Fedora kernel-2.6.17-1.2142_FC4 patched with stable patch-2.6.17.4-vs2.0.2-rc26.diff
[linux-2.6.git] / fs / jffs2 / nodelist.c
index cd6a8bd..1d46677 100644 (file)
@@ -7,7 +7,7 @@
  *
  * For licensing information, see the file 'LICENCE' in this directory.
  *
- * $Id: nodelist.c,v 1.90 2004/12/08 17:59:20 dwmw2 Exp $
+ * $Id: nodelist.c,v 1.115 2005/11/07 11:14:40 gleixner Exp $
  *
  */
 
 void jffs2_add_fd_to_list(struct jffs2_sb_info *c, struct jffs2_full_dirent *new, struct jffs2_full_dirent **list)
 {
        struct jffs2_full_dirent **prev = list;
-       D1(printk(KERN_DEBUG "jffs2_add_fd_to_list( %p, %p (->%p))\n", new, list, *list));
+
+       dbg_dentlist("add dirent \"%s\", ino #%u\n", new->name, new->ino);
 
        while ((*prev) && (*prev)->nhash <= new->nhash) {
                if ((*prev)->nhash == new->nhash && !strcmp((*prev)->name, new->name)) {
                        /* Duplicate. Free one */
                        if (new->version < (*prev)->version) {
-                               D1(printk(KERN_DEBUG "Eep! Marking new dirent node obsolete\n"));
-                               D1(printk(KERN_DEBUG "New dirent is \"%s\"->ino #%u. Old is \"%s\"->ino #%u\n", new->name, new->ino, (*prev)->name, (*prev)->ino));
+                               dbg_dentlist("Eep! Marking new dirent node is obsolete, old is \"%s\", ino #%u\n",
+                                       (*prev)->name, (*prev)->ino);
                                jffs2_mark_node_obsolete(c, new->raw);
                                jffs2_free_full_dirent(new);
                        } else {
-                               D1(printk(KERN_DEBUG "Marking old dirent node (ino #%u) obsolete\n", (*prev)->ino));
+                               dbg_dentlist("marking old dirent \"%s\", ino #%u bsolete\n",
+                                       (*prev)->name, (*prev)->ino);
                                new->next = (*prev)->next;
                                jffs2_mark_node_obsolete(c, ((*prev)->raw));
                                jffs2_free_full_dirent(*prev);
                                *prev = new;
                        }
-                       goto out;
+                       return;
                }
                prev = &((*prev)->next);
        }
        new->next = *prev;
        *prev = new;
+}
+
+void jffs2_truncate_fragtree(struct jffs2_sb_info *c, struct rb_root *list, uint32_t size)
+{
+       struct jffs2_node_frag *frag = jffs2_lookup_node_frag(list, size);
+
+       dbg_fragtree("truncating fragtree to 0x%08x bytes\n", size);
+
+       /* We know frag->ofs <= size. That's what lookup does for us */
+       if (frag && frag->ofs != size) {
+               if (frag->ofs+frag->size > size) {
+                       frag->size = size - frag->ofs;
+               }
+               frag = frag_next(frag);
+       }
+       while (frag && frag->ofs >= size) {
+               struct jffs2_node_frag *next = frag_next(frag);
+
+               frag_erase(frag, list);
+               jffs2_obsolete_node_frag(c, frag);
+               frag = next;
+       }
 
- out:
-       D2(while(*list) {
-               printk(KERN_DEBUG "Dirent \"%s\" (hash 0x%08x, ino #%u\n", (*list)->name, (*list)->nhash, (*list)->ino);
-               list = &(*list)->next;
-       });
+       if (size == 0)
+               return;
+
+       /*
+        * If the last fragment starts at the RAM page boundary, it is
+        * REF_PRISTINE irrespective of its size.
+        */
+       frag = frag_last(list);
+       if (frag->node && (frag->ofs & (PAGE_CACHE_SIZE - 1)) == 0) {
+               dbg_fragtree2("marking the last fragment 0x%08x-0x%08x REF_PRISTINE.\n",
+                       frag->ofs, frag->ofs + frag->size);
+               frag->node->raw->flash_offset = ref_offset(frag->node->raw) | REF_PRISTINE;
+       }
 }
 
-/* Put a new tmp_dnode_info into the list, keeping the list in 
-   order of increasing version
-*/
-static void jffs2_add_tn_to_list(struct jffs2_tmp_dnode_info *tn, struct jffs2_tmp_dnode_info **list)
+void jffs2_obsolete_node_frag(struct jffs2_sb_info *c, struct jffs2_node_frag *this)
 {
-       struct jffs2_tmp_dnode_info **prev = list;
-       
-       while ((*prev) && (*prev)->version < tn->version) {
-               prev = &((*prev)->next);
+       if (this->node) {
+               this->node->frags--;
+               if (!this->node->frags) {
+                       /* The node has no valid frags left. It's totally obsoleted */
+                       dbg_fragtree2("marking old node @0x%08x (0x%04x-0x%04x) obsolete\n",
+                               ref_offset(this->node->raw), this->node->ofs, this->node->ofs+this->node->size);
+                       jffs2_mark_node_obsolete(c, this->node->raw);
+                       jffs2_free_full_dnode(this->node);
+               } else {
+                       dbg_fragtree2("marking old node @0x%08x (0x%04x-0x%04x) REF_NORMAL. frags is %d\n",
+                               ref_offset(this->node->raw), this->node->ofs, this->node->ofs+this->node->size, this->node->frags);
+                       mark_ref_normal(this->node->raw);
+               }
+
        }
-       tn->next = (*prev);
-        *prev = tn;
+       jffs2_free_node_frag(this);
 }
 
-static void jffs2_free_tmp_dnode_info_list(struct jffs2_tmp_dnode_info *tn)
+static void jffs2_fragtree_insert(struct jffs2_node_frag *newfrag, struct jffs2_node_frag *base)
 {
-       struct jffs2_tmp_dnode_info *next;
+       struct rb_node *parent = &base->rb;
+       struct rb_node **link = &parent;
+
+       dbg_fragtree2("insert frag (0x%04x-0x%04x)\n", newfrag->ofs, newfrag->ofs + newfrag->size);
+
+       while (*link) {
+               parent = *link;
+               base = rb_entry(parent, struct jffs2_node_frag, rb);
+
+               if (newfrag->ofs > base->ofs)
+                       link = &base->rb.rb_right;
+               else if (newfrag->ofs < base->ofs)
+                       link = &base->rb.rb_left;
+               else {
+                       JFFS2_ERROR("duplicate frag at %08x (%p,%p)\n", newfrag->ofs, newfrag, base);
+                       BUG();
+               }
+       }
+
+       rb_link_node(&newfrag->rb, &base->rb, link);
+}
 
-       while (tn) {
-               next = tn;
-               tn = tn->next;
-               jffs2_free_full_dnode(next->fn);
-               jffs2_free_tmp_dnode_info(next);
+/*
+ * Allocate and initializes a new fragment.
+ */
+static struct jffs2_node_frag * new_fragment(struct jffs2_full_dnode *fn, uint32_t ofs, uint32_t size)
+{
+       struct jffs2_node_frag *newfrag;
+
+       newfrag = jffs2_alloc_node_frag();
+       if (likely(newfrag)) {
+               newfrag->ofs = ofs;
+               newfrag->size = size;
+               newfrag->node = fn;
+       } else {
+               JFFS2_ERROR("cannot allocate a jffs2_node_frag object\n");
        }
+
+       return newfrag;
 }
 
-static void jffs2_free_full_dirent_list(struct jffs2_full_dirent *fd)
+/*
+ * Called when there is no overlapping fragment exist. Inserts a hole before the new
+ * fragment and inserts the new fragment to the fragtree.
+ */
+static int no_overlapping_node(struct jffs2_sb_info *c, struct rb_root *root,
+                              struct jffs2_node_frag *newfrag,
+                              struct jffs2_node_frag *this, uint32_t lastend)
 {
-       struct jffs2_full_dirent *next;
+       if (lastend < newfrag->node->ofs) {
+               /* put a hole in before the new fragment */
+               struct jffs2_node_frag *holefrag;
+
+               holefrag= new_fragment(NULL, lastend, newfrag->node->ofs - lastend);
+               if (unlikely(!holefrag)) {
+                       jffs2_free_node_frag(newfrag);
+                       return -ENOMEM;
+               }
 
