From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BE0E133C507 for ; Fri, 12 Jun 2026 11:41:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781264517; cv=none; b=kabK7NqDt40c/y7K+PveiZaQuq7PBO/QbHEeAGtma5wEQQWFT70WWS8kJsDp1qU7VKc/6u6aRmftJrNBMwuuI7omp4Hsy19W4TOzpNo1WfYEJ+uo8zL/ng5uB9QcVMsZrJBlsogEm7Puw0c3VXJB/VUyoWiXntGmXmhgsqo48mw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781264517; c=relaxed/simple; bh=TVBnzo45of42ymEL0WqVO1MuMZ22PHKMEB5Zg0Lx1NQ=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=HMGiHtrpvehUVRNaXE85Nf0L4A+XOnggHg81gRdSYqI2OkLJOjH9pnBFkYnfeL8y6WQ3rcpslcHIpi9d3L1RnqNqMVWTmGToB1LUpUDMaC1uO7kMigZzMh62io9rPUmKVrtXGrvSA5WQq1yoOj6/kPxJwcYaHeqC7IJxbxJngn4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Hh0xQU1Y; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Hh0xQU1Y" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 081851F000E9; Fri, 12 Jun 2026 11:41:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781264515; bh=ylbQ3WDgglVbQIR5UCvUscgBs0RR6IK3cMZ7rSE9EpI=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=Hh0xQU1YrqSU2I/+wzvkKzKC/jpIZACY5GFjmXivSFY11b+D5AoizJT9cYvOQBBzw klLAaHH827IjWp1LrjevHWhqeNoTlHZ1v56R7fu/jDO0yMZCR7IhEHnFcKhXZOXKFS WQXWvKPY0wyn03yNvdj4tQfcErXuHpGQLrFf7XBmlA0LPgCSsY8g6YSpBg5HVbaRsN +09/dCjHALlz0TrxCiBEdrUW6p7z8jNbiaYUfNfK4ByyojJvLKxcVObYhF2+hlT4iH l/pyBUaV2OhOq+rMgAPGevDjs/zqydhWU5JpNTi2uELj0EKi++41qer1ABMmETTW5m A452qTUhYFCKA== From: sashiko-bot@kernel.org Subject: Re: [PATCH v11 9/9] i3c: hub: p3h2x4x: Add SMBus slave mode support Reply-To: sashiko-reviews@lists.linux.dev To: "Lakshay Piplani" Cc: robh@kernel.org, devicetree@vger.kernel.org, linux-i3c@lists.infradead.org, conor+dt@kernel.org, Frank.Li@kernel.org In-Reply-To: <20260612111816.3688240-10-lakshay.piplani@nxp.com> References: <20260612111816.3688240-10-lakshay.piplani@nxp.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Fri, 12 Jun 2026 11:41:54 +0000 Message-Id: <20260612114155.081851F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 5 potential issue(= s) to consider: New issues: - [High] Unconditional dereference of `tp_smbus_client` prior to its NULL c= heck in `p3h2x4x_read_smbus_agent_rx_buf`. - [High] Failure