1/*
2 * JFFS2 -- Journalling Flash File System, Version 2.
3 *
4 * Copyright �� 2001-2007 Red Hat, Inc.
5 * Copyright �� 2004-2010 David Woodhouse <dwmw2@infradead.org>
6 *
7 * Created by David Woodhouse <dwmw2@infradead.org>
8 *
9 * For licensing information, see the file 'LICENCE' in this directory.
10 *
11 */
12
13#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14
15#include <linux/kernel.h>
16#include <linux/mtd/mtd.h>
17#include <linux/slab.h>
18#include <linux/pagemap.h>
19#include <linux/crc32.h>
20#include <linux/compiler.h>
21#include <linux/stat.h>
22#include "nodelist.h"
23#include "compr.h"
24
25static int jffs2_garbage_collect_pristine(struct jffs2_sb_info *c,
26					  struct jffs2_inode_cache *ic,
27					  struct jffs2_raw_node_ref *raw);
28static int jffs2_garbage_collect_metadata(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
29					struct jffs2_inode_info *f, struct jffs2_full_dnode *fd);
30static int jffs2_garbage_collect_dirent(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
31					struct jffs2_inode_info *f, struct jffs2_full_dirent *fd);
32static int jffs2_garbage_collect_deletion_dirent(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
33					struct jffs2_inode_info *f, struct jffs2_full_dirent *fd);
34static int jffs2_garbage_collect_hole(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
35				      struct jffs2_inode_info *f, struct jffs2_full_dnode *fn,
36				      uint32_t start, uint32_t end);
37static int jffs2_garbage_collect_dnode(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
38				       struct jffs2_inode_info *f, struct jffs2_full_dnode *fn,
39				       uint32_t start, uint32_t end);
40static int jffs2_garbage_collect_live(struct jffs2_sb_info *c,  struct jffs2_eraseblock *jeb,
41			       struct jffs2_raw_node_ref *raw, struct jffs2_inode_info *f);
42
43/* Called with erase_completion_lock held */
44static struct jffs2_eraseblock *jffs2_find_gc_block(struct jffs2_sb_info *c)
45{
46	struct jffs2_eraseblock *ret;
47	struct list_head *nextlist = NULL;
48	int n = jiffies % 128;
49
50	/* Pick an eraseblock to garbage collect next. This is where we'll
51	   put the clever wear-levelling algorithms. Eventually.  */
52	/* We possibly want to favour the dirtier blocks more when the
53	   number of free blocks is low. */
54again:
55	if (!list_empty(&c->bad_used_list) && c->nr_free_blocks > c->resv_blocks_gcbad) {
56		jffs2_dbg(1, "Picking block from bad_used_list to GC next\n");
57		nextlist = &c->bad_used_list;
58	} else if (n < 50 && !list_empty(&c->erasable_list)) {
59		/* Note that most of them will have gone directly to be erased.
60		   So don't favour the erasable_list _too_ much. */
61		jffs2_dbg(1, "Picking block from erasable_list to GC next\n");
62		nextlist = &c->erasable_list;
63	} else if (n < 110 && !list_empty(&c->very_dirty_list)) {
64		/* Most of the time, pick one off the very_dirty list */
65		jffs2_dbg(1, "Picking block from very_dirty_list to GC next\n");
66		nextlist = &c->very_dirty_list;
67	} else if (n < 126 && !list_empty(&c->dirty_list)) {
68		jffs2_dbg(1, "Picking block from dirty_list to GC next\n");
69		nextlist = &c->dirty_list;
70	} else if (!list_empty(&c->clean_list)) {
71		jffs2_dbg(1, "Picking block from clean_list to GC next\n");
72		nextlist = &c->clean_list;
73	} else if (!list_empty(&c->dirty_list)) {
74		jffs2_dbg(1, "Picking block from dirty_list to GC next (clean_list was empty)\n");
75
76		nextlist = &c->dirty_list;
77	} else if (!list_empty(&c->very_dirty_list)) {
78		jffs2_dbg(1, "Picking block from very_dirty_list to GC next (clean_list and dirty_list were empty)\n");
79		nextlist = &c->very_dirty_list;
80	} else if (!list_empty(&c->erasable_list)) {
81		jffs2_dbg(1, "Picking block from erasable_list to GC next (clean_list and {very_,}dirty_list were empty)\n");
82
83		nextlist = &c->erasable_list;
84	} else if (!list_empty(&c->erasable_pending_wbuf_list)) {
85		/* There are blocks are wating for the wbuf sync */
86		jffs2_dbg(1, "Synching wbuf in order to reuse erasable_pending_wbuf_list blocks\n");
87		spin_unlock(&c->erase_completion_lock);
88		jffs2_flush_wbuf_pad(c);
89		spin_lock(&c->erase_completion_lock);
90		goto again;
91	} else {
92		/* Eep. All were empty */
93		jffs2_dbg(1, "No clean, dirty _or_ erasable blocks to GC from! Where are they all?\n");
94		return NULL;
95	}
96
97	ret = list_entry(nextlist->next, struct jffs2_eraseblock, list);
98	list_del(&ret->list);
99	c->gcblock = ret;
100	ret->gc_node = ret->first_node;
101	if (!ret->gc_node) {
102		pr_warn("Eep. ret->gc_node for block at 0x%08x is NULL\n",
103			ret->offset);
104		BUG();
105	}
106
107	/* Have we accidentally picked a clean block with wasted space ? */
108	if (ret->wasted_size) {
109		jffs2_dbg(1, "Converting wasted_size %08x to dirty_size\n",
110			  ret->wasted_size);
111		ret->dirty_size += ret->wasted_size;
112		c->wasted_size -= ret->wasted_size;
113		c->dirty_size += ret->wasted_size;
114		ret->wasted_size = 0;
115	}
116
117	return ret;
118}
119
120/* jffs2_garbage_collect_pass
121 * Make a single attempt to progress GC. Move one node, and possibly
122 * start erasing one eraseblock.
