From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C913E3AFCE7; Tue, 19 May 2026 15:06:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779203167; cv=none; b=gB/oYcfz8DDbpr5Zdj1LckzrApq8FVgahjvq2RyIRYBwM28C9cA6VoLTuifw+rnR4X4KdEriE9pGeifofrkDiRG6+DrgVPNIrivzRo0koaomVMHm4KfvPlHw97xTG4CpBQ0fKeJqk6+i2WJXRKe5KmEIhyXgsYw4T0qHJtg6UxE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779203167; c=relaxed/simple; bh=DMFV9uBMZekgXlaVW/Eg6OWqQPHj5WhH0ysdpCmCSsE=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=j/U/EqhQvMRXo5xX6b4wm2dV3j34XheBhW6xrBYFHQzqNUsiXuFrZiitby7byLbOaVDI1YAT5/hixHGIAge58rPGcvmHJe9hETVpotOMMkyzYGXDxgE4iP1GvDYWqOeF4Eq9j2kTiAACxvaIAlTnpuTLJ5L2tzrVJVuEVWlULPc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=mLYS9NID; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="mLYS9NID" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D9E5AC2BCB3; Tue, 19 May 2026 15:06:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1779203167; bh=DMFV9uBMZekgXlaVW/Eg6OWqQPHj5WhH0ysdpCmCSsE=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date:From; b=mLYS9NIDpjzBuXGupRQTNIXW+MdlHM35a8Bt/FinIvGWie9+hDAtAKLwvR7VIpY9x vkMsBAbfCPDl0JvWCDZRFJyiDlutaeVKWto77amlT6M5/6GgbP8wplPQnLlNq4E9jA +kPFvdq3crnpLqY0g1i14l96K5cjbTz6GutH4y5LnP2PuRnTXsYtWZA20BUC5s5vTf E3AD+rN2AO9wIRsimiiLSgt06//hsNddq/Y/zmd43DdkFTHaB7GNt8zlSdZC2stSJs lOzgURlvm/DbtVILqr7ZELhKoXU/7+NINQCz65fUdilzPZm0QEA02Dtpnuv9nZyIBx DPVYtL69A5ivg== From: sashiko-bot@kernel.org Subject: Re: [PATCH v23 1/8] soc: cadence: Create helper functions for Cadence MHDP Reply-To: sashiko-reviews@lists.linux.dev To: "Laurentiu Palcu" Cc: Frank.Li@kernel.org, robh@kernel.org, linux-phy@lists.infradead.org, imx@lists.linux.dev, neil.armstrong@linaro.org, vkoul@kernel.org, conor+dt@kernel.org, olteanv@gmail.com, devicetree@vger.kernel.org In-Reply-To: <20260519-dcss-hdmi-upstreaming-v23-1-5615524a9c63@oss.nxp.com> References: <20260519-dcss-hdmi-upstreaming-v23-1-5615524a9c63@oss.nxp.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 19 May 2026 15:06:06 +0000 Message-Id: <20260519150606.D9E5AC2BCB3@smtp.kernel.org> Precedence: bulk X-Mailing-List: imx@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 3 potential issue(= s) to consider: - [High] Buffer overflow in cdns_mhdp_secure_mailbox_send_recv_multi() due = to ignored bounds check. - [High] Mailbox size validation bypass and permanent FIFO desynchronizatio= n for opcode 0x09. - [Medium] Mailbox RX FIFO is not properly drained on error paths, leading = to permanent