[Qemu-devel] [PATCH for-4.0 0/9] ppc: get rid of g_malloc(sizeof(T) * n)

[Qemu-devel] [PATCH for-4.0 0/9] ppc: get rid of g_malloc(sizeof(T) * n)

[Greg Kurz]

As explained in HACKING, the g_malloc(sizeof(T) * n) construct is unsafe
because it can't detect multiplication overflowing size_t and doesn't
allow type checking.

It appears to be used in a bunch of places though:

$ git grep -E 'malloc.*sizeof' | grep ' \* '  | wc -l
101

This series fixes the ppc target and ppc machine code. The changes are
mostly trivial. Only the mac99 and e500 machines required some more work
that should be reviewed carefully, as it was only compile-tested.

--
Greg

---

Greg Kurz (9):
      target/ppc: use g_new(T, n) instead of g_malloc(sizeof(T) * n)
      spapr: use g_new(T, n) instead of g_malloc(sizeof(T) * n)
      ppc405_boards: use g_new(T, n) instead of g_malloc(sizeof(T) * n)
      ppc405_uc: use g_new(T, n) instead of g_malloc(sizeof(T) * n)
      ppc440_bamboo: use g_new(T, n) instead of g_malloc(sizeof(T) * n)
      sam460ex: use g_new(T, n) instead of g_malloc(sizeof(T) * n)
      virtex_ml507: use g_new(T, n) instead of g_malloc(sizeof(T) * n)
      mac_newworld: simplify IRQ wiring
      e500: simplify IRQ wiring


 hw/ppc/e500.c                   |   18 ++++++++----------
 hw/ppc/mac_newworld.c           |   30 +++++++++++++-----------------
 hw/ppc/ppc405_boards.c          |    4 ++--
 hw/ppc/ppc405_uc.c              |    4 ++--
 hw/ppc/ppc440_bamboo.c          |    5 ++---
 hw/ppc/sam460ex.c               |    2 +-
 hw/ppc/spapr_iommu.c            |    2 +-
 hw/ppc/spapr_vio.c              |    2 +-
 hw/ppc/virtex_ml507.c           |    2 +-
 include/hw/ppc/openpic.h        |    2 ++
 target/ppc/translate_init.inc.c |    6 +++---
 11 files changed, 36 insertions(+), 41 deletions(-)

[Qemu-devel] [PATCH for-4.0 1/9] target/ppc: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Greg Kurz]

Because it is a recommended coding practice (see HACKING).

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 target/ppc/translate_init.inc.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/ppc/translate_init.inc.c b/target/ppc/translate_init.inc.c
index 168d0cec28b7..03f1d34a9769 100644
--- a/target/ppc/translate_init.inc.c
+++ b/target/ppc/translate_init.inc.c
@@ -9081,13 +9081,13 @@ static void init_ppc_proc(PowerPCCPU *cpu)
             nb_tlb *= 2;
         switch (env->tlb_type) {
         case TLB_6XX:
-            env->tlb.tlb6 = g_malloc0(nb_tlb * sizeof(ppc6xx_tlb_t));
+            env->tlb.tlb6 = g_new0(ppc6xx_tlb_t, nb_tlb);
             break;
         case TLB_EMB:
-            env->tlb.tlbe = g_malloc0(nb_tlb * sizeof(ppcemb_tlb_t));
+            env->tlb.tlbe = g_new0(ppcemb_tlb_t, nb_tlb);
             break;
         case TLB_MAS:
-            env->tlb.tlbm = g_malloc0(nb_tlb * sizeof(ppcmas_tlb_t));
+            env->tlb.tlbm = g_new0(ppcmas_tlb_t, nb_tlb);
             break;
         }
         /* Pre-compute some useful values */

[Qemu-devel] [PATCH for-4.0 2/9] spapr: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Greg Kurz]

Because it is a recommended coding practice (see HACKING).

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/ppc/spapr_iommu.c |    2 +-
 hw/ppc/spapr_vio.c   |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/spapr_iommu.c b/hw/ppc/spapr_iommu.c
index 1b0880ac9edb..b56466f89a64 100644
--- a/hw/ppc/spapr_iommu.c
+++ b/hw/ppc/spapr_iommu.c
@@ -93,7 +93,7 @@ static uint64_t *spapr_tce_alloc_table(uint32_t liobn,
 
     if (!table) {
         *fd = -1;
-        table = g_malloc0(nb_table * sizeof(uint64_t));
+        table = g_new0(uint64_t, nb_table);
     }
 
     trace_spapr_iommu_new_table(liobn, table, *fd);
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index 840d4a3c451c..7e8a9ad09337 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -730,7 +730,7 @@ void spapr_dt_vdevice(VIOsPAPRBus *bus, void *fdt)
     }
 
     /* Copy out into an array of pointers */
-    qdevs = g_malloc(sizeof(qdev) * num);
+    qdevs = g_new(DeviceState *, num);
     num = 0;
     QTAILQ_FOREACH(kid, &bus->bus.children, sibling) {
         qdevs[num++] = kid->child;

[Qemu-devel] [PATCH for-4.0 3/9] ppc405_boards: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Greg Kurz]

Because it is a recommended coding practice (see HACKING).

