From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 948492E3709; Tue, 19 May 2026 16:11:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779207076; cv=none; b=txrwEahvW6SvDak8ody5LgDCaPXNTUvjknzU40xFzDdyHCxQz9htmcM/gke2nubqLTFJvy8its3wMke1czs1WZadm+At2e0vvfZ9cA9RO370pNxcVUJ8rzK8T8E3+uRqL6IzHTpvpXfZ7GlFF6HkO3JWv0SYl000lga1EolIxSs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779207076; c=relaxed/simple; bh=trZIadoytzbfIBSQtzAvLSVb1hPuPoV+47zfFFPiINo=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=laTHgzuz/fgAssTPRaekg0lFbL/jabZA1DRBa/WeQNENngQucM3xJF46U5gAL7TbLTcqUF5IxGCNi3dh636ljoM/W9eQ6tkzBZ5Gd+i56Yl75e+ficfvIjz3mV/Ysb39pBz2bQPGUQtHWgu/mHHKEG6k0OAFdHqKmvnC0s7PHq0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=VR96cqep; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="VR96cqep" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CDC43C2BCB3; Tue, 19 May 2026 16:11:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1779207076; bh=trZIadoytzbfIBSQtzAvLSVb1hPuPoV+47zfFFPiINo=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date:From; b=VR96cqepf/3WeIsg5BahVa1aibmQHaw0hjEjepqvQBNSgp7W2S2xZlg6In47BZHF2 fBfIzpvClzDOfb9fGSDZc10m2nNe9mcg/vMLZfYI+mCHyI2U/Ak4bIT9OwIXaNjP1e vfw4AhEo3Sy3bHbbNVqLX4Czu4pcOcu9si1T0zmAouM5FR2KbV45Nr5Cdt8sL13Ke7 icNy9/7q6yYLhlepmD4EJ4Le2O1iACs+AzKX2dW5Kr42LJElbc+8BNwxwdMrqloZx3 ExxErugSKcKNa056cooZ5zFY1+J/U6Ax5w/KySLPQNkhGhxVpGT7CCmzn5d5A3+lGx ojeaqAwh0lsIg== From: sashiko-bot@kernel.org Subject: Re: [PATCH v23 2/8] drm: bridge: cadence: Update mhdp8546 mailbox access functions Reply-To: sashiko-reviews@lists.linux.dev To: "Laurentiu Palcu" Cc: Frank.Li@kernel.org, vkoul@kernel.org, conor+dt@kernel.org, linux-phy@lists.infradead.org, imx@lists.linux.dev, devicetree@vger.kernel.org, robh@kernel.org, neil.armstrong@linaro.org, olteanv@gmail.com In-Reply-To: <20260519-dcss-hdmi-upstreaming-v23-2-5615524a9c63@oss.nxp.com> References: <20260519-dcss-hdmi-upstreaming-v23-2-5615524a9c63@oss.nxp.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 19 May 2026 16:11:15 +0000 Message-Id: <20260519161115.CDC43C2BCB3@smtp.kernel.org> Precedence: bulk X-Mailing-List: imx@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 8 potential issue(= s) to consider: New issues: - [High] Calling disable_irq() on a devm-managed IRQ permanently disables i= t across probe cycles. Pre-existing issues: - [Critical] Stack-based buffer overflow when parsing HDCP receiver IDs. - [High] cdns_mhdp_get_edid_block() silently returns success when EDID bloc= k validation fails. - [High] IRQ handler is requested and enabled before the wait queues and wo= rk items it depends on are initialized. - [High] Work items are not cancelled on probe error paths, leading to use-= after-free. - [High] HDCP work items are intentionally not cancelled