123 */
124int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
125{
126	struct jffs2_inode_info *f;
127	struct jffs2_inode_cache *ic;
128	struct jffs2_eraseblock *jeb;
129	struct jffs2_raw_node_ref *raw;
130	uint32_t gcblock_dirty;
131	int ret = 0, inum, nlink;
132	int xattr = 0;
133
134	if (mutex_lock_interruptible(&c->alloc_sem))
135		return -EINTR;
136
137
138	for (;;) {
139		/* We can't start doing GC until we've finished checking
140		   the node CRCs etc. */
141		int bucket, want_ino;
142
143		spin_lock(&c->erase_completion_lock);
144		if (!c->unchecked_size)
145			break;
146		spin_unlock(&c->erase_completion_lock);
147
148		if (!xattr)
149			xattr = jffs2_verify_xattr(c);
150
151		spin_lock(&c->inocache_lock);
152		/* Instead of doing the inodes in numeric order, doing a lookup
153		 * in the hash for each possible number, just walk the hash
154		 * buckets of *existing* inodes. This means that we process
155		 * them out-of-order, but it can be a lot faster if there's
156		 * a sparse inode# space. Which there often is. */
157		want_ino = c->check_ino;
158		for (bucket = c->check_ino % c->inocache_hashsize ; bucket < c->inocache_hashsize; bucket++) {
159			for (ic = c->inocache_list[bucket]; ic; ic = ic->next) {
160				if (ic->ino < want_ino)
161					continue;
162
163				if (ic->state != INO_STATE_CHECKEDABSENT &&
164				    ic->state != INO_STATE_PRESENT)
165					goto got_next; /* with inocache_lock held */
166
167				jffs2_dbg(1, "Skipping ino #%u already checked\n",
168					  ic->ino);
169			}
170			want_ino = 0;
171		}
172
173		/* Point c->check_ino past the end of the last bucket. */
174		c->check_ino = ((c->highest_ino + c->inocache_hashsize + 1) &
175				~c->inocache_hashsize) - 1;
176
177		spin_unlock(&c->inocache_lock);
178
179		pr_crit("Checked all inodes but still 0x%x bytes of unchecked space?\n",
180			c->unchecked_size);
181		jffs2_dbg_dump_block_lists_nolock(c);
182		mutex_unlock(&c->alloc_sem);
183		return -ENOSPC;
184
185	got_next:
186		/* For next time round the loop, we want c->checked_ino to indicate
187		 * the *next* one we want to check. And since we're walking the
188		 * buckets rather than doing it sequentially, it's: */
189		c->check_ino = ic->ino + c->inocache_hashsize;
190
191		if (!ic->pino_nlink) {
192			jffs2_dbg(1, "Skipping check of ino #%d with nlink/pino zero\n",
193				  ic->ino);
194			spin_unlock(&c->inocache_lock);
195			jffs2_xattr_delete_inode(c, ic);
196			continue;
197		}
198		switch(ic->state) {
199		case INO_STATE_CHECKEDABSENT:
200		case INO_STATE_PRESENT:
201			spin_unlock(&c->inocache_lock);
202			continue;
203
204		case INO_STATE_GC:
205		case INO_STATE_CHECKING:
206			pr_warn("Inode #%u is in state %d during CRC check phase!\n",
207				ic->ino, ic->state);
208			spin_unlock(&c->inocache_lock);
209			BUG();
210
211		case INO_STATE_READING:
212			/* We need to wait for it to finish, lest we move on
213			   and trigger the BUG() above while we haven't yet
214			   finished checking all its nodes */
215			jffs2_dbg(1, "Waiting for ino #%u to finish reading\n",
216				  ic->ino);
217			/* We need to come back again for the _same_ inode. We've
218			 made no progress in this case, but that should be OK */
219			c->check_ino = ic->ino;
220
221			mutex_unlock(&c->alloc_sem);
222			sleep_on_spinunlock(&c->inocache_wq, &c->inocache_lock);
223			return 0;
224
225		default:
226			BUG();
227
228		case INO_STATE_UNCHECKED:
229			;
230		}
231		ic->state = INO_STATE_CHECKING;
232		spin_unlock(&c->inocache_lock);
233
234		jffs2_dbg(1, "%s(): triggering inode scan of ino#%u\n",
235			  __func__, ic->ino);
236
237		ret = jffs2_do_crccheck_inode(c, ic);
238		if (ret)
239			pr_warn("Returned error for crccheck of ino #%u. Expect badness...\n",
240				ic->ino);
241
242		jffs2_set_inocache_state(c, ic, INO_STATE_CHECKEDABSENT);
243		mutex_unlock(&c->alloc_sem);
244		return ret;
245	}
246
247	/* If there are any blocks which need erasing, erase them now */
248	if (!list_empty(&c->erase_complete_list) ||
249	    !list_empty(&c->erase_pending_list)) {
250		spin_unlock(&c->erase_completion_lock);
251		mutex_unlock(&c->alloc_sem);
252		jffs2_dbg(1, "%s(): erasing pending blocks\n", __func__);
253		if (jffs2_erase_pending_blocks(c, 1))
254			return 0;
255
256		jffs2_dbg(1, "No progress from erasing block; doing GC anyway\n");
257		mutex_lock(&c->alloc_sem);
258		spin_lock(&c->erase_completion_lock);
259	}
260
261	/* First, work out which block we're garbage-collecting */
262	jeb = c->gcblock;
263
264	if (!jeb)
265		jeb = jffs2_find_gc_block(c);
266
267	if (!jeb) {
268		/* Couldn't find a free block. But maybe we can just erase one and make 'progress'? */
269		if (c->nr_erasing_blocks) {
270			spin_unlock(&c->erase_completion_lock);
271			mutex_unlock(&c->alloc_sem);
272			return -EAGAIN;
273		}
274		jffs2_dbg(1, "Couldn't find erase block to garbage collect!\n");
275		spin_unlock(&c->erase_completion_lock);
276		mutex_unlock(&c->alloc_sem);
277		return -EIO;
278	}
279
280	jffs2_dbg(1, "GC from block %08x, used_size %08x, dirty_size %08x, free_size %08x\n",
281		  jeb->offset, jeb->used_size, jeb->dirty_size, jeb->free_size);
282	D1(if (c->nextblock)
283	   printk(KERN_DEBUG "Nextblock at  %08x, used_size %08x, dirty_size %08x, wasted_size %08x, free_size %08x\n", c->nextblock->offset, c->nextblock->used_size, c->nextblock->dirty_size, c->nextblock->wasted_size, c->nextblock->free_size));
284
285	if (!jeb->used_size) {
286		mutex_unlock(&c->alloc_sem);
287		goto eraseit;
288	}
289
290	raw = jeb->gc_node;
291	gcblock_dirty = jeb->dirty_size;
292
293	while(ref_obsolete(raw)) {
294		jffs2_dbg(1, "Node at 0x%08x is obsolete... skipping\n",
295			  ref_offset(raw));
296		raw = ref_next(raw);
297		if (unlikely(!raw)) {
298			pr_warn("eep. End of raw list while still supposedly nodes to GC\n");
299			pr_warn("erase block at 0x%08x. free_size 0x%08x, dirty_size 0x%08x, used_size 0x%08x\n",
300				jeb->offset, jeb->free_size,
301				jeb->dirty_size, jeb->used_size);
302			jeb->gc_node = raw;
303			spin_unlock(&c->erase_completion_lock);
304			mutex_unlock(&c->alloc_sem);
305			BUG();
306		}
307	}
308	jeb->gc_node = raw;
309
310	jffs2_dbg(1, "Going to garbage collect node at 0x%08x\n",
311		  ref_offset(raw));
312
313	if (!raw->next_in_ino) {
314		/* Inode-less node. Clean marker, snapshot or something like that */
315		spin_unlock(&c->erase_completion_lock);
316		if (ref_flags(raw) == REF_PRISTINE) {
317			/* It's an unknown node with JFFS2_FEATURE_RWCOMPAT_COPY */
318			jffs2_garbage_collect_pristine(c, NULL, raw);
319		} else {
320			/* Just mark it obsolete */
321			jffs2_mark_node_obsolete(c, raw);
322		}
323		mutex_unlock(&c->alloc_sem);
324		goto eraseit_lock;
325	}
326
327	ic = jffs2_raw_ref_to_ic(raw);
328
329#ifdef CONFIG_JFFS2_FS_XATTR
330	/* When 'ic' refers xattr_datum/xattr_ref, this node is GCed as xattr.
331	 * We can decide whether this node is inode or xattr by ic->class.     */
332	if (ic->class == RAWNODE_CLASS_XATTR_DATUM
333	    || ic->class == RAWNODE_CLASS_XATTR_REF) {
334		spin_unlock(&c->erase_completion_lock);
335
336		if (ic->class == RAWNODE_CLASS_XATTR_DATUM) {
337			ret = jffs2_garbage_collect_xattr_datum(c, (struct jffs2_xattr_datum *)ic, raw);
338		} else {
339			ret = jffs2_garbage_collect_xattr_ref(c, (struct jffs2_xattr_ref *)ic, raw);
340		}
341		goto test_gcnode;
342	}
343#endif
344
345	/* We need to hold the inocache. Either the erase_completion_lock or
346	   the inocache_lock are sufficient; we trade down since the inocache_lock
347	   causes less contention. */
348	spin_lock(&c->inocache_lock);
349
350	spin_unlock(&c->erase_completion_lock);
351
352	jffs2_dbg(1, "%s(): collecting from block @0x%08x. Node @0x%08x(%d), ino #%u\n",
353		  __func__, jeb->offset, ref_offset(raw), ref_flags(raw),
354		  ic->ino);
355
356	/* Three possibilities:
357	   1. Inode is already in-core. We must iget it and do proper
358	      updating to its fragtree, etc.