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/ppc/ppc405_boards.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/ppc405_boards.c b/hw/ppc/ppc405_boards.c
index 3be3fe4432b4..f35b412c88dd 100644
--- a/hw/ppc/ppc405_boards.c
+++ b/hw/ppc/ppc405_boards.c
@@ -149,7 +149,7 @@ static void ref405ep_init(MachineState *machine)
     MemoryRegion *bios;
     MemoryRegion *sram = g_new(MemoryRegion, 1);
     ram_addr_t bdloc;
-    MemoryRegion *ram_memories = g_malloc(2 * sizeof(*ram_memories));
+    MemoryRegion *ram_memories = g_new(MemoryRegion, 2);
     hwaddr ram_bases[2], ram_sizes[2];
     target_ulong sram_size;
     long bios_size;
@@ -446,7 +446,7 @@ static void taihu_405ep_init(MachineState *machine)
     qemu_irq *pic;
     MemoryRegion *sysmem = get_system_memory();
     MemoryRegion *bios;
-    MemoryRegion *ram_memories = g_malloc(2 * sizeof(*ram_memories));
+    MemoryRegion *ram_memories = g_new(MemoryRegion, 2);
     MemoryRegion *ram = g_malloc0(sizeof(*ram));
     hwaddr ram_bases[2], ram_sizes[2];
     long bios_size;

[Qemu-devel] [PATCH for-4.0 4/9] ppc405_uc: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Greg Kurz]

Because it is a recommended coding practice (see HACKING).

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/ppc/ppc405_uc.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/ppc405_uc.c b/hw/ppc/ppc405_uc.c
index 5c58415cf1fd..e1aadf126d59 100644
--- a/hw/ppc/ppc405_uc.c
+++ b/hw/ppc/ppc405_uc.c
@@ -1519,7 +1519,7 @@ CPUPPCState *ppc405cr_init(MemoryRegion *address_space_mem,
     /* OBP arbitrer */
     ppc4xx_opba_init(0xef600600);
     /* Universal interrupt controller */
-    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] =
         ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] =
@@ -1877,7 +1877,7 @@ CPUPPCState *ppc405ep_init(MemoryRegion *address_space_mem,
     /* Initialize timers */
     ppc_booke_timers_init(cpu, sysclk, 0);
     /* Universal interrupt controller */
-    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] =
         ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] =

[Qemu-devel] [PATCH for-4.0 5/9] ppc440_bamboo: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Greg Kurz]

Because it is a recommended coding practice (see HACKING).

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/ppc/ppc440_bamboo.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index f5720f979e42..b8aa55d52669 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -169,8 +169,7 @@ static void bamboo_init(MachineState *machine)
     unsigned int pci_irq_nrs[4] = { 28, 27, 26, 25 };
     MemoryRegion *address_space_mem = get_system_memory();
     MemoryRegion *isa = g_new(MemoryRegion, 1);
-    MemoryRegion *ram_memories
-        = g_malloc(PPC440EP_SDRAM_NR_BANKS * sizeof(*ram_memories));
+    MemoryRegion *ram_memories = g_new(MemoryRegion, PPC440EP_SDRAM_NR_BANKS);
     hwaddr ram_bases[PPC440EP_SDRAM_NR_BANKS];
     hwaddr ram_sizes[PPC440EP_SDRAM_NR_BANKS];
     qemu_irq *pic;
@@ -200,7 +199,7 @@ static void bamboo_init(MachineState *machine)
     ppc_dcr_init(env, NULL, NULL);
 
     /* interrupt controller */
-    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
     pic = ppcuic_init(env, irqs, 0x0C0, 0, 1);

[Qemu-devel] [PATCH for-4.0 6/9] sam460ex: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Greg Kurz]

Because it is a recommended coding practice (see HACKING).

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/ppc/sam460ex.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index 5aac58f36ee1..4b051c0950a9 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -430,7 +430,7 @@ static void sam460ex_init(MachineState *machine)
     ppc4xx_plb_init(env);
 
     /* interrupt controllers */
-    irqs = g_malloc0(sizeof(*irqs) * PPCUIC_OUTPUT_NB);
+    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
     uic[0] = ppcuic_init(env, irqs, 0xc0, 0, 1);

[Qemu-devel] [PATCH for-4.0 7/9] virtex_ml507: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Greg Kurz]

Because it is a recommended coding practice (see HACKING).