during driver remo= val, leading to use-after-free. - [High] Concurrent read-modify-write operations on mhdp->sw_events can res= ult in lost software events. - [High] Asynchronous firmware load callback can cause a use-after-free on = remove timeout. -- commit 68527048a69af8f87537e4a9dc19aa348ad8c6b4 Author: Sandor Yu Subject: drm: bridge: cadence: Update mhdp8546 mailbox access functions The patch replaces the basic mailbox access functions with new mailbox help= er functions for MHDP commands. All MHDP commands passed through the mailbox a= re rewritten to utilize these new helper routines. > diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c b/driver= s/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c > index 064c6915c8960..cb151da0db13d 100644 > --- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c > +++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c [ ... ] > @@ -418,28 +118,17 @@ int cdns_mhdp_get_edid_block(void *data, u8 *edid, > u8 msg[2], reg[2], i; > int ret; > =20 > - mutex_lock(&mhdp->mbox_mutex); > - > for (i =3D 0; i < 4; i++) { [ ... ] > + ret =3D cdns_mhdp_mailbox_send_recv_multi(&mhdp->base, > + MB_MODULE_ID_DP_TX, > + DPTX_GET_EDID, > + sizeof(msg), msg, > + DPTX_GET_EDID, > + sizeof(reg), reg, > + length, edid); > if (ret) > continue; > =20 > + if (reg[0] =3D=3D length && reg[1] =3D=3D block / 2) > break; > } > =20 > - mutex_unlock(&mhdp->mbox_mutex); > - > if (ret) > dev_err(mhdp->dev, "get block[%d] edid failed: %d\n", > block, ret); > =20 > return ret; [Severity: High] This is a pre-existing issue, but does this function silently return success when EDID block validation fails?=20 If the loop retries 4 times and the condition checking the register values evaluates to false each time, the loop finishes with ret equal to 0.=20 Could this cause the DRM subsystem to subsequently use an uninitialized or corrupt edid buffer? [ ... ] > @@ -2338,12 +2005,12 @@ static int cdns_mhdp_probe(struct platform_device= *pdev) [ ... ] > - irq =3D platform_get_irq(pdev, 0); > - ret =3D devm_request_threaded_irq(mhdp->dev, irq, NULL, > + mhdp->irq =3D platform_get_irq(pdev, 0); > + ret =3D devm_request_threaded_irq(mhdp->dev, mhdp->irq, NULL, > cdns_mhdp_irq_handler, IRQF_ONESHOT, > "mhdp8546", mhdp); > if (ret) { > - dev_err(dev, "cannot install IRQ %d\n", irq); > + dev_err(dev, "cannot install IRQ %d\n", mhdp->irq); > ret =3D -EIO; > goto plat_fini; > } [Severity: High] This is a pre-existing issue, but is the IRQ handler requested and enabled before the wait queues and work items it depends on are initialized? Looking further down in this function, the initialization for the work items and waitqueues occurs after this point. If an interrupt triggers in this window, could the handler call wake_up or schedule_work on uninitialized structures and cause a panic? [Severity: High] This isn't a bug introduced by this patch, but can concurrent read-modify-w= rite operations on the software events field result in lost events?