359	   2. Inode is not in-core, node is REF_PRISTINE. We lock the
360	      inocache to prevent a read_inode(), copy the node intact.
361	   3. Inode is not in-core, node is not pristine. We must iget()
362	      and take the slow path.
363	*/
364
365	switch(ic->state) {
366	case INO_STATE_CHECKEDABSENT:
367		/* It's been checked, but it's not currently in-core.
368		   We can just copy any pristine nodes, but have
369		   to prevent anyone else from doing read_inode() while
370		   we're at it, so we set the state accordingly */
371		if (ref_flags(raw) == REF_PRISTINE)
372			ic->state = INO_STATE_GC;
373		else {
374			jffs2_dbg(1, "Ino #%u is absent but node not REF_PRISTINE. Reading.\n",
375				  ic->ino);
376		}
377		break;
378
379	case INO_STATE_PRESENT:
380		/* It's in-core. GC must iget() it. */
381		break;
382
383	case INO_STATE_UNCHECKED:
384	case INO_STATE_CHECKING:
385	case INO_STATE_GC:
386		/* Should never happen. We should have finished checking
387		   by the time we actually start doing any GC, and since
388		   we're holding the alloc_sem, no other garbage collection
389		   can happen.
390		*/
391		pr_crit("Inode #%u already in state %d in jffs2_garbage_collect_pass()!\n",
392			ic->ino, ic->state);
393		mutex_unlock(&c->alloc_sem);
394		spin_unlock(&c->inocache_lock);
395		BUG();
396
397	case INO_STATE_READING:
398		/* Someone's currently trying to read it. We must wait for
399		   them to finish and then go through the full iget() route
400		   to do the GC. However, sometimes read_inode() needs to get
401		   the alloc_sem() (for marking nodes invalid) so we must
402		   drop the alloc_sem before sleeping. */
403
404		mutex_unlock(&c->alloc_sem);
405		jffs2_dbg(1, "%s(): waiting for ino #%u in state %d\n",
406			  __func__, ic->ino, ic->state);
407		sleep_on_spinunlock(&c->inocache_wq, &c->inocache_lock);
408		/* And because we dropped the alloc_sem we must start again from the
409		   beginning. Ponder chance of livelock here -- we're returning success
410		   without actually making any progress.
411
412		   Q: What are the chances that the inode is back in INO_STATE_READING
413		   again by the time we next enter this function? And that this happens
414		   enough times to cause a real delay?
415
416		   A: Small enough that I don't care :)
417		*/
418		return 0;
419	}
420
421	/* OK. Now if the inode is in state INO_STATE_GC, we are going to copy the
422	   node intact, and we don't have to muck about with the fragtree etc.
423	   because we know it's not in-core. If it _was_ in-core, we go through
424	   all the iget() crap anyway */
425
426	if (ic->state == INO_STATE_GC) {
427		spin_unlock(&c->inocache_lock);
428
429		ret = jffs2_garbage_collect_pristine(c, ic, raw);
430
431		spin_lock(&c->inocache_lock);
432		ic->state = INO_STATE_CHECKEDABSENT;
433		wake_up(&c->inocache_wq);
434
435		if (ret != -EBADFD) {
436			spin_unlock(&c->inocache_lock);
437			goto test_gcnode;
438		}
439
440		/* Fall through if it wanted us to, with inocache_lock held */
441	}
442
443	/* Prevent the fairly unlikely race where the gcblock is
444	   entirely obsoleted by the final close of a file which had
445	   the only valid nodes in the block, followed by erasure,
446	   followed by freeing of the ic because the erased block(s)
447	   held _all_ the nodes of that inode.... never been seen but
448	   it's vaguely possible. */
449
450	inum = ic->ino;
451	nlink = ic->pino_nlink;
452	spin_unlock(&c->inocache_lock);
453
454	f = jffs2_gc_fetch_inode(c, inum, !nlink);
455	if (IS_ERR(f)) {
456		ret = PTR_ERR(f);
457		goto release_sem;
458	}
459	if (!f) {
460		ret = 0;
461		goto release_sem;
462	}
463
464	ret = jffs2_garbage_collect_live(c, jeb, raw, f);
465
466	jffs2_gc_release_inode(c, f);
467
468 test_gcnode:
469	if (jeb->dirty_size == gcblock_dirty && !ref_obsolete(jeb->gc_node)) {
470		/* Eep. This really should never happen. GC is broken */
471		pr_err("Error garbage collecting node at %08x!\n",
472		       ref_offset(jeb->gc_node));
473		ret = -ENOSPC;
474	}
475 release_sem:
476	mutex_unlock(&c->alloc_sem);
477
478 eraseit_lock:
479	/* If we've finished this block, start it erasing */
480	spin_lock(&c->erase_completion_lock);
481
482 eraseit:
483	if (c->gcblock && !c->gcblock->used_size) {
484		jffs2_dbg(1, "Block at 0x%08x completely obsoleted by GC. Moving to erase_pending_list\n",
485			  c->gcblock->offset);
486		/* We're GC'ing an empty block? */
487		list_add_tail(&c->gcblock->list, &c->erase_pending_list);
488		c->gcblock = NULL;
489		c->nr_erasing_blocks++;
490		jffs2_garbage_collect_trigger(c);
491	}
492	spin_unlock(&c->erase_completion_lock);
493
494	return ret;
495}
496
497static int jffs2_garbage_collect_live(struct jffs2_sb_info *c,  struct jffs2_eraseblock *jeb,
498				      struct jffs2_raw_node_ref *raw, struct jffs2_inode_info *f)
499{
500	struct jffs2_node_frag *frag;
501	struct jffs2_full_dnode *fn = NULL;
502	struct jffs2_full_dirent *fd;
503	uint32_t start = 0, end = 0, nrfrags = 0;
504	int ret = 0;
505
506	mutex_lock(&f->sem);
507
508	/* Now we have the lock for this inode. Check that it's still the one at the head
509	   of the list. */
510
511	spin_lock(&c->erase_completion_lock);
512
513	if (c->gcblock != jeb) {
514		spin_unlock(&c->erase_completion_lock);
515		jffs2_dbg(1, "GC block is no longer gcblock. Restart\n");
516		goto upnout;
517	}
518	if (ref_obsolete(raw)) {
519		spin_unlock(&c->erase_completion_lock);
520		jffs2_dbg(1, "node to be GC'd was obsoleted in the meantime.\n");
521		/* They'll call again */
522		goto upnout;
523	}
524	spin_unlock(&c->erase_completion_lock);
525
526	/* OK. Looks safe. And nobody can get us now because we have the semaphore. Move the block */
527	if (f->metadata && f->metadata->raw == raw) {
528		fn = f->metadata;
529		ret = jffs2_garbage_collect_metadata(c, jeb, f, fn);
530		goto upnout;
531	}
532
533	/* FIXME. Read node and do lookup? */
534	for (frag = frag_first(&f->fragtree); frag; frag = frag_next(frag)) {
535		if (frag->node && frag->node->raw == raw) {
