/O unit. It is
1016 			 * possible that we'll need to read more soon, so read
1017 			 * up to the next min. I/O unit, in order not to
1018 			 * re-read the same min. I/O unit twice.
1019 			 */
1020 			end = ref_offset(ref) + len;
1021 			rem = end % c->wbuf_pagesize;
1022 			if (rem)
1023 				end += c->wbuf_pagesize - rem;
1024 			len = end - ref_offset(ref);
1025 		}
1026 
1027 		dbg_readinode("read %d bytes at %#08x(%d).\n", len, ref_offset(ref), ref_flags(ref));
1028 
1029 		/* FIXME: point() */
1030 		err = jffs2_flash_read(c, ref_offset(ref), len, &retlen, buf);
1031 		if (err) {
1032 			JFFS2_ERROR("can not read %d bytes from 0x%08x, " "error code: %d.\n", len, ref_offset(ref), err);
1033 			goto free_out;
1034 		}
1035 
1036 		if (retlen < len) {
1037 			JFFS2_ERROR("short read at %#08x: %zu instead of %d.\n", ref_offset(ref), retlen, len);
1038 			err = -EIO;
1039 			goto free_out;
1040 		}
1041 
1042 		node = (union jffs2_node_union *)buf;
1043 
1044 		/* No need to mask in the valid bit; it shouldn't be invalid */
1045 		if (je32_to_cpu(node->u.hdr_crc) != crc32(0, node, sizeof(node->u)-4)) {
1046 			JFFS2_NOTICE("Node header CRC failed at %#08x. {%04x,%04x,%08x,%08x}\n",
1047 				     ref_offset(ref), je16_to_cpu(node->u.magic),
1048 				     je16_to_cpu(node->u.nodetype),
1049 				     je32_to_cpu(node->u.totlen),
1050 				     je32_to_cpu(node->u.hdr_crc));
1051 			jffs2_dbg_dump_node(c, ref_offset(ref));
1052 			jffs2_mark_node_obsolete(c, ref);
1053 			goto cont;
1054 		}
1055 		if (je16_to_cpu(node->u.magic) != JFFS2_MAGIC_BITMASK) {
1056 			/* Not a JFFS2 node, whinge and move on */
1057 			JFFS2_NOTICE("Wrong magic bitmask 0x%04x in node header at %#08x.\n",
1058 				     je16_to_cpu(node->u.magic), ref_offset(ref));
1059 			jffs2_mark_node_obsolete(c, ref);
1060 			goto cont;
1061 		}
1062 
1063 		switch (je16_to_cpu(node->u.nodetype)) {
1064 
1065 		case JFFS2_NODETYPE_DIRENT:
1066 
1067 			if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent)) {
1068 				err = read_more(c, ref, sizeof(struct jffs2_raw_dirent), &len, buf);
1069 				if (unlikely(err))
1070 					goto free_out;
1071 			}
1072 
1073 			err = read_direntry(c, ref, &node->d, retlen, rii);
1074 			if (unlikely(err))
1075 				goto free_out;
1076 
1077 			break;
1078 
1079 		case JFFS2_NODETYPE_INODE:
1080 
1081 			if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode)) {
1082 				err = read_more(c, ref, sizeof(struct jffs2_raw_inode), &len, buf);
1083 				if (unlikely(err))
1084 					goto free_out;
1085 			}
1086 
1087 			err = read_dnode(c, ref, &node->i, len, rii);
1088 			if (unlikely(err))
1089 				goto free_out;
1090 
1091 			break;
1092 
1093 		default:
1094 			if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node)) {
1095 				err = read_more(c, ref, sizeof(struct jffs2_unknown_node), &len, buf);
1096 				if (unlikely(err))
1097 					goto free_out;
1098 			}
1099 
1100 			err = read_unknown(c, ref, &node->u);
1101 			if (err == 1) {
1102 				jffs2_mark_node_obsolete(c, ref);
1103 				break;
1104 			} else if (unlikely(err))
1105 				goto free_out;
1106 
1107 		}
1108 	cont:
1109 		spin_lock(&c->erase_completion_lock);
1110 	}
1111 
1112 	spin_unlock(&c->erase_completion_lock);
1113 	kfree(buf);
1114 
1115 	f->highest_version = rii->highest_version;
1116 
1117 	dbg_readinode("nodes of inode #%u were read, the highest version is %u, latest_mctime %u, mctime_ver %u.\n",
1118 		      f->inocache->ino, rii->highest_version, rii->latest_mctime,
1119 		      rii->mctime_ver);
1120 	return 0;
1121 
1122  free_out:
1123 	jffs2_free_tmp_dnode_info_list(&rii->tn_root);
1124 	jffs2_free_full_dirent_list(rii->fds);
1125 	rii->fds = NULL;
1126 	kfree(buf);
1127 	return err;
1128 }
1129 
1130 static int jffs2_do_read_inode_internal(struct jffs2_sb_info *c,
1131 					struct jffs2_inode_info *f,
1132 					struct jffs2_raw_inode *latest_node)
1133 {
1134 	struct jffs2_readinode_info rii;
1135 	uint32_t crc, new_size;
1136 	size_t retlen;
1137 	int ret;
1138 
1139 	dbg_readinode("ino #%u nlink is %d\n", f->inocache->ino, f->inocache->nlink);
1140 
1141 	memset(&rii, 0, sizeof(rii));
1142 
1143 	/* Grab all nodes relevant to this ino */
1144 	ret = jffs2_get_inode_nodes(c, f, &rii);
1145 
1146 	if (ret) {
1147 		JFFS2_ERROR("cannot read nodes for ino %u, returned error is %d\n", f->inocache->ino, ret);
1148 		if (f->inocache->state == INO_STATE_READING)
1149 			jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1150 		return ret;
1151 	}
1152 
1153 	ret = jffs2_build_inode_fragtree(c, f, &rii);
1154 	if (ret) {
1155 		JFFS2_ERROR("Failed to build final fragtree for inode #%u: error %d\n",
1156 			    f->inocache->ino, ret);
1157 		if (f->inocache->state == INO_STATE_READING)
1158 			jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1159 		jffs2_free_tmp_dnode_info_list(&rii.tn_root);
1160 		/* FIXME: We could at least crc-check them all */
1161 		if (rii.mdata_tn) {
1162 			jffs2_free_full_dnode(rii.mdata_tn->fn);
1163 			jffs2_free_tmp_dnode_info(rii.mdata_tn);
1164 			rii.mdata_tn = NULL;
1165 		}
1166 		return ret;
1167 	}
1168 
1169 	if (rii.mdata_tn) {
1170 		if (rii.mdata_tn->fn->raw == rii.latest_ref) {
1171 			f->metadata = rii.mdata_tn->fn;
1172 			jffs2_free_tmp_dnode_info(rii.mdata_tn);
1173 		} else {
1174 			jffs2_kill_tn(c, rii.mdata_tn);
1175 		}
1176 		rii.mdata_tn = NULL;
1177 	}
1178 
1179 	f->dents = rii.fds;
1180 
1181 	jffs2_dbg_fragtree_paranoia_check_nolock(f);