=20 The IRQ handler sets bits while the wait routine clears them. Is there a ra= ce condition here if neither operation is atomic and no lock protects them? [Severity: High] This is also a pre-existing issue, but are the work items properly cancelled on probe error paths?=20 If probe fails after the IRQ is requested, for example during the firmware load phase, the devm cleanup will free the mhdp structure. Since the work items are not explicitly cancelled, could a queued work item execute after the memory is freed and cause a use-after-free? [ ... ] > @@ -2408,6 +2075,10 @@ static void cdns_mhdp_remove(struct platform_devic= e *pdev) > =20 > drm_bridge_remove(&mhdp->bridge); > =20 > + disable_irq(mhdp->irq); > + cancel_work_sync(&mhdp->modeset_retry_work); > + flush_work(&mhdp->hpd_work); > + > ret =3D wait_event_timeout(mhdp->fw_load_wq, > mhdp->hw_state =3D=3D MHDP_HW_READY, > timeout); [Severity: High] Does calling disable_irq on a devm-managed IRQ permanently disable it across probe cycles?=20 Since the devm cleanup does not reset the IRQ disable depth when it frees the irq, won't this leave the disable depth imbalanced if the driver is re-probed later, preventing it from receiving any interrupts? [Severity: High] This is a pre-existing issue, but can the asynchronous firmware load callba= ck cause a use-after-free on a remove timeout?=20 If the wait condition times out, this function logs an error and proceeds, eventually allowing devm to free the mhdp structure. Since the asynchronous request does not cancel pending callbacks, could the delayed callback run a= nd dereference the freed pointer? [ ... ] > @@ -2433,8 +2104,7 @@ static void cdns_mhdp_remove(struct platform_device= *pdev) > pm_runtime_put_sync(&pdev->dev); > pm_runtime_disable(&pdev->dev); > =20 > - cancel_work_sync(&mhdp->modeset_retry_work); > - flush_work(&mhdp->hpd_work); > + mutex_destroy(&mhdp->base.mailbox_mutex); > /* Ignoring mhdp->hdcp.check_work and mhdp->hdcp.prop_work here. */ > } [Severity: High] This is a pre-existing issue, but are the HDCP work items intentionally left uncancelled during driver removal?=20 Because they are ignored here, couldn't they remain queued or actively executing after the mhdp structure is freed by devm cleanup, resulting in a use-after-free? > diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c b/driver= s/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c > index 5cd0b873e16f9..1b5c90af63dee 100644 > --- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c > +++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c [ ... ] > @@ -170,98 +46,52 @@ static u8 