desynchronization. -- commit c962067d82ee12edcd834501898758652f04fb81 Author: Sandor Yu soc: cadence: Create helper functions for Cadence MHDP This commit introduces mailbox communication helper functions for Cadence=20 MHDP IPs. It adds support for both secure and non-secure mailbox access,=20 along with register and DPCD read/write helpers. > diff --git a/drivers/soc/cadence/cdns-mhdp-helper.c b/drivers/soc/cadence= /cdns-mhdp-helper.c > new file mode 100644 > --- /dev/null > +++ b/drivers/soc/cadence/cdns-mhdp-helper.c [ ... ] > +static int mhdp_mailbox_recv_header(struct cdns_mhdp_base *base, > + u8 module_id, u8 opcode, > + u16 req_size, bool secure) > +{ [ ... ] > + /* > + * If the message in mailbox is not what we want, we need to > + * clear the mailbox by reading its contents. > + * Response data length for HDCP TX HDCP_TRAN_IS_REC_ID_VALID depend on > + * case. > + */ > + if (opcode !=3D header[0] || > + module_id !=3D header[1] || > + (opcode !=3D HDCP_TRAN_IS_REC_ID_VALID && req_size !=3D mbox_size)) { Does this bypass apply to any module using opcode 0x09? Looking at the command definitions, DPTX_TRAINING_CONTROL also uses 0x09, which means it would inadvertently bypass this size validation check since the module_id isn't checked here. Additionally, if this check is bypassed and the firmware actually sends an mbox_size larger than what is dynamically read, will those unread bytes remain in the RX FIFO? Could the next mailbox command end up reading those stale leftover bytes as its response header, breaking synchronization? > + for (i =3D 0; i < mbox_size; i++) { > + if (secure) > + ret =3D mhdp_mailbox_read_secure(base); > + else > + ret =3D mhdp_mailbox_read(base); > + if (ret < 0) > + break; > + } > + > + return -EINVAL; > + } > + > + return 0; > +} > + > +static int mhdp_mailbox_recv_data(struct cdns_mhdp_base *base, > + u8 *buff, u16 buff_size, bool secure) > +{ > + u32 i; > + int ret; > + > + for (i =3D 0; i < buff_size; i++) { > + if (secure) > + ret =3D mhdp_mailbox_read_secure(base); > + else > + ret =3D mhdp_mailbox_read(base); > + if (ret < 0) > + return ret; If readx_poll_timeout() fails during the read, does returning directly here leave the rest of the message stuck in the RX FIFO? If a read times out or fails, could the next thread to acquire the mailbox_mutex parse these leftover bytes as a new response header? Should t= he FIFO be explicitly drained when an error occurs to maintain state machine synchronization? > + > + buff[i] =3D ret; > + } > + > + return 