1182 
1183 	if (unlikely(!rii.latest_ref)) {
1184 		/* No data nodes for this inode. */
1185 		if (f->inocache->ino != 1) {
1186 			JFFS2_WARNING("no data nodes found for ino #%u\n", f->inocache->ino);
1187 			if (!rii.fds) {
1188 				if (f->inocache->state == INO_STATE_READING)
1189 					jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1190 				return -EIO;
1191 			}
1192 			JFFS2_NOTICE("but it has children so we fake some modes for it\n");
1193 		}
1194 		latest_node->mode = cpu_to_jemode(S_IFDIR|S_IRUGO|S_IWUSR|S_IXUGO);
1195 		latest_node->version = cpu_to_je32(0);
1196 		latest_node->atime = latest_node->ctime = latest_node->mtime = cpu_to_je32(0);
1197 		latest_node->isize = cpu_to_je32(0);
1198 		latest_node->gid = cpu_to_je16(0);
1199 		latest_node->uid = cpu_to_je16(0);
1200 		if (f->inocache->state == INO_STATE_READING)
1201 			jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1202 		return 0;
1203 	}
1204 
1205 	ret = jffs2_flash_read(c, ref_offset(rii.latest_ref), sizeof(*latest_node), &retlen, (void *)latest_node);
1206 	if (ret || retlen != sizeof(*latest_node)) {
1207 		JFFS2_ERROR("failed to read from flash: error %d, %zd of %zd bytes read\n",
1208 			ret, retlen, sizeof(*latest_node));
1209 		/* FIXME: If this fails, there seems to be a memory leak. Find it. */
1210 		up(&f->sem);
1211 		jffs2_do_clear_inode(c, f);
1212 		return ret?ret:-EIO;
1213 	}
1214 
1215 	crc = crc32(0, latest_node, sizeof(*latest_node)-8);
1216 	if (crc != je32_to_cpu(latest_node->node_crc)) {
1217 		JFFS2_ERROR("CRC failed for read_inode of inode %u at physical location 0x%x\n",
1218 			f->inocache->ino, ref_offset(rii.latest_ref));
1219 		up(&f->sem);
1220 		jffs2_do_clear_inode(c, f);
1221 		return -EIO;
1222 	}
1223 
1224 	switch(jemode_to_cpu(latest_node->mode) & S_IFMT) {
1225 	case S_IFDIR:
1226 		if (rii.mctime_ver > je32_to_cpu(latest_node->version)) {
1227 			/* The times in the latest_node are actually older than
1228 			   mctime in the latest dirent. Cheat. */
1229 			latest_node->ctime = latest_node->mtime = cpu_to_je32(rii.latest_mctime);
1230 		}
1231 		break;
1232 
1233 
1234 	case S_IFREG:
1235 		/* If it was a regular file, truncate it to the latest node's isize */
1236 		new_size = jffs2_truncate_fragtree(c, &f->fragtree, je32_to_cpu(latest_node->isize));
1237 		if (new_size != je32_to_cpu(latest_node->isize)) {
1238 			JFFS2_WARNING("Truncating ino #%u to %d bytes failed because it only had %d bytes to start with!\n",
1239 				      f->inocache->ino, je32_to_cpu(latest_node->isize), new_size);
1240 			latest_node->isize = cpu_to_je32(new_size);
1241 		}
1242 		break;
1243 
1244 	case S_IFLNK:
1245 		/* Hack to work around broken isize in old symlink code.
