kfree (read_buf); 
kfree(read_buf); 
jffs_scan_flash(struct jffs_control *c){	char name[JFFS_MAX_NAME_LEN + 2];	struct jffs_raw_inode raw_inode;	struct jffs_node *node = NULL;	struct jffs_fmcontrol *fmc = c->fmc;	__u32 checksum;	__u8 tmp_accurate;	__u16 tmp_chksum;	__u32 deleted_file;	loff_t pos = 0;	loff_t start;	loff_t test_start;	loff_t end = fmc->flash_size;	__u8 *read_buf;	int i, len, retlen;	__u32 offset;	__u32 free_chunk_size1;	__u32 free_chunk_size2;	#define NUMFREEALLOWED     2        /* 2 chunks of at least erase size space allowed */	int num_free_space = 0;       /* Flag err if more than TWO				       free blocks found. This is NOT allowed				       by the current jffs design.				    */	int num_free_spc_not_accp = 0; /* For debugging purposed keep count 					of how much free space was rejected and					marked dirty				     */	D1(printk("jffs_scan_flash(): start pos = 0x%lx, end = 0x%lx\n",		  (long)pos, (long)end));	flash_safe_acquire(fmc->mtd);	/*	  check and make sure that any sector does not suffer	  from the "partly erased, bit flipping syndrome" (TM Vipin :)	  If so, offending sectors will be erased.	*/	if(check_partly_erased_sectors(fmc) < 0){		flash_safe_release(fmc->mtd);		return -EIO; /* bad, bad, bad error. Cannot continue.*/	}	/* Allocate read buffer */	read_buf = (__u8 *) kmalloc (sizeof(__u8) * 4096, GFP_KERNEL);	if (!read_buf) {		flash_safe_release(fmc->mtd);		return -ENOMEM;	}			      	/* Start the scan.  */	while (pos < end) {		deleted_file = 0;		/* Remember the position from where we started this scan.  */		start = pos;		switch (flash_read_u32(fmc->mtd, pos)) {		case JFFS_EMPTY_BITMASK:			/* We have found 0xffffffff at this position.  We have to			   scan the rest of the flash till the end or till			   something else than 0xffffffff is found.		           Keep going till we do not find JFFS_EMPTY_BITMASK 			   anymore */			D1(printk("jffs_scan_flash(): 0xffffffff at pos 0x%lx.\n",				  (long)pos));		        while(pos < end){			      len = end - pos < 4096 ? end - pos : 4096;			      			      retlen = flash_safe_read(fmc->mtd, pos,						 &read_buf[0], len);			      retlen &= ~3;			      			      for (i=0 ; i < retlen ; i+=4, pos += 4) {				      if(*((__u32 *) &read_buf[i]) !=					 JFFS_EMPTY_BITMASK)					break;			      }			      if (i == retlen)				    continue;			      else				    break;			}			D1(printk("jffs_scan_flash():0xffffffff ended at pos 0x%lx.\n",				  (long)pos));						/* If some free space ends in the middle of a sector,			   treat it as dirty rather than clean.			   This is to handle the case where one thread 			   allocated space for a node, but didn't get to			   actually _write_ it before power was lost, leaving			   a gap in the log. Shifting all node writes into			   a single kernel thread will fix the original problem.			*/			if ((__u32) pos % fmc->sector_size) {				/* If there was free space in previous 				   sectors, don't mark that dirty too - 				   only from the beginning of this sector				   (or from start) 				*/			        test_start = pos & ~(fmc->sector_size-1); /* end of last sector */				if (start < test_start) {				        /* free space started in the previous sector! */					if((num_free_space < NUMFREEALLOWED) && 					   ((unsigned int)(test_start - start) >= fmc->sector_size)){				                /*						  Count it in if we are still under NUMFREEALLOWED *and* it is 						  at least 1 erase sector in length. This will keep us from 						  picking any little ole' space as "free".						*/					  					        D1(printk("Reducing end of free space to 0x%x from 0x%x\n",							  (unsigned int)test_start, (unsigned int)pos));						D1(printk("Free space accepted: Starting 0x%x for 0x%x bytes\n",							  (unsigned int) start,							  (unsigned int)(test_start - start)));						/* below, space from "start" to "pos" will be marked dirty. */						start = test_start; 												/* Being in here means that we have found at least an entire 						   erase sector size of free space ending on a sector boundary.						   