cdns_mhdp_hdcp_handle_status(struct cdns_m= hdp_device *mhdp, [ ... ] > static int cdns_mhdp_hdcp_rx_id_valid(struct cdns_mhdp_device *mhdp, > u8 *recv_num, u8 *hdcp_rx_id) > { > u8 rec_id_hdr[2]; > - u8 status; > int ret; > =20 > - mutex_lock(&mhdp->mbox_mutex); > - ret =3D cdns_mhdp_secure_mailbox_send(mhdp, MB_MODULE_ID_HDCP_TX, > - HDCP_TRAN_IS_REC_ID_VALID, 0, NULL); [ ... ] > + ret =3D cdns_mhdp_secure_mailbox_send_recv_multi(&mhdp->base, > + MB_MODULE_ID_HDCP_TX, > + HDCP_TRAN_IS_REC_ID_VALID, > + 0, NULL, > + HDCP_TRAN_IS_REC_ID_VALID, > + sizeof(rec_id_hdr), rec_id_hdr, > + 0, hdcp_rx_id); > if (ret) > - goto err_rx_id_valid; > + return ret; [Severity: Critical] This isn't a bug introduced by this patch, but does this pattern allow a stack-based buffer overflow when parsing HDCP receiver IDs?=20 If the pointer passed to this function points to a fixed-size stack array, and the mailbox helper relies on the receiver count from the external sink to determine how many bytes to write, could a malicious or malfunctioning sink returning a large receiver count write out of bounds? --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260519-dcss-hdmi-= upstreaming-v23-0-5615524a9c63@oss.nxp.com?part=3D2 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B650BCD4F3C for ; Tue, 19 May 2026 16:11:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=I9hNBBkfmN3Shw/UrljoZELitcz1Rf0rw1KR9FWGzQE=; b=NZQEK/cFae1Dcl zdAv9c0Cz04U9GSaPD5sY0kMf2Mg+IpTIGmNfI8ftjfR9vB3iNj6YTQhq3AMS3gHc61wqNvSBTFK5 v0MNVX8zxPOg1lrOUxqry65L2CrOGs4Gug/lENh6qX3FgrPW5Lbt8/RCTOB+kD1Ulfd9IW9F/qxFt dNOG/33TyrMeCfEKf7wvRC6ZQlYDcssKa0fSTiajdVKMnOUguFS6ru9SUUwxGFV0jq0p7eWcvvdd9 029+ScDVmN+krIDtL/d+h4ujKDd6rdruK7UzpZfl0Kw+mKNj3ZY0KZ386Lp6NrTpQGKzRZTdV27Wq L8LdNEw8Q8YB4ed7WdCQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wPN2N-00000002BaE-22Nj; Tue, 19 May 2026 16:11:19 +0000 Received: from sea.source.kernel.org ([172.234.252.31]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wPN2K-00000002BZb-3wrR for linux-phy@lists.infradead.org; Tue, 19 May 2026 16:11:18 +0000 Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 5E7FD401E1; Tue, 19 May 2026 16:11:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CDC43C2BCB3; Tue, 19 May 2026 16:11:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1779207076; bh=trZIadoytzbfIBSQtzAvLSVb1hPuPoV+47zfFFPiINo=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date:From; b=VR96cqepf/3WeIsg5BahVa1aibmQHaw0hjEjepqvQBNSgp7W2S2xZlg6In47BZHF2 fBfIzpvClzDOfb9fGSDZc10m2nNe9mcg/vMLZfYI+mCHyI2U/Ak4bIT9OwIXaNjP1e vfw4AhEo3Sy3bHbbNVqLX4Czu4pcOcu9si1T0zmAouM5FR2KbV45Nr5Cdt8sL13Ke7 icNy9/7q6yYLhlepmD4EJ4Le2O1iACs+AzKX2dW5Kr42LJElbc+8BNwxwdMrqloZx3 ExxErugSKcKNa056cooZ5zFY1+J/U6Ax5w/KySLPQNkhGhxVpGT7CCmzn5d5A3+lGx ojeaqAwh0lsIg== From: sashiko-bot@kernel.org