-       while (fd) {
-               next = fd->next;
-               jffs2_free_full_dirent(fd);
-               fd = next;
+               if (this) {
+                       /* By definition, the 'this' node has no right-hand child,
+                          because there are no frags with offset greater than it.
+                          So that's where we want to put the hole */
+                       dbg_fragtree2("add hole frag %#04x-%#04x on the right of the new frag.\n",
+                               holefrag->ofs, holefrag->ofs + holefrag->size);
+                       rb_link_node(&holefrag->rb, &this->rb, &this->rb.rb_right);
+               } else {
+                       dbg_fragtree2("Add hole frag %#04x-%#04x to the root of the tree.\n",
+                               holefrag->ofs, holefrag->ofs + holefrag->size);
+                       rb_link_node(&holefrag->rb, NULL, &root->rb_node);
+               }
+               rb_insert_color(&holefrag->rb, root);
+               this = holefrag;
        }
+
+       if (this) {
+               /* By definition, the 'this' node has no right-hand child,
+                  because there are no frags with offset greater than it.
+                  So that's where we want to put new fragment */
+               dbg_fragtree2("add the new node at the right\n");
+               rb_link_node(&newfrag->rb, &this->rb, &this->rb.rb_right);
+       } else {
+               dbg_fragtree2("insert the new node at the root of the tree\n");
+               rb_link_node(&newfrag->rb, NULL, &root->rb_node);
+       }
+       rb_insert_color(&newfrag->rb, root);
+
+       return 0;
 }
 
-/* Returns first valid node after 'ref'. May return 'ref' */
-static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_ref *ref)
+/* Doesn't set inode->i_size */
+static int jffs2_add_frag_to_fragtree(struct jffs2_sb_info *c, struct rb_root *root, struct jffs2_node_frag *newfrag)
 {
-       while (ref && ref->next_in_ino) {
-               if (!ref_obsolete(ref))
-                       return ref;
-               D1(printk(KERN_DEBUG "node at 0x%08x is obsoleted. Ignoring.\n", ref_offset(ref)));
-               ref = ref->next_in_ino;
+       struct jffs2_node_frag *this;
+       uint32_t lastend;
+
+       /* Skip all the nodes which are completed before this one starts */
+       this = jffs2_lookup_node_frag(root, newfrag->node->ofs);
+
+       if (this) {
+               dbg_fragtree2("lookup gave frag 0x%04x-0x%04x; phys 0x%08x (*%p)\n",
+                         this->ofs, this->ofs+this->size, this->node?(ref_offset(this->node->raw)):0xffffffff, this);
+               lastend = this->ofs + this->size;
+       } else {
+               dbg_fragtree2("lookup gave no frag\n");
+               lastend = 0;
+       }
+
+       /* See if we ran off the end of the fragtree */
+       if (lastend <= newfrag->ofs) {
+               /* We did */
+
+               /* Check if 'this' node was on the same page as the new node.
+                  If so, both 'this' and the new node get marked REF_NORMAL so
+                  the GC can take a look.
+               */
+               if (lastend && (lastend-1) >> PAGE_CACHE_SHIFT == newfrag->ofs >> PAGE_CACHE_SHIFT) {
+                       if (this->node)
+                               mark_ref_normal(this->node->raw);
+                       mark_ref_normal(newfrag->node->raw);
+               }
+
+               return no_overlapping_node(c, root, newfrag, this, lastend);
+       }
+
+       if (this->node)
+               dbg_fragtree2("dealing with frag %u-%u, phys %#08x(%d).\n",
+               this->ofs, this->ofs + this->size,
+               ref_offset(this->node->raw), ref_flags(this->node->raw));
+       else
+               dbg_fragtree2("dealing with hole frag %u-%u.\n",
+               this->ofs, this->ofs + this->size);
+
+       /* OK. 'this' is pointing at the first frag that newfrag->ofs at least partially obsoletes,
+        * - i.e. newfrag->ofs < this->ofs+this->size && newfrag->ofs >= this->ofs
+        */
+       if (newfrag->ofs > this->ofs) {
+               /* This node isn't completely obsoleted. The start of it remains valid */
+
+               /* Mark the new node and the partially covered node REF_NORMAL -- let
+                  the GC take a look at them */
+               mark_ref_normal(newfrag->node->raw);
+               if (this->node)
+                       mark_ref_normal(this->node->raw);
+
+               if (this->ofs + this->size > newfrag->ofs + newfrag->size) {
+                       /* The new node splits 'this' frag into two */
+                       struct jffs2_node_frag *newfrag2;
+
+                       if (this->node)
+                               dbg_fragtree2("split old frag 0x%04x-0x%04x, phys 0x%08x\n",
+                                       this->ofs, this->ofs+this->size, ref_offset(this->node->raw));
+                       else
+                               dbg_fragtree2("split old hole frag 0x%04x-0x%04x\n",
+                                       this->ofs, this->ofs+this->size);
+
+                       /* New second frag pointing to this's node */
+                       newfrag2 = new_fragment(this->node, newfrag->ofs + newfrag->size,
+                                               this->ofs + this->size - newfrag->ofs - newfrag->size);
+                       if (unlikely(!newfrag2))
+                               return -ENOMEM;
+                       if (this->node)
+                               this->node->frags++;
+
+                       /* Adjust size of original 'this' */
+                       this->size = newfrag->ofs - this->ofs;
+
+                       /* Now, we know there's no node with offset
+                          greater than this->ofs but smaller than
+                          newfrag2->ofs or newfrag->ofs, for obvious
+                          reasons. So we can do a tree insert from
+                          'this' to insert newfrag, and a tree insert
+                          from newfrag to insert newfrag2. */
+                       jffs2_fragtree_insert(newfrag, this);
+                       rb_insert_color(&newfrag->rb, root);
+
+                       jffs2_fragtree_insert(newfrag2, newfrag);
+                       rb_insert_color(&newfrag2->rb, root);
+
+                       return 0;
+               }
+               /* New node just reduces 'this' frag in size, doesn't split it */
+               this->size = newfrag->ofs - this->ofs;
+
+               /* Again, we know it lives down here in the tree */
+               jffs2_fragtree_insert(newfrag, this);
+               rb_insert_color(&newfrag->rb, root);
+       } else {
+               /* New frag starts at the same point as 'this' used to. Replace
+                  it in the tree without doing a delete and insertion */
+               dbg_fragtree2("inserting newfrag (*%p),%d-%d in before 'this' (*%p),%d-%d\n",
+                         newfrag, newfrag->ofs, newfrag->ofs+newfrag->size, this, this->ofs, this->ofs+this->size);
+
+               rb_replace_node(&this->rb, &newfrag->rb, root);
+
+               if (newfrag->ofs + newfrag->size >= this->ofs+this->size) {
+                       dbg_fragtree2("obsoleting node frag %p (%x-%x)\n", this, this->ofs, this->ofs+this->size);
+                       jffs2_obsolete_node_frag(c, this);
+               } else {
+                       this->ofs += newfrag->size;
+                       this->size -= newfrag->size;
+
+                       jffs2_fragtree_insert(this, newfrag);
+                       rb_insert_color(&this->rb, root);
+                       return 0;
+               }
        }
-       return NULL;
+       /* OK, now we have newfrag added in the correct place in the tree, but
+          frag_next(newfrag) may be a fragment which is overlapped by it
+       */
+       while ((this = frag_next(newfrag)) && newfrag->ofs + newfrag->size >= this->ofs + this->size) {
+               /* 'this' frag is obsoleted completely. */
+               dbg_fragtree2("obsoleting node frag %p (%x-%x) and removing from tree\n",
+                       this, this->ofs, this->ofs+this->size);
+               rb_erase(&this->rb, root);
+               jffs2_obsolete_node_frag(c, this);
+       }
+       /* Now we're pointing at the first frag which isn't totally obsoleted by
+          the new frag */
+
+       if (!this || newfrag->ofs + newfrag->size == this->ofs)
+               return 0;
+
+       /* Still some overlap but we don't need to move it in the tree */
+       this->size = (this->ofs + this->size) - (newfrag->ofs + newfrag->size);
+       this->ofs = newfrag->ofs + newfrag->size;
+
+       /* And mark them REF_NORMAL so the GC takes a look at them */
+       if (this->node)
+               mark_ref_normal(this->node->raw);
+       mark_ref_normal(newfrag->node->raw);
+
+       return 0;
 }
 