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/ppc/virtex_ml507.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
index ee9b4b449086..517712057434 100644
--- a/hw/ppc/virtex_ml507.c
+++ b/hw/ppc/virtex_ml507.c
@@ -105,7 +105,7 @@ static PowerPCCPU *ppc440_init_xilinx(ram_addr_t *ram_size,
     ppc_dcr_init(env, NULL, NULL);
 
     /* interrupt controller */
-    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
+    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
     irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
     irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
     ppcuic_init(env, irqs, 0x0C0, 0, 1);

[Qemu-devel] [PATCH for-4.0 8/9] mac_newworld: simplify IRQ wiring

[Greg Kurz]

The OpenPIC have 5 outputs per connected CPU. The machine init code hence
needs a bi-dimensional array (smp_cpu lines, 5 columns) to wire up the irqs
between the PIC and the CPUs.

The current code first allocates an array of smp_cpus pointers to qemu_irq
type, then it allocates another array of smp_cpus * 5 qemu_irq and fills the
first array with pointers to each line of the second array. This is rather
convoluted.

Simplify the logic by introducing a structured type that describes all the
OpenPIC outputs for a single CPU, ie, fixed size of 5 qemu_irq, and only
allocate a smp_cpu sized array of those.

This also allows to use g_new(T, n) instead of g_malloc(sizeof(T) * n)
as recommended in HACKING.

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/ppc/mac_newworld.c    |   30 +++++++++++++-----------------
 include/hw/ppc/openpic.h |    2 ++
 2 files changed, 15 insertions(+), 17 deletions(-)

diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 14273a123e52..8c1bc6dd8a90 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -115,7 +115,7 @@ static void ppc_core99_init(MachineState *machine)
     PowerPCCPU *cpu = NULL;
     CPUPPCState *env = NULL;
     char *filename;
-    qemu_irq **openpic_irqs;
+    IrqLines *openpic_irqs;
     int linux_boot, i, j, k;
     MemoryRegion *ram = g_new(MemoryRegion, 1), *bios = g_new(MemoryRegion, 1);
     hwaddr kernel_base, initrd_base, cmdline_base = 0;
@@ -249,41 +249,37 @@ static void ppc_core99_init(MachineState *machine)
     memory_region_add_subregion(get_system_memory(), 0xf8000000,
                                 sysbus_mmio_get_region(s, 0));
 
-    openpic_irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
-    openpic_irqs[0] =
-        g_malloc0(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
+    openpic_irqs = g_new0(IrqLines, smp_cpus);
     for (i = 0; i < smp_cpus; i++) {
         /* Mac99 IRQ connection between OpenPIC outputs pins
          * and PowerPC input pins
          */
         switch (PPC_INPUT(env)) {
         case PPC_FLAGS_INPUT_6xx:
-            openpic_irqs[i] = openpic_irqs[0] + (i * OPENPIC_OUTPUT_NB);
-            openpic_irqs[i][OPENPIC_OUTPUT_INT] =
+            openpic_irqs[i].irq[OPENPIC_OUTPUT_INT] =
                 ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_INT];
-            openpic_irqs[i][OPENPIC_OUTPUT_CINT] =
+            openpic_irqs[i].irq[OPENPIC_OUTPUT_CINT] =
                 ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_INT];
-            openpic_irqs[i][OPENPIC_OUTPUT_MCK] =
+            openpic_irqs[i].irq[OPENPIC_OUTPUT_MCK] =
                 ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_MCP];
             /* Not connected ? */
-            openpic_irqs[i][OPENPIC_OUTPUT_DEBUG] = NULL;
+            openpic_irqs[i].irq[OPENPIC_OUTPUT_DEBUG] = NULL;
             /* Check this */
-            openpic_irqs[i][OPENPIC_OUTPUT_RESET] =
+            openpic_irqs[i].irq[OPENPIC_OUTPUT_RESET] =
                 ((qemu_irq *)env->irq_inputs)[PPC6xx_INPUT_HRESET];
             break;
 #if defined(TARGET_PPC64)
         case PPC_FLAGS_INPUT_970:
-            openpic_irqs[i] = openpic_irqs[0] + (i * OPENPIC_OUTPUT_NB);
-            openpic_irqs[i][OPENPIC_OUTPUT_INT] =
+            openpic_irqs[i].irq[OPENPIC_OUTPUT_INT] =
                 ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_INT];
-            openpic_irqs[i][OPENPIC_OUTPUT_CINT] =
+            openpic_irqs[i].irq[OPENPIC_OUTPUT_CINT] =
                 ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_INT];
-            openpic_irqs[i][OPENPIC_OUTPUT_MCK] =
+            openpic_irqs[i].irq[OPENPIC_OUTPUT_MCK] =
                 ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_MCP];
             /* Not connected ? */
-            openpic_irqs[i][OPENPIC_OUTPUT_DEBUG] = NULL;
+            openpic_irqs[i].irq[OPENPIC_OUTPUT_DEBUG] = NULL;
             /* Check this */
-            openpic_irqs[i][OPENPIC_OUTPUT_RESET] =
+            openpic_irqs[i].irq[OPENPIC_OUTPUT_RESET] =
                 ((qemu_irq *)env->irq_inputs)[PPC970_INPUT_HRESET];
             break;
 #endif /* defined(TARGET_PPC64) */
@@ -300,7 +296,7 @@ static void ppc_core99_init(MachineState *machine)
     k = 0;
     for (i = 0; i < smp_cpus; i++) {
         for (j = 0; j < OPENPIC_OUTPUT_NB; j++) {
-            sysbus_connect_irq(s, k++, openpic_irqs[i][j]);
+            sysbus_connect_irq(s, k++, openpic_irqs[i].irq[j]);
         }
     }
     g_free(openpic_irqs);
diff --git a/include/hw/ppc/openpic.h b/include/hw/ppc/openpic.h
index 5eb982197d2a..dad08fe9be9e 100644
--- a/include/hw/ppc/openpic.h
+++ b/include/hw/ppc/openpic.h
@@ -20,6 +20,8 @@ enum {
     OPENPIC_OUTPUT_NB,
 };
 