536			fn = frag->node;
537			end = frag->ofs + frag->size;
538			if (!nrfrags++)
539				start = frag->ofs;
540			if (nrfrags == frag->node->frags)
541				break; /* We've found them all */
542		}
543	}
544	if (fn) {
545		if (ref_flags(raw) == REF_PRISTINE) {
546			ret = jffs2_garbage_collect_pristine(c, f->inocache, raw);
547			if (!ret) {
548				/* Urgh. Return it sensibly. */
549				frag->node->raw = f->inocache->nodes;
550			}
551			if (ret != -EBADFD)
552				goto upnout;
553		}
554		/* We found a datanode. Do the GC */
555		if((start >> PAGE_SHIFT) < ((end-1) >> PAGE_SHIFT)) {
556			/* It crosses a page boundary. Therefore, it must be a hole. */
557			ret = jffs2_garbage_collect_hole(c, jeb, f, fn, start, end);
558		} else {
559			/* It could still be a hole. But we GC the page this way anyway */
560			ret = jffs2_garbage_collect_dnode(c, jeb, f, fn, start, end);
561		}
562		goto upnout;
563	}
564
565	/* Wasn't a dnode. Try dirent */
566	for (fd = f->dents; fd; fd=fd->next) {
567		if (fd->raw == raw)
568			break;
569	}
570
571	if (fd && fd->ino) {
572		ret = jffs2_garbage_collect_dirent(c, jeb, f, fd);
573	} else if (fd) {
574		ret = jffs2_garbage_collect_deletion_dirent(c, jeb, f, fd);
575	} else {
576		pr_warn("Raw node at 0x%08x wasn't in node lists for ino #%u\n",
577			ref_offset(raw), f->inocache->ino);
578		if (ref_obsolete(raw)) {
579			pr_warn("But it's obsolete so we don't mind too much\n");
580		} else {
581			jffs2_dbg_dump_node(c, ref_offset(raw));
582			BUG();
583		}
584	}
585 upnout:
586	mutex_unlock(&f->sem);
587
588	return ret;
589}
590
591static int jffs2_garbage_collect_pristine(struct jffs2_sb_info *c,
592					  struct jffs2_inode_cache *ic,
593					  struct jffs2_raw_node_ref *raw)
594{
595	union jffs2_node_union *node;
596	size_t retlen;
597	int ret;
598	uint32_t phys_ofs, alloclen;
599	uint32_t crc, rawlen;
600	int retried = 0;
601
602	jffs2_dbg(1, "Going to GC REF_PRISTINE node at 0x%08x\n",
603		  ref_offset(raw));
604
605	alloclen = rawlen = ref_totlen(c, c->gcblock, raw);
606
607	/* Ask for a small amount of space (or the totlen if smaller) because we
608	   don't want to force wastage of the end of a block if splitting would
609	   work. */
610	if (ic && alloclen > sizeof(struct jffs2_raw_inode) + JFFS2_MIN_DATA_LEN)
611		alloclen = sizeof(struct jffs2_raw_inode) + JFFS2_MIN_DATA_LEN;
612
613	ret = jffs2_reserve_space_gc(c, alloclen, &alloclen, rawlen);
614	/* 'rawlen' is not the exact summary size; it is only an upper estimation */
615
616	if (ret)
617		return ret;
618
619	if (alloclen < rawlen) {
620		/* Doesn't fit untouched. We'll go the old route and split it */
621		return -EBADFD;
622	}
623
624	node = kmalloc(rawlen, GFP_KERNEL);
625	if (!node)
626		return -ENOMEM;
627
628	ret = jffs2_flash_read(c, ref_offset(raw), rawlen, &retlen, (char *)node);
629	if (!ret && retlen != rawlen)
630		ret = -EIO;
631	if (ret)
632		goto out_node;
633
634	crc = crc32(0, node, sizeof(struct jffs2_unknown_node)-4);
635	if (je32_to_cpu(node->u.hdr_crc) != crc) {
636		pr_warn("Header CRC failed on REF_PRISTINE node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
637			ref_offset(raw), je32_to_cpu(node->u.hdr_crc), crc);
638		goto bail;
639	}
640
641	switch(je16_to_cpu(node->u.nodetype)) {
642	case JFFS2_NODETYPE_INODE:
643		crc = crc32(0, node, sizeof(node->i)-8);
644		if (je32_to_cpu(node->i.node_crc) != crc) {
645			pr_warn("Node CRC failed on REF_PRISTINE data node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
646				ref_offset(raw), je32_to_cpu(node->i.node_crc),
647				crc);
648			goto bail;
649		}
650
651		if (je32_to_cpu(node->i.dsize)) {
652			crc = crc32(0, node->i.data, je32_to_cpu(node->i.csize));
653			if (je32_to_cpu(node->i.data_crc) != crc) {
654				pr_warn("Data CRC failed on REF_PRISTINE data node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
655					ref_offset(raw),
656					je32_to_cpu(node->i.data_crc), crc);
657				goto bail;
658			}
659		}
660		break;
661
662	case JFFS2_NODETYPE_DIRENT:
663		crc = crc32(0, node, sizeof(node->d)-8);
664		if (je32_to_cpu(node->d.node_crc) != crc) {
665			pr_warn("Node CRC failed on REF_PRISTINE dirent node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
666				ref_offset(raw),
667				je32_to_cpu(node->d.node_crc), crc);
668			goto bail;
669		}
670
671		if (strnlen(node->d.name, node->d.nsize) != node->d.nsize) {
672			pr_warn("Name in dirent node at 0x%08x contains zeroes\n",
673				ref_offset(raw));
674			goto bail;
675		}
676
677		if (node->d.nsize) {
678			crc = crc32(0, node->d.name, node->d.nsize);
679			if (je32_to_cpu(node->d.name_crc) != crc) {
680				pr_warn("Name CRC failed on REF_PRISTINE dirent node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
681					ref_offset(raw),
682					je32_to_cpu(node->d.name_crc), crc);
683				goto bail;
684			}
685		}
686		break;
687	default:
688		/* If it's inode-less, we don't _know_ what it is. Just copy it intact */
689		if (ic) {
690			pr_warn("Unknown node type for REF_PRISTINE node at 0x%08x: 0x%04x\n",
691				ref_offset(raw), je16_to_cpu(node->u.nodetype));
692			goto bail;
693		}
694	}
695
696	/* OK, all the CRCs are good; this node can just be copied as-is. */
697 retry:
698	phys_ofs = write_ofs(c);
699
700	ret = jffs2_flash_write(c, phys_ofs, rawlen, &retlen, (char *)node);
701
702	if (ret || (retlen != rawlen)) {
703		pr_notice("Write of %d bytes at 0x%08x failed. returned %d, retlen %zd\n",
704			  rawlen, phys_ofs, ret, retlen);
705		if (retlen) {
706			jffs2_add_physical_node_ref(c, phys_ofs | REF_OBSOLETE, rawlen, NULL);
707		} else {
708			pr_notice("Not marking the space at 0x%08x as dirty because the flash driver returned retlen zero\n",
709				  phys_ofs);
710		}
711		if (!retried) {
712			/* Try to reallocate space and retry */
713			uint32_t dummy;
714			struct jffs2_eraseblock *jeb = &c->blocks[phys_ofs / c->sector_size];
715
716			retried = 1;
717
718			jffs2_dbg(1, "Retrying failed write of REF_PRISTINE node.\n");
719