to clear `tp_smbus_client` on hardware error in `p3h2x4x_t= p_i2c_unreg_slave` leads to Use-After-Free. - [High] IBI requests are not cleaned up on the `probe` error path, leaving= active interrupts pointing to freed device memory. - [High] Early return on `regmap_read` failure in `p3h2x4x_ibi_handler` abo= rts processing for other ports, risking an interrupt storm. Pre-existing issues: - [High] I2C adapters registered in `p3h2x4x_tp_smbus_algo` are leaked on s= ubsequent probe errors, leading to Use-After-Free. -- commit c3438427374cdabfa4f0a09443f69b5b076d009a Author: Lakshay Piplani i3c: hub: p3h2x4x: Add SMBus slave mode support Add SMBus slave mode support for the P3H2x4x hub SMBus target ports, allowing the hub to receive downstream payloads into target buffers and report receive events through IBI to registered I2C slave clients. > diff --git a/drivers/i3c/hub/p3h2840_i3c_hub_i3c.c b/drivers/i3c/hub/p3h2= 840_i3c_hub_i3c.c > --- a/drivers/i3c/hub/p3h2840_i3c_hub_i3c.c > +++ b/drivers/i3c/hub/p3h2840_i3c_hub_i3c.c [ ... ] > @@ -120,5 +128,24 @@ int p3h2x4x_tp_i3c_algo(struct p3h2x4x_i3c_hub_dev *= p3h2x4x_hub) > p3h2x4x_hub->tp_bus[tp].is_registered =3D true; > p3h2x4x_hub->hub_config.tp_config[tp].always_enable =3D true; > } > - return regmap_write(p3h2x4x_hub->regmap, P3H2X4X_TP_NET_CON_CONF, ntwk_= mask); > +#if IS_ENABLED(CONFIG_I2C_SLAVE) > + ret =3D i3c_device_request_ibi(p3h2x4x_hub->i3cdev, &p3h2x4x_ibireq); > + if (ret) > + return ret; > + > + ret =3D i3c_device_enable_ibi(p3h2x4x_hub->i3cdev); [Severity: High] Because these IBI functions are not devres-managed, do we need to manually clean them up on a probe failure? If a subsequent step in p3h2x4x_i3c_hub_probe() fails after this completes, probe will abort and devres will free the p3h2x4x_i3c_hub structure. Since the I3C core isn't informed to free the IBI, the hardware remains configured. If an IBI fires later, could p3h2x4x_ibi_handler() try to dereference the freed driver data? [ ... ] > diff --git a/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c b/drivers/i3c/hub/p3= h2840_i3c_hub_smbus.c > --- a/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c > +++ b/drivers/i3c/hub/p3h2840_i3c_hub_smbus.c [ ... ] > @@ -15,6 +15,146 @@ enum p3h2x4x_smbus_desc_idx { > P3H2X4X_DESC_READ_LEN, > }; > =20 > +#if IS_ENABLED(CONFIG_I2C_SLAVE) > +static void p3h2x4x_read_smbus_agent_rx_buf(struct i3c_device *i3cdev, e= num p3h2x4x_rcv_buf rfbuf, > + enum p3h2x4x_tp tp, bool is_of) > +{ [ ... ] > + /* notify slave driver about received data */ > + if ((p3h2x4x_i3c_hub->tp_bus[tp].tp_smbus_client->addr & 0x7f) =3D=3D (= slave_address >> 1)) { > + client =3D p3h2x4x_i3c_hub->tp_bus[tp].tp_smbus_client; > + if (!client) > + goto ibi_err; [Severity: High] Can this code cause a panic if an In-Band Interrupt occurs for a port without a bound SMBus slave client? We dereference tp_smbus_client->addr unconditionally here, right before the NULL check happens. [ ... ] > +void p3h2x4x_ibi_handler(struct i3c_device *i3cdev, > + const struct i3c_ibi_payload *payload) > +{ [ ... ] > + for (i =3D 0; i < P3H2X4X_TP_MAX_COUNT; ++i) { > + if (p3h2x4x_i3c_hub->tp_bus[i].is_registered && (payload_byte_two >> i= ) & 0x01) { > + ret =3D regmap_read(p3h2x4x_i3c_hub->regmap, P3H2X4X_TP0_SMBUS_AGNT_S= TS + i, > + &target_port_status); > + if (ret) { > + dev_err(&i3cdev->dev, "target port read status failed %d\n", ret); > + return; > + } [Severity: High] If regmap_read() fails for one port, this return statement prematurely exits the handler. Does this skip clearing the hardware status of the current port and prevent servicing other ports with pending events? If the underlying hardware interrupt conditions are not cleared, could the device immediately re-assert the IBI line and cause an interrupt storm? [ ... ] > +static int p3h2x4x_tp_i2c_unreg_slave(struct i2c_client *slave) > +{ [ ... ] > + ret =3D regmap_clear_bits(hub->regmap, > + P3H2X4X_TP_SMBUS_AGNT_IBI_CONFIG, > + bus->tp_mask); > + if (ret) > + return ret; > + > + bus->tp_smbus_client =3D NULL; [Severity: High] If regmap_clear_bits() fails, we return the error without clearing bus->tp_smbus_client. Since the client driver might still free its i2c_client structure during removal despite the unregistration failure, could this leave a dangling pointer that gets dereferenced if an IBI fires later? [ ... ] > @@ -205,11 +345,63 @@ static u32 p3h2x4x_tp_smbus_funcs(struct i2c_adapte= r *adapter) > return I2C_FUNC_I2C | I2C_FUNC_SMBUS_BLOCK_DATA; > } > =20 [ ... ] > /* > * I2C algorithm Structure > */ > static struct i2c_algorithm p3h2x4x_tp_i2c_algorithm =3D { > .master_xfer =3D p3h2x4x_tp_i2c_xfer, > +#if IS_ENABLED(CONFIG_I2C_SLAVE) > + .reg_slave =3D p3h2x4x_tp_i2c_reg_slave, > + .unreg_slave =3D p3h2x4x_tp_i2c_unreg_slave, > +#endif > .functionality =3D p3h2x4x_tp_smbus_funcs, > }; [Severity: High] This is a pre-existing issue, but I2C adapters registered in p3h2x4x_tp_smbus_algo() lack a devres action for automatic cleanup. If p3h2x4x_i3c_hub_probe() encounters an error after adapters are added with i2c_add_adapter(), devres will free the memory backing the adapters, but they remain registered with the I2C subsystem. Could this lead to a use-after-free if the I2C core accesses these ghost adapters? --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260612111816.3688= 240-1-lakshay.piplani@nxp.com?part=3D9 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D1E2CCD8CA8 for ; Fri, 12 Jun 2026 11:41:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=S1iAF7kdgBpIDzgCdITHIbtniNLSt4AIHCS7HHbdfHs=; b=uvH2A5Cl8A/EUo DLrlucbDS3YGuv+FWvsqVrkdWru8ye8lMycoikjY/6Js2sHF2kn2k2VUJCgGR6mLVnhrNHknvBL/n qQYJfuTJclGyDEN53cImXGgI+SOYy0cemSWejFjmUpY6cijXJBEXVh+toowdDUhh1yi9tBOtaqxZM dAeo6j8t7Z3KULgUQ5fhcOrFHOH+da4NsoVWJlDxxVPgot3yFDJC/nnPtOwiaTPe9DQiYkUnG76g3 vuxXKMRFRnVGzS0V66XQPli72bv+8XMIwtxxVucB9j2QKkIrcQw4k9WqXTQXgpKHo9GzDm1e9oJl3 jNuj4XMC5WdGTyBW23dg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wY0Gq-0000000Aod1-2anu; Fri, 12 Jun 2026 11:41:56 +0000 Received: from sea.source.kernel.org ([172.234.252.31]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wY0Gp-0000000Aocj-342y for linux-i3c@lists.infradead.org; Fri, 12 Jun 2026 11:41:55 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 6EC2D41E48; Fri, 12 Jun 2026 11:41:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 081851F000E9; Fri, 12 Jun 2026 11:41:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781264515; bh=ylbQ3WDgglVbQIR5UCvUscgBs0RR6IK3cMZ7rSE9EpI=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=Hh0xQU1YrqSU2I/+wzvkKzKC/jpIZACY5GFjmXivSFY11b+D5AoizJT9cYvOQBBzw