From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B728363C6C for ; Tue, 23 Jun 2026 06:25:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782195920; cv=none; b=sq1kyu2hMbY3C5dDgvH50RygbzKdiyxIbeSEopBHjfcj1XlcararbLodV4prHTpwAGmaIo2iphiAA1OLrkL0yXrwysGTmxM9ZlWepjQOfnvUYg+sPqic0MvKEHC9f7RRuI/scegz39c/qygyS8FQdWQazb17EsNuW5fBVatErHs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782195920; c=relaxed/simple; bh=VLehpKV+rsnSYwifcRrtuDdA9GuS3Z9HPyB37eNfUKU=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=PelJuZ62twVdXXsFrXzByZ3+o0kWr+j398WgU3XHFilx8CHALKgMLKjtbLtF/XRC/QhaadmEK28Y1DU5MFzWcYGMXhigYCvN4ZtpI9bG0PD/iURXNOCZVEvyFpuwFg9OjEX4Qq2hPXmUGX8P4QixZf2hRYeT3ncxiOcWWuUu0t0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Bh9WneyB; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Bh9WneyB" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7B7B81F000E9; Tue, 23 Jun 2026 06:25:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1782195918; bh=YDi1HR/uAYilrE9a9WgNxd0pqwEH/nO/OHN6kj200OU=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=Bh9WneyB8bvdlYTSdLQaHINeyz3zKd2KZ/1uzEnh7soClYM2FU4iQ4ep85LAOIZj5 8rLFESMuIB2X3YPaPv6BpP2Ik5jNBRGVkIihwUCHk2smOkQj6hX0KxBgGB2857jqFz +zxitJ8TN9lJa7vwztvNbcVbjZ4cV0I8ZD31Sd0QYANPM52Y6EKtzy7Y4eIGZLi4TM 3ZjPsSTwK93tQbZ0FejXfrfl2LdjPRQzf1Kuyaa5fzD1GAlmPg2fZ4wrfxMZ/OvtzX 6+77fi4k7biIrOUvIzMXYwi085VjoY/2PQbRayFnBj70ld1HBaYQkldX+ts9oYK7tm R7GlxEdjSiYYQ== From: sashiko-bot@kernel.org Subject: Re: [PATCH] i3c: master: svc: report timeout waiting for STOP idle Reply-To: sashiko-reviews@lists.linux.dev To: "Pengpeng Hou" Cc: Frank.Li@kernel.org, imx@lists.linux.dev, linux-i3c@lists.infradead.org In-Reply-To: <20260623060821.23238-1-pengpeng@iscas.ac.cn> References: <20260623060821.23238-1-pengpeng@iscas.ac.cn> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 23 Jun 2026 06:25:18 +0000 Message-Id: <20260623062518.7B7B81F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: imx@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 7 potential issue(= s) to consider: Pre-existing issues: - [Critical] Missing synchronization between IBI processing and device deta= chment causes Use-After-Free. - [Critical] Stack Buffer Overflow during Dynamic Address Assignment (DAA). - [Critical] Heap Buffer Overflow in IBI payload reading loop. - [High] Use of sleeping polling macro in atomic/hardirq context. - [High] DDR write payload is written twice to the FIFO when SVC_I3C_QUIRK_= FIFO_EMPTY is active. - [High] Hard lockup (infinite loop) in hardirq handler if hardware reports= RX pending without bytes. - [High] Endianness Portability Bug (Mixed I/O accessors on FIFO). -- commit f5ce1c99dd938b33fc88fc935174301f58c2a87a Author: Pengpeng Hou i3c: master: svc: report timeout waiting for STOP idle The commit modifies svc_i3c_master_xfer() to capture the return value of readl_poll_timeout() when waiting for the controller state to become idle. It routes the error through the cleanup path to ensure the caller observes the failed transfer. > diff --git a/drivers/i3c/master/svc-i3c-master.c b/drivers/i3c/master/svc= -i3c-master.c > index 93805df8a9406..ae38ceee5abf8 100644 > --- a/drivers/i3c/master/svc-i3c-master.c > +++ b/drivers/i3c/master/svc-i3c-master.c > @@ -1488,8 +1488,11 @@ static int svc_i3c_master_xfer(struct svc_i3c_mast= er *master, > svc_i3c_master_emit_force_exit(master); > =20 > /* Wait