0; > +} [ ... ] > +int cdns_mhdp_secure_mailbox_send_recv_multi(struct cdns_mhdp_base *base, > + u8 module_id, u8 opcode, > + u16 msg_size, u8 *msg, > + u8 opcode_resp, > + u16 resp1_size, u8 *resp1, > + u16 resp2_size, u8 *resp2) > +{ [ ... ] > + ret =3D mhdp_mailbox_recv_data(base, resp1, resp1_size, true); > + if (ret) { > + dev_err(base->dev, "ModuleID=3D%d, Resp_CMD=3D%d recv data1 failed: %d= \n", > + module_id, opcode_resp, ret); > + return ret; > + } > + > + /* > + * Response data length for HDCP TX HDCP_TRAN_IS_REC_ID_VALID depend on > + * the number of HDCP receivers in resp1[0]. > + * 1 for regular case, more can be in repeater. > + */ > + if (module_id =3D=3D MB_MODULE_ID_HDCP_TX && > + opcode =3D=3D HDCP_TRAN_IS_REC_ID_VALID) > + ret =3D mhdp_mailbox_recv_data(base, resp2, 5 * resp1[0], true); Could this dynamically calculated length exceed the caller-provided resp2_size buffer capacity? Since resp1[0] is read directly from the hardware response and could be up to 255, this might result in writing up to 1275 bytes into the resp2 buffer. Does this need a bounds check against resp2_size to prevent memory corruption if a misbehaving or compromised device sends a large value? > + else > + ret =3D mhdp_mailbox_recv_data(base, resp2, resp2_size, true); > + if (ret) > + dev_err(base->dev, "ModuleID=3D%d, Resp_CMD=3D%d recv data2 failed: %d= \n", > + module_id, opcode_resp, ret); > + return ret; > +} --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260519-dcss-hdmi-= upstreaming-v23-0-5615524a9c63@oss.nxp.com?part=3D1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id CA109CD4F5B for ; Tue, 19 May 2026 15:06:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=lzNJVNb03weyrmtH6Sf/tG5Hz58t118rWWaeNun80cs=; b=Vc9lctqFASSGe7 oGl/qB4zvKTNizy3nW6nWWgdYb5YO506GgOJ3DZIrpme9Kksoc4DwK6xZbRoRvj4KDTd2uS4U5gT/ xTxJJfPjEHXpuVe/4+wHXiyTN80PwvCWAgEBJINYwlVTSxcOALILBtOU361nY+msZn3W844/ebFYI LBp9OyMMt/NWflCOIvg/d6LgwB1RaePsIwk1CWdccRwNhNyjo2POZQ8qPP2pez2CdWjhhy1F8GZFi hq5igcxa5myyCc5bWWvxSm1Fe4wQwoMmou0F5lVOng18dlIKJBcQN2UzM6EKsLRP34GDzm2yeZuL0 cEqW8a5uCEmUZU1YaAXQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wPM1K-00000001w63-1BBr; Tue, 19 May 2026 15:06:10 +0000 Received: from sea.source.kernel.org ([172.234.252.31]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wPM1I-00000001w5G-0leF for linux-phy@lists.infradead.org; Tue, 19 May 2026 15:06:09 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 7E463441ED; Tue, 19 May 2026 15:06:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D9E5AC2BCB3; Tue, 