720			jffs2_dbg_acct_sanity_check(c,jeb);
721			jffs2_dbg_acct_paranoia_check(c, jeb);
722
723			ret = jffs2_reserve_space_gc(c, rawlen, &dummy, rawlen);
724						/* this is not the exact summary size of it,
725							it is only an upper estimation */
726
727			if (!ret) {
728				jffs2_dbg(1, "Allocated space at 0x%08x to retry failed write.\n",
729					  phys_ofs);
730
731				jffs2_dbg_acct_sanity_check(c,jeb);
732				jffs2_dbg_acct_paranoia_check(c, jeb);
733
734				goto retry;
735			}
736			jffs2_dbg(1, "Failed to allocate space to retry failed write: %d!\n",
737				  ret);
738		}
739
740		if (!ret)
741			ret = -EIO;
742		goto out_node;
743	}
744	jffs2_add_physical_node_ref(c, phys_ofs | REF_PRISTINE, rawlen, ic);
745
746	jffs2_mark_node_obsolete(c, raw);
747	jffs2_dbg(1, "WHEEE! GC REF_PRISTINE node at 0x%08x succeeded\n",
748		  ref_offset(raw));
749
750 out_node:
751	kfree(node);
752	return ret;
753 bail:
754	ret = -EBADFD;
755	goto out_node;
756}
757
758static int jffs2_garbage_collect_metadata(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
759					struct jffs2_inode_info *f, struct jffs2_full_dnode *fn)
760{
761	struct jffs2_full_dnode *new_fn;
762	struct jffs2_raw_inode ri;
763	struct jffs2_node_frag *last_frag;
764	union jffs2_device_node dev;
765	char *mdata = NULL;
766	int mdatalen = 0;
767	uint32_t alloclen, ilen;
768	int ret;
769
770	if (S_ISBLK(JFFS2_F_I_MODE(f)) ||
771	    S_ISCHR(JFFS2_F_I_MODE(f)) ) {
772		/* For these, we don't actually need to read the old node */
773		mdatalen = jffs2_encode_dev(&dev, JFFS2_F_I_RDEV(f));
774		mdata = (char *)&dev;
775		jffs2_dbg(1, "%s(): Writing %d bytes of kdev_t\n",
776			  __func__, mdatalen);
777	} else if (S_ISLNK(JFFS2_F_I_MODE(f))) {
778		mdatalen = fn->size;
779		mdata = kmalloc(fn->size, GFP_KERNEL);
780		if (!mdata) {
781			pr_warn("kmalloc of mdata failed in jffs2_garbage_collect_metadata()\n");
782			return -ENOMEM;
783		}
784		ret = jffs2_read_dnode(c, f, fn, mdata, 0, mdatalen);
785		if (ret) {
786			pr_warn("read of old metadata failed in jffs2_garbage_collect_metadata(): %d\n",
787				ret);
788			kfree(mdata);
789			return ret;
790		}
791		jffs2_dbg(1, "%s(): Writing %d bites of symlink target\n",
792			  __func__, mdatalen);
793
794	}
795
796	ret = jffs2_reserve_space_gc(c, sizeof(ri) + mdatalen, &alloclen,
797				JFFS2_SUMMARY_INODE_SIZE);
798	if (ret) {
799		pr_warn("jffs2_reserve_space_gc of %zd bytes for garbage_collect_metadata failed: %d\n",
800			sizeof(ri) + mdatalen, ret);
801		goto out;
802	}
803
804	last_frag = frag_last(&f->fragtree);
805	if (last_frag)
806		/* Fetch the inode length from the fragtree rather then
807		 * from i_size since i_size may have not been updated yet */
808		ilen = last_frag->ofs + last_frag->size;
809	else
810		ilen = JFFS2_F_I_SIZE(f);
811
812	memset(&ri, 0, sizeof(ri));
813	ri.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
814	ri.nodetype = cpu_to_je16(JFFS2_NODETYPE_INODE);
815	ri.totlen = cpu_to_je32(sizeof(ri) + mdatalen);
816	ri.hdr_crc = cpu_to_je32(crc32(0, &ri, sizeof(struct jffs2_unknown_node)-4));
817
818	ri.ino = cpu_to_je32(f->inocache->ino);
819	ri.version = cpu_to_je32(++f->highest_version);
820	ri.mode = cpu_to_jemode(JFFS2_F_I_MODE(f));
821	ri.uid = cpu_to_je16(JFFS2_F_I_UID(f));
822	ri.gid = cpu_to_je16(JFFS2_F_I_GID(f));
823	ri.isize = cpu_to_je32(ilen);
824	ri.atime = cpu_to_je32(JFFS2_F_I_ATIME(f));
825	ri.ctime = cpu_to_je32(JFFS2_F_I_CTIME(f));
826	ri.mtime = cpu_to_je32(JFFS2_F_I_MTIME(f));
827	ri.offset = cpu_to_je32(0);
828	ri.csize = cpu_to_je32(mdatalen);
829	ri.dsize = cpu_to_je32(mdatalen);
830	ri.compr = JFFS2_COMPR_NONE;
831	ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8));
832	ri.data_crc = cpu_to_je32(crc32(0, mdata, mdatalen));
833
834	new_fn = jffs2_write_dnode(c, f, &ri, mdata, mdatalen, ALLOC_GC);
835
836	if (IS_ERR(new_fn)) {
837		pr_warn("Error writing new dnode: %ld\n", PTR_ERR(new_fn));
838		ret = PTR_ERR(new_fn);
839		goto out;
840	}
841	jffs2_mark_node_obsolete(c, fn->raw);
842	jffs2_free_full_dnode(fn);
843	f->metadata = new_fn;
844 out:
845	if (S_ISLNK(JFFS2_F_I_MODE(f)))
846		kfree(mdata);
847	return ret;
848}
849
850static int jffs2_garbage_collect_dirent(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
851					struct jffs2_inode_info *f, struct jffs2_full_dirent *fd)
852{
853	struct jffs2_full_dirent *new_fd;
854	struct jffs2_raw_dirent rd;
855	uint32_t alloclen;
856	int ret;
857
858	rd.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
859	rd.nodetype = cpu_to_je16(JFFS2_NODETYPE_DIRENT);
860	rd.nsize = strlen(fd->name);
861	rd.totlen = cpu_to_je32(sizeof(rd) + rd.nsize);
862	rd.hdr_crc = cpu_to_je32(crc32(0, &rd, sizeof(struct jffs2_unknown_node)-4));
863
864	rd.pino = cpu_to_je32(f->inocache->ino);
865	rd.version = cpu_to_je32(++f->highest_version);
866	rd.ino = cpu_to_je32(fd->ino);
867	/* If the times on this inode were set by explicit utime() they can be different,
868	   so refrain from splatting them. */
869	if (JFFS2_F_I_MTIME(f) == JFFS2_F_I_CTIME(f))
870		rd.mctime = cpu_to_je32(JFFS2_F_I_MTIME(f));
871	else
872		rd.mctime = cpu_to_je32(0);
873	rd.type = fd->type;
874	rd.node_crc = cpu_to_je32(crc32(0, &rd, sizeof(rd)-8));
875	rd.name_crc = cpu_to_je32(crc32(0, fd->name, rd.nsize));
876
877	ret = jffs2_reserve_space_gc(c, sizeof(rd)+rd.nsize, &alloclen,
878				JFFS2_SUMMARY_DIRENT_SIZE(rd.nsize));
879	if (ret) {
880		pr_warn("jffs2_reserve_space_gc of %zd bytes for garbage_collect_dirent failed: %d\n",
881			sizeof(rd)+rd.nsize, ret);
882		return ret;
883	}
884	new_fd = jffs2_write_dirent(c, f, &rd, fd->name, rd.nsize, ALLOC_GC);
885
886	if (IS_ERR(new_fd)) {
887		pr_warn("jffs2_write_dirent in garbage_collect_dirent failed: %ld\n",
888			PTR_ERR(new_fd));
889		return PTR_ERR(new_fd);
890	}
891	jffs2_add_fd_to_list(c, new_fd, &f->dents);
892	return 0;
893}
894
895static int jffs2_garbage_collect_deletion_dirent(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
896					struct jffs2_inode_info *f, struct jffs2_full_dirent *fd)