-/* Get tmp_dnode_info and full_dirent for all non-obsolete nodes associated
-   with this ino, returning the former in order of version */
+/*
+ * Given an inode, probably with existing tree of fragments, add the new node
+ * to the fragment tree.
+ */
+int jffs2_add_full_dnode_to_inode(struct jffs2_sb_info *c, struct jffs2_inode_info *f, struct jffs2_full_dnode *fn)
+{
+       int ret;
+       struct jffs2_node_frag *newfrag;
+
+       if (unlikely(!fn->size))
+               return 0;
+
+       newfrag = new_fragment(fn, fn->ofs, fn->size);
+       if (unlikely(!newfrag))
+               return -ENOMEM;
+       newfrag->node->frags = 1;
+
+       dbg_fragtree("adding node %#04x-%#04x @0x%08x on flash, newfrag *%p\n",
+                 fn->ofs, fn->ofs+fn->size, ref_offset(fn->raw), newfrag);
+
+       ret = jffs2_add_frag_to_fragtree(c, &f->fragtree, newfrag);
+       if (unlikely(ret))
+               return ret;
+
+       /* If we now share a page with other nodes, mark either previous
+          or next node REF_NORMAL, as appropriate.  */
+       if (newfrag->ofs & (PAGE_CACHE_SIZE-1)) {
+               struct jffs2_node_frag *prev = frag_prev(newfrag);
+
+               mark_ref_normal(fn->raw);
+               /* If we don't start at zero there's _always_ a previous */
+               if (prev->node)
+                       mark_ref_normal(prev->node->raw);
+       }
+
+       if ((newfrag->ofs+newfrag->size) & (PAGE_CACHE_SIZE-1)) {
+               struct jffs2_node_frag *next = frag_next(newfrag);
+
+               if (next) {
+                       mark_ref_normal(fn->raw);
+                       if (next->node)
+                               mark_ref_normal(next->node->raw);
+               }
+       }
+       jffs2_dbg_fragtree_paranoia_check_nolock(f);
+
+       return 0;
+}
 
-int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
-                         struct jffs2_tmp_dnode_info **tnp, struct jffs2_full_dirent **fdp,
-                         uint32_t *highest_version, uint32_t *latest_mctime,
-                         uint32_t *mctime_ver)
+/*
+ * Check the data CRC of the node.
+ *
+ * Returns: 0 if the data CRC is correct;
+ *         1 - if incorrect;
+ *         error code if an error occured.
+ */
+static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info *tn)
 {
-       struct jffs2_raw_node_ref *ref, *valid_ref;
-       struct jffs2_tmp_dnode_info *tn, *ret_tn = NULL;
-       struct jffs2_full_dirent *fd, *ret_fd = NULL;
-       union jffs2_node_union node;
+       struct jffs2_raw_node_ref *ref = tn->fn->raw;
+       int err = 0, pointed = 0;
+       struct jffs2_eraseblock *jeb;
+       unsigned char *buffer;
+       uint32_t crc, ofs, len;
        size_t retlen;
-       int err;
 
-       *mctime_ver = 0;
-       
-       D1(printk(KERN_DEBUG "jffs2_get_inode_nodes(): ino #%u\n", f->inocache->ino));
+       BUG_ON(tn->csize == 0);
 
-       spin_lock(&c->erase_completion_lock);
+       if (!jffs2_is_writebuffered(c))
+               goto adj_acc;
 
-       valid_ref = jffs2_first_valid_node(f->inocache->nodes);
+       /* Calculate how many bytes were already checked */
+       ofs = ref_offset(ref) + sizeof(struct jffs2_raw_inode);
+       len = ofs % c->wbuf_pagesize;
+       if (likely(len))
+               len = c->wbuf_pagesize - len;
 
-       if (!valid_ref)
-               printk(KERN_WARNING "Eep. No valid nodes for ino #%u\n", f->inocache->ino);
+       if (len >= tn->csize) {
+               dbg_readinode("no need to check node at %#08x, data length %u, data starts at %#08x - it has already been checked.\n",
+                       ref_offset(ref), tn->csize, ofs);
+               goto adj_acc;
+       }
 
-       while (valid_ref) {
-               /* We can hold a pointer to a non-obsolete node without the spinlock,
-                  but _obsolete_ nodes may disappear at any time, if the block
-                  they're in gets erased. So if we mark 'ref' obsolete while we're
-                  not holding the lock, it can go away immediately. For that reason,
-                  we find the next valid node first, before processing 'ref'.
-               */
-               ref = valid_ref;
-               valid_ref = jffs2_first_valid_node(ref->next_in_ino);
-               spin_unlock(&c->erase_completion_lock);
+       ofs += len;
+       len = tn->csize - len;
 
-               cond_resched();
+       dbg_readinode("check node at %#08x, data length %u, partial CRC %#08x, correct CRC %#08x, data starts at %#08x, start checking from %#08x - %u bytes.\n",
+               ref_offset(ref), tn->csize, tn->partial_crc, tn->data_crc, ofs - len, ofs, len);
+
+#ifndef __ECOS
+       /* TODO: instead, incapsulate point() stuff to jffs2_flash_read(),
+        * adding and jffs2_flash_read_end() interface. */
+       if (c->mtd->point) {
+               err = c->mtd->point(c->mtd, ofs, len, &retlen, &buffer);
+               if (!err && retlen < tn->csize) {
+                       JFFS2_WARNING("MTD point returned len too short: %zu "
+                                       "instead of %u.\n", retlen, tn->csize);
+                       c->mtd->unpoint(c->mtd, buffer, ofs, len);
+               } else if (err)
+                       JFFS2_WARNING("MTD point failed: error code %d.\n", err);
+               else
+                       pointed = 1; /* succefully pointed to device */
+       }
+#endif
 
-               /* FIXME: point() */
-               err = jffs2_flash_read(c, (ref_offset(ref)), 
-                                      min_t(uint32_t, ref_totlen(c, NULL, ref), sizeof(node)),
-                                      &retlen, (void *)&node);
+       if (!pointed) {
+               buffer = kmalloc(len, GFP_KERNEL);
+               if (unlikely(!buffer))
+                       return -ENOMEM;
+
+               /* TODO: this is very frequent pattern, make it a separate
+                * routine */
+               err = jffs2_flash_read(c, ofs, len, &retlen, buffer);
                if (err) {
-                       printk(KERN_WARNING "error %d reading node at 0x%08x in get_inode_nodes()\n", err, ref_offset(ref));
+                       JFFS2_ERROR("can not read %d bytes from 0x%08x, error code: %d.\n", len, ofs, err);
                        goto free_out;
                }
-                       
 