Subject: Re: [PATCH v23 2/8] drm: bridge: cadence: Update mhdp8546 mailbox access functions To: "Laurentiu Palcu" Cc: Frank.Li@kernel.org, vkoul@kernel.org, conor+dt@kernel.org, linux-phy@lists.infradead.org, imx@lists.linux.dev, devicetree@vger.kernel.org, robh@kernel.org, neil.armstrong@linaro.org, olteanv@gmail.com In-Reply-To: <20260519-dcss-hdmi-upstreaming-v23-2-5615524a9c63@oss.nxp.com> References: <20260519-dcss-hdmi-upstreaming-v23-2-5615524a9c63@oss.nxp.com> Date: Tue, 19 May 2026 16:11:15 +0000 Message-Id: <20260519161115.CDC43C2BCB3@smtp.kernel.org> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260519_091117_021231_4EE4E367 X-CRM114-Status: GOOD ( 24.78 ) X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg OCBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpOZXcgaXNzdWVzOgotIFtIaWdoXSBD YWxsaW5nIGRpc2FibGVfaXJxKCkgb24gYSBkZXZtLW1hbmFnZWQgSVJRIHBlcm1hbmVudGx5IGRp c2FibGVzIGl0IGFjcm9zcyBwcm9iZSBjeWNsZXMuCgpQcmUtZXhpc3RpbmcgaXNzdWVzOgotIFtD cml0aWNhbF0gU3RhY2stYmFzZWQgYnVmZmVyIG92ZXJmbG93IHdoZW4gcGFyc2luZyBIRENQIHJl Y2VpdmVyIElEcy4KLSBbSGlnaF0gY2Ruc19taGRwX2dldF9lZGlkX2Jsb2NrKCkgc2lsZW50bHkg cmV0dXJucyBzdWNjZXNzIHdoZW4gRURJRCBibG9jayB2YWxpZGF0aW9uIGZhaWxzLgotIFtIaWdo XSBJUlEgaGFuZGxlciBpcyByZXF1ZXN0ZWQgYW5kIGVuYWJsZWQgYmVmb3JlIHRoZSB3YWl0IHF1 ZXVlcyBhbmQgd29yayBpdGVtcyBpdCBkZXBlbmRzIG9uIGFyZSBpbml0aWFsaXplZC4KLSBbSGln aF0gV29yayBpdGVtcyBhcmUgbm90IGNhbmNlbGxlZCBvbiBwcm9iZSBlcnJvciBwYXRocywgbGVh ZGluZyB0byB1c2UtYWZ0ZXItZnJlZS4KLSBbSGlnaF0gSERDUCB3b3JrIGl0ZW1zIGFyZSBpbnRl bnRpb25hbGx5IG5vdCBjYW5jZWxsZWQgZHVyaW5nIGRyaXZlciByZW1vdmFsLCBsZWFkaW5nIHRv IHVzZS1hZnRlci1mcmVlLgotIFtIaWdoXSBDb25jdXJyZW50IHJlYWQtbW9kaWZ5LXdyaXRlIG9w ZXJhdGlvbnMgb24gbWhkcC0+c3dfZXZlbnRzIGNhbiByZXN1bHQgaW4gbG9zdCBzb2Z0d2FyZSBl dmVudHMuCi0gW0hpZ2hdIEFzeW5jaHJvbm91cyBmaXJtd2FyZSBsb2FkIGNhbGxiYWNrIGNhbiBj YXVzZSBhIHVzZS1hZnRlci1mcmVlIG9uIHJlbW92ZSB0aW1lb3V0LgotLQoKY29tbWl0IDY4NTI3 MDQ4YTY5YWY4Zjg3NTM3ZTRhOWRjMTlhYTM0OGFkOGM2YjQKQXV0aG9yOiBTYW5kb3IgWXUgPFNh bmRvci55dUBueHAuY29tPgpTdWJqZWN0OiBkcm06IGJyaWRnZTogY2FkZW5jZTogVXBkYXRlIG1o ZHA4NTQ2IG1haWxib3ggYWNjZXNzIGZ1bmN0aW9ucwoKVGhlIHBhdGNoIHJlcGxhY2VzIHRoZSBi YXNpYyBtYWlsYm94IGFjY2VzcyBmdW5jdGlvbnMgd2l0aCBuZXcgbWFpbGJveCBoZWxwZXIKZnVu Y3Rpb25zIGZvciBNSERQIGNvbW1hbmRzLiBBbGwgTUhEUCBjb21tYW5kcyBwYXNzZWQgdGhyb3Vn aCB0aGUgbWFpbGJveCBhcmUKcmV3cml0dGVuIHRvIHV0aWxpemUgdGhlc2UgbmV3IGhlbHBlciBy b3V0aW5lcy4KCj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1L2RybS9icmlkZ2UvY2FkZW5jZS9j ZG5zLW1oZHA4NTQ2LWNvcmUuYyBiL2RyaXZlcnMvZ3B1L2RybS9icmlkZ2UvY2FkZW5jZS9jZG5z LW1oZHA4NTQ2LWNvcmUuYwo+IGluZGV4IDA2NGM2OTE1Yzg5NjAuLmNiMTUxZGEwZGIxM2QgMTAw NjQ0Cj4gLS0tIGEvZHJpdmVycy9ncHUvZHJtL2JyaWRnZS9jYWRlbmNlL2NkbnMtbWhkcDg1NDYt Y29yZS5jCj4gKysrIGIvZHJpdmVycy9ncHUvZHJtL2JyaWRnZS9jYWRlbmNlL2NkbnMtbWhkcDg1 NDYtY29yZS5jClsgLi4uIF0KPiBAQCAtNDE4LDI4ICsxMTgsMTcgQEAgaW50IGNkbnNfbWhkcF9n