+typedef struct IrqLines { qemu_irq irq[OPENPIC_OUTPUT_NB]; } IrqLines;
+
 #define OPENPIC_MODEL_RAVEN       0
 #define OPENPIC_MODEL_FSL_MPIC_20 1
 #define OPENPIC_MODEL_FSL_MPIC_42 2

[Qemu-devel] [PATCH for-4.0 9/9] e500: simplify IRQ wiring

[Greg Kurz]

The OpenPIC have 5 outputs per connected CPU. The machine init code hence
needs a bi-dimensional array (smp_cpu lines, 5 columns) to wire up the irqs
between the PIC and the CPUs.

The current code first allocates an array of smp_cpus pointers to qemu_irq
type, then it allocates another array of smp_cpus * 5 qemu_irq and fills the
first array with pointers to each line of the second array. This is rather
convoluted.

Simplify the logic by introducing a structured type that describes all the
OpenPIC outputs for a single CPU, ie, fixed size of 5 qemu_irq, and only
allocate a smp_cpu sized array of those.

This also allows to use g_new(T, n) instead of g_malloc(sizeof(T) * n)
as recommended in HACKING.

Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/ppc/e500.c |   18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index e6747fce282a..b20fea0dfcef 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -685,7 +685,7 @@ static void ppce500_cpu_reset(void *opaque)
 }
 
 static DeviceState *ppce500_init_mpic_qemu(PPCE500MachineState *pms,
-                                           qemu_irq **irqs)
+                                           IrqLines  *irqs)
 {
     DeviceState *dev;
     SysBusDevice *s;
@@ -705,7 +705,7 @@ static DeviceState *ppce500_init_mpic_qemu(PPCE500MachineState *pms,
     k = 0;
     for (i = 0; i < smp_cpus; i++) {
         for (j = 0; j < OPENPIC_OUTPUT_NB; j++) {
-            sysbus_connect_irq(s, k++, irqs[i][j]);
+            sysbus_connect_irq(s, k++, irqs[i].irq[j]);
         }
     }
 
@@ -713,7 +713,7 @@ static DeviceState *ppce500_init_mpic_qemu(PPCE500MachineState *pms,
 }
 
 static DeviceState *ppce500_init_mpic_kvm(const PPCE500MachineClass *pmc,
-                                          qemu_irq **irqs, Error **errp)
+                                          IrqLines *irqs, Error **errp)
 {
     Error *err = NULL;
     DeviceState *dev;
@@ -742,7 +742,7 @@ static DeviceState *ppce500_init_mpic_kvm(const PPCE500MachineClass *pmc,
 
 static DeviceState *ppce500_init_mpic(PPCE500MachineState *pms,
                                       MemoryRegion *ccsr,
-                                      qemu_irq **irqs)
+                                      IrqLines *irqs)
 {
     MachineState *machine = MACHINE(pms);
     const PPCE500MachineClass *pmc = PPCE500_MACHINE_GET_CLASS(pms);
@@ -806,15 +806,14 @@ void ppce500_init(MachineState *machine)
     /* irq num for pin INTA, INTB, INTC and INTD is 1, 2, 3 and
      * 4 respectively */
     unsigned int pci_irq_nrs[PCI_NUM_PINS] = {1, 2, 3, 4};
-    qemu_irq **irqs;
+    IrqLines *irqs;
     DeviceState *dev, *mpicdev;
     CPUPPCState *firstenv = NULL;
     MemoryRegion *ccsr_addr_space;
     SysBusDevice *s;
     PPCE500CCSRState *ccsr;
 
-    irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *));
-    irqs[0] = g_malloc0(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB);
+    irqs = g_new0(IrqLines, smp_cpus);
     for (i = 0; i < smp_cpus; i++) {
         PowerPCCPU *cpu;
         CPUState *cs;
@@ -834,10 +833,9 @@ void ppce500_init(MachineState *machine)
             firstenv = env;
         }
 