-                       /* Check we've managed to read at least the common node header */
-               if (retlen < min_t(uint32_t, ref_totlen(c, NULL, ref), sizeof(node.u))) {
-                       printk(KERN_WARNING "short read in get_inode_nodes()\n");
+               if (retlen != len) {
+                       JFFS2_ERROR("short read at %#08x: %zd instead of %d.\n",
+                                       ofs, retlen, len);
                        err = -EIO;
                        goto free_out;
                }
-                       
-               switch (je16_to_cpu(node.u.nodetype)) {
-               case JFFS2_NODETYPE_DIRENT:
-                       D1(printk(KERN_DEBUG "Node at %08x (%d) is a dirent node\n", ref_offset(ref), ref_flags(ref)));
-                       if (ref_flags(ref) == REF_UNCHECKED) {
-                               printk(KERN_WARNING "BUG: Dirent node at 0x%08x never got checked? How?\n", ref_offset(ref));
-                               BUG();
-                       }
-                       if (retlen < sizeof(node.d)) {
-                               printk(KERN_WARNING "short read in get_inode_nodes()\n");
-                               err = -EIO;
-                               goto free_out;
-                       }
-                       /* sanity check */
-                       if (PAD((node.d.nsize + sizeof (node.d))) != PAD(je32_to_cpu (node.d.totlen))) {
-                               printk(KERN_NOTICE "jffs2_get_inode_nodes(): Illegal nsize in node at 0x%08x: nsize 0x%02x, totlen %04x\n",
-                                      ref_offset(ref), node.d.nsize, je32_to_cpu(node.d.totlen));
-                               jffs2_mark_node_obsolete(c, ref);
-                               spin_lock(&c->erase_completion_lock);
-                               continue;
-                       }
-                       if (je32_to_cpu(node.d.version) > *highest_version)
-                               *highest_version = je32_to_cpu(node.d.version);
-                       if (ref_obsolete(ref)) {
-                               /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
-                               printk(KERN_ERR "Dirent node at 0x%08x became obsolete while we weren't looking\n",
-                                      ref_offset(ref));
-                               BUG();
-                       }
-                       
-                       fd = jffs2_alloc_full_dirent(node.d.nsize+1);
-                       if (!fd) {
-                               err = -ENOMEM;
-                               goto free_out;
-                       }
-                       fd->raw = ref;
-                       fd->version = je32_to_cpu(node.d.version);
-                       fd->ino = je32_to_cpu(node.d.ino);
-                       fd->type = node.d.type;
-
-                       /* Pick out the mctime of the latest dirent */
-                       if(fd->version > *mctime_ver) {
-                               *mctime_ver = fd->version;
-                               *latest_mctime = je32_to_cpu(node.d.mctime);
-                       }
+       }
 
-                       /* memcpy as much of the name as possible from the raw
-                          dirent we've already read from the flash
-                       */
-                       if (retlen > sizeof(struct jffs2_raw_dirent))
-                               memcpy(&fd->name[0], &node.d.name[0], min_t(uint32_t, node.d.nsize, (retlen-sizeof(struct jffs2_raw_dirent))));
-                               
-                       /* Do we need to copy any more of the name directly
-                          from the flash?
-                       */
-                       if (node.d.nsize + sizeof(struct jffs2_raw_dirent) > retlen) {
-                               /* FIXME: point() */
-                               int already = retlen - sizeof(struct jffs2_raw_dirent);
-                                       
-                               err = jffs2_flash_read(c, (ref_offset(ref)) + retlen, 
-                                                  node.d.nsize - already, &retlen, &fd->name[already]);
-                               if (!err && retlen != node.d.nsize - already)
-                                       err = -EIO;
-                                       
-                               if (err) {
-                                       printk(KERN_WARNING "Read remainder of name in jffs2_get_inode_nodes(): error %d\n", err);
-                                       jffs2_free_full_dirent(fd);
-                                       goto free_out;
-                               }
-                       }
-                       fd->nhash = full_name_hash(fd->name, node.d.nsize);
-                       fd->next = NULL;
-                       fd->name[node.d.nsize] = '\0';
-                               /* Wheee. We now have a complete jffs2_full_dirent structure, with
-                                  the name in it and everything. Link it into the list 
-                               */
-                       D1(printk(KERN_DEBUG "Adding fd \"%s\", ino #%u\n", fd->name, fd->ino));
-                       jffs2_add_fd_to_list(c, fd, &ret_fd);
-                       break;
-
-               case JFFS2_NODETYPE_INODE:
-                       D1(printk(KERN_DEBUG "Node at %08x (%d) is a data node\n", ref_offset(ref), ref_flags(ref)));
-                       if (retlen < sizeof(node.i)) {
-                               printk(KERN_WARNING "read too short for dnode\n");
-                               err = -EIO;
-                               goto free_out;
-                       }
-                       if (je32_to_cpu(node.i.version) > *highest_version)
-                               *highest_version = je32_to_cpu(node.i.version);
-                       D1(printk(KERN_DEBUG "version %d, highest_version now %d\n", je32_to_cpu(node.i.version), *highest_version));
-
-                       if (ref_obsolete(ref)) {
-                               /* Obsoleted. This cannot happen, surely? dwmw2 20020308 */
-                               printk(KERN_ERR "Inode node at 0x%08x became obsolete while we weren't looking\n",
-                                      ref_offset(ref));
-                               BUG();
-                       }
+       /* Continue calculating CRC */
+       crc = crc32(tn->partial_crc, buffer, len);
+       if(!pointed)
+               kfree(buffer);
+#ifndef __ECOS
+       else
+               c->mtd->unpoint(c->mtd, buffer, ofs, len);
+#endif
 
-                       /* If we've never checked the CRCs on this node, check them now. */
-                       if (ref_flags(ref) == REF_UNCHECKED) {
-                               uint32_t crc, len;
-                               struct jffs2_eraseblock *jeb;
-
-                               crc = crc32(0, &node, sizeof(node.i)-8);
-                               if (crc != je32_to_cpu(node.i.node_crc)) {
-                                       printk(KERN_NOTICE "jffs2_get_inode_nodes(): CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
-                                              ref_offset(ref), je32_to_cpu(node.i.node_crc), crc);
-                                       jffs2_mark_node_obsolete(c, ref);
-                                       spin_lock(&c->erase_completion_lock);
-                                       continue;
-                               }
-                               
-                               /* sanity checks */
-                               if ( je32_to_cpu(node.i.offset) > je32_to_cpu(node.i.isize) ||
-                                    PAD(je32_to_cpu(node.i.csize) + sizeof (node.i)) != PAD(je32_to_cpu(node.i.totlen))) {
-                                       printk(KERN_NOTICE "jffs2_get_inode_nodes(): Inode corrupted at 0x%08x, totlen %d, #ino  %d, version %d, isize %d, csize %d, dsize %d \n",
-                                               ref_offset(ref),  je32_to_cpu(node.i.totlen),  je32_to_cpu(node.i.ino),
-                                               je32_to_cpu(node.i.version),  je32_to_cpu(node.i.isize), 
-                                               je32_to_cpu(node.i.csize), je32_to_cpu(node.i.dsize));
-                                       jffs2_mark_node_obsolete(c, ref);
-                                       spin_lock(&c->erase_completion_lock);
-                                       continue;
-                               }
+       if (crc != tn->data_crc) {
+               JFFS2_NOTICE("wrong data CRC in data node at 0x%08x: read %#08x, calculated %#08x.\n",
+                       ofs, tn->data_crc, crc);
+               return 1;
+       }
 