897{
898	struct jffs2_full_dirent **fdp = &f->dents;
899	int found = 0;
900
901	/* On a medium where we can't actually mark nodes obsolete
902	   pernamently, such as NAND flash, we need to work out
903	   whether this deletion dirent is still needed to actively
904	   delete a 'real' dirent with the same name that's still
905	   somewhere else on the flash. */
906	if (!jffs2_can_mark_obsolete(c)) {
907		struct jffs2_raw_dirent *rd;
908		struct jffs2_raw_node_ref *raw;
909		int ret;
910		size_t retlen;
911		int name_len = strlen(fd->name);
912		uint32_t name_crc = crc32(0, fd->name, name_len);
913		uint32_t rawlen = ref_totlen(c, jeb, fd->raw);
914
915		rd = kmalloc(rawlen, GFP_KERNEL);
916		if (!rd)
917			return -ENOMEM;
918
919		/* Prevent the erase code from nicking the obsolete node refs while
920		   we're looking at them. I really don't like this extra lock but
921		   can't see any alternative. Suggestions on a postcard to... */
922		mutex_lock(&c->erase_free_sem);
923
924		for (raw = f->inocache->nodes; raw != (void *)f->inocache; raw = raw->next_in_ino) {
925
926			cond_resched();
927
928			/* We only care about obsolete ones */
929			if (!(ref_obsolete(raw)))
930				continue;
931
932			/* Any dirent with the same name is going to have the same length... */
933			if (ref_totlen(c, NULL, raw) != rawlen)
934				continue;
935
936			/* Doesn't matter if there's one in the same erase block. We're going to
937			   delete it too at the same time. */
938			if (SECTOR_ADDR(raw->flash_offset) == SECTOR_ADDR(fd->raw->flash_offset))
939				continue;
940
941			jffs2_dbg(1, "Check potential deletion dirent at %08x\n",
942				  ref_offset(raw));
943
944			/* This is an obsolete node belonging to the same directory, and it's of the right
945			   length. We need to take a closer look...*/
946			ret = jffs2_flash_read(c, ref_offset(raw), rawlen, &retlen, (char *)rd);
947			if (ret) {
948				pr_warn("%s(): Read error (%d) reading obsolete node at %08x\n",
949					__func__, ret, ref_offset(raw));
950				/* If we can't read it, we don't need to continue to obsolete it. Continue */
951				continue;
952			}
953			if (retlen != rawlen) {
954				pr_warn("%s(): Short read (%zd not %u) reading header from obsolete node at %08x\n",
955					__func__, retlen, rawlen,
956					ref_offset(raw));
957				continue;
958			}
959
960			if (je16_to_cpu(rd->nodetype) != JFFS2_NODETYPE_DIRENT)
961				continue;
962
963			/* If the name CRC doesn't match, skip */
964			if (je32_to_cpu(rd->name_crc) != name_crc)
965				continue;
966
967			/* If the name length doesn't match, or it's another deletion dirent, skip */
968			if (rd->nsize != name_len || !je32_to_cpu(rd->ino))
969				continue;
970
971			/* OK, check the actual name now */
972			if (memcmp(rd->name, fd->name, name_len))
973				continue;
974
975			/* OK. The name really does match. There really is still an older node on
976			   the flash which our deletion dirent obsoletes. So we have to write out
977			   a new deletion dirent to replace it */
978			mutex_unlock(&c->erase_free_sem);
979
980			jffs2_dbg(1, "Deletion dirent at %08x still obsoletes real dirent \"%s\" at %08x for ino #%u\n",
981				  ref_offset(fd->raw), fd->name,
982				  ref_offset(raw), je32_to_cpu(rd->ino));
983			kfree(rd);
984
985			return jffs2_garbage_collect_dirent(c, jeb, f, fd);
986		}
987
988		mutex_unlock(&c->erase_free_sem);
989		kfree(rd);
990	}
991
992	/* FIXME: If we're deleting a dirent which contains the current mtime and ctime,
993	   we should update the metadata node with those times accordingly */
994
995	/* No need for it any more. Just mark it obsolete and remove it from the list */
996	while (*fdp) {
997		if ((*fdp) == fd) {
998			found = 1;
999			*fdp = fd->next;
1000			break;
1001		}
1002		fdp = &(*fdp)->next;
1003	}
1004	if (!found) {
1005		pr_warn("Deletion dirent \"%s\" not found in list for ino #%u\n",
1006			fd->name, f->inocache->ino);
1007	}
1008	jffs2_mark_node_obsolete(c, fd->raw);
1009	jffs2_free_full_dirent(fd);
1010	return 0;
1011}
1012
1013static int jffs2_garbage_collect_hole(struct jffs2_sb_info *c, struct jffs2_eraseblock *jeb,
1014				      struct jffs2_inode_info *f, struct jffs2_full_dnode *fn,
1015				      uint32_t start, uint32_t end)
1016{
1017	struct jffs2_raw_inode ri;
1018	struct jffs2_node_frag *frag;
1019	struct jffs2_full_dnode *new_fn;
1020	uint32_t alloclen, ilen;
1021	int ret;
1022
1023	jffs2_dbg(1, "Writing replacement hole node for ino #%u from offset 0x%x to 0x%x\n",
1024		  f->inocache->ino, start, end);
1025
1026	memset(&ri, 0, sizeof(ri));
1027
1028	if(fn->frags > 1) {
1029		size_t readlen;
1030		uint32_t crc;
1031		/* It's partially obsoleted by a later write. So we have to
1032		   write it out again with the _same_ version as before */
1033		ret = jffs2_flash_read(c, ref_offset(fn->raw), sizeof(ri), &readlen, (char *)&ri);
1034		if (readlen != sizeof(ri) || ret) {
1035			pr_warn("Node read failed in jffs2_garbage_collect_hole. Ret %d, retlen %zd. Data will be lost by writing new hole node\n",
1036				ret, readlen);
1037			goto fill;
1038		}
1039		if (je16_to_cpu(ri.nodetype) != JFFS2_NODETYPE_INODE) {
1040			pr_warn("%s(): Node at 0x%08x had node type 0x%04x instead of JFFS2_NODETYPE_INODE(0x%04x)\n",
1041				__func__, ref_offset(fn->raw),
1042				je16_to_cpu(ri.nodetype), JFFS2_NODETYPE_INODE);
1043			return -EIO;
1044		}
1045		if (je32_to_cpu(ri.totlen) != sizeof(ri)) {
1046			pr_warn("%s(): Node at 0x%08x had totlen 0x%x instead of expected 0x%zx\n",
1047				__func__, ref_offset(fn->raw),
1048				je32_to_cpu(ri.totlen), sizeof(ri));
1049			return -EIO;
1050		}
1051		crc = crc32(0, &ri, sizeof(ri)-8);
1052		if (crc != je32_to_cpu(ri.node_crc)) {
1053			pr_warn("%s: Node at 0x%08x had CRC 0x%08x which doesn't match calculated CRC 0x%08x\n",
1054				__func__, ref_offset(fn->raw),
1055				je32_to_cpu(ri.node_crc), crc);
1056			/* FIXME: We could possibly deal with this by writing new holes for each frag */