-        irqs[i] = irqs[0] + (i * OPENPIC_OUTPUT_NB);
         input = (qemu_irq *)env->irq_inputs;
-        irqs[i][OPENPIC_OUTPUT_INT] = input[PPCE500_INPUT_INT];
-        irqs[i][OPENPIC_OUTPUT_CINT] = input[PPCE500_INPUT_CINT];
+        irqs[i].irq[OPENPIC_OUTPUT_INT] = input[PPCE500_INPUT_INT];
+        irqs[i].irq[OPENPIC_OUTPUT_CINT] = input[PPCE500_INPUT_CINT];
         env->spr_cb[SPR_BOOKE_PIR].default_value = cs->cpu_index = i;
         env->mpic_iack = pmc->ccsrbar_base + MPC8544_MPIC_REGS_OFFSET + 0xa0;
 

Re: [Qemu-devel] [PATCH for-4.0 0/9] ppc: get rid of g_malloc(sizeof(T) * n)

[Eric Blake]

On 11/27/18 7:04 AM, Greg Kurz wrote:
> As explained in HACKING, the g_malloc(sizeof(T) * n) construct is unsafe
> because it can't detect multiplication overflowing size_t and doesn't
> allow type checking.
> 
> It appears to be used in a bunch of places though:
> 
> $ git grep -E 'malloc.*sizeof' | grep ' \* '  | wc -l
> 101
> 
> This series fixes the ppc target and ppc machine code. The changes are
> mostly trivial. Only the mac99 and e500 machines required some more work
> that should be reviewed carefully, as it was only compile-tested.

Did you do this all manually, or did you try to use Coccinelle?  Hmm - 
we have a Coccinelle script for this mentioned in commit b45c03f (most 
recently reused in bdd81add) - but it is not yet in scripts/coccinelle/. 
  Maybe that would be worth doing now.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org

Re: [Qemu-devel] [PATCH for-4.0 0/9] ppc: get rid of g_malloc(sizeof(T) * n)

[Greg Kurz]

On Tue, 27 Nov 2018 07:16:44 -0600
Eric Blake <eblake@redhat.com> wrote:

> On 11/27/18 7:04 AM, Greg Kurz wrote:
> > As explained in HACKING, the g_malloc(sizeof(T) * n) construct is unsafe
> > because it can't detect multiplication overflowing size_t and doesn't
> > allow type checking.
> > 
> > It appears to be used in a bunch of places though:
> > 
> > $ git grep -E 'malloc.*sizeof' | grep ' \* '  | wc -l
> > 101
> > 
> > This series fixes the ppc target and ppc machine code. The changes are
> > mostly trivial. Only the mac99 and e500 machines required some more work
> > that should be reviewed carefully, as it was only compile-tested.  
> 
> Did you do this all manually, or did you try to use Coccinelle?  Hmm - 
> we have a Coccinelle script for this mentioned in commit b45c03f (most 
> recently reused in bdd81add) - but it is not yet in scripts/coccinelle/. 
>   Maybe that would be worth doing now.
> 

I did that manually because I didn't know about Markus's Coccinelle
script... Also, I've only fixed the case involving a multiplication,
since HACKING says "g_malloc(sizeof(*v)) are acceptable".

I'll have a look at adding the script in scripts/coccinelle/.

Cheers,

--
Greg

Re: [Qemu-devel] [PATCH for-4.0 3/9] ppc405_boards: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Philippe Mathieu-Daudé]

On 27/11/18 14:05, Greg Kurz wrote:
> Because it is a recommended coding practice (see HACKING).
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>
> ---
>  hw/ppc/ppc405_boards.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/ppc/ppc405_boards.c b/hw/ppc/ppc405_boards.c
> index 3be3fe4432b4..f35b412c88dd 100644
> --- a/hw/ppc/ppc405_boards.c
> +++ b/hw/ppc/ppc405_boards.c
> @@ -149,7 +149,7 @@ static void ref405ep_init(MachineState *machine)
>      MemoryRegion *bios;
>      MemoryRegion *sram = g_new(MemoryRegion, 1);
>      ram_addr_t bdloc;
> -    MemoryRegion *ram_memories = g_malloc(2 * sizeof(*ram_memories));
> +    MemoryRegion *ram_memories = g_new(MemoryRegion, 2);
>      hwaddr ram_bases[2], ram_sizes[2];
>      target_ulong sram_size;
>      long bios_size;
> @@ -446,7 +446,7 @@ static void taihu_405ep_init(MachineState *machine)
>      qemu_irq *pic;
>      MemoryRegion *sysmem = get_system_memory();
>      MemoryRegion *bios;
> -    MemoryRegion *ram_memories = g_malloc(2 * sizeof(*ram_memories));
> +    MemoryRegion *ram_memories = g_new(MemoryRegion, 2);
>      MemoryRegion *ram = g_malloc0(sizeof(*ram));

Why not change both lines here?