idle if stop is sent. */ > - readl_poll_timeout(master->regs + SVC_I3C_MSTATUS, reg, > - SVC_I3C_MSTATUS_STATE_IDLE(reg), 0, 1000); > + ret =3D readl_poll_timeout(master->regs + SVC_I3C_MSTATUS, reg, > + SVC_I3C_MSTATUS_STATE_IDLE(reg), > + 0, 1000); [Severity: High] This isn't a bug introduced by this patch, but does this code use a sleeping polling macro in an atomic context? The readl_poll_timeout macro uses ktime_get() for non-zero timeouts. Calling this from an atomic context, such as while holding a spinlock with interrupts disabled, can cause kernel deadlocks when CONFIG_DEBUG_ATOMIC_SLEEP is enabled. This also appears in svc_i3c_master_handle_ibi() where readl_relaxed_poll_timeout() is used inside a hardirq handler. > + if (ret) > + goto cleanup; > } > =20 > return 0; > @@ -1500,6 +1503,7 @@ static int svc_i3c_master_xfer(struct svc_i3c_maste= r *master, > else > svc_i3c_master_emit_force_exit(master); > =20 > +cleanup: > svc_i3c_master_clear_merrwarn(master); > svc_i3c_master_flush_fifo(master); While reviewing this file, I noticed a few other pre-existing issues: [Severity: High] This is a pre-existing issue, but does this code write the DDR payload to the FIFO twice when the SVC_I3C_QUIRK_FIFO_EMPTY quirk is active? In svc_i3c_master_xfer(), if the transfer is SVC_I3C_MCTRL_TYPE_DDR and is a write, the full payload is pushed into the FIFO: drivers/i3c/master/svc-i3c-master.c:svc_i3c_master_xfer() { ... if (xfer_type =3D=3D SVC_I3C_MCTRL_TYPE_DDR) { writel(rnw_cmd, master->regs + SVC_I3C_MWDATAB); if (!rnw) { ret =3D svc_i3c_master_write(master, out, xfer_len); ... } However, xfer_len is not modified. Later, the quirk workaround triggers and pushes the same payload bytes into the FIFO again: drivers/i3c/master/svc-i3c-master.c:svc_i3c_master_xfer() { ... if (svc_has_quirk(master, SVC_I3C_QUIRK_FIFO_EMPTY) && !rnw && xfer= _len) { ... writesb(master->regs + SVC_I3C_MWDATAB1, out, len - 1); ... } [Severity: High] This is a pre-existing issue, but does this code mix stream and register I/O accessors on the same FIFO, potentially causing data corruption on big-endian architectures? The subsystem architecture guidelines explicitly forbid mixing accessors like writesb() and writel() on the same FIFO address because register accessors perform implicit byte-swapping while stream accessors do not. In svc_i3c_master_xfer(), both are mixed for bulk and remainder writes: drivers/i3c/master/svc-i3c-master.c:svc_i3c_master_xfer() { ... writesb(master->regs + SVC_I3C_MWDATAB1, out, len - 1); /* Mark END bit if this is the last byte */ writel(out[len - 1] | end, master->regs + SVC_I3C_MWDATAB); ... } Similarly, readsb() is used in svc_i3c_master_handle_ibi() on the RX FIFO, whereas svc_i3c_master_read() uses readl() on the same FIFO. [Severity: Critical] This is a pre-existing issue, but is there missing synchronization between IBI processing and device detachment that could cause a use-after-free? In svc_i3c_master_ibi_isr(), the device descriptor is fetched under master->ibi.lock, but the lock is dropped before handling the IBI: drivers/i3c/master/svc-i3c-master.c:svc_i3c_master_ibi_isr() { ... spin_lock(&master->ibi.lock); dev =3D master->ibi.slots[ibiaddr]; spin_unlock(&master->ibi.lock); ... svc_i3c_master_handle_ibi(master, dev); ... } If the I3C core detaches the device concurrently, svc_i3c_master_detach_i3c_dev() can free