19 May 2026 15:06:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1779203167; bh=DMFV9uBMZekgXlaVW/Eg6OWqQPHj5WhH0ysdpCmCSsE=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date:From; b=mLYS9NIDpjzBuXGupRQTNIXW+MdlHM35a8Bt/FinIvGWie9+hDAtAKLwvR7VIpY9x vkMsBAbfCPDl0JvWCDZRFJyiDlutaeVKWto77amlT6M5/6GgbP8wplPQnLlNq4E9jA +kPFvdq3crnpLqY0g1i14l96K5cjbTz6GutH4y5LnP2PuRnTXsYtWZA20BUC5s5vTf E3AD+rN2AO9wIRsimiiLSgt06//hsNddq/Y/zmd43DdkFTHaB7GNt8zlSdZC2stSJs lOzgURlvm/DbtVILqr7ZELhKoXU/7+NINQCz65fUdilzPZm0QEA02Dtpnuv9nZyIBx DPVYtL69A5ivg== From: sashiko-bot@kernel.org Subject: Re: [PATCH v23 1/8] soc: cadence: Create helper functions for Cadence MHDP To: "Laurentiu Palcu" Cc: Frank.Li@kernel.org, robh@kernel.org, linux-phy@lists.infradead.org, imx@lists.linux.dev, neil.armstrong@linaro.org, vkoul@kernel.org, conor+dt@kernel.org, olteanv@gmail.com, devicetree@vger.kernel.org In-Reply-To: <20260519-dcss-hdmi-upstreaming-v23-1-5615524a9c63@oss.nxp.com> References: <20260519-dcss-hdmi-upstreaming-v23-1-5615524a9c63@oss.nxp.com> Date: Tue, 19 May 2026 15:06:06 +0000 Message-Id: <20260519150606.D9E5AC2BCB3@smtp.kernel.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260519_080608_261457_08CADE5A X-CRM114-Status: GOOD ( 21.63 ) X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MyBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6Ci0gW0hpZ2hdIEJ1ZmZlciBvdmVyZmxv dyBpbiBjZG5zX21oZHBfc2VjdXJlX21haWxib3hfc2VuZF9yZWN2X211bHRpKCkgZHVlIHRvIGln bm9yZWQgYm91bmRzIGNoZWNrLgotIFtIaWdoXSBNYWlsYm94IHNpemUgdmFsaWRhdGlvbiBieXBh c3MgYW5kIHBlcm1hbmVudCBGSUZPIGRlc3luY2hyb25pemF0aW9uIGZvciBvcGNvZGUgMHgwOS4K LSBbTWVkaXVtXSBNYWlsYm94IFJYIEZJRk8gaXMgbm90IHByb3Blcmx5IGRyYWluZWQgb24gZXJy b3IgcGF0aHMsIGxlYWRpbmcgdG8gcGVybWFuZW50IGRlc3luY2hyb25pemF0aW9uLgotLQoKY29t bWl0IGM5NjIwNjdkODJlZTEyZWRjZDgzNDUwMTg5ODc1ODY1MmYwNGZiODEKQXV0aG9yOiBTYW5k b3IgWXUgPFNhbmRvci55dUBueHAuY29tPgpzb2M6IGNhZGVuY2U6IENyZWF0ZSBoZWxwZXIgZnVu Y3Rpb25zIGZvciBDYWRlbmNlIE1IRFAKClRoaXMgY29tbWl0IGludHJvZHVjZXMgbWFpbGJveCBj b21tdW5pY2F0aW9uIGhlbHBlciBmdW5jdGlvbnMgZm9yIENhZGVuY2UgCk1IRFAgSVBzLiBJdCBh ZGRzIHN1cHBvcnQgZm9yIGJvdGggc2VjdXJlIGFuZCBub24tc2VjdXJlIG1haWxib3ggYWNjZXNz LCAKYWxvbmcgd2l0aCByZWdpc3RlciBhbmQgRFBDRCByZWFkL3dyaXRlIGhlbHBlcnMuCgo+IGRp ZmYgLS1naXQgYS9kcml2ZXJzL3NvYy9jYWRlbmNlL2NkbnMtbWhkcC1oZWxwZXIuYyBiL2RyaXZl cnMvc29jL2NhZGVuY2UvY2Rucy1taGRwLWhlbHBlci5jCj4gbmV3IGZpbGUgbW9kZSAxMDA2NDQK PiAtLS0gL2Rldi9udWxsCj4gKysrIGIvZHJpdmVycy9zb2MvY2FkZW5jZS9jZG5zLW1oZHAtaGVs