klLAaHH827IjWp1LrjevHWhqeNoTlHZ1v56R7fu/jDO0yMZCR7IhEHnFcKhXZOXKFS WQXWvKPY0wyn03yNvdj4tQfcErXuHpGQLrFf7XBmlA0LPgCSsY8g6YSpBg5HVbaRsN +09/dCjHALlz0TrxCiBEdrUW6p7z8jNbiaYUfNfK4ByyojJvLKxcVObYhF2+hlT4iH l/pyBUaV2OhOq+rMgAPGevDjs/zqydhWU5JpNTi2uELj0EKi++41qer1ABMmETTW5m A452qTUhYFCKA== From: sashiko-bot@kernel.org Subject: Re: [PATCH v11 9/9] i3c: hub: p3h2x4x: Add SMBus slave mode support To: "Lakshay Piplani" Cc: robh@kernel.org, devicetree@vger.kernel.org, linux-i3c@lists.infradead.org, conor+dt@kernel.org, Frank.Li@kernel.org In-Reply-To: <20260612111816.3688240-10-lakshay.piplani@nxp.com> References: <20260612111816.3688240-10-lakshay.piplani@nxp.com> Date: Fri, 12 Jun 2026 11:41:54 +0000 Message-Id: <20260612114155.081851F000E9@smtp.kernel.org> X-BeenThere: linux-i3c@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-i3c" Errors-To: linux-i3c-bounces+linux-i3c=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg NSBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpOZXcgaXNzdWVzOgotIFtIaWdoXSBV bmNvbmRpdGlvbmFsIGRlcmVmZXJlbmNlIG9mIGB0cF9zbWJ1c19jbGllbnRgIHByaW9yIHRvIGl0 cyBOVUxMIGNoZWNrIGluIGBwM2gyeDR4X3JlYWRfc21idXNfYWdlbnRfcnhfYnVmYC4KLSBbSGln aF0gRmFpbHVyZSB0byBjbGVhciBgdHBfc21idXNfY2xpZW50YCBvbiBoYXJkd2FyZSBlcnJvciBp biBgcDNoMng0eF90cF9pMmNfdW5yZWdfc2xhdmVgIGxlYWRzIHRvIFVzZS1BZnRlci1GcmVlLgot IFtIaWdoXSBJQkkgcmVxdWVzdHMgYXJlIG5vdCBjbGVhbmVkIHVwIG9uIHRoZSBgcHJvYmVgIGVy cm9yIHBhdGgsIGxlYXZpbmcgYWN0aXZlIGludGVycnVwdHMgcG9pbnRpbmcgdG8gZnJlZWQgZGV2 aWNlIG1lbW9yeS4KLSBbSGlnaF0gRWFybHkgcmV0dXJuIG9uIGByZWdtYXBfcmVhZGAgZmFpbHVy ZSBpbiBgcDNoMng0eF9pYmlfaGFuZGxlcmAgYWJvcnRzIHByb2Nlc3NpbmcgZm9yIG90aGVyIHBv cnRzLCByaXNraW5nIGFuIGludGVycnVwdCBzdG9ybS4KClByZS1leGlzdGluZyBpc3N1ZXM6Ci0g W0hpZ2hdIEkyQyBhZGFwdGVycyByZWdpc3RlcmVkIGluIGBwM2gyeDR4X3RwX3NtYnVzX2FsZ29g IGFyZSBsZWFrZWQgb24gc3Vic2VxdWVudCBwcm9iZSBlcnJvcnMsIGxlYWRpbmcgdG8gVXNlLUFm dGVyLUZyZWUuCi0tCgpjb21taXQgYzM0Mzg0MjczNzRjZGFiZmE0ZjBhMDk0NDNmNjliNWIwNzZk MDA5YQpBdXRob3I6IExha3NoYXkgUGlwbGFuaSA8bGFrc2hheS5waXBsYW5pQG54cC5jb20+Cgpp M2M6IGh1YjogcDNoMng0eDogQWRkIFNNQnVzIHNsYXZlIG1vZGUgc3VwcG9ydAoKQWRkIFNNQnVz