the device data without synchronizing against the IRQ handler: drivers/i3c/master/svc-i3c-master.c:svc_i3c_master_detach_i3c_dev() { ... kfree(data); ... } [Severity: Critical] This is a pre-existing issue, but does this code lack bounds checking on dev_nb, potentially causing a stack buffer overflow? The svc_i3c_master_do_daa_locked() function defines fixed-size arrays on the stack for up to SVC_I3C_MAX_DEVS (32) devices: drivers/i3c/master/svc-i3c-master.c:svc_i3c_master_do_daa_locked() { u64 prov_id[SVC_I3C_MAX_DEVS] =3D {}, nacking_prov_id =3D 0; unsigned int dev_nb =3D 0, last_addr =3D 0, dyn_addr =3D 0; ... } The loop assigns addresses to responding devices and writes to these arrays using dev_nb without verifying it hasn't exceeded the array bounds: drivers/i3c/master/svc-i3c-master.c:svc_i3c_master_do_daa_locked() { ... addrs[dev_nb] =3D dyn_addr; ... dev_nb++; ... } [Severity: Critical] This is a pre-existing issue, but does the loop draining the hardware RX FIFO use a hardcoded bound that could exceed the dynamically allocated buffer size? The slot->data buffer is allocated based on the device's max_payload_len, which can be small. However, the loop condition checks against SVC_I3C_FIFO_SIZE (16 bytes): drivers/i3c/master/svc-i3c-master.c:svc_i3c_master_handle_ibi() { ... while (SVC_I3C_MSTATUS_RXPEND(readl(master->regs + SVC_I3C_MSTATUS)) && slot->len < SVC_I3C_FIFO_SIZE) { ... count =3D SVC_I3C_MDATACTRL_RXCOUNT(mdatactrl); readsb(master->regs + SVC_I3C_MRDATAB, buf, count); slot->len +=3D count; ... } Because the check evaluates slot->len < 16 before adding count (which can also be up to 16 bytes), up to 31 bytes could be written to a buffer that might only be 1 or 2 bytes long. [Severity: High] This is a pre-existing issue, but could this loop cause a hard lockup in the hardirq handler if the hardware reports RXPEND is true but RXCOUNT is 0? drivers/i3c/master/svc-i3c-master.c:svc_i3c_master_handle_ibi() { ... while (SVC_I3C_MSTATUS_RXPEND(readl(master->regs + SVC_I3C_MSTATUS)) && slot->len < SVC_I3C_FIFO_SIZE) { ... count =3D SVC_I3C_MDATACTRL_RXCOUNT(mdatactrl); readsb(master->regs + SVC_I3C_MRDATAB, buf, count); slot->len +=3D count; buf +=3D count; } ... } The loop relies entirely on the hardware state to terminate. If RXCOUNT is 0, count will be 0, slot->len will not increase, and the loop will spin indefinitely. --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260623060821.2323= 8-1-pengpeng@iscas.ac.cn?part=3D1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1491CCD4F26 for ; Tue, 23 Jun 2026 06:25:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=fLv5lkffPs9d4O8ZAF0YTRbKiHCgQkeYBgUEbR3WAUY=; b=EkHF4gDWtDgMsX 5HLmqaiPdk7k0bsh7fJ3n1iGa42p2lQ02K7GTf9pmqXCnbWN6GmDhOp4kq2Pxl1mZQ+SYCIJRbCe8 85bhGRfQzrJ5045ZbBLdu+5taUK+x8Mdrpea8cMy/emFvV7orffPXM1zyqjH9maENGOgSF6RygyKT zbcGsQKAdFjsll64I9gpgokinr0EG8LE7hFKZNWg9aTg/s+gIf99AAY6ZR325eb+MJPv1V5V+0wFd qyry8wOaVDi7hfEVPdwlb6eEWj19g6mKEP8U+zNWAmKJ1Lz1LKuxE85azO86u5UtGLV0xzksD1j/2 QirtBguLqGEO/je6lakw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wbuZV-00000005lnl-2lRX; Tue, 23 Jun 2026 06:25:21 +0000 Received: from tor.source.kernel.org ([172.105.4.254]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wbuZT-00000005lne-2zAE for linux-i3c@lists.infradead.org; Tue, 23 Jun 2026 06:25:19 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id EBBC360207; Tue, 