ZXRfZWRpZF9ibG9jayh2b2lkICpkYXRhLCB1OCAqZWRpZCwKPiAgCXU4IG1zZ1syXSwgcmVnWzJd LCBpOwo+ICAJaW50IHJldDsKPiAgCj4gLQltdXRleF9sb2NrKCZtaGRwLT5tYm94X211dGV4KTsK PiAtCj4gIAlmb3IgKGkgPSAwOyBpIDwgNDsgaSsrKSB7ClsgLi4uIF0KPiArCQlyZXQgPSBjZG5z X21oZHBfbWFpbGJveF9zZW5kX3JlY3ZfbXVsdGkoJm1oZHAtPmJhc2UsCj4gKwkJCQkJCQlNQl9N T0RVTEVfSURfRFBfVFgsCj4gKwkJCQkJCQlEUFRYX0dFVF9FRElELAo+ICsJCQkJCQkJc2l6ZW9m KG1zZyksIG1zZywKPiArCQkJCQkJCURQVFhfR0VUX0VESUQsCj4gKwkJCQkJCQlzaXplb2YocmVn KSwgcmVnLAo+ICsJCQkJCQkJbGVuZ3RoLCBlZGlkKTsKPiAgCQlpZiAocmV0KQo+ICAJCQljb250 aW51ZTsKPiAgCj4gKwkJaWYgKHJlZ1swXSA9PSBsZW5ndGggJiYgcmVnWzFdID09IGJsb2NrIC8g MikKPiAgCQkJYnJlYWs7Cj4gIAl9Cj4gIAo+IC0JbXV0ZXhfdW5sb2NrKCZtaGRwLT5tYm94X211 dGV4KTsKPiAtCj4gIAlpZiAocmV0KQo+ICAJCWRldl9lcnIobWhkcC0+ZGV2LCAiZ2V0IGJsb2Nr WyVkXSBlZGlkIGZhaWxlZDogJWRcbiIsCj4gIAkJCWJsb2NrLCByZXQpOwo+ICAKPiAgCXJldHVy biByZXQ7CgpbU2V2ZXJpdHk6IEhpZ2hdClRoaXMgaXMgYSBwcmUtZXhpc3RpbmcgaXNzdWUsIGJ1 dCBkb2VzIHRoaXMgZnVuY3Rpb24gc2lsZW50bHkgcmV0dXJuIHN1Y2Nlc3MKd2hlbiBFRElEIGJs b2NrIHZhbGlkYXRpb24gZmFpbHM/IAoKSWYgdGhlIGxvb3AgcmV0cmllcyA0IHRpbWVzIGFuZCB0 aGUgY29uZGl0aW9uIGNoZWNraW5nIHRoZSByZWdpc3RlciB2YWx1ZXMKZXZhbHVhdGVzIHRvIGZh bHNlIGVhY2ggdGltZSwgdGhlIGxvb3AgZmluaXNoZXMgd2l0aCByZXQgZXF1YWwgdG8gMC4gCkNv dWxkIHRoaXMgY2F1c2UgdGhlIERSTSBzdWJzeXN0ZW0gdG8gc3Vic2VxdWVudGx5IHVzZSBhbiB1 bmluaXRpYWxpemVkIG9yCmNvcnJ1cHQgZWRpZCBidWZmZXI/CgpbIC4uLiBdCj4gQEAgLTIzMzgs MTIgKzIwMDUsMTIgQEAgc3RhdGljIGludCBjZG5zX21oZHBfcHJvYmUoc3RydWN0IHBsYXRmb3Jt X2RldmljZSAqcGRldikKWyAuLi4gXQo+IC0JaXJxID0gcGxhdGZvcm1fZ2V0X2lycShwZGV2LCAw KTsKPiAtCXJldCA9IGRldm1fcmVxdWVzdF90aHJlYWRlZF9pcnEobWhkcC0+ZGV2LCBpcnEsIE5V TEwsCj4gKwltaGRwLT5pcnEgPSBwbGF0Zm9ybV9nZXRfaXJxKHBkZXYsIDApOwo+ICsJcmV0ID0g ZGV2bV9yZXF1ZXN0X3RocmVhZGVkX2lycShtaGRwLT5kZXYsIG1oZHAtPmlycSwgTlVMTCwKPiAg CQkJCQljZG5zX21oZHBfaXJxX2hhbmRsZXIsIElSUUZfT05FU0hPVCwKPiAgCQkJCQkibWhkcDg1 NDYiLCBtaGRwKTsKPiAgCWlmIChyZXQpIHsKPiAtCQlkZXZfZXJyKGRldiwgImNhbm5vdCBpbnN0 YWxsIElSUSAlZFxuIiwgaXJxKTsKPiArCQlkZXZfZXJyKGRldiwgImNhbm5vdCBpbnN0YWxsIElS USAlZFxuIiwgbWhkcC0+aXJxKTsKPiAgCQlyZXQgPSAtRUlPOwo+ICAJCWdvdG8gcGxhdF9maW5p Owo+ICAJfQoKW1NldmVyaXR5OiBIaWdoXQpUaGlzIGlzIGEgcHJlLWV4aXN0aW5nIGlzc3VlLCBi dXQgaXMgdGhlIElSUSBoYW5kbGVyIHJlcXVlc3RlZCBhbmQgZW5hYmxlZApiZWZvcmUgdGhlIHdh aXQgcXVldWVzIGFuZCB3b3JrIGl0ZW1zIGl0IGRlcGVuZHMgb24gYXJlIGluaXRpYWxpemVkPwoK TG9va2luZyBmdXJ0aGVyIGRvd24gaW4gdGhpcyBmdW5jdGlvbiwgdGhlIGluaXRpYWxpemF0aW9u IGZvciB0aGUgd29yayBpdGVtcwphbmQgd2FpdHF1ZXVlcyBvY2N1cnMgYWZ0ZXIgdGhpcyBwb2lu dC4gSWYgYW4gaW50ZXJydXB0IHRyaWdnZXJzIGluIHRoaXMKd2luZG93LCBjb3VsZCB0aGUgaGFu ZGxlciBjYWxsIHdha2VfdXAgb3Igc2NoZWR1bGVfd29yayBvbiB1bmluaXRpYWxpemVkCnN0cnVj dHVyZXMgYW5kIGNhdXNlIGEgcGFuaWM/CgpbU2V2ZXJpdHk6IEhpZ2hdClRoaXMgaXNuJ3QgYSBi dWcgaW50cm9kdWNlZCBieSB0aGlzIHBhdGNoLCBidXQgY2FuIGNvbmN1cnJlbnQgcmVhZC1tb2Rp