IHNsYXZlIG1vZGUgc3VwcG9ydCBmb3IgdGhlIFAzSDJ4NHggaHViIFNNQnVzIHRhcmdldCBwb3J0 cywKYWxsb3dpbmcgdGhlIGh1YiB0byByZWNlaXZlIGRvd25zdHJlYW0gcGF5bG9hZHMgaW50byB0 YXJnZXQgYnVmZmVycyBhbmQKcmVwb3J0IHJlY2VpdmUgZXZlbnRzIHRocm91Z2ggSUJJIHRvIHJl Z2lzdGVyZWQgSTJDIHNsYXZlIGNsaWVudHMuCgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2kzYy9o dWIvcDNoMjg0MF9pM2NfaHViX2kzYy5jIGIvZHJpdmVycy9pM2MvaHViL3AzaDI4NDBfaTNjX2h1 Yl9pM2MuYwo+IC0tLSBhL2RyaXZlcnMvaTNjL2h1Yi9wM2gyODQwX2kzY19odWJfaTNjLmMKPiAr KysgYi9kcml2ZXJzL2kzYy9odWIvcDNoMjg0MF9pM2NfaHViX2kzYy5jClsgLi4uIF0KPiBAQCAt MTIwLDUgKzEyOCwyNCBAQCBpbnQgcDNoMng0eF90cF9pM2NfYWxnbyhzdHJ1Y3QgcDNoMng0eF9p M2NfaHViX2RldiAqcDNoMng0eF9odWIpCj4gIAkJcDNoMng0eF9odWItPnRwX2J1c1t0cF0uaXNf cmVnaXN0ZXJlZCA9IHRydWU7Cj4gIAkJcDNoMng0eF9odWItPmh1Yl9jb25maWcudHBfY29uZmln W3RwXS5hbHdheXNfZW5hYmxlID0gdHJ1ZTsKPiAgCX0KPiAtCXJldHVybiByZWdtYXBfd3JpdGUo cDNoMng0eF9odWItPnJlZ21hcCwgUDNIMlg0WF9UUF9ORVRfQ09OX0NPTkYsIG50d2tfbWFzayk7 Cj4gKyNpZiBJU19FTkFCTEVEKENPTkZJR19JMkNfU0xBVkUpCj4gKwlyZXQgPSBpM2NfZGV2aWNl X3JlcXVlc3RfaWJpKHAzaDJ4NHhfaHViLT5pM2NkZXYsICZwM2gyeDR4X2liaXJlcSk7Cj4gKwlp ZiAocmV0KQo+ICsJCXJldHVybiByZXQ7Cj4gKwo+ICsJcmV0ID0gaTNjX2RldmljZV9lbmFibGVf aWJpKHAzaDJ4NHhfaHViLT5pM2NkZXYpOwoKW1NldmVyaXR5OiBIaWdoXQpCZWNhdXNlIHRoZXNl IElCSSBmdW5jdGlvbnMgYXJlIG5vdCBkZXZyZXMtbWFuYWdlZCwgZG8gd2UgbmVlZCB0byBtYW51 YWxseQpjbGVhbiB0aGVtIHVwIG9uIGEgcHJvYmUgZmFpbHVyZT8KCklmIGEgc3Vic2VxdWVudCBz dGVwIGluIHAzaDJ4NHhfaTNjX2h1Yl9wcm9iZSgpIGZhaWxzIGFmdGVyIHRoaXMgY29tcGxldGVz LApwcm9iZSB3aWxsIGFib3J0IGFuZCBkZXZyZXMgd2lsbCBmcmVlIHRoZSBwM2gyeDR4X2kzY19o dWIgc3RydWN0dXJlLiBTaW5jZQp0aGUgSTNDIGNvcmUgaXNuJ3QgaW5mb3JtZWQgdG8gZnJlZSB0 aGUgSUJJLCB0aGUgaGFyZHdhcmUgcmVtYWlucwpjb25maWd1cmVkLiBJZiBhbiBJQkkgZmlyZXMg bGF0ZXIsIGNvdWxkIHAzaDJ4NHhfaWJpX2hhbmRsZXIoKSB0cnkgdG8KZGVyZWZlcmVuY2UgdGhl IGZyZWVkIGRyaXZlciBkYXRhPwoKWyAuLi4gXQo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2kzYy9o dWIvcDNoMjg0MF9pM2NfaHViX3NtYnVzLmMgYi9kcml2ZXJzL2kzYy9odWIvcDNoMjg0MF9pM2Nf aHViX3NtYnVzLmMKPiAtLS0gYS9kcml2ZXJzL2kzYy9odWIvcDNoMjg0MF9pM2NfaHViX3NtYnVz LmMKPiArKysgYi9kcml2ZXJzL2kzYy9odWIvcDNoMjg0MF9pM2NfaHViX3NtYnVzLmMKWyAuLi4g XQo+IEBAIC0xNSw2ICsxNSwxNDYgQEAgZW51bSBwM2gyeDR4X3NtYnVzX2Rlc2NfaWR4IHsKPiAg