Keep track of free spaces accepted.						*/						num_free_space++;					}else{					        num_free_spc_not_accp++;					        D1(printk("Free space (#%i) found but *Not* accepted: Starting"							  " 0x%x for 0x%x bytes\n",							  num_free_spc_not_accp, (unsigned int)start, 							  (unsigned int)((unsigned int)(pos & ~(fmc->sector_size-1)) - (unsigned int)start)));					        					}									}				if((((__u32)(pos - start)) != 0)){				        D1(printk("Dirty space: Starting 0x%x for 0x%x bytes\n",						  (unsigned int) start, (unsigned int) (pos - start)));					jffs_fmalloced(fmc, (__u32) start,						       (__u32) (pos - start), NULL);				}else{					/* "Flipping bits" detected. This means that our scan for them					   did not catch this offset. See check_partly_erased_sectors() for					   more info.					*/				        					D1(printk("jffs_scan_flash():wants to allocate dirty flash "						  "space for 0 bytes.\n"));					D1(printk("jffs_scan_flash(): Flipping bits! We will free "						  "all allocated memory, erase this sector and remount\n"));					/* calculate start of present sector */					offset = (((__u32)pos)/(__u32)fmc->sector_size) * (__u32)fmc->sector_size;										D1(printk("jffs_scan_flash():erasing sector starting 0x%x.\n",						  offset));										if (flash_erase_region(fmc->mtd,							       offset, fmc->sector_size) < 0) {						printk(KERN_ERR "JFFS: Erase of flash failed. "						       "offset = %u, erase_size = %d\n",						       offset , fmc->sector_size);						flash_safe_release(fmc->mtd);						kfree (read_buf);						return -1; /* bad, bad, bad! */					}					flash_safe_release(fmc->mtd);					kfree (read_buf);					return -EAGAIN; /* erased offending sector. Try mount one more time please. */				}			}else{			        /* Being in here means that we have found free space that ends on an erase sector				   boundary.				   Count it in if we are still under NUMFREEALLOWED *and* it is at least 1 erase 				   sector in length. This will keep us from picking any little ole' space as "free".				 */			         if((num_free_space < NUMFREEALLOWED) && 				    ((unsigned int)(pos - start) >= fmc->sector_size)){				           /* We really don't do anything to mark space as free, except *not* 					      mark it dirty and just advance the "pos" location pointer. 					      It will automatically be picked up as free space.					    */ 				           num_free_space++;				           D1(printk("Free space accepted: Starting 0x%x for 0x%x bytes\n",						     (unsigned int) start, (unsigned int) (pos - start)));				 }else{				         num_free_spc_not_accp++;					 D1(printk("Free space (#%i) found but *Not* accepted: Starting "						   "0x%x for 0x%x bytes\n", num_free_spc_not_accp, 						   (unsigned int) start, 						   (unsigned int) (pos - start)));					 					 /* Mark this space as dirty. We already have our free space. */					 D1(printk("Dirty space: Starting 0x%x for 0x%x bytes\n",						   (unsigned int) start, (unsigned int) (pos - start)));					 jffs_fmalloced(fmc, (__u32) start,							(__u32) (pos - start), NULL);				           				 }				 			}			if(num_free_space > NUMFREEALLOWED){			         printk(KERN_WARNING "jffs_scan_flash(): Found free space "					"number %i. Only %i free space is allowed.\n",					num_free_space, NUMFREEALLOWED);			      			}			continue;		case JFFS_DIRTY_BITMASK:			/* We have found 0x00000000 at this position.  Scan as far			   as possible to find out how much is dirty.  */			D1(printk("jffs_scan_flash(): 0x00000000 at pos 0x%lx.\n",				  (long)pos));			for (; pos < end			       && JFFS_DIRTY_BITMASK == flash_read_u32(fmc->mtd, pos);			     pos += 4);			D1(printk("jffs_scan_flash(): 0x00 ended at "				  "pos 0x%lx.\n", (long)pos));			jffs_fmalloced(fmc, (__u32) start,				       (__u32) (pos - start), NULL);			continue;		case JFFS_MAGIC_BITMASK:			/* We have probably found a new raw inode.  */			break;		default:		bad_inode:			/* We're f*cked.  This is not solved yet.  We have			   to scan for the magic pattern.  */			D1(printk("*************** Dirty flash memory or "				  "bad inode: "				  "hexdump(pos = 0x%lx, len = 128):\n",				  (long)pos));			D1(jffs_hexdump(fmc->mtd, pos, 128));			for (pos += 4; pos < end; pos += 4) {				switch (flash_read_u32(fmc->mtd, pos)) {				case JFFS_MAGIC_BITMASK:				case JFFS_EMPTY_BITMASK:					/* handle these in the main switch() loop */					goto cont_scan;				default:					break;				}			}			cont_scan:			/* First, mark as dirty the region			   which really does contain crap. */			jffs_fmalloced(fmc, (__u32) start,				       (__u32) (pos - start),				       NULL);						continue;		}/* switch */		/* We have found the beginning of an inode.  Create a		   node for it unless there already is one available.  */		if (!node) {			if (!(node = jffs_alloc_node())) {				/* Free read buffer */				kfree (read_buf);				/* Release the flash device */				flash_safe_release(fmc->mtd);					return -ENOMEM;			}			DJM(no_jffs_node++);		}		/* Read the next raw inode.  */		flash_safe_read(fmc->mtd, pos, (u_char *) &raw_inode,				sizeof(struct jffs_raw_inode));		/* When we compute the checksum for the inode, we never		   count the 'accurate' or the 'checksum' fields.  */		tmp_accurate = raw_inode.accurate;		tmp_chksum = raw_inode.chksum;		raw_inode.accurate = 0;		raw_inode.chksum = 0;		checksum = jffs_checksum(&raw_inode,					 sizeof(struct jffs_raw_inode));		raw_inode.accurate = tmp_accurate;		raw_inode.chksum = tmp_chksum;		D3(printk("*** We have found this raw inode at pos 0x%lx "			  "on the flash:\n", (long)pos));		D3(jffs_print_raw_inode(&raw_inode));		if (checksum != raw_inode.chksum) {			D1(printk("jffs_scan_flash(): Bad checksum: "				  "checksum = %u, "				  "raw_inode.chksum = %u\n",				  checksum, raw_inode.chksum));			pos += sizeof(struct jffs_raw_inode);			jffs_fmalloced(fmc, (__u32) start,				       (__u32) (pos - start), NULL);			/* Reuse this unused struct jffs_node.  */			continue;		}		/* Check the raw inode read so far.  Start with the		   maximum length of the filename.  */		if (raw_inode.nsize > JFFS_MAX_NAME_LEN) {			printk(KERN_WARNING "jffs_scan_flash: Found a "			       "JFFS node with name too large\n");			goto bad_inode;		}		if (raw_inode.rename && raw_inode.dsize != sizeof(__u32)) {			printk(KERN_WARNING "jffs_scan_flash: Found a "			       "rename node with dsize %u.\n",			       raw_inode.dsize);			jffs_print_raw_inode(&raw_inode);			goto bad_inode;		}		/* The node's data segment should not exceed a		   certain length.  */		if (raw_inode.dsize > fmc->max_chunk_size) {			printk(KERN_WARNING "jffs_scan_flash: Found a "			       "JFFS node with dsize (0x%x) > max_chunk_size (0x%x)\n",			       raw_inode.dsize, fmc->max_chunk_size);			goto bad_inode;		}		pos += sizeof(struct jffs_raw_inode);		/* This shouldn't be necessary because a node that		   violates the flash boundaries shouldn't be written		   in the first place. */		if (pos >= end) {			goto check_node;		}		/* Read the name.  */		*name = 0;		if (raw_inode.nsize) {		        flash_safe_read(fmc->mtd, pos, name, raw_inode.nsize);			name[raw_inode.nsize] = '\0';			pos += raw_inode.nsize			       + JFFS_GET_PAD_BYTES(raw_inode.nsize);			D3(printk("name == \"%s\"\n", name));			checksum = jffs_checksum(name, raw_inode.nsize);			if (checksum != raw_inode.nchksum) {				D1(printk("jffs_scan_flash(): Bad checksum: "					  "checksum = %u, "					  "raw_inode.nchksum = %u\n",					  checksum, raw_inode.nchksum));				jffs_fmalloced(fmc, (__u32) start,					       (__u32) (pos - start), NULL);				/* Reuse this unused struct jffs_node.  */				continue;			}			if (pos >= end) {				goto check_node;			}		}		/* Read the data, if it exists, in order to be sure it		   matches the checksum.  */		if (raw_inode.dsize) {			if (raw_inode.rename) {				deleted_file = flash_read_u32(fmc->mtd, pos);			}			if (jffs_checksum_flash(fmc->mtd, pos, raw_inode.dsize, &checksum)) {				printk("jffs_checksum_flash() failed to calculate a checksum\n");				jffs_fmalloced(fmc, (__u32) start,					       (__u32) (pos - start), NULL);				/* Reuse this unused struct jffs_node.  */				continue;			}							pos += raw_inode.dsize			       + JFFS_GET_PAD_BYTES(raw_inode.dsize);			if (checksum != raw_inode.dchksum) {				D1(printk("jffs_scan_flash(): Bad checksum: "					  "checksum = %u, "					  "raw_inode.dchksum = %u\n",					  checksum, raw_inode.dchksum));				jffs_fmalloced(fmc, (__u32) start,					       (__u32) (pos - start), NULL);				/* Reuse this unused struct jffs_node.  */				continue;			}		}		check_node:		/* Remember the highest inode number in the whole file		   system.  This information will be used when assigning		   new files new inode numbers.  */		if (c->next_ino <= raw_inode.ino) {			c->next_ino = raw_inode.ino + 1;		}		if (raw_inode.accurate) {			int err;			node->data_offset = raw_inode.offset;			node->data_size = raw_inode.dsize;			node->removed_size = raw_inode.rsize;			/* Compute the offset to the actual data in the			   on-flash node.  */			node->fm_offset			= sizeof(struct jffs_raw_inode)			  + raw_inode.nsize			  + JFFS_GET_PAD_BYTES(raw_inode.nsize);			node->fm = jffs_fmalloced(fmc, (__u32) start,						  (__u32) (pos - start),						  node);			if (!node->fm) {				D(printk("jffs_scan_flash(): !node->fm\n"));				jffs_free_node(node);				DJM(no_jffs_node--);				/* Free read buffer */				kfree (read_buf);				/* Release the flash device */				flash_safe_release(fmc->mtd);				return -ENOMEM;			}			if ((err = jffs_insert_node(c, NULL, &raw_inode,						    name, node)) < 0) {				printk("JFFS: Failed to handle raw inode. "				       "(err = %d)\n", err);				break;			}			if (raw_inode.rename) {				struct jffs_delete_list *dl				= (struct jffs_delete_list *)				  kmalloc(sizeof(struct jffs_delete_list),					  GFP_KERNEL);				if (!dl) {					D(printk("jffs_scan_flash: !dl\n"));					jffs_free_node(node);					DJM(no_jffs_node--);					/* Release the flash device */					flash_safe_release(fmc->flash_part);					/* Free read buffer */					kfree (read_buf);					return -ENOMEM;				}				dl->ino = deleted_file;				dl->next = c->delete_list;				c->delete_list = dl;				node->data_size = 0;			}			D3(jffs_print_node(node));			node = NULL; /* Don't free the node!  */		}		else {			jffs_fmalloced(fmc, (__u32) start,				       (__u32) (pos - start), NULL);			D3(printk("jffs_scan_flash(): Just found an obsolete "				  "raw_inode. Continuing the scan...\n"));			/* Reuse this unused struct jffs_node.  */		}	}	if (node) {		jffs_free_node(node);		DJM(no_jffs_node--);	}	jffs_build_end(fmc);	/* Free read buffer */	kfree (read_buf);	if(!num_free_space){	        printk(KERN_WARNING "jffs_scan_flash(): Did not find even a single "		       "chunk of free space. This is BAD!\n");	}	/* Return happy */	D3(printk("jffs_scan_flash(): Leaving...\n"));	flash_safe_release(fmc->mtd);	/* This is to trap the "free size accounting screwed error. */	free_chunk_size1 = jffs_free_size1(fmc);	free_chunk_size2 = jffs_free_size2(fmc);	if (free_chunk_size1 + free_chunk_size2 != fmc->free_size) {		printk(KERN_WARNING "jffs_scan_falsh():Free size accounting screwed\n");		printk(KERN_WARNING "jfffs_scan_flash():free_chunk_size1 == 0x%x, "		       "free_chunk_size2 == 0x%x, fmc->free_size == 0x%x\n", 		       free_chunk_size1, free_chunk_size2, fmc->free_size);		return -1; /* Do NOT mount f/s so that we can inspect what happened.			      Mounting this  screwed up f/s will screw us up anyway.			    */	}		return 0; /* as far as we are concerned, we are happy! */} /* jffs_scan_flash()  */
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/f99d49adf527fa6f7a9c42257fa76bca6b8df1e3/intrep.c/clean/fs/jffs/intrep.c