bdesc->freeptr = *((void **) (((char *)retval)+sizeof(struct hdr_start)));#else	bdesc->freeptr = *((void **) retval);#endif	bdesc->refcnt++;	restore_flags(flags);	/* OK, we're safe again */#ifdef CONFIG_DEBUG_MALLOC	{		struct hdr_start *hd;		struct hdr_end *he;		hd = (struct hdr_start *) retval;		retval = hd+1;		len -= sizeof(struct hdr_start)+sizeof(struct hdr_end);		if(hd->magic != DEB_MAGIC_FREE && hd->magic != DEB_MAGIC_FREED) {			printk("DEB_MALLOC allocating %s block 0x%x (head 0x%x) from %s:%d, magic %x\n",				(hd->magic == DEB_MAGIC_ALLOC) ? "nonfree" : "trashed", 				retval,hd,deb_file,deb_line,hd->magic);			return NULL;		}		if(len > hd->size || len > bdir->size-sizeof(struct hdr_start)-sizeof(struct hdr_end)) {			printk("DEB_MALLOC got %x:%x-byte block, wanted %x, from %s:%d, last %s:%d\n",				hd->size,bdir->size,len,hd->file,hd->line,deb_file,deb_line);			return NULL;		}		{			unsigned char *x = (unsigned char *) retval;			unsigned short pos = 4;			x += pos;			while(pos < hd->size) {				if(*x++ != 0xF8) {					printk("DEB_MALLOC used 0x%x:%x(%x) while free, from %s:%d\n",						retval,pos,hd->size,hd->file,hd->line);					return NULL;				}				pos++;			}		}		he = (struct hdr_end *)(((char *)retval)+hd->size);		if(he->magic != DEB_MAGIC_END) {			printk("DEB_MALLOC overran 0x%x:%d while free, from %s:%d\n",retval,hd->size,hd->file,hd->line);		}		memset(retval, 0xf0, len);		he = (struct hdr_end *)(((char *)retval)+len);		hd->file = hd->ok_file = deb_file;		hd->line = hd->ok_line = deb_line;		hd->size = len;		hd->magic = DEB_MAGIC_ALLOC;		he->magic = DEB_MAGIC_END;	}#endif	return retval;too_large:       /* This should be changed for sizes > 1 page. */	printk("kmalloc called with impossibly large argument (%d)\n", len);	return NULL;}#ifdef CONFIG_DEBUG_MALLOCvoid deb_kcheck_s(const char *deb_file, unsigned short deb_line,	void *obj, int size){	struct hdr_start *hd;	struct hdr_end *he;	if (!obj)		return;	hd = (struct hdr_start *) obj;	hd--;	if(hd->magic != DEB_MAGIC_ALLOC) {		if(hd->magic == DEB_MAGIC_FREE) {			printk("DEB_MALLOC Using free block of 0x%x at %s:%d, by %s:%d, wasOK %s:%d\n",				obj,deb_file,deb_line,hd->file,hd->line,hd->ok_file,hd->ok_line);			/* For any other condition it is either superfluous or dangerous to print something. */			hd->magic = DEB_MAGIC_FREED;		}		return;	}	if(hd->size != size) {		if(size != 0) {			printk("DEB_MALLOC size for 0x%x given as %d, stored %d, at %s:%d, wasOK %s:%d\n",				obj,size,hd->size,deb_file,deb_line,hd->ok_file,hd->ok_line);		}		size = hd->size;	}	he = (struct hdr_end *)(((char *)obj)+size);	if(he->magic != DEB_MAGIC_END) {		printk("DEB_MALLOC overran block 0x%x:%d, at %s:%d, wasOK %s:%d\n",			obj,hd->size,deb_file,deb_line,hd->ok_file,hd->ok_line);		hd->magic = DEB_MAGIC_USED;		return;	}	hd->ok_file = deb_file;	hd->ok_line = deb_line;}#endif/* * Here is the kfree routine.  If you know the size of the object that you * are freeing, then kfree_s() will use that information to speed up the * search for the bucket descriptor. * * We will #define a macro so that "kfree(x)" is becomes "kfree_s(x, 0)" */#ifdef CONFIG_DEBUG_MALLOCvoid deb_kfree_s(const char *deb_file, unsigned short deb_line,	void *obj, int size)#elsevoid kfree_s(void *obj, int size)#endif{	unsigned long		flags;	void			*page;	struct _bucket_dir	*bdir;	struct bucket_desc	*bdesc, *prev;	if (!obj)		return;#ifdef CONFIG_DEBUG_MALLOC	{		struct hdr_start *hd;		struct hdr_end *he;		hd = (struct hdr_start *) obj;		hd--;		if(hd->magic == DEB_MAGIC_FREE) {			printk("DEB_MALLOC dup free of 0x%x at %s:%d by %s:%d, wasOK %s:%d\n",					obj,deb_file,deb_line,hd->file,hd->line,hd->ok_file,hd->ok_line);			