CVAzSDJYNFhfREVTQ19SRUFEX0xFTiwKPiAgfTsKPiAgCj4gKyNpZiBJU19FTkFCTEVEKENPTkZJ R19JMkNfU0xBVkUpCj4gK3N0YXRpYyB2b2lkIHAzaDJ4NHhfcmVhZF9zbWJ1c19hZ2VudF9yeF9i dWYoc3RydWN0IGkzY19kZXZpY2UgKmkzY2RldiwgZW51bSBwM2gyeDR4X3Jjdl9idWYgcmZidWYs Cj4gKwkJCQkJICAgIGVudW0gcDNoMng0eF90cCB0cCwgYm9vbCBpc19vZikKPiArewpbIC4uLiBd Cj4gKwkvKiBub3RpZnkgc2xhdmUgZHJpdmVyIGFib3V0IHJlY2VpdmVkIGRhdGEgKi8KPiArCWlm ICgocDNoMng0eF9pM2NfaHViLT50cF9idXNbdHBdLnRwX3NtYnVzX2NsaWVudC0+YWRkciAmIDB4 N2YpID09IChzbGF2ZV9hZGRyZXNzID4+IDEpKSB7Cj4gKwkJY2xpZW50ID0gcDNoMng0eF9pM2Nf aHViLT50cF9idXNbdHBdLnRwX3NtYnVzX2NsaWVudDsKPiArCQlpZiAoIWNsaWVudCkKPiArCQkJ Z290byBpYmlfZXJyOwoKW1NldmVyaXR5OiBIaWdoXQpDYW4gdGhpcyBjb2RlIGNhdXNlIGEgcGFu aWMgaWYgYW4gSW4tQmFuZCBJbnRlcnJ1cHQgb2NjdXJzIGZvciBhIHBvcnQKd2l0aG91dCBhIGJv dW5kIFNNQnVzIHNsYXZlIGNsaWVudD8KCldlIGRlcmVmZXJlbmNlIHRwX3NtYnVzX2NsaWVudC0+ YWRkciB1bmNvbmRpdGlvbmFsbHkgaGVyZSwgcmlnaHQgYmVmb3JlCnRoZSBOVUxMIGNoZWNrIGhh cHBlbnMuCgpbIC4uLiBdCj4gK3ZvaWQgcDNoMng0eF9pYmlfaGFuZGxlcihzdHJ1Y3QgaTNjX2Rl dmljZSAqaTNjZGV2LAo+ICsJCQkgY29uc3Qgc3RydWN0IGkzY19pYmlfcGF5bG9hZCAqcGF5bG9h ZCkKPiArewpbIC4uLiBdCj4gKwlmb3IgKGkgPSAwOyBpIDwgUDNIMlg0WF9UUF9NQVhfQ09VTlQ7 ICsraSkgewo+ICsJCWlmIChwM2gyeDR4X2kzY19odWItPnRwX2J1c1tpXS5pc19yZWdpc3RlcmVk ICYmIChwYXlsb2FkX2J5dGVfdHdvID4+IGkpICYgMHgwMSkgewo+ICsJCQlyZXQgPSByZWdtYXBf cmVhZChwM2gyeDR4X2kzY19odWItPnJlZ21hcCwgUDNIMlg0WF9UUDBfU01CVVNfQUdOVF9TVFMg KyBpLAo+ICsJCQkJCSAgJnRhcmdldF9wb3J0X3N0YXR1cyk7Cj4gKwkJCWlmIChyZXQpIHsKPiAr CQkJCWRldl9lcnIoJmkzY2Rldi0+ZGV2LCAidGFyZ2V0IHBvcnQgcmVhZCBzdGF0dXMgZmFpbGVk ICVkXG4iLCByZXQpOwo+ICsJCQkJcmV0dXJuOwo+ICsJCQl9CgpbU2V2ZXJpdHk6IEhpZ2hdCklm IHJlZ21hcF9yZWFkKCkgZmFpbHMgZm9yIG9uZSBwb3J0LCB0aGlzIHJldHVybiBzdGF0ZW1lbnQg cHJlbWF0dXJlbHkKZXhpdHMgdGhlIGhhbmRsZXIuCgpEb2VzIHRoaXMgc2tpcCBjbGVhcmluZyB0 aGUgaGFyZHdhcmUgc3RhdHVzIG9mIHRoZSBjdXJyZW50IHBvcnQgYW5kIHByZXZlbnQKc2Vydmlj aW5nIG90aGVyIHBvcnRzIHdpdGggcGVuZGluZyBldmVudHM/IElmIHRoZSB1bmRlcmx5aW5nIGhh cmR3YXJlCmludGVycnVwdCBjb25kaXRpb25zIGFyZSBub3QgY2xlYXJlZCwgY291bGQgdGhlIGRl dmljZSBpbW1lZGlhdGVseSByZS1hc3NlcnQKdGhlIElCSSBsaW5lIGFuZCBjYXVzZSBhbiBpbnRl cnJ1cHQgc3Rvcm0/CgpbIC4uLiBdCj4gK3N0YXRpYyBpbnQgcDNoMng0eF90cF9pMmNfdW5yZWdf c2xhdmUoc3RydWN0IGkyY19jbGllbnQgKnNsYXZlKQo+ICt7ClsgLi4uIF0KPiArCXJldCA9IHJl