Znktd3JpdGUKb3BlcmF0aW9ucyBvbiB0aGUgc29mdHdhcmUgZXZlbnRzIGZpZWxkIHJlc3VsdCBp biBsb3N0IGV2ZW50cz8gCgpUaGUgSVJRIGhhbmRsZXIgc2V0cyBiaXRzIHdoaWxlIHRoZSB3YWl0 IHJvdXRpbmUgY2xlYXJzIHRoZW0uIElzIHRoZXJlIGEgcmFjZQpjb25kaXRpb24gaGVyZSBpZiBu ZWl0aGVyIG9wZXJhdGlvbiBpcyBhdG9taWMgYW5kIG5vIGxvY2sgcHJvdGVjdHMgdGhlbT8KCltT ZXZlcml0eTogSGlnaF0KVGhpcyBpcyBhbHNvIGEgcHJlLWV4aXN0aW5nIGlzc3VlLCBidXQgYXJl IHRoZSB3b3JrIGl0ZW1zIHByb3Blcmx5IGNhbmNlbGxlZApvbiBwcm9iZSBlcnJvciBwYXRocz8g CgpJZiBwcm9iZSBmYWlscyBhZnRlciB0aGUgSVJRIGlzIHJlcXVlc3RlZCwgZm9yIGV4YW1wbGUg ZHVyaW5nIHRoZSBmaXJtd2FyZQpsb2FkIHBoYXNlLCB0aGUgZGV2bSBjbGVhbnVwIHdpbGwgZnJl ZSB0aGUgbWhkcCBzdHJ1Y3R1cmUuIFNpbmNlIHRoZSB3b3JrCml0ZW1zIGFyZSBub3QgZXhwbGlj aXRseSBjYW5jZWxsZWQsIGNvdWxkIGEgcXVldWVkIHdvcmsgaXRlbSBleGVjdXRlIGFmdGVyCnRo ZSBtZW1vcnkgaXMgZnJlZWQgYW5kIGNhdXNlIGEgdXNlLWFmdGVyLWZyZWU/CgpbIC4uLiBdCj4g QEAgLTI0MDgsNiArMjA3NSwxMCBAQCBzdGF0aWMgdm9pZCBjZG5zX21oZHBfcmVtb3ZlKHN0cnVj dCBwbGF0Zm9ybV9kZXZpY2UgKnBkZXYpCj4gIAo+ICAJZHJtX2JyaWRnZV9yZW1vdmUoJm1oZHAt PmJyaWRnZSk7Cj4gIAo+ICsJZGlzYWJsZV9pcnEobWhkcC0+aXJxKTsKPiArCWNhbmNlbF93b3Jr X3N5bmMoJm1oZHAtPm1vZGVzZXRfcmV0cnlfd29yayk7Cj4gKwlmbHVzaF93b3JrKCZtaGRwLT5o cGRfd29yayk7Cj4gKwo+ICAJcmV0ID0gd2FpdF9ldmVudF90aW1lb3V0KG1oZHAtPmZ3X2xvYWRf d3EsCj4gIAkJCQkgbWhkcC0+aHdfc3RhdGUgPT0gTUhEUF9IV19SRUFEWSwKPiAgCQkJCSB0aW1l b3V0KTsKCltTZXZlcml0eTogSGlnaF0KRG9lcyBjYWxsaW5nIGRpc2FibGVfaXJxIG9uIGEgZGV2 bS1tYW5hZ2VkIElSUSBwZXJtYW5lbnRseSBkaXNhYmxlIGl0IGFjcm9zcwpwcm9iZSBjeWNsZXM/ IAoKU2luY2UgdGhlIGRldm0gY2xlYW51cCBkb2VzIG5vdCByZXNldCB0aGUgSVJRIGRpc2FibGUg ZGVwdGggd2hlbiBpdCBmcmVlcwp0aGUgaXJxLCB3b24ndCB0aGlzIGxlYXZlIHRoZSBkaXNhYmxl IGRlcHRoIGltYmFsYW5jZWQgaWYgdGhlIGRyaXZlciBpcwpyZS1wcm9iZWQgbGF0ZXIsIHByZXZl bnRpbmcgaXQgZnJvbSByZWNlaXZpbmcgYW55IGludGVycnVwdHM/CgpbU2V2ZXJpdHk6IEhpZ2hd ClRoaXMgaXMgYSBwcmUtZXhpc3RpbmcgaXNzdWUsIGJ1dCBjYW4gdGhlIGFzeW5jaHJvbm91cyBm aXJtd2FyZSBsb2FkIGNhbGxiYWNrCmNhdXNlIGEgdXNlLWFmdGVyLWZyZWUgb24gYSByZW1vdmUg dGltZW91dD8gCgpJZiB0aGUgd2FpdCBjb25kaXRpb24gdGltZXMgb3V0LCB0aGlzIGZ1bmN0aW9u IGxvZ3MgYW4gZXJyb3IgYW5kIHByb2NlZWRzLApldmVudHVhbGx5IGFsbG93aW5nIGRldm0gdG8g ZnJlZSB0aGUgbWhkcCBzdHJ1Y3R1cmUuIFNpbmNlIHRoZSBhc3luY2hyb25vdXMKcmVxdWVzdCBk b2VzIG5vdCBjYW5jZWwgcGVuZGluZyBjYWxsYmFja3MsIGNvdWxkIHRoZSBkZWxheWVkIGNhbGxi YWNrIHJ1biBhbmQKZGVyZWZlcmVuY2UgdGhlIGZyZWVkIHBvaW50ZXI/CgpbIC4uLiBdCj4gQEAg LTI0MzMsOCArMjEwNCw3IEBAIHN0YXRpYyB2b2lkIGNkbnNfbWhkcF9yZW1vdmUoc3RydWN0IHBs YXRmb3JtX2RldmljZSAqcGRldikKPiAgCXBtX3J1bnRpbWVfcHV0X3N5bmMoJnBkZXYtPmRldik7 Cj4gIAlwbV9ydW50aW1lX2Rpc2FibGUoJnBkZXYtPmRldik7Cj4gIAo+IC0JY2FuY2VsX3dvcmtf c3luYygmbWhkcC0+bW9kZXNldF9yZXRyeV93b3JrKTsKPiAtCWZsdXNoX3dvcmsoJm1oZHAtPmhw ZF93b3JrKTsKPiArCW11dGV4X2Rlc3Ryb3koJm1oZHAtPmJhc2UubWFpbGJveF9tdXRleCk7Cj4g IAkvKiBJZ25vcmluZyBtaGRwLT5oZGNwLmNoZWNrX3dvcmsgYW5kIG1oZHAtPmhkY3AucHJvcF93 b3JrIGhlcmUuICovCj4gIH0KCltTZXZlcml0eTogSGlnaF0KVGhpcyBpcyBhIHByZS1leGlzdGlu