return;		}		if(hd->size != size) {			if(size != 0) {				if(hd->magic != DEB_MAGIC_USED)					printk("DEB_MALLOC size for 0x%x given as %d, stored %d, at %s:%d, wasOK %s:%d\n",						obj,size,hd->size,deb_file,deb_line,hd->ok_file,hd->ok_line);			}			size = hd->size;		}		he = (struct hdr_end *)(((char *)obj)+size);		if(he->magic != DEB_MAGIC_END) {			if(hd->magic != DEB_MAGIC_USED)				printk("DEB_MALLOC overran block 0x%x:%d, at %s:%d, from %s:%d, wasOK %s:%d\n",					obj,hd->size,deb_file,deb_line,hd->file,hd->line,hd->ok_file,hd->ok_line);		}		size += sizeof(struct hdr_start)+sizeof(struct hdr_end);	}#endif	save_flags(flags);	/* Calculate what page this object lives in */	page = (void *)  ((unsigned long) obj & PAGE_MASK);	/* Now search the buckets looking for that page */	for (bdir = bucket_dir; bdir->size; bdir++) {	    prev = 0;	    /* If size is zero then this conditional is always true */	    if (bdir->size >= size) {		/* We have to turn off interrupts here because		   we are descending the chain.  If something		   changes it in the middle we could suddenly		   find ourselves descending the free list.		   I think this would only cause a memory		   leak, but better safe than sorry. */		cli(); /* To avoid race conditions */		for (bdesc = bdir->chain; bdesc; bdesc = bdesc->next) {		    if (bdesc->page == page)			goto found;		    prev = bdesc;		}	    }	}	restore_flags(flags);	printk("Bad address passed to kernel kfree_s(%p, %d)\n",obj, size);#ifdef CONFIG_DEBUG_MALLOC	printk("Offending code: %s:%d\n",deb_file,deb_line);#else	printk("Offending eip: %08x\n",((unsigned long *) &obj)[-1]);#endif	return;found:	/* interrupts are off here. */#ifdef CONFIG_DEBUG_MALLOC	{		struct hdr_start *hd;		struct hdr_end *he;		hd = (struct hdr_start *) obj;		hd--;				hd->file = deb_file;		hd->line = deb_line;		hd->magic = DEB_MAGIC_FREE;		hd->size = bdir->size-sizeof(struct hdr_start)-sizeof(struct hdr_end);		he = (struct hdr_end *)(((char *)obj)+hd->size);		memset(obj, 0xf8, hd->size);		he->magic = DEB_MAGIC_END;		*((void **)obj) = bdesc->freeptr;		obj = hd;	}#else	*((void **)obj) = bdesc->freeptr;#endif	bdesc->freeptr = obj;	bdesc->refcnt--;	if (bdesc->refcnt == 0) {		/*		 * We need to make sure that prev is still accurate.  It		 * may not be, if someone rudely interrupted us....		 */		if ((prev && (prev->next != bdesc)) ||		    (!prev && (bdir->chain != bdesc)))			for (prev = bdir->chain; prev; prev = prev->next)				if (prev->next == bdesc)					break;		if (prev)			prev->next = bdesc->next;		else {			if (bdir->chain != bdesc)				panic("kmalloc bucket chains corrupted");			bdir->chain = bdesc->next;		}		bdesc->next = free_bucket_desc;		free_bucket_desc = bdesc;		free_page((unsigned long) bdesc->page);	}	restore_flags(flags);	return;}#ifdef CONFIG_DEBUG_MALLOCint get_malloc(char *buffer){	int len = 0;	int i;	unsigned long		flags;	void			*page;	struct _bucket_dir	*bdir;	struct bucket_desc	*bdesc;	save_flags(flags);	cli(); /* To avoid race conditions */	for (bdir = bucket_dir; bdir->size; bdir++) {		for (bdesc = bdir->chain; bdesc; bdesc = bdesc->next) {			page = bdesc->page;			for (i=PAGE_SIZE/bdir->size; i > 0 ; i--) {				struct hdr_start *hd;				hd = (struct hdr_start *)page;				if(hd->magic == DEB_MAGIC_ALLOC) {					if(len > PAGE_SIZE-80) {						restore_flags(flags);						len += sprintf(buffer+len,"...\n");						return len;					}					len += sprintf(buffer+len,"%08x:%03x %s:%d %s:%d\n",						(long)(page+sizeof(struct hdr_start)),hd->size,hd->file,hd->line,hd->ok_file,hd->ok_line);				}				page += bdir->size;			}		}	}	restore_flags(flags);	return len;}#endif