23 Jun 2026 06:25:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7B7B81F000E9; Tue, 23 Jun 2026 06:25:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1782195918; bh=YDi1HR/uAYilrE9a9WgNxd0pqwEH/nO/OHN6kj200OU=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=Bh9WneyB8bvdlYTSdLQaHINeyz3zKd2KZ/1uzEnh7soClYM2FU4iQ4ep85LAOIZj5 8rLFESMuIB2X3YPaPv6BpP2Ik5jNBRGVkIihwUCHk2smOkQj6hX0KxBgGB2857jqFz +zxitJ8TN9lJa7vwztvNbcVbjZ4cV0I8ZD31Sd0QYANPM52Y6EKtzy7Y4eIGZLi4TM 3ZjPsSTwK93tQbZ0FejXfrfl2LdjPRQzf1Kuyaa5fzD1GAlmPg2fZ4wrfxMZ/OvtzX 6+77fi4k7biIrOUvIzMXYwi085VjoY/2PQbRayFnBj70ld1HBaYQkldX+ts9oYK7tm R7GlxEdjSiYYQ== From: sashiko-bot@kernel.org Subject: Re: [PATCH] i3c: master: svc: report timeout waiting for STOP idle To: "Pengpeng Hou" Cc: Frank.Li@kernel.org, imx@lists.linux.dev, linux-i3c@lists.infradead.org In-Reply-To: <20260623060821.23238-1-pengpeng@iscas.ac.cn> References: <20260623060821.23238-1-pengpeng@iscas.ac.cn> Date: Tue, 23 Jun 2026 06:25:18 +0000 Message-Id: <20260623062518.7B7B81F000E9@smtp.kernel.org> X-BeenThere: linux-i3c@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-i3c" Errors-To: linux-i3c-bounces+linux-i3c=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg NyBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpQcmUtZXhpc3RpbmcgaXNzdWVzOgot IFtDcml0aWNhbF0gTWlzc2luZyBzeW5jaHJvbml6YXRpb24gYmV0d2VlbiBJQkkgcHJvY2Vzc2lu ZyBhbmQgZGV2aWNlIGRldGFjaG1lbnQgY2F1c2VzIFVzZS1BZnRlci1GcmVlLgotIFtDcml0aWNh bF0gU3RhY2sgQnVmZmVyIE92ZXJmbG93IGR1cmluZyBEeW5hbWljIEFkZHJlc3MgQXNzaWdubWVu dCAoREFBKS4KLSBbQ3JpdGljYWxdIEhlYXAgQnVmZmVyIE92ZXJmbG93IGluIElCSSBwYXlsb2Fk IHJlYWRpbmcgbG9vcC4KLSBbSGlnaF0gVXNlIG9mIHNsZWVwaW5nIHBvbGxpbmcgbWFjcm8gaW4g YXRvbWljL2hhcmRpcnEgY29udGV4dC4KLSBbSGlnaF0gRERSIHdyaXRlIHBheWxvYWQgaXMgd3Jp dHRlbiB0d2ljZSB0byB0aGUgRklGTyB3aGVuIFNWQ19JM0NfUVVJUktfRklGT19FTVBUWSBpcyBh Y3RpdmUuCi0gW0hpZ2hdIEhhcmQgbG9ja3VwIChpbmZpbml0ZSBsb29wKSBpbiBoYXJkaXJxIGhh bmRsZXIgaWYgaGFyZHdhcmUgcmVwb3J0cyBSWCBwZW5kaW5nIHdpdGhvdXQgYnl0ZXMuCi0gW0hp Z2hdIEVuZGlhbm5lc3MgUG9ydGFiaWxpdHkgQnVnIChNaXhlZCBJL08gYWNjZXNzb3JzIG9uIEZJ Rk8pLgotLQoKY29tbWl0IGY1Y2UxYzk5ZGQ5MzhiMzNmYzg4ZmM5MzUxNzQzMDFmNThjMmE4N2EK QXV0aG9yOiBQZW5ncGVuZyBIb3UgPHBlbmdwZW5nQGlzY2FzLmFjLmNuPgoKaTNjOiBtYXN0ZXI6 IHN2YzogcmVwb3J0IHRpbWVvdXQgd2FpdGluZyBmb3IgU1RPUCBpZGxlCgpUaGUgY29tbWl0IG1v ZGlmaWVzIHN2Y19pM2NfbWFzdGVyX3hmZXIoKSB0byBjYXB0dXJlIHRoZSByZXR1cm4gdmFsdWUK b2YgcmVhZGxfcG9sbF90aW1lb3V0KCkgd2hlbiB3YWl0aW5nIGZvciB0aGUgY29udHJvbGxlciBz dGF0ZSB0byBiZWNvbWUKaWRsZS4gSXQgcm91dGVzIHRoZSBlcnJvciB0aHJvdWdoIHRoZSBjbGVh bnVwIHBhdGggdG8gZW5zdXJlIHRoZSBjYWxsZXIKb2JzZXJ2ZXMgdGhlIGZhaWxlZCB0cmFuc2Zl ci4KCj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvaTNjL21hc3Rlci9zdmMtaTNjLW1hc3Rlci5jIGIv ZHJpdmVycy9pM2MvbWFzdGVyL3N2Yy1pM2MtbWFzdGVyLmMKPiBpbmRleCA5MzgwNWRmOGE5NDA2 Li5hZTM4Y2VlZTVhYmY4IDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvaTNjL21hc3Rlci9zdmMtaTNj LW1hc3Rlci5jCj4gKysrIGIvZHJpdmVycy9pM2MvbWFzdGVyL3N2Yy1pM2MtbWFzdGVyLmMKPiBA QCAtMTQ4OCw4ICsxNDg4LDExIEBAIHN0YXRpYyBpbnQgc3ZjX2kzY19tYXN0ZXJfeGZlcihzdHJ1 Y3Qgc3ZjX2kzY19tYXN0ZXIgKm1hc3RlciwKPiAgCQkJc3ZjX2kzY19tYXN0ZXJfZW1pdF9mb3Jj ZV9leGl0KG1hc3Rlcik7Cj4gIAo+ICAJCS8qIFdhaXQgaWRsZSBpZiBzdG9wIGlzIHNlbnQuICov Cj4gLQkJcmVhZGxfcG9sbF90aW1lb3V0KG1hc3Rlci0+cmVncyArIFNWQ19JM0NfTVNUQVRVUywg cmVnLAo+IC0JCQkJICAgU1ZDX0kzQ19NU1RBVFVTX1NUQVRFX0lETEUocmVnKSwgMCwgMTAwMCk7 Cj4gKwkJcmV0ID0gcmVhZGxfcG9sbF90