       MemoryRegion *ram = g_new0(MemoryRegion, 1);

>      hwaddr ram_bases[2], ram_sizes[2];
>      long bios_size;
> 
> 

Re: [Qemu-devel] [PATCH for-4.0 1/9] target/ppc: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Philippe Mathieu-Daudé]

On 27/11/18 14:05, Greg Kurz wrote:
> Because it is a recommended coding practice (see HACKING).
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

> ---
>  target/ppc/translate_init.inc.c |    6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/target/ppc/translate_init.inc.c b/target/ppc/translate_init.inc.c
> index 168d0cec28b7..03f1d34a9769 100644
> --- a/target/ppc/translate_init.inc.c
> +++ b/target/ppc/translate_init.inc.c
> @@ -9081,13 +9081,13 @@ static void init_ppc_proc(PowerPCCPU *cpu)
>              nb_tlb *= 2;
>          switch (env->tlb_type) {
>          case TLB_6XX:
> -            env->tlb.tlb6 = g_malloc0(nb_tlb * sizeof(ppc6xx_tlb_t));
> +            env->tlb.tlb6 = g_new0(ppc6xx_tlb_t, nb_tlb);
>              break;
>          case TLB_EMB:
> -            env->tlb.tlbe = g_malloc0(nb_tlb * sizeof(ppcemb_tlb_t));
> +            env->tlb.tlbe = g_new0(ppcemb_tlb_t, nb_tlb);
>              break;
>          case TLB_MAS:
> -            env->tlb.tlbm = g_malloc0(nb_tlb * sizeof(ppcmas_tlb_t));
> +            env->tlb.tlbm = g_new0(ppcmas_tlb_t, nb_tlb);
>              break;
>          }
>          /* Pre-compute some useful values */
> 
> 

Re: [Qemu-devel] [PATCH for-4.0 4/9] ppc405_uc: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Philippe Mathieu-Daudé]

On 27/11/18 14:05, Greg Kurz wrote:
> Because it is a recommended coding practice (see HACKING).
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

> ---
>  hw/ppc/ppc405_uc.c |    4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/ppc/ppc405_uc.c b/hw/ppc/ppc405_uc.c
> index 5c58415cf1fd..e1aadf126d59 100644
> --- a/hw/ppc/ppc405_uc.c
> +++ b/hw/ppc/ppc405_uc.c
> @@ -1519,7 +1519,7 @@ CPUPPCState *ppc405cr_init(MemoryRegion *address_space_mem,
>      /* OBP arbitrer */
>      ppc4xx_opba_init(0xef600600);
>      /* Universal interrupt controller */
> -    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
> +    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
>      irqs[PPCUIC_OUTPUT_INT] =
>          ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
>      irqs[PPCUIC_OUTPUT_CINT] =
> @@ -1877,7 +1877,7 @@ CPUPPCState *ppc405ep_init(MemoryRegion *address_space_mem,
>      /* Initialize timers */
>      ppc_booke_timers_init(cpu, sysclk, 0);
>      /* Universal interrupt controller */
> -    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
> +    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
>      irqs[PPCUIC_OUTPUT_INT] =
>          ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
>      irqs[PPCUIC_OUTPUT_CINT] =
> 
> 

Re: [Qemu-devel] [PATCH for-4.0 5/9] ppc440_bamboo: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Philippe Mathieu-Daudé]

On 27/11/18 14:05, Greg Kurz wrote:
> Because it is a recommended coding practice (see HACKING).
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

> ---
>  hw/ppc/ppc440_bamboo.c |    5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
> index f5720f979e42..b8aa55d52669 100644
> --- a/hw/ppc/ppc440_bamboo.c
> +++ b/hw/ppc/ppc440_bamboo.c
> @@ -169,8 +169,7 @@ static void bamboo_init(MachineState *machine)
>      unsigned int pci_irq_nrs[4] = { 28, 27, 26, 25 };
>      MemoryRegion *address_space_mem = get_system_memory();
>      MemoryRegion *isa = g_new(MemoryRegion, 1);
> -    MemoryRegion *ram_memories
> -        = g_malloc(PPC440EP_SDRAM_NR_BANKS * sizeof(*ram_memories));
> +    MemoryRegion *ram_memories = g_new(MemoryRegion, PPC440EP_SDRAM_NR_BANKS);
>      hwaddr ram_bases[PPC440EP_SDRAM_NR_BANKS];
>      hwaddr ram_sizes[PPC440EP_SDRAM_NR_BANKS];
>      qemu_irq *pic;
> @@ -200,7 +199,7 @@ static void bamboo_init(MachineState *machine)
>      ppc_dcr_init(env, NULL, NULL);
>  
>      /* interrupt controller */
> -    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
> +    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
>      irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
>      irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
>      pic = ppcuic_init(env, irqs, 0x0C0, 0, 1);
> 
> 

Re: [Qemu-devel] [PATCH for-4.0 7/9] virtex_ml507: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Philippe Mathieu-Daudé]

On 27/11/18 14:06, Greg Kurz wrote:
> Because it is a recommended coding practice (see HACKING).
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>
> ---
>  hw/ppc/virtex_ml507.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
> index ee9b4b449086..517712057434 100644
> --- a/hw/ppc/virtex_ml507.c
> +++ b/hw/ppc/virtex_ml507.c
> @@ -105,7 +105,7 @@ static PowerPCCPU *ppc440_init_xilinx(ram_addr_t *ram_size,
>      ppc_dcr_init(env, NULL, NULL);
>  
>      /* interrupt controller */
> -    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
> +    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