cGVyLmMKWyAuLi4gXQo+ICtzdGF0aWMgaW50IG1oZHBfbWFpbGJveF9yZWN2X2hlYWRlcihzdHJ1 Y3QgY2Ruc19taGRwX2Jhc2UgKmJhc2UsCj4gKwkJCQkgICAgdTggbW9kdWxlX2lkLCB1OCBvcGNv ZGUsCj4gKwkJCQkgICAgdTE2IHJlcV9zaXplLCBib29sIHNlY3VyZSkKPiArewpbIC4uLiBdCj4g KwkvKgo+ICsJICogSWYgdGhlIG1lc3NhZ2UgaW4gbWFpbGJveCBpcyBub3Qgd2hhdCB3ZSB3YW50 LCB3ZSBuZWVkIHRvCj4gKwkgKiBjbGVhciB0aGUgbWFpbGJveCBieSByZWFkaW5nIGl0cyBjb250 ZW50cy4KPiArCSAqIFJlc3BvbnNlIGRhdGEgbGVuZ3RoIGZvciBIRENQIFRYIEhEQ1BfVFJBTl9J U19SRUNfSURfVkFMSUQgZGVwZW5kIG9uCj4gKwkgKiBjYXNlLgo+ICsJICovCj4gKwlpZiAob3Bj b2RlICE9IGhlYWRlclswXSB8fAo+ICsJICAgIG1vZHVsZV9pZCAhPSBoZWFkZXJbMV0gfHwKPiAr CSAgIChvcGNvZGUgIT0gSERDUF9UUkFOX0lTX1JFQ19JRF9WQUxJRCAmJiByZXFfc2l6ZSAhPSBt Ym94X3NpemUpKSB7CgpEb2VzIHRoaXMgYnlwYXNzIGFwcGx5IHRvIGFueSBtb2R1bGUgdXNpbmcg b3Bjb2RlIDB4MDk/CgpMb29raW5nIGF0IHRoZSBjb21tYW5kIGRlZmluaXRpb25zLCBEUFRYX1RS QUlOSU5HX0NPTlRST0wgYWxzbyB1c2VzIDB4MDksCndoaWNoIG1lYW5zIGl0IHdvdWxkIGluYWR2 ZXJ0ZW50bHkgYnlwYXNzIHRoaXMgc2l6ZSB2YWxpZGF0aW9uIGNoZWNrIHNpbmNlCnRoZSBtb2R1 bGVfaWQgaXNuJ3QgY2hlY2tlZCBoZXJlLgoKQWRkaXRpb25hbGx5LCBpZiB0aGlzIGNoZWNrIGlz IGJ5cGFzc2VkIGFuZCB0aGUgZmlybXdhcmUgYWN0dWFsbHkgc2VuZHMgYW4KbWJveF9zaXplIGxh cmdlciB0aGFuIHdoYXQgaXMgZHluYW1pY2FsbHkgcmVhZCwgd2lsbCB0aG9zZSB1bnJlYWQgYnl0 ZXMKcmVtYWluIGluIHRoZSBSWCBGSUZPPyBDb3VsZCB0aGUgbmV4dCBtYWlsYm94IGNvbW1hbmQg ZW5kIHVwIHJlYWRpbmcgdGhvc2UKc3RhbGUgbGVmdG92ZXIgYnl0ZXMgYXMgaXRzIHJlc3BvbnNl IGhlYWRlciwgYnJlYWtpbmcgc3luY2hyb25pemF0aW9uPwoKPiArCQlmb3IgKGkgPSAwOyBpIDwg bWJveF9zaXplOyBpKyspIHsKPiArCQkJaWYgKHNlY3VyZSkKPiArCQkJCXJldCA9IG1oZHBfbWFp bGJveF9yZWFkX3NlY3VyZShiYXNlKTsKPiArCQkJZWxzZQo+ICsJCQkJcmV0ID0gbWhkcF9tYWls Ym94X3JlYWQoYmFzZSk7Cj4gKwkJCWlmIChyZXQgPCAwKQo+ICsJCQkJYnJlYWs7Cj4gKwkJfQo+ ICsKPiArCQlyZXR1cm4gLUVJTlZBTDsKPiArCX0KPiArCj4gKwlyZXR1cm4gMDsKPiArfQo+ICsK PiArc3RhdGljIGludCBtaGRwX21haWxib3hfcmVjdl9kYXRhKHN0cnVjdCBjZG5zX21oZHBfYmFz ZSAqYmFzZSwKPiArCQkJCSAgdTggKmJ1ZmYsIHUxNiBidWZmX3NpemUsIGJvb2wgc2VjdXJlKQo+ ICt7Cj4gKwl1MzIgaTsKPiArCWludCByZXQ7Cj4gKwo+ICsJZm9yIChpID0gMDsgaSA8IGJ1ZmZf c2l6ZTsgaSsrKSB7Cj4gKwkJaWYgKHNlY3VyZSkKPiArCQkJcmV0ID0gbWhkcF9tYWlsYm94X3Jl YWRfc2VjdXJlKGJhc2UpOwo+ICsJCWVsc2UKPiArCQkJcmV0ID0gbWhkcF9tYWlsYm94X3JlYWQo YmFzZSk7Cj4gKwkJaWYgKHJldCA8IDApCj4gKwkJCXJldHVybiByZXQ7CgpJZiByZWFkeF9wb2xs X3RpbWVvdXQoKSBmYWlscyBkdXJpbmcgdGhlIHJlYWQsIGRvZXMgcmV0dXJuaW5nIGRpcmVjdGx5 IGhlcmUKbGVhdmUgdGhlIHJlc3Qgb2YgdGhlIG1lc3NhZ2Ugc3R1Y2sgaW4gdGhlIFJYIEZJRk8/ CgpJZiBhIHJlYWQgdGltZXMgb3V0IG9yIGZhaWxzLCBjb3VsZCB0aGUgbmV4dCB0aHJlYWQgdG8g YWNxdWlyZSB0aGUKbWFpbGJveF9tdXRleCBwYXJzZSB0aGVzZSBsZWZ0b3ZlciBieXRlcyBhcyBh