Z21hcF9jbGVhcl9iaXRzKGh1Yi0+cmVnbWFwLAo+ICsJCQkJUDNIMlg0WF9UUF9TTUJVU19BR05U X0lCSV9DT05GSUcsCj4gKwkJCQlidXMtPnRwX21hc2spOwo+ICsJaWYgKHJldCkKPiArCQlyZXR1 cm4gcmV0Owo+ICsKPiArCWJ1cy0+dHBfc21idXNfY2xpZW50ID0gTlVMTDsKCltTZXZlcml0eTog SGlnaF0KSWYgcmVnbWFwX2NsZWFyX2JpdHMoKSBmYWlscywgd2UgcmV0dXJuIHRoZSBlcnJvciB3 aXRob3V0IGNsZWFyaW5nCmJ1cy0+dHBfc21idXNfY2xpZW50LgoKU2luY2UgdGhlIGNsaWVudCBk cml2ZXIgbWlnaHQgc3RpbGwgZnJlZSBpdHMgaTJjX2NsaWVudCBzdHJ1Y3R1cmUgZHVyaW5nCnJl bW92YWwgZGVzcGl0ZSB0aGUgdW5yZWdpc3RyYXRpb24gZmFpbHVyZSwgY291bGQgdGhpcyBsZWF2 ZSBhIGRhbmdsaW5nCnBvaW50ZXIgdGhhdCBnZXRzIGRlcmVmZXJlbmNlZCBpZiBhbiBJQkkgZmly ZXMgbGF0ZXI/CgpbIC4uLiBdCj4gQEAgLTIwNSwxMSArMzQ1LDYzIEBAIHN0YXRpYyB1MzIgcDNo Mng0eF90cF9zbWJ1c19mdW5jcyhzdHJ1Y3QgaTJjX2FkYXB0ZXIgKmFkYXB0ZXIpCj4gIAlyZXR1 cm4gSTJDX0ZVTkNfSTJDIHwgSTJDX0ZVTkNfU01CVVNfQkxPQ0tfREFUQTsKPiAgfQo+ICAKWyAu Li4gXQo+ICAvKgo+ICAqIEkyQyBhbGdvcml0aG0gU3RydWN0dXJlCj4gICovCj4gIHN0YXRpYyBz dHJ1Y3QgaTJjX2FsZ29yaXRobSBwM2gyeDR4X3RwX2kyY19hbGdvcml0aG0gPSB7Cj4gIAkubWFz dGVyX3hmZXIgICAgPSBwM2gyeDR4X3RwX2kyY194ZmVyLAo+ICsjaWYgSVNfRU5BQkxFRChDT05G SUdfSTJDX1NMQVZFKQo+ICsJLnJlZ19zbGF2ZSA9IHAzaDJ4NHhfdHBfaTJjX3JlZ19zbGF2ZSwK PiArCS51bnJlZ19zbGF2ZSA9IHAzaDJ4NHhfdHBfaTJjX3VucmVnX3NsYXZlLAo+ICsjZW5kaWYK PiAgCS5mdW5jdGlvbmFsaXR5ICA9IHAzaDJ4NHhfdHBfc21idXNfZnVuY3MsCj4gIH07CgpbU2V2 ZXJpdHk6IEhpZ2hdClRoaXMgaXMgYSBwcmUtZXhpc3RpbmcgaXNzdWUsIGJ1dCBJMkMgYWRhcHRl cnMgcmVnaXN0ZXJlZCBpbgpwM2gyeDR4X3RwX3NtYnVzX2FsZ28oKSBsYWNrIGEgZGV2cmVzIGFj dGlvbiBmb3IgYXV0b21hdGljIGNsZWFudXAuCgpJZiBwM2gyeDR4X2kzY19odWJfcHJvYmUoKSBl bmNvdW50ZXJzIGFuIGVycm9yIGFmdGVyIGFkYXB0ZXJzIGFyZSBhZGRlZAp3aXRoIGkyY19hZGRf YWRhcHRlcigpLCBkZXZyZXMgd2lsbCBmcmVlIHRoZSBtZW1vcnkgYmFja2luZyB0aGUgYWRhcHRl cnMsCmJ1dCB0aGV5IHJlbWFpbiByZWdpc3RlcmVkIHdpdGggdGhlIEkyQyBzdWJzeXN0ZW0uCgpD b3VsZCB0aGlzIGxlYWQgdG8gYSB1c2UtYWZ0ZXItZnJlZSBpZiB0aGUgSTJDIGNvcmUgYWNjZXNz ZXMgdGhlc2UgZ2hvc3QKYWRhcHRlcnM/CgotLSAKU2FzaGlrbyBBSSByZXZpZXcgwrcgaHR0cHM6 Ly9zYXNoaWtvLmRldi8jL3BhdGNoc2V0LzIwMjYwNjEyMTExODE2LjM2ODgyNDAtMS1sYWtzaGF5 LnBpcGxhbmlAbnhwLmNvbT9wYXJ0PTkKCi0tIApsaW51eC1pM2MgbWFpbGluZyBsaXN0CmxpbnV4 LWkzY0BsaXN0cy5pbmZyYWRlYWQub3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxt YW4vbGlzdGluZm8vbGludXgtaTNjCg==