1246 		   Remove this when dwmw2 comes to his senses and stops
1247 		   symlinks from being an entirely gratuitous special
1248 		   case. */
1249 		if (!je32_to_cpu(latest_node->isize))
1250 			latest_node->isize = latest_node->dsize;
1251 
1252 		if (f->inocache->state != INO_STATE_CHECKING) {
1253 			/* Symlink's inode data is the target path. Read it and
1254 			 * keep in RAM to facilitate quick follow symlink
1255 			 * operation. */
1256 			f->target = kmalloc(je32_to_cpu(latest_node->csize) + 1, GFP_KERNEL);
1257 			if (!f->target) {
1258 				JFFS2_ERROR("can't allocate %d bytes of memory for the symlink target path cache\n", je32_to_cpu(latest_node->csize));
1259 				up(&f->sem);
1260 				jffs2_do_clear_inode(c, f);
1261 				return -ENOMEM;
1262 			}
1263 
1264 			ret = jffs2_flash_read(c, ref_offset(rii.latest_ref) + sizeof(*latest_node),
1265 						je32_to_cpu(latest_node->csize), &retlen, (char *)f->target);
1266 
1267 			if (ret  || retlen != je32_to_cpu(latest_node->csize)) {
1268 				if (retlen != je32_to_cpu(latest_node->csize))
1269 					ret = -EIO;
1270 				kfree(f->target);
1271 				f->target = NULL;
1272 				up(&f->sem);
1273 				jffs2_do_clear_inode(c, f);
1274 				return -ret;
1275 			}
1276 
1277 			f->target[je32_to_cpu(latest_node->csize)] = '\0';
1278 			dbg_readinode("symlink's target '%s' cached\n", f->target);
1279 		}
1280 
1281 		/* fall through... */
1282 
1283 	case S_IFBLK:
1284 	case S_IFCHR:
1285 		/* Certain inode types should have only one data node, and it's
1286 		   kept as the metadata node */
1287 		if (f->metadata) {
1288 			JFFS2_ERROR("Argh. Special inode #%u with mode 0%o had metadata node\n",
1289 			       f->inocache->ino, jemode_to_cpu(latest_node->mode));
1290 			up(&f->sem);
1291 			jffs2_do_clear_inode(c, f);
1292 			return -EIO;
1293 		}
1294 		if (!frag_first(&f->fragtree)) {
1295 			JFFS2_ERROR("Argh. Special inode #%u with mode 0%o has no fragments\n",
1296 			       f->inocache->ino, jemode_to_cpu(latest_node->mode));
1297 			up(&f->sem);
1298 			jffs2_do_clear_inode(c, f);
1299 			return -EIO;
1300 		}
1301 		/* ASSERT: f->fraglist != NULL */
1302 		if (frag_next(frag_first(&f->fragtree))) {
1303 			JFFS2_ERROR("Argh. Special inode #%u with mode 0x%x had more than one node\n",
1304 			       f->inocache->ino, jemode_to_cpu(latest_node->mode));
1305 			/* FIXME: Deal with it - check crc32, check for duplicate node, check times and discard the older one */
1306 			up(&f->sem);
1307 			jffs2_do_clear_inode(c, f);
1308 			return -EIO;
1309 		}
1310 		/* OK. We're happy */
1311 		f->metadata = frag_first(&f->fragtree)->node;
1312 		jffs2_free_node_frag(frag_first(&f->fragtree));
1313 		f->fragtree = RB_ROOT;
1314 		break;
1315 	}
1316 	if (f->inocache->state == INO_STATE_READING)
1317 		jffs2_set_inocache_state(c, f->inocache, INO_STATE_PRESENT);
1318 
1319 	return 0;
1320 }
1321 
1322 /* Scan the list of all nodes present for this ino, build map of versions, etc. */
1323 int jffs2_do_read_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
1324 			uint32_t ino, struct jffs2_raw_inode *latest_node)
1325 {
1326 	dbg_readinode("read inode #%u\n", ino);
1327 
1328  retry_inocache:
1329 	spin_lock(&c->inocache_lock);
1330 	f->inocache = jffs2_get_ino_cache(c, ino);
1331 
1332 	if (f->inocache) {
1333 		/* Check its state. We may need to wait before we can use it */
1334 		switch(f->inocache->state) {
1335 		case INO_STATE_UNCHECKED:
1336 		case INO_STATE_CHECKEDABSENT:
1337 			f->inocache->state = INO_STATE_READING;
1338 			break;
1339 
1340 		case INO_STATE_CHECKING:
1341 		case INO_STATE_GC:
1342 			/* If it's in either of these states, we need
1343 			   to wait for whoever's got it to finish and
1344 			   put it back. */
1345 			dbg_readinode("waiting for ino #%u in state %d\n", ino, f->inocache->state);
1346 			sleep_on_spinunlock(&c->inocache_wq, &c->inocache_lock);
1347 			goto retry_inocache;
1348 
1349 		case INO_STATE_READING:
1350 		case INO_STATE_PRESENT:
1351 			/* Eep. This should never happen. It can
1352 			happen if Linux calls read_inode() again
1353 			before clear_inode() has finished though. */
1354 			JFFS2_ERROR("Eep. Trying to read_inode #%u when it's already in state %d!\n", ino, f->inocache->state);
1355 			/* Fail. That's probably better than allowing it to succeed */
1356 			f->inocache = NULL;
1357 			break;
1358 
1359 		default:
1360 			BUG();
1361 		}
1362 	}
1363 	spin_unlock(&c->inocache_lock);
1364 
1365 	if (!f->inocache && ino == 1) {
1366 		/* Special case - no root inode on medium */
1367 		f->inocache = jffs2_alloc_inode_cache();
1368 		if (!f->inocache) {
1369 			JFFS2_ERROR("cannot allocate inocache for root inode\n");
1370 			return -ENOMEM;
1371 		}
1372 		dbg_readinode("creating inocache for root inode\n");
1373 		memset(f->inocache, 0, sizeof(struct jffs2_inode_cache));
1374 		f->inocache->ino = f->inocache->nlink = 1;
1375 		f->inocache->nodes = (struct jffs2_raw_node_ref *)f->inocache;
1376 		f->inocache->state = INO_STATE_READING;
1377 		jffs2_add_ino_cache(c, f->inocache);
1378 	}
1379 	if (!f->inocache) {
1380 		JFFS2_ERROR("requestied to read an nonexistent ino %u\n", ino);
1381 		return -ENOENT;
1382 	}
1383 
1384 	return jffs2_do_read_inode_internal(c, f, latest_node);
1385 }
1386 
1387 int jffs2_do_crccheck_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
1388 {
1389 	struct jffs2_raw_inode n;
1390 	struct jffs2_inode_info *f = kzalloc(sizeof(*f), GFP_KERNEL);
1391 	int ret;
1392 
1393 	if (!f)
1394 		return -ENOMEM;
1395 
1396 	init_MUTEX_LOCKED(&f->sem);
1397 	f->inocache = ic;
1398 
1399 	ret = jffs2_do_read_inode_internal(c, f, &n);
1400 	if (!ret) {
1401 		up(&f->sem);
1402 		jffs2_do_clear_inode(c, f);
1403 	}
1404 	kfree (f);
1405 	return ret;
1406 }
1407 
1408 void jffs2_do_clear_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f)
1409 {
1410 	struct jffs2_full_dirent *fd, *fds;
1411 	int deleted;
1412 
1413 	jffs2_clear_acl(f);
1414 	jffs2_xattr_delete_inode(c, f->inocache);
1415 	down(&f->sem);
1416 	deleted = f->inocache && !f->inocache->nlink;
1417 
1418 	if (f->inocache && f->inocache->state != INO_STATE_CHECKING)
1419 		jffs2_set_inocache_state(c, f->inocache, INO_STATE_CLEARING);
1420 
1421 	if (f->metadata) {
1422 		if (deleted)
1423 			jffs2_mark_node_obsolete(c, f->metadata->raw);
1424 		jffs2_free_full_dnode(f->metadata);
1425 	}
1426 
1427 	jffs2_kill_fragtree(&f->fragtree, deleted?c:NULL);
1428 
1429 	if (f->target) {
1430 		kfree(f->target);
1431 		f->target = NULL;
1432 	}
1433 
1434 	fds = f->dents;
1435 	while(fds) {
1436 		fd = fds;
1437 		fds = fd->next;
1438 		jffs2_free_full_dirent(fd);
1439 	}
1440 
1441 	if (f->inocache && f->inocache->state != INO_STATE_CHECKING) {
1442 		jffs2_set_inocache_state(c, f->inocache, INO_STATE_CHECKEDABSENT);
1443 		if (f->inocache->nodes == (void *)f->inocache)
1444 			jffs2_del_ino_cache(c, f->inocache);
1445 	}
1446 
1447 	up(&f->sem);
1448 }
1449