>      irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
>      irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
>      ppcuic_init(env, irqs, 0x0C0, 0, 1);
> 
> 

Re: [Qemu-devel] [PATCH for-4.0 6/9] sam460ex: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Philippe Mathieu-Daudé]

On 27/11/18 14:06, Greg Kurz wrote:
> Because it is a recommended coding practice (see HACKING).
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

> ---
>  hw/ppc/sam460ex.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
> index 5aac58f36ee1..4b051c0950a9 100644
> --- a/hw/ppc/sam460ex.c
> +++ b/hw/ppc/sam460ex.c
> @@ -430,7 +430,7 @@ static void sam460ex_init(MachineState *machine)
>      ppc4xx_plb_init(env);
>  
>      /* interrupt controllers */
> -    irqs = g_malloc0(sizeof(*irqs) * PPCUIC_OUTPUT_NB);
> +    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
>      irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
>      irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
>      uic[0] = ppcuic_init(env, irqs, 0xc0, 0, 1);
> 
> 

Re: [Qemu-devel] [PATCH for-4.0 3/9] ppc405_boards: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Greg Kurz]

On Tue, 27 Nov 2018 14:41:53 +0100
Philippe Mathieu-Daudé <philmd@redhat.com> wrote:

> On 27/11/18 14:05, Greg Kurz wrote:
> > Because it is a recommended coding practice (see HACKING).
> > 
> > Signed-off-by: Greg Kurz <groug@kaod.org>
> > ---
> >  hw/ppc/ppc405_boards.c |    4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/hw/ppc/ppc405_boards.c b/hw/ppc/ppc405_boards.c
> > index 3be3fe4432b4..f35b412c88dd 100644
> > --- a/hw/ppc/ppc405_boards.c
> > +++ b/hw/ppc/ppc405_boards.c
> > @@ -149,7 +149,7 @@ static void ref405ep_init(MachineState *machine)
> >      MemoryRegion *bios;
> >      MemoryRegion *sram = g_new(MemoryRegion, 1);
> >      ram_addr_t bdloc;
> > -    MemoryRegion *ram_memories = g_malloc(2 * sizeof(*ram_memories));
> > +    MemoryRegion *ram_memories = g_new(MemoryRegion, 2);
> >      hwaddr ram_bases[2], ram_sizes[2];
> >      target_ulong sram_size;
> >      long bios_size;
> > @@ -446,7 +446,7 @@ static void taihu_405ep_init(MachineState *machine)
> >      qemu_irq *pic;
> >      MemoryRegion *sysmem = get_system_memory();
> >      MemoryRegion *bios;
> > -    MemoryRegion *ram_memories = g_malloc(2 * sizeof(*ram_memories));
> > +    MemoryRegion *ram_memories = g_new(MemoryRegion, 2);
> >      MemoryRegion *ram = g_malloc0(sizeof(*ram));  
> 
> Why not change both lines here?
> 
>        MemoryRegion *ram = g_new0(MemoryRegion, 1);
> 

Because HACKING says:

Declarations like T *v = g_malloc(sizeof(*v)) are acceptable, though.

but if there's a consensus on fixing these as well, I'll happily do
it :)

> >      hwaddr ram_bases[2], ram_sizes[2];
> >      long bios_size;
> > 
> >   

Re: [Qemu-devel] [PATCH for-4.0 7/9] virtex_ml507: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Edgar E. Iglesias]

On Tue, Nov 27, 2018 at 02:06:12PM +0100, Greg Kurz wrote:
> Because it is a recommended coding practice (see HACKING).
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>


> ---
>  hw/ppc/virtex_ml507.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
> index ee9b4b449086..517712057434 100644
> --- a/hw/ppc/virtex_ml507.c
> +++ b/hw/ppc/virtex_ml507.c
> @@ -105,7 +105,7 @@ static PowerPCCPU *ppc440_init_xilinx(ram_addr_t *ram_size,
>      ppc_dcr_init(env, NULL, NULL);
>  
>      /* interrupt controller */
> -    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
> +    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
>      irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
>      irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
>      ppcuic_init(env, irqs, 0x0C0, 0, 1);
> 

Re: [Qemu-devel] [PATCH for-4.0 5/9] ppc440_bamboo: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Edgar E. Iglesias]

On Tue, Nov 27, 2018 at 02:05:51PM +0100, Greg Kurz wrote:
> Because it is a recommended coding practice (see HACKING).
> 
> Signed-off-by: Greg Kurz <groug@kaod.org>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>