1057			pr_warn("Data in the range 0x%08x to 0x%08x of inode #%u will be lost\n",
1058				start, end, f->inocache->ino);
1059			goto fill;
1060		}
1061		if (ri.compr != JFFS2_COMPR_ZERO) {
1062			pr_warn("%s(): Node 0x%08x wasn't a hole node!\n",
1063				__func__, ref_offset(fn->raw));
1064			pr_warn("Data in the range 0x%08x to 0x%08x of inode #%u will be lost\n",
1065				start, end, f->inocache->ino);
1066			goto fill;
1067		}
1068	} else {
1069	fill:
1070		ri.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
1071		ri.nodetype = cpu_to_je16(JFFS2_NODETYPE_INODE);
1072		ri.totlen = cpu_to_je32(sizeof(ri));
1073		ri.hdr_crc = cpu_to_je32(crc32(0, &ri, sizeof(struct jffs2_unknown_node)-4));
1074
1075		ri.ino = cpu_to_je32(f->inocache->ino);
1076		ri.version = cpu_to_je32(++f->highest_version);
1077		ri.offset = cpu_to_je32(start);
1078		ri.dsize = cpu_to_je32(end - start);
1079		ri.csize = cpu_to_je32(0);
1080		ri.compr = JFFS2_COMPR_ZERO;
1081	}
1082
1083	frag = frag_last(&f->fragtree);
1084	if (frag)
1085		/* Fetch the inode length from the fragtree rather then
1086		 * from i_size since i_size may have not been updated yet */
1087		ilen = frag->ofs + frag->size;
1088	else
1089		ilen = JFFS2_F_I_SIZE(f);
1090
1091	ri.mode = cpu_to_jemode(JFFS2_F_I_MODE(f));
1092	ri.uid = cpu_to_je16(JFFS2_F_I_UID(f));
1093	ri.gid = cpu_to_je16(JFFS2_F_I_GID(f));
1094	ri.isize = cpu_to_je32(ilen);
1095	ri.atime = cpu_to_je32(JFFS2_F_I_ATIME(f));
1096	ri.ctime = cpu_to_je32(JFFS2_F_I_CTIME(f));
1097	ri.mtime = cpu_to_je32(JFFS2_F_I_MTIME(f));
1098	ri.data_crc = cpu_to_je32(0);
1099	ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8));
1100
1101	ret = jffs2_reserve_space_gc(c, sizeof(ri), &alloclen,
1102				     JFFS2_SUMMARY_INODE_SIZE);
1103	if (ret) {
1104		pr_warn("jffs2_reserve_space_gc of %zd bytes for garbage_collect_hole failed: %d\n",
1105			sizeof(ri), ret);
1106		return ret;
1107	}
1108	new_fn = jffs2_write_dnode(c, f, &ri, NULL, 0, ALLOC_GC);
1109
1110	if (IS_ERR(new_fn)) {
1111		pr_warn("Error writing new hole node: %ld\n", PTR_ERR(new_fn));
1112		return PTR_ERR(new_fn);
1113	}
1114	if (je32_to_cpu(ri.version) == f->highest_version) {
1115		jffs2_add_full_dnode_to_inode(c, f, new_fn);
1116		if (f->metadata) {
1117			jffs2_mark_node_obsolete(c, f->metadata->raw);
1118			jffs2_free_full_dnode(f->metadata);
1119			f->metadata = NULL;
1120		}
1121		return 0;
1122	}
1123
1124	/*
1125	 * We should only get here in the case where the node we are
1126	 * replacing had more than one frag, so we kept the same version
1127	 * number as before. (Except in case of error -- see 'goto fill;'
1128	 * above.)
1129	 */
1130	D1(if(unlikely(fn->frags <= 1)) {
1131			pr_warn("%s(): Replacing fn with %d frag(s) but new ver %d != highest_version %d of ino #%d\n",
1132				__func__, fn->frags, je32_to_cpu(ri.version),
1133				f->highest_version, je32_to_cpu(ri.ino));
1134	});
1135
1136	/* This is a partially-overlapped hole node. Mark it REF_NORMAL not REF_PRISTINE */
1137	mark_ref_normal(new_fn->raw);
1138
1139	for (frag = jffs2_lookup_node_frag(&f->fragtree, fn->ofs);
1140	     frag; frag = frag_next(frag)) {
1141		if (frag->ofs > fn->size + fn->ofs)
1142			break;
1143		if (frag->node == fn) {
1144			frag->node = new_fn;
1145			new_fn->frags++;
1146			fn->frags--;
1147		}
1148	}
1149	if (fn->frags) {
1150		pr_warn("%s(): Old node still has frags!\n", __func__);
1151		BUG();
1152	}
1153	if (!new_fn->frags) {
1154		pr_warn("%s(): New node has no frags!\n", __func__);
1155		BUG();
1156	}
1157
1158	jffs2_mark_node_obsolete(c, fn->raw);
1159	jffs2_free_full_dnode(fn);
1160
1161	return 0;
1162}
1163
1164static int jffs2_garbage_collect_dnode(struct jffs2_sb_info *c, struct jffs2_eraseblock *orig_jeb,
1165				       struct jffs2_inode_info *f, struct jffs2_full_dnode *fn,
1166				       uint32_t start, uint32_t end)
1167{
1168	struct inode *inode = OFNI_EDONI_2SFFJ(f);
1169	struct jffs2_full_dnode *new_fn;
1170	struct jffs2_raw_inode ri;
1171	uint32_t alloclen, offset, orig_end, orig_start;
1172	int ret = 0;
1173	unsigned char *comprbuf = NULL, *writebuf;
1174	struct page *page;
1175	unsigned char *pg_ptr;
1176
1177	memset(&ri, 0, sizeof(ri));
1178
1179	jffs2_dbg(1, "Writing replacement dnode for ino #%u from offset 0x%x to 0x%x\n",
1180		  f->inocache->ino, start, end);
1181
1182	orig_end = end;
1183	orig_start = start;
1184
1185	if (c->nr_free_blocks + c->nr_erasing_blocks > c->resv_blocks_gcmerge) {
1186		/* Attempt to do some merging. But only expand to cover logically
1187		   adjacent frags if the block containing them is already considered
1188		   to be dirty. Otherwise we end up with GC just going round in
1189		   circles dirtying the nodes it already wrote out, especially
1190		   on NAND where we have small eraseblocks and hence a much higher
1191		   chance of nodes having to be split to cross boundaries. */
1192
1193		struct jffs2_node_frag *frag;
1194		uint32_t min, max;
1195
1196		min = start & ~(PAGE_SIZE-1);
1197		max = min + PAGE_SIZE;
1198
1199		frag = jffs2_lookup_node_frag(&f->fragtree, start);
1200
1201		/* BUG_ON(!frag) but that'll happen anyway... */
1202
1203		BUG_ON(frag->ofs != start);
1204
1205		/* First grow down... */
1206		while((frag = frag_prev(frag)) && frag->ofs >= min) {
1207
1208			/* If the previous frag doesn't even reach the beginning, there's
1209			   excessive fragmentation. Just merge. */
1210			if (frag->ofs > min) {
1211				jffs2_dbg(1, "Expanding down to cover partial frag (0x%x-0x%x)\n",
1212					  frag->ofs, frag->ofs+frag->size);
1213				start = frag->ofs;
1214				continue;
1215			}
1216			/* OK. This frag holds the first byte of the page. */
1217			if (!frag->node || !frag->node->raw) {
1218				jffs2_dbg(1, "First frag in page is hole (0x%x-0x%x). Not expanding down.\n",
1219					  frag->ofs, frag->ofs+frag->size);
1220				break;
1221			} else {
1222
1223				/* OK, it's a frag which extends to the beginning of the page. Does it live
1224				   in a block which is still considered clean? If so, don't obsolete it.