-                               if (node.i.compr != JFFS2_COMPR_ZERO && je32_to_cpu(node.i.csize)) {
-                                       unsigned char *buf=NULL;
-                                       uint32_t pointed = 0;
-#ifndef __ECOS
-                                       if (c->mtd->point) {
-                                               err = c->mtd->point (c->mtd, ref_offset(ref) + sizeof(node.i), je32_to_cpu(node.i.csize),
-                                                                    &retlen, &buf);
-                                               if (!err && retlen < je32_to_cpu(node.i.csize)) {
-                                                       D1(printk(KERN_DEBUG "MTD point returned len too short: 0x%zx\n", retlen));
-                                                       c->mtd->unpoint(c->mtd, buf, ref_offset(ref) + sizeof(node.i), je32_to_cpu(node.i.csize));
-                                               } else if (err){
-                                                       D1(printk(KERN_DEBUG "MTD point failed %d\n", err));
-                                               } else
-                                                       pointed = 1; /* succefully pointed to device */
-                                       }
-#endif                                 
-                                       if(!pointed){
-                                               buf = kmalloc(je32_to_cpu(node.i.csize), GFP_KERNEL);
-                                               if (!buf)
-                                                       return -ENOMEM;
-                                               
-                                               err = jffs2_flash_read(c, ref_offset(ref) + sizeof(node.i), je32_to_cpu(node.i.csize),
-                                                                      &retlen, buf);
-                                               if (!err && retlen != je32_to_cpu(node.i.csize))
-                                                       err = -EIO;
-                                               if (err) {
-                                                       kfree(buf);
-                                                       return err;
-                                               }
-                                       }
-                                       crc = crc32(0, buf, je32_to_cpu(node.i.csize));
-                                       if(!pointed)
-                                               kfree(buf);
+adj_acc:
+       jeb = &c->blocks[ref->flash_offset / c->sector_size];
+       len = ref_totlen(c, jeb, ref);
+
+       /*
+        * Mark the node as having been checked and fix the
+        * accounting accordingly.
+        */
+       spin_lock(&c->erase_completion_lock);
+       jeb->used_size += len;
+       jeb->unchecked_size -= len;
+       c->used_size += len;
+       c->unchecked_size -= len;
+       spin_unlock(&c->erase_completion_lock);
+
+       return 0;
+
+free_out:
+       if(!pointed)
+               kfree(buffer);
 #ifndef __ECOS
-                                       else
-                                               c->mtd->unpoint(c->mtd, buf, ref_offset(ref) + sizeof(node.i), je32_to_cpu(node.i.csize));
+       else
+               c->mtd->unpoint(c->mtd, buffer, ofs, len);
 #endif
+       return err;
+}
 
-                                       if (crc != je32_to_cpu(node.i.data_crc)) {
-                                               printk(KERN_NOTICE "jffs2_get_inode_nodes(): Data CRC failed on node at 0x%08x: Read 0x%08x, calculated 0x%08x\n",
-                                                      ref_offset(ref), je32_to_cpu(node.i.data_crc), crc);
-                                               jffs2_mark_node_obsolete(c, ref);
-                                               spin_lock(&c->erase_completion_lock);
-                                               continue;
-                                       }
-                                       
-                               }
+/*
+ * Helper function for jffs2_add_older_frag_to_fragtree().
+ *
+ * Checks the node if we are in the checking stage.
+ */
+static int check_node(struct jffs2_sb_info *c, struct jffs2_inode_info *f, struct jffs2_tmp_dnode_info *tn)
+{
+       int ret;
 
-                               /* Mark the node as having been checked and fix the accounting accordingly */
-                               spin_lock(&c->erase_completion_lock);
-                               jeb = &c->blocks[ref->flash_offset / c->sector_size];
-                               len = ref_totlen(c, jeb, ref);
-
-                               jeb->used_size += len;
-                               jeb->unchecked_size -= len;
-                               c->used_size += len;
-                               c->unchecked_size -= len;
-
-                               /* If node covers at least a whole page, or if it starts at the 
-                                  beginning of a page and runs to the end of the file, or if 
-                                  it's a hole node, mark it REF_PRISTINE, else REF_NORMAL. 
-
-                                  If it's actually overlapped, it'll get made NORMAL (or OBSOLETE) 
-                                  when the overlapping node(s) get added to the tree anyway. 
-                               */
-                               if ((je32_to_cpu(node.i.dsize) >= PAGE_CACHE_SIZE) ||
-                                   ( ((je32_to_cpu(node.i.offset)&(PAGE_CACHE_SIZE-1))==0) &&
-                                     (je32_to_cpu(node.i.dsize)+je32_to_cpu(node.i.offset) ==  je32_to_cpu(node.i.isize)))) {
-                                       D1(printk(KERN_DEBUG "Marking node at 0x%08x REF_PRISTINE\n", ref_offset(ref)));
-                                       ref->flash_offset = ref_offset(ref) | REF_PRISTINE;
-                               } else {
-                                       D1(printk(KERN_DEBUG "Marking node at 0x%08x REF_NORMAL\n", ref_offset(ref)));
-                                       ref->flash_offset = ref_offset(ref) | REF_NORMAL;
-                               }
-                               spin_unlock(&c->erase_completion_lock);
+       BUG_ON(ref_obsolete(tn->fn->raw));
+
+       /* We only check the data CRC of unchecked nodes */
+       if (ref_flags(tn->fn->raw) != REF_UNCHECKED)
+               return 0;
+
+       dbg_fragtree2("check node %#04x-%#04x, phys offs %#08x.\n",
+               tn->fn->ofs, tn->fn->ofs + tn->fn->size, ref_offset(tn->fn->raw));
+
+       ret = check_node_data(c, tn);
+       if (unlikely(ret < 0)) {
+               JFFS2_ERROR("check_node_data() returned error: %d.\n",
+                       ret);
+       } else if (unlikely(ret > 0)) {
+               dbg_fragtree2("CRC error, mark it obsolete.\n");
+               jffs2_mark_node_obsolete(c, tn->fn->raw);
+       }
+
+       return ret;
+}
+
+/*
+ * Helper function for jffs2_add_older_frag_to_fragtree().
+ *
+ * Called when the new fragment that is being inserted
+ * splits a hole fragment.
+ */
+static int split_hole(struct jffs2_sb_info *c, struct rb_root *root,
+                     struct jffs2_node_frag *newfrag, struct jffs2_node_frag *hole)
+{
+       dbg_fragtree2("fragment %#04x-%#04x splits the hole %#04x-%#04x\n",
+               newfrag->ofs, newfrag->ofs + newfrag->size, hole->ofs, hole->ofs + hole->size);
+
+       if (hole->ofs == newfrag->ofs) {
+               /*
+                * Well, the new fragment actually starts at the same offset as
+                * the hole.
+                */
+               if (hole->ofs + hole->size > newfrag->ofs + newfrag->size) {
+                       /*
+                        * We replace the overlapped left part of the hole by
+                        * the new node.
+                        */
+
+                       dbg_fragtree2("insert fragment %#04x-%#04x and cut the left part of the hole\n",
+                               newfrag->ofs, newfrag->ofs + newfrag->size);
+                       rb_replace_node(&hole->rb, &newfrag->rb, root);
+
+                       hole->ofs += newfrag->size;
+                       hole->size -= newfrag->size;
+
+                       /*
+                        * We know that 'hole' should be the right hand
+                        * fragment.
+                        */
+                       jffs2_fragtree_insert(hole, newfrag);
+                       rb_insert_color(&hole->rb, root);
+               } else {
+                       /*
+                        * Ah, the new fragment is of the same size as the hole.
+                        * Relace the hole by it.
+                        */
+                       dbg_fragtree2("insert fragment %#04x-%#04x and overwrite hole\n",
+                               newfrag->ofs, newfrag->ofs + newfrag->size);
+                       rb_replace_node(&hole->rb, &newfrag->rb, root);
+                       jffs2_free_node_frag(hole);
+               }
+       } else {
+               /* The new fragment lefts some hole space at the left */
+
+               struct jffs2_node_frag * newfrag2 = NULL;
+
+               if (hole->ofs + hole->size > newfrag->ofs + newfrag->size) {
+                       /* The new frag also lefts some space at the right */
+                       newfrag2 = new_fragment(NULL, newfrag->ofs +
+                               newfrag->size, hole->ofs + hole->size
+                               - newfrag->ofs - newfrag->size);
+                       if (unlikely(!newfrag2)) {
+                               jffs2_free_node_frag(newfrag);
+                               return -ENOMEM;
                        }
+               }
 