ZyBpc3N1ZSwgYnV0IGFyZSB0aGUgSERDUCB3b3JrIGl0ZW1zIGludGVudGlvbmFsbHkgbGVmdAp1 bmNhbmNlbGxlZCBkdXJpbmcgZHJpdmVyIHJlbW92YWw/IAoKQmVjYXVzZSB0aGV5IGFyZSBpZ25v cmVkIGhlcmUsIGNvdWxkbid0IHRoZXkgcmVtYWluIHF1ZXVlZCBvciBhY3RpdmVseQpleGVjdXRp bmcgYWZ0ZXIgdGhlIG1oZHAgc3RydWN0dXJlIGlzIGZyZWVkIGJ5IGRldm0gY2xlYW51cCwgcmVz dWx0aW5nIGluCmEgdXNlLWFmdGVyLWZyZWU/Cgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9k cm0vYnJpZGdlL2NhZGVuY2UvY2Rucy1taGRwODU0Ni1oZGNwLmMgYi9kcml2ZXJzL2dwdS9kcm0v YnJpZGdlL2NhZGVuY2UvY2Rucy1taGRwODU0Ni1oZGNwLmMKPiBpbmRleCA1Y2QwYjg3M2UxNmY5 Li4xYjVjOTBhZjYzZGVlIDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvZ3B1L2RybS9icmlkZ2UvY2Fk ZW5jZS9jZG5zLW1oZHA4NTQ2LWhkY3AuYwo+ICsrKyBiL2RyaXZlcnMvZ3B1L2RybS9icmlkZ2Uv Y2FkZW5jZS9jZG5zLW1oZHA4NTQ2LWhkY3AuYwpbIC4uLiBdCj4gQEAgLTE3MCw5OCArNDYsNTIg QEAgc3RhdGljIHU4IGNkbnNfbWhkcF9oZGNwX2hhbmRsZV9zdGF0dXMoc3RydWN0IGNkbnNfbWhk cF9kZXZpY2UgKm1oZHAsClsgLi4uIF0KPiAgc3RhdGljIGludCBjZG5zX21oZHBfaGRjcF9yeF9p ZF92YWxpZChzdHJ1Y3QgY2Ruc19taGRwX2RldmljZSAqbWhkcCwKPiAgCQkJCSAgICAgIHU4ICpy ZWN2X251bSwgdTggKmhkY3BfcnhfaWQpCj4gIHsKPiAgCXU4IHJlY19pZF9oZHJbMl07Cj4gLQl1 OCBzdGF0dXM7Cj4gIAlpbnQgcmV0Owo+ICAKPiAtCW11dGV4X2xvY2soJm1oZHAtPm1ib3hfbXV0 ZXgpOwo+IC0JcmV0ID0gY2Ruc19taGRwX3NlY3VyZV9tYWlsYm94X3NlbmQobWhkcCwgTUJfTU9E VUxFX0lEX0hEQ1BfVFgsCj4gLQkJCQkJICAgIEhEQ1BfVFJBTl9JU19SRUNfSURfVkFMSUQsIDAs IE5VTEwpOwpbIC4uLiBdCj4gKwlyZXQgPSBjZG5zX21oZHBfc2VjdXJlX21haWxib3hfc2VuZF9y ZWN2X211bHRpKCZtaGRwLT5iYXNlLAo+ICsJCQkJCQkgICAgICAgTUJfTU9EVUxFX0lEX0hEQ1Bf VFgsCj4gKwkJCQkJCSAgICAgICBIRENQX1RSQU5fSVNfUkVDX0lEX1ZBTElELAo+ICsJCQkJCQkg ICAgICAgMCwgTlVMTCwKPiArCQkJCQkJICAgICAgIEhEQ1BfVFJBTl9JU19SRUNfSURfVkFMSUQs Cj4gKwkJCQkJCSAgICAgICBzaXplb2YocmVjX2lkX2hkciksIHJlY19pZF9oZHIsCj4gKwkJCQkJ CSAgICAgICAwLCBoZGNwX3J4X2lkKTsKPiAgCWlmIChyZXQpCj4gLQkJZ290byBlcnJfcnhfaWRf dmFsaWQ7Cj4gKwkJcmV0dXJuIHJldDsKCltTZXZlcml0eTogQ3JpdGljYWxdClRoaXMgaXNuJ3Qg YSBidWcgaW50cm9kdWNlZCBieSB0aGlzIHBhdGNoLCBidXQgZG9lcyB0aGlzIHBhdHRlcm4gYWxs b3cgYQpzdGFjay1iYXNlZCBidWZmZXIgb3ZlcmZsb3cgd2hlbiBwYXJzaW5nIEhEQ1AgcmVjZWl2 ZXIgSURzPyAKCklmIHRoZSBwb2ludGVyIHBhc3NlZCB0byB0aGlzIGZ1bmN0aW9uIHBvaW50cyB0 byBhIGZpeGVkLXNpemUgc3RhY2sgYXJyYXksCmFuZCB0aGUgbWFpbGJveCBoZWxwZXIgcmVsaWVz IG9uIHRoZSByZWNlaXZlciBjb3VudCBmcm9tIHRoZSBleHRlcm5hbCBzaW5rCnRvIGRldGVybWlu ZSBob3cgbWFueSBieXRlcyB0byB3cml0ZSwgY291bGQgYSBtYWxpY2lvdXMgb3IgbWFsZnVuY3Rp b25pbmcKc2luayByZXR1cm5pbmcgYSBsYXJnZSByZWNlaXZlciBjb3VudCB3cml0ZSBvdXQgb2Yg Ym91bmRzPwoKLS0gClNhc2hpa28gQUkgcmV2aWV3IMK3IGh0dHBzOi8vc2FzaGlrby5kZXYvIy9w YXRjaHNldC8yMDI2MDUxOS1kY3NzLWhkbWktdXBzdHJlYW1pbmctdjIzLTAtNTYxNTUyNGE5YzYz QG9zcy5ueHAuY29tP3BhcnQ9MgoKLS0gCmxpbnV4LXBoeSBtYWlsaW5nIGxpc3QKbGludXgtcGh5 QGxpc3RzLmluZnJhZGVhZC5vcmcKaHR0cHM6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4v bGlzdGluZm8vbGludXgtcGh5Cg==