1225				   If not, cover it anyway. */
1226
1227				struct jffs2_raw_node_ref *raw = frag->node->raw;
1228				struct jffs2_eraseblock *jeb;
1229
1230				jeb = &c->blocks[raw->flash_offset / c->sector_size];
1231
1232				if (jeb == c->gcblock) {
1233					jffs2_dbg(1, "Expanding down to cover frag (0x%x-0x%x) in gcblock at %08x\n",
1234						  frag->ofs,
1235						  frag->ofs + frag->size,
1236						  ref_offset(raw));
1237					start = frag->ofs;
1238					break;
1239				}
1240				if (!ISDIRTY(jeb->dirty_size + jeb->wasted_size)) {
1241					jffs2_dbg(1, "Not expanding down to cover frag (0x%x-0x%x) in clean block %08x\n",
1242						  frag->ofs,
1243						  frag->ofs + frag->size,
1244						  jeb->offset);
1245					break;
1246				}
1247
1248				jffs2_dbg(1, "Expanding down to cover frag (0x%x-0x%x) in dirty block %08x\n",
1249					  frag->ofs,
1250					  frag->ofs + frag->size,
1251					  jeb->offset);
1252				start = frag->ofs;
1253				break;
1254			}
1255		}
1256
1257		/* ... then up */
1258
1259		/* Find last frag which is actually part of the node we're to GC. */
1260		frag = jffs2_lookup_node_frag(&f->fragtree, end-1);
1261
1262		while((frag = frag_next(frag)) && frag->ofs+frag->size <= max) {
1263
1264			/* If the previous frag doesn't even reach the beginning, there's lots
1265			   of fragmentation. Just merge. */
1266			if (frag->ofs+frag->size < max) {
1267				jffs2_dbg(1, "Expanding up to cover partial frag (0x%x-0x%x)\n",
1268					  frag->ofs, frag->ofs+frag->size);
1269				end = frag->ofs + frag->size;
1270				continue;
1271			}
1272
1273			if (!frag->node || !frag->node->raw) {
1274				jffs2_dbg(1, "Last frag in page is hole (0x%x-0x%x). Not expanding up.\n",
1275					  frag->ofs, frag->ofs+frag->size);
1276				break;
1277			} else {
1278
1279				/* OK, it's a frag which extends to the beginning of the page. Does it live
1280				   in a block which is still considered clean? If so, don't obsolete it.
1281				   If not, cover it anyway. */
1282
1283				struct jffs2_raw_node_ref *raw = frag->node->raw;
1284				struct jffs2_eraseblock *jeb;
1285
1286				jeb = &c->blocks[raw->flash_offset / c->sector_size];
1287
1288				if (jeb == c->gcblock) {
1289					jffs2_dbg(1, "Expanding up to cover frag (0x%x-0x%x) in gcblock at %08x\n",
1290						  frag->ofs,
1291						  frag->ofs + frag->size,
1292						  ref_offset(raw));
1293					end = frag->ofs + frag->size;
1294					break;
1295				}
1296				if (!ISDIRTY(jeb->dirty_size + jeb->wasted_size)) {
1297					jffs2_dbg(1, "Not expanding up to cover frag (0x%x-0x%x) in clean block %08x\n",
1298						  frag->ofs,
1299						  frag->ofs + frag->size,
1300						  jeb->offset);
1301					break;
1302				}
1303
1304				jffs2_dbg(1, "Expanding up to cover frag (0x%x-0x%x) in dirty block %08x\n",
1305					  frag->ofs,
1306					  frag->ofs + frag->size,
1307					  jeb->offset);
1308				end = frag->ofs + frag->size;
1309				break;
1310			}
1311		}
1312		jffs2_dbg(1, "Expanded dnode to write from (0x%x-0x%x) to (0x%x-0x%x)\n",
1313			  orig_start, orig_end, start, end);
1314
1315		D1(BUG_ON(end > frag_last(&f->fragtree)->ofs + frag_last(&f->fragtree)->size));
1316		BUG_ON(end < orig_end);
1317		BUG_ON(start > orig_start);
1318	}
1319
1320	/* The rules state that we must obtain the page lock *before* f->sem, so
1321	 * drop f->sem temporarily. Since we also hold c->alloc_sem, nothing's
1322	 * actually going to *change* so we're safe; we only allow reading.
1323	 *
1324	 * It is important to note that jffs2_write_begin() will ensure that its
1325	 * page is marked Uptodate before allocating space. That means that if we
1326	 * end up here trying to GC the *same* page that jffs2_write_begin() is
1327	 * trying to write out, read_cache_page() will not deadlock. */
1328	mutex_unlock(&f->sem);
1329	page = read_cache_page(inode->i_mapping, start >> PAGE_SHIFT,
1330			       __jffs2_read_folio, NULL);
1331	if (IS_ERR(page)) {
1332		pr_warn("read_cache_page() returned error: %ld\n",
1333			PTR_ERR(page));
1334		mutex_lock(&f->sem);
1335		return PTR_ERR(page);
1336	}
1337
1338	pg_ptr = kmap(page);
1339	mutex_lock(&f->sem);
1340
1341	offset = start;
1342	while(offset < orig_end) {
1343		uint32_t datalen;
1344		uint32_t cdatalen;
1345		uint16_t comprtype = JFFS2_COMPR_NONE;
1346
1347		ret = jffs2_reserve_space_gc(c, sizeof(ri) + JFFS2_MIN_DATA_LEN,
1348					&alloclen, JFFS2_SUMMARY_INODE_SIZE);
1349
1350		if (ret) {
1351			pr_warn("jffs2_reserve_space_gc of %zd bytes for garbage_collect_dnode failed: %d\n",
1352				sizeof(ri) + JFFS2_MIN_DATA_LEN, ret);
1353			break;
1354		}
1355		cdatalen = min_t(uint32_t, alloclen - sizeof(ri), end - offset);
1356		datalen = end - offset;
1357
1358		writebuf = pg_ptr + (offset & (PAGE_SIZE -1));
1359
1360		comprtype = jffs2_compress(c, f, writebuf, &comprbuf, &datalen, &cdatalen);
1361
1362		ri.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
1363		ri.nodetype = cpu_to_je16(JFFS2_NODETYPE_INODE);
1364		ri.totlen = cpu_to_je32(sizeof(ri) + cdatalen);
1365		ri.hdr_crc = cpu_to_je32(crc32(0, &ri, sizeof(struct jffs2_unknown_node)-4));
1366
1367		ri.ino = cpu_to_je32(f->inocache->ino);
1368		ri.version = cpu_to_je32(++f->highest_version);
1369		ri.mode = cpu_to_jemode(JFFS2_F_I_MODE(f));
1370		ri.uid = cpu_to_je16(JFFS2_F_I_UID(f));
1371		ri.gid = cpu_to_je16(JFFS2_F_I_GID(f));
1372		ri.isize = cpu_to_je32(JFFS2_F_I_SIZE(f));
1373		ri.atime = cpu_to_je32(JFFS2_F_I_ATIME(f));
1374		ri.ctime = cpu_to_je32(JFFS2_F_I_CTIME(f));
1375		ri.mtime = cpu_to_je32(JFFS2_F_I_MTIME(f));
1376		ri.offset = cpu_to_je32(offset);
1377		ri.csize = cpu_to_je32(cdatalen);
1378		ri.dsize = cpu_to_je32(datalen);
1379		ri.compr = comprtype & 0xff;
1380		ri.usercompr = (comprtype >> 8) & 0xff;
1381		ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8));
1382		ri.data_crc = cpu_to_je32(crc32(0, comprbuf, cdatalen));
1383
1384		new_fn = jffs2_write_dnode(c, f, &ri, comprbuf, cdatalen, ALLOC_GC);
1385
1386		jffs2_free_comprbuf(comprbuf, writebuf);
1387
1388		if (IS_ERR(new_fn)) {
1389			pr_warn("Error writing new dnode: %ld\n",
1390				PTR_ERR(new_fn));
1391			ret = PTR_ERR(new_fn);
1392			break;
1393		}
1394		ret = jffs2_add_full_dnode_to_inode(c, f, new_fn);
1395		offset += datalen;
1396		if (f->metadata) {
1397			jffs2_mark_node_obsolete(c, f->metadata->raw);
1398			jffs2_free_full_dnode(f->metadata);
1399			f->metadata = NULL;
1400		}
1401	}
1402
1403	kunmap(page);
1404	put_page(page);
1405	return ret;
1406}
1407