> ---
>  hw/ppc/ppc440_bamboo.c |    5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
> index f5720f979e42..b8aa55d52669 100644
> --- a/hw/ppc/ppc440_bamboo.c
> +++ b/hw/ppc/ppc440_bamboo.c
> @@ -169,8 +169,7 @@ static void bamboo_init(MachineState *machine)
>      unsigned int pci_irq_nrs[4] = { 28, 27, 26, 25 };
>      MemoryRegion *address_space_mem = get_system_memory();
>      MemoryRegion *isa = g_new(MemoryRegion, 1);
> -    MemoryRegion *ram_memories
> -        = g_malloc(PPC440EP_SDRAM_NR_BANKS * sizeof(*ram_memories));
> +    MemoryRegion *ram_memories = g_new(MemoryRegion, PPC440EP_SDRAM_NR_BANKS);
>      hwaddr ram_bases[PPC440EP_SDRAM_NR_BANKS];
>      hwaddr ram_sizes[PPC440EP_SDRAM_NR_BANKS];
>      qemu_irq *pic;
> @@ -200,7 +199,7 @@ static void bamboo_init(MachineState *machine)
>      ppc_dcr_init(env, NULL, NULL);
>  
>      /* interrupt controller */
> -    irqs = g_malloc0(sizeof(qemu_irq) * PPCUIC_OUTPUT_NB);
> +    irqs = g_new0(qemu_irq, PPCUIC_OUTPUT_NB);
>      irqs[PPCUIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_INT];
>      irqs[PPCUIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPC40x_INPUT_CINT];
>      pic = ppcuic_init(env, irqs, 0x0C0, 0, 1);
> 

Re: [Qemu-devel] [PATCH for-4.0 3/9] ppc405_boards: use g_new(T, n) instead of g_malloc(sizeof(T) * n)

[Philippe Mathieu-Daudé]

On 27/11/18 14:52, Greg Kurz wrote:
> On Tue, 27 Nov 2018 14:41:53 +0100
> Philippe Mathieu-Daudé <philmd@redhat.com> wrote:
> 
>> On 27/11/18 14:05, Greg Kurz wrote:
>>> Because it is a recommended coding practice (see HACKING).
>>>
>>> Signed-off-by: Greg Kurz <groug@kaod.org>
>>> ---
>>>  hw/ppc/ppc405_boards.c |    4 ++--
>>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/hw/ppc/ppc405_boards.c b/hw/ppc/ppc405_boards.c
>>> index 3be3fe4432b4..f35b412c88dd 100644
>>> --- a/hw/ppc/ppc405_boards.c
>>> +++ b/hw/ppc/ppc405_boards.c
>>> @@ -149,7 +149,7 @@ static void ref405ep_init(MachineState *machine)
>>>      MemoryRegion *bios;
>>>      MemoryRegion *sram = g_new(MemoryRegion, 1);
>>>      ram_addr_t bdloc;
>>> -    MemoryRegion *ram_memories = g_malloc(2 * sizeof(*ram_memories));
>>> +    MemoryRegion *ram_memories = g_new(MemoryRegion, 2);
>>>      hwaddr ram_bases[2], ram_sizes[2];
>>>      target_ulong sram_size;
>>>      long bios_size;
>>> @@ -446,7 +446,7 @@ static void taihu_405ep_init(MachineState *machine)
>>>      qemu_irq *pic;
>>>      MemoryRegion *sysmem = get_system_memory();
>>>      MemoryRegion *bios;
>>> -    MemoryRegion *ram_memories = g_malloc(2 * sizeof(*ram_memories));
>>> +    MemoryRegion *ram_memories = g_new(MemoryRegion, 2);
>>>      MemoryRegion *ram = g_malloc0(sizeof(*ram));  
>>
>> Why not change both lines here?
>>
>>        MemoryRegion *ram = g_new0(MemoryRegion, 1);
>>
> 
> Because HACKING says:
> 
> Declarations like T *v = g_malloc(sizeof(*v)) are acceptable, though.

Yes, I agree, but it is weird to have 2 similar lines and only change 1,
for code consistency I'd change both...

> 
> but if there's a consensus on fixing these as well, I'll happily do
> it :)
> 
>>>      hwaddr ram_bases[2], ram_sizes[2];
>>>      long bios_size;
>>>
>>>   
> 

Re: [Qemu-devel] [PATCH for-4.0 0/9] ppc: get rid of g_malloc(sizeof(T) * n)

[David Gibson]

[-- Attachment #1: Type: text/plain, Size: 807 bytes --]

On Tue, Nov 27, 2018 at 02:04:53PM +0100, Greg Kurz wrote:
> As explained in HACKING, the g_malloc(sizeof(T) * n) construct is unsafe
> because it can't detect multiplication overflowing size_t and doesn't
> allow type checking.
> 
> It appears to be used in a bunch of places though:
> 
> $ git grep -E 'malloc.*sizeof' | grep ' \* '  | wc -l
> 101
> 
> This series fixes the ppc target and ppc machine code. The changes are
> mostly trivial. Only the mac99 and e500 machines required some more work
> that should be reviewed carefully, as it was only compile-tested.

Series applied, thanks.


-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]