IG5ldyByZXNwb25zZSBoZWFkZXI/IFNob3VsZCB0aGUKRklGTyBiZSBleHBsaWNpdGx5IGRyYWlu ZWQgd2hlbiBhbiBlcnJvciBvY2N1cnMgdG8gbWFpbnRhaW4gc3RhdGUgbWFjaGluZQpzeW5jaHJv bml6YXRpb24/Cgo+ICsKPiArCQlidWZmW2ldID0gcmV0Owo+ICsJfQo+ICsKPiArCXJldHVybiAw Owo+ICt9ClsgLi4uIF0KPiAraW50IGNkbnNfbWhkcF9zZWN1cmVfbWFpbGJveF9zZW5kX3JlY3Zf bXVsdGkoc3RydWN0IGNkbnNfbWhkcF9iYXNlICpiYXNlLAo+ICsJCQkJCSAgICAgdTggbW9kdWxl X2lkLCB1OCBvcGNvZGUsCj4gKwkJCQkJICAgICB1MTYgbXNnX3NpemUsIHU4ICptc2csCj4gKwkJ CQkJICAgICB1OCBvcGNvZGVfcmVzcCwKPiArCQkJCQkgICAgIHUxNiByZXNwMV9zaXplLCB1OCAq cmVzcDEsCj4gKwkJCQkJICAgICB1MTYgcmVzcDJfc2l6ZSwgdTggKnJlc3AyKQo+ICt7ClsgLi4u IF0KPiArCXJldCA9IG1oZHBfbWFpbGJveF9yZWN2X2RhdGEoYmFzZSwgcmVzcDEsIHJlc3AxX3Np emUsIHRydWUpOwo+ICsJaWYgKHJldCkgewo+ICsJCWRldl9lcnIoYmFzZS0+ZGV2LCAiTW9kdWxl SUQ9JWQsIFJlc3BfQ01EPSVkIHJlY3YgZGF0YTEgZmFpbGVkOiAlZFxuIiwKPiArCQkJbW9kdWxl X2lkLCBvcGNvZGVfcmVzcCwgcmV0KTsKPiArCQlyZXR1cm4gcmV0Owo+ICsJfQo+ICsKPiArCS8q Cj4gKwkgKiBSZXNwb25zZSBkYXRhIGxlbmd0aCBmb3IgSERDUCBUWCBIRENQX1RSQU5fSVNfUkVD X0lEX1ZBTElEIGRlcGVuZCBvbgo+ICsJICogdGhlIG51bWJlciBvZiBIRENQIHJlY2VpdmVycyBp biByZXNwMVswXS4KPiArCSAqIDEgZm9yIHJlZ3VsYXIgY2FzZSwgbW9yZSBjYW4gYmUgaW4gcmVw ZWF0ZXIuCj4gKwkgKi8KPiArCWlmIChtb2R1bGVfaWQgPT0gTUJfTU9EVUxFX0lEX0hEQ1BfVFgg JiYKPiArCSAgICBvcGNvZGUgPT0gSERDUF9UUkFOX0lTX1JFQ19JRF9WQUxJRCkKPiArCQlyZXQg PSBtaGRwX21haWxib3hfcmVjdl9kYXRhKGJhc2UsIHJlc3AyLCA1ICogcmVzcDFbMF0sIHRydWUp OwoKQ291bGQgdGhpcyBkeW5hbWljYWxseSBjYWxjdWxhdGVkIGxlbmd0aCBleGNlZWQgdGhlIGNh bGxlci1wcm92aWRlZApyZXNwMl9zaXplIGJ1ZmZlciBjYXBhY2l0eT8KClNpbmNlIHJlc3AxWzBd IGlzIHJlYWQgZGlyZWN0bHkgZnJvbSB0aGUgaGFyZHdhcmUgcmVzcG9uc2UgYW5kIGNvdWxkIGJl IHVwCnRvIDI1NSwgdGhpcyBtaWdodCByZXN1bHQgaW4gd3JpdGluZyB1cCB0byAxMjc1IGJ5dGVz IGludG8gdGhlIHJlc3AyCmJ1ZmZlci4gRG9lcyB0aGlzIG5lZWQgYSBib3VuZHMgY2hlY2sgYWdh aW5zdCByZXNwMl9zaXplIHRvIHByZXZlbnQgbWVtb3J5CmNvcnJ1cHRpb24gaWYgYSBtaXNiZWhh dmluZyBvciBjb21wcm9taXNlZCBkZXZpY2Ugc2VuZHMgYSBsYXJnZSB2YWx1ZT8KCj4gKwllbHNl Cj4gKwkJcmV0ID0gbWhkcF9tYWlsYm94X3JlY3ZfZGF0YShiYXNlLCByZXNwMiwgcmVzcDJfc2l6 ZSwgdHJ1ZSk7Cj4gKwlpZiAocmV0KQo+ICsJCWRldl9lcnIoYmFzZS0+ZGV2LCAiTW9kdWxlSUQ9 JWQsIFJlc3BfQ01EPSVkIHJlY3YgZGF0YTIgZmFpbGVkOiAlZFxuIiwKPiArCQkJbW9kdWxlX2lk LCBvcGNvZGVfcmVzcCwgcmV0KTsKPiArCXJldHVybiByZXQ7Cj4gK30KCi0tIApTYXNoaWtvIEFJ IHJldmlldyDCtyBodHRwczovL3Nhc2hpa28uZGV2LyMvcGF0Y2hzZXQvMjAyNjA1MTktZGNzcy1o ZG1pLXVwc3RyZWFtaW5nLXYyMy0wLTU2MTU1MjRhOWM2M0Bvc3MubnhwLmNvbT9wYXJ0PTEKCi0t IApsaW51eC1waHkgbWFpbGluZyBsaXN0CmxpbnV4LXBoeUBsaXN0cy5pbmZyYWRlYWQub3JnCmh0 dHBzOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LXBoeQo=