-                       tn = jffs2_alloc_tmp_dnode_info();
-                       if (!tn) {
-                               D1(printk(KERN_DEBUG "alloc tn failed\n"));
-                               err = -ENOMEM;
-                               goto free_out;
+               hole->size = newfrag->ofs - hole->ofs;
+               dbg_fragtree2("left the hole %#04x-%#04x at the left and inserd fragment %#04x-%#04x\n",
+                       hole->ofs, hole->ofs + hole->size, newfrag->ofs, newfrag->ofs + newfrag->size);
+
+               jffs2_fragtree_insert(newfrag, hole);
+               rb_insert_color(&newfrag->rb, root);
+
+               if (newfrag2) {
+                       dbg_fragtree2("left the hole %#04x-%#04x at the right\n",
+                               newfrag2->ofs, newfrag2->ofs + newfrag2->size);
+                       jffs2_fragtree_insert(newfrag2, newfrag);
+                       rb_insert_color(&newfrag2->rb, root);
+               }
+       }
+
+       return 0;
+}
+
+/*
+ * This function is used when we build inode. It expects the nodes are passed
+ * in the decreasing version order. The whole point of this is to improve the
+ * inodes checking on NAND: we check the nodes' data CRC only when they are not
+ * obsoleted. Previously, add_frag_to_fragtree() function was used and
+ * nodes were passed to it in the increasing version ordes and CRCs of all
+ * nodes were checked.
+ *
+ * Note: tn->fn->size shouldn't be zero.
+ *
+ * Returns 0 if the node was inserted
+ *         1 if it wasn't inserted (since it is obsolete)
+ *         < 0 an if error occured
+ */
+int jffs2_add_older_frag_to_fragtree(struct jffs2_sb_info *c, struct jffs2_inode_info *f,
+                                    struct jffs2_tmp_dnode_info *tn)
+{
+       struct jffs2_node_frag *this, *newfrag;
+       uint32_t lastend;
+       struct jffs2_full_dnode *fn = tn->fn;
+       struct rb_root *root = &f->fragtree;
+       uint32_t fn_size = fn->size, fn_ofs = fn->ofs;
+       int err, checked = 0;
+       int ref_flag;
+
+       dbg_fragtree("insert fragment %#04x-%#04x, ver %u\n", fn_ofs, fn_ofs + fn_size, tn->version);
+
+       /* Skip all the nodes which are completed before this one starts */
+       this = jffs2_lookup_node_frag(root, fn_ofs);
+       if (this)
+               dbg_fragtree2("'this' found %#04x-%#04x (%s)\n", this->ofs, this->ofs + this->size, this->node ? "data" : "hole");
+
+       if (this)
+               lastend = this->ofs + this->size;
+       else
+               lastend = 0;
+
+       /* Detect the preliminary type of node */
+       if (fn->size >= PAGE_CACHE_SIZE)
+               ref_flag = REF_PRISTINE;
+       else
+               ref_flag = REF_NORMAL;
+
+       /* See if we ran off the end of the root */
+       if (lastend <= fn_ofs) {
+               /* We did */
+
+               /*
+                * We are going to insert the new node into the
+                * fragment tree, so check it.
+                */
+               err = check_node(c, f, tn);
+               if (err != 0)
+                       return err;
+
+               fn->frags = 1;
+
+               newfrag = new_fragment(fn, fn_ofs, fn_size);
+               if (unlikely(!newfrag))
+                       return -ENOMEM;
+
+               err = no_overlapping_node(c, root, newfrag, this, lastend);
+               if (unlikely(err != 0)) {
+                       jffs2_free_node_frag(newfrag);
+                       return err;
+               }
+
+               goto out_ok;
+       }
+
+       fn->frags = 0;
+
+       while (1) {
+               /*
+                * Here we have:
+                * fn_ofs < this->ofs + this->size && fn_ofs >= this->ofs.
+                *
+                * Remember, 'this' has higher version, any non-hole node
+                * which is already in the fragtree is newer then the newly
+                * inserted.
+                */
+               if (!this->node) {
+                       /*
+                        * 'this' is the hole fragment, so at least the
+                        * beginning of the new fragment is valid.
+                        */
+
+                       /*
+                        * We are going to insert the new node into the
+                        * fragment tree, so check it.
+                        */
+                       if (!checked) {
+                               err = check_node(c, f, tn);
+                               if (unlikely(err != 0))
+                                       return err;
+                               checked = 1;
                        }
 
-                       tn->fn = jffs2_alloc_full_dnode();
-                       if (!tn->fn) {
-                               D1(printk(KERN_DEBUG "alloc fn failed\n"));
-                               err = -ENOMEM;
-                               jffs2_free_tmp_dnode_info(tn);
-                               goto free_out;
+                       if (this->ofs + this->size >= fn_ofs + fn_size) {
+                               /* We split the hole on two parts */
+
+                               fn->frags += 1;
+                               newfrag = new_fragment(fn, fn_ofs, fn_size);
+                               if (unlikely(!newfrag))
+                                       return -ENOMEM;
+
+                               err = split_hole(c, root, newfrag, this);
+                               if (unlikely(err))
+                                       return err;
+                               goto out_ok;
                        }
-                       tn->version = je32_to_cpu(node.i.version);
-                       tn->fn->ofs = je32_to_cpu(node.i.offset);
-                       /* There was a bug where we wrote hole nodes out with
-                          csize/dsize swapped. Deal with it */
-                       if (node.i.compr == JFFS2_COMPR_ZERO && !je32_to_cpu(node.i.dsize) && je32_to_cpu(node.i.csize))
-                               tn->fn->size = je32_to_cpu(node.i.csize);
-                       else // normal case...
-                               tn->fn->size = je32_to_cpu(node.i.dsize);
-                       tn->fn->raw = ref;
-                       D1(printk(KERN_DEBUG "dnode @%08x: ver %u, offset %04x, dsize %04x\n",
-                                 ref_offset(ref), je32_to_cpu(node.i.version),
-                                 je32_to_cpu(node.i.offset), je32_to_cpu(node.i.dsize)));
-                       jffs2_add_tn_to_list(tn, &ret_tn);
-                       break;
-
-               default:
-                       if (ref_flags(ref) == REF_UNCHECKED) {
-                               struct jffs2_eraseblock *jeb;
-                               uint32_t len;
-
-                               printk(KERN_ERR "Eep. Unknown node type %04x at %08x was marked REF_UNCHECKED\n",
-                                      je16_to_cpu(node.u.nodetype), ref_offset(ref));
-
-                               /* Mark the node as having been checked and fix the accounting accordingly */
-                               spin_lock(&c->erase_completion_lock);
-                               jeb = &c->blocks[ref->flash_offset / c->sector_size];
-                               len = ref_totlen(c, jeb, ref);
-
-                               jeb->used_size += len;
-                               jeb->unchecked_size -= len;
-                               c->used_size += len;
-                               c->unchecked_size -= len;
-
-                               mark_ref_normal(ref);
-                               spin_unlock(&c->erase_completion_lock);
+
+                       /*
+                        * The beginning of the new fragment is valid since it
+                        * overlaps the hole node.
+                        */
+
+                       ref_flag = REF_NORMAL;
+
+                       fn->frags += 1;
+                       newfrag = new_fragment(fn, fn_ofs,
+                                       this->ofs + this->size - fn_ofs);
+                       if (unlikely(!newfrag))
+                               return -ENOMEM;
+
+                       if (fn_ofs == this->ofs) {
+                               /*
+                                * The new node starts at the same offset as
+                                * the hole and supersieds the hole.
+                                */
+                               dbg_fragtree2("add the new fragment instead of hole %#04x-%#04x, refcnt %d\n",
+                                       fn_ofs, fn_ofs + this->ofs + this->size - fn_ofs, fn->frags);
+
+                               rb_replace_node(&this->rb, &newfrag->rb, root);
+                               jffs2_free_node_frag(this);
+                       } else {
+                               /*
+                                * The hole becomes shorter as its right part
+                                * is supersieded by the new fragment.
+                                */
+                               dbg_fragtree2("reduce size of hole %#04x-%#04x to %#04x-%#04x\n",
+                                       this->ofs, this->ofs + this->size, this->ofs, this->ofs + this->size - newfrag->size);
+
+                               dbg_fragtree2("add new fragment %#04x-%#04x, refcnt %d\n", fn_ofs,
+                                       fn_ofs + this->ofs + this->size - fn_ofs, fn->frags);
+
+                               this->size -= newfrag->size;
+                               jffs2_fragtree_insert(newfrag, this);
+                               rb_insert_color(&newfrag->rb, root);
                        }
-                       node.u.nodetype = cpu_to_je16(JFFS2_NODE_ACCURATE | je16_to_cpu(node.u.nodetype));
-                       if (crc32(0, &node, sizeof(struct jffs2_unknown_node)-4) != je32_to_cpu(node.u.hdr_crc)) {
-                               /* Hmmm. This should have been caught at scan time. */
-                               printk(KERN_ERR "Node header CRC failed at %08x. But it must have been OK earlier.\n",
-                                      ref_offset(ref));
-                               printk(KERN_ERR "Node was: { %04x, %04x, %08x, %08x }\n", 
-                                      je16_to_cpu(node.u.magic), je16_to_cpu(node.u.nodetype), je32_to_cpu(node.u.totlen),
-                                      je32_to_cpu(node.u.hdr_crc));
-                               jffs2_mark_node_obsolete(c, ref);
-                       } else switch(je16_to_cpu(node.u.nodetype) & JFFS2_COMPAT_MASK) {
-                       case JFFS2_FEATURE_INCOMPAT:
-                               printk(KERN_NOTICE "Unknown INCOMPAT nodetype %04X at %08x\n", je16_to_cpu(node.u.nodetype), ref_offset(ref));
-                               /* EEP */
-                               BUG();
-                               break;
-                       case JFFS2_FEATURE_ROCOMPAT:
-                               printk(KERN_NOTICE "Unknown ROCOMPAT nodetype %04X at %08x\n", je16_to_cpu(node.u.nodetype), ref_offset(ref));
-                               if (!(c->flags & JFFS2_SB_FLAG_RO))
-                                       BUG();
-                               break;
-                       case JFFS2_FEATURE_RWCOMPAT_COPY:
-                               printk(KERN_NOTICE "Unknown RWCOMPAT_COPY nodetype %04X at %08x\n", je16_to_cpu(node.u.nodetype), ref_offset(ref));
-                               break;
-                       case JFFS2_FEATURE_RWCOMPAT_DELETE:
-                               printk(KERN_NOTICE "Unknown RWCOMPAT_DELETE nodetype %04X at %08x\n", je16_to_cpu(node.u.nodetype), ref_offset(ref));
-                               jffs2_mark_node_obsolete(c, ref);
-                               break;
+
+                       fn_ofs += newfrag->size;
+                       fn_size -= newfrag->size;
+                       this = rb_entry(rb_next(&newfrag->rb),
+                                       struct jffs2_node_frag, rb);
+
+                       dbg_fragtree2("switch to the next 'this' fragment: %#04x-%#04x %s\n",
+                               this->ofs, this->ofs + this->size, this->node ? "(data)" : "(hole)");
+               }
+
+               /*
+                * 'This' node is not the hole so it obsoletes the new fragment
+                * either fully or partially.
+                */
+               if (this->ofs + this->size >= fn_ofs + fn_size) {
+                       /* The new node is obsolete, drop it */
+                       if (fn->frags == 0) {
+                               dbg_fragtree2("%#04x-%#04x is obsolete, mark it obsolete\n", fn_ofs, fn_ofs + fn_size);
+                               ref_flag = REF_OBSOLETE;
                        }
+                       goto out_ok;
+               } else {
+                       struct jffs2_node_frag *new_this;
+
+                       /* 'This' node obsoletes the beginning of the new node */
+                       dbg_fragtree2("the beginning %#04x-%#04x is obsolete\n", fn_ofs, this->ofs + this->size);
+
+                       ref_flag = REF_NORMAL;
+
+                       fn_size -= this->ofs + this->size - fn_ofs;
+                       fn_ofs = this->ofs + this->size;
+                       dbg_fragtree2("now considering %#04x-%#04x\n", fn_ofs, fn_ofs + fn_size);
+
+                       new_this = rb_entry(rb_next(&this->rb), struct jffs2_node_frag, rb);
+                       if (!new_this) {
+                               /*
+                                * There is no next fragment. Add the rest of
+                                * the new node as the right-hand child.
+                                */
+                               if (!checked) {
+                                       err = check_node(c, f, tn);
+                                       if (unlikely(err != 0))
+                                               return err;
+                                       checked = 1;
+                               }
 
+                               fn->frags += 1;
+                               newfrag = new_fragment(fn, fn_ofs, fn_size);
+                               if (unlikely(!newfrag))
+                                       return -ENOMEM;
+
+                               dbg_fragtree2("there are no more fragments, insert %#04x-%#04x\n",
+                                       newfrag->ofs, newfrag->ofs + newfrag->size);
+                               rb_link_node(&newfrag->rb, &this->rb, &this->rb.rb_right);
+                               rb_insert_color(&newfrag->rb, root);
+                               goto out_ok;
+                       } else {
+                               this = new_this;
+                               dbg_fragtree2("switch to the next 'this' fragment: %#04x-%#04x %s\n",
+                                       this->ofs, this->ofs + this->size, this->node ? "(data)" : "(hole)");
+                       }
                }
-               spin_lock(&c->erase_completion_lock);
+       }
 
+out_ok:
+       BUG_ON(fn->size < PAGE_CACHE_SIZE && ref_flag == REF_PRISTINE);
+
+       if (ref_flag == REF_OBSOLETE) {
+               dbg_fragtree2("the node is obsolete now\n");
+               /* jffs2_mark_node_obsolete() will adjust space accounting */
+               jffs2_mark_node_obsolete(c, fn->raw);
+               return 1;
        }
+
+       dbg_fragtree2("the node is \"%s\" now\n", ref_flag == REF_NORMAL ? "REF_NORMAL" : "REF_PRISTINE");
+
+       /* Space accounting was adjusted at check_node_data() */
+       spin_lock(&c->erase_completion_lock);
+       fn->raw->flash_offset = ref_offset(fn->raw) | ref_flag;
        spin_unlock(&c->erase_completion_lock);
-       *tnp = ret_tn;
-       *fdp = ret_fd;
 
        return 0;
-
- free_out:
-       jffs2_free_tmp_dnode_info_list(ret_tn);
-       jffs2_free_full_dirent_list(ret_fd);
-       return err;
 }
 
 void jffs2_set_inocache_state(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic, int state)
@@ -465,33 +865,34 @@ void jffs2_set_inocache_state(struct jffs2_sb_info *c, struct jffs2_inode_cache
 
 /* During mount, this needs no locking. During normal operation, its
    callers want to do other stuff while still holding the inocache_lock.
-   Rather than introducing special case get_ino_cache functions or 
+   Rather than introducing special case get_ino_cache functions or
    callbacks, we just let the caller do the locking itself. */
-   
+
 struct jffs2_inode_cache *jffs2_get_ino_cache(struct jffs2_sb_info *c, uint32_t ino)
 {
        struct jffs2_inode_cache *ret;
 
-       D2(printk(KERN_DEBUG "jffs2_get_ino_cache(): ino %u\n", ino));
-
        ret = c->inocache_list[ino % INOCACHE_HASHSIZE];
        while (ret && ret->ino < ino) {
                ret = ret->next;
        }
-       
+
        if (ret && ret->ino != ino)
                ret = NULL;
 
-       D2(printk(KERN_DEBUG "jffs2_get_ino_cache found %p for ino %u\n", ret, ino));
        return ret;
 }
 
 void jffs2_add_ino_cache (struct jffs2_sb_info *c, struct jffs2_inode_cache *new)
 {
        struct jffs2_inode_cache **prev;
-       D2(printk(KERN_DEBUG "jffs2_add_ino_cache: Add %p (ino #%u)\n", new, new->ino));
+
        spin_lock(&c->inocache_lock);
-       
+       if (!new->ino)
+               new->ino = ++c->highest_ino;
+
+       dbg_inocache("add %p (ino #%u)\n", new, new->ino);
+
        prev = &c->inocache_list[new->ino % INOCACHE_HASHSIZE];
 
        while ((*prev) && (*prev)->ino < new->ino) {
@@ -506,11 +907,12 @@ void jffs2_add_ino_cache (struct jffs2_sb_info *c, struct jffs2_inode_cache *new
 void jffs2_del_ino_cache(struct jffs2_sb_info *c, struct jffs2_inode_cache *old)
 {
        struct jffs2_inode_cache **prev;
-       D2(printk(KERN_DEBUG "jffs2_del_ino_cache: Del %p (ino #%u)\n", old, old->ino));
+
+       dbg_inocache("del %p (ino #%u)\n", old, old->ino);
        spin_lock(&c->inocache_lock);
-       
+
        prev = &c->inocache_list[old->ino % INOCACHE_HASHSIZE];
-       
+
        while ((*prev) && (*prev)->ino < old->ino) {
                prev = &(*prev)->next;
        }
@@ -518,6 +920,14 @@ void jffs2_del_ino_cache(struct jffs2_sb_info *c, struct jffs2_inode_cache *old)
                *prev = old->next;
        }
 
+       /* Free it now unless it's in READING or CLEARING state, which
+          are the transitions upon read_inode() and clear_inode(). The
+          rest of the time we know nobody else is looking at it, and
+          if it's held by read_inode() or clear_inode() they'll free it
+          for themselves. */
+       if (old->state != INO_STATE_READING && old->state != INO_STATE_CLEARING)
+               jffs2_free_inode_cache(old);
+
        spin_unlock(&c->inocache_lock);
 }
 
@@ -525,12 +935,11 @@ void jffs2_free_ino_caches(struct jffs2_sb_info *c)
 {
        int i;
        struct jffs2_inode_cache *this, *next;
-       
+
        for (i=0; i<INOCACHE_HASHSIZE; i++) {
                this = c->inocache_list[i];
                while (this) {
                        next = this->next;
-                       D2(printk(KERN_DEBUG "jffs2_free_ino_caches: Freeing ino #%u at %p\n", this->ino, this));
                        jffs2_free_inode_cache(this);
                        this = next;
                }
@@ -553,38 +962,30 @@ void jffs2_free_raw_node_refs(struct jffs2_sb_info *c)
                c->blocks[i].first_node = c->blocks[i].last_node = NULL;
        }
 }
-       
+
 struct jffs2_node_frag *jffs2_lookup_node_frag(struct rb_root *fragtree, uint32_t offset)
 {
-       /* The common case in lookup is that there will be a node 
+       /* The common case in lookup is that there will be a node
           which precisely matches. So we go looking for that first */
        struct rb_node *next;
        struct jffs2_node_frag *prev = NULL;
        struct jffs2_node_frag *frag = NULL;
 
-       D2(printk(KERN_DEBUG "jffs2_lookup_node_frag(%p, %d)\n", fragtree, offset));
+       dbg_fragtree2("root %p, offset %d\n", fragtree, offset);
 
        next = fragtree->rb_node;
 
        while(next) {
                frag = rb_entry(next, struct jffs2_node_frag, rb);
 
-               D2(printk(KERN_DEBUG "Considering frag %d-%d (%p). left %p, right %p\n",
-                         frag->ofs, frag->ofs+frag->size, frag, frag->rb.rb_left, frag->rb.rb_right));
                if (frag->ofs + frag->size <= offset) {
-                       D2(printk(KERN_DEBUG "Going right from frag %d-%d, before the region we care about\n",
-                                 frag->ofs, frag->ofs+frag->size));
                        /* Remember the closest smaller match on the way down */
                        if (!prev || frag->ofs > prev->ofs)
                                prev = frag;
                        next = frag->rb.rb_right;
                } else if (frag->ofs > offset) {
-                       D2(printk(KERN_DEBUG "Going left from frag %d-%d, after the region we care about\n",
-                                 frag->ofs, frag->ofs+frag->size));
                        next = frag->rb.rb_left;
                } else {
-                       D2(printk(KERN_DEBUG "Returning frag %d,%d, matched\n",
-                                 frag->ofs, frag->ofs+frag->size));
                        return frag;
                }
        }
@@ -593,11 +994,11 @@ struct jffs2_node_frag *jffs2_lookup_node_frag(struct rb_root *fragtree, uint32_
           and return the closest smaller one */
 
        if (prev)
-               D2(printk(KERN_DEBUG "No match. Returning frag %d,%d, closest previous\n",
-                         prev->ofs, prev->ofs+prev->size));
-       else 
-               D2(printk(KERN_DEBUG "Returning NULL, empty fragtree\n"));
-       
+               dbg_fragtree2("no match. Returning frag %#04x-%#04x, closest previous\n",
+                         prev->ofs, prev->ofs+prev->size);
+       else
+               dbg_fragtree2("returning NULL, empty fragtree\n");
+
        return prev;
 }
 
@@ -611,39 +1012,32 @@ void jffs2_kill_fragtree(struct rb_root *root, struct jffs2_sb_info *c)
        if (!root->rb_node)
                return;
 
-       frag = (rb_entry(root->rb_node, struct jffs2_node_frag, rb));
+       dbg_fragtree("killing\n");
 
+       frag = (rb_entry(root->rb_node, struct jffs2_node_frag, rb));
        while(frag) {
                if (frag->rb.rb_left) {
-                       D2(printk(KERN_DEBUG "Going left from frag (%p) %d-%d\n", 
-                                 frag, frag->ofs, frag->ofs+frag->size));
                        frag = frag_left(frag);
                        continue;
                }
                if (frag->rb.rb_right) {
-                       D2(printk(KERN_DEBUG "Going right from frag (%p) %d-%d\n", 
-                                 frag, frag->ofs, frag->ofs+frag->size));
                        frag = frag_right(frag);
                        continue;
                }
 
-               D2(printk(KERN_DEBUG "jffs2_kill_fragtree: frag at 0x%x-0x%x: node %p, frags %d--\n",
-                         frag->ofs, frag->ofs+frag->size, frag->node,
-                         frag->node?frag->node->frags:0));
-                       
                if (frag->node && !(--frag->node->frags)) {
-                       /* Not a hole, and it's the final remaining frag 
+                       /* Not a hole, and it's the final remaining frag
                           of this node. Free the node */
                        if (c)
                                jffs2_mark_node_obsolete(c, frag->node->raw);
-                       
+
                        jffs2_free_full_dnode(frag->node);
                }
                parent = frag_parent(frag);
                if (parent) {
                        if (frag_left(parent) == frag)
                                parent->rb.rb_left = NULL;
-                       else 
+                       else
                                parent->rb.rb_right = NULL;
                }
 
@@ -653,29 +1047,3 @@ void jffs2_kill_fragtree(struct rb_root *root, struct jffs2_sb_info *c)
                cond_resched();
        }
 }
-
-void jffs2_fragtree_insert(struct jffs2_node_frag *newfrag, struct jffs2_node_frag *base)
-{
-       struct rb_node *parent = &base->rb;
-       struct rb_node **link = &parent;
-
-       D2(printk(KERN_DEBUG "jffs2_fragtree_insert(%p; %d-%d, %p)\n", newfrag, 
-                 newfrag->ofs, newfrag->ofs+newfrag->size, base));
-
-       while (*link) {
-               parent = *link;
-               base = rb_entry(parent, struct jffs2_node_frag, rb);
-       
-               D2(printk(KERN_DEBUG "fragtree_insert considering frag at 0x%x\n", base->ofs));
-               if (newfrag->ofs > base->ofs)
-                       link = &base->rb.rb_right;
-               else if (newfrag->ofs < base->ofs)
-                       link = &base->rb.rb_left;
-               else {
-                       printk(KERN_CRIT "Duplicate frag at %08x (%p,%p)\n", newfrag->ofs, newfrag, base);
-                       BUG();
-               }
-       }
-
-       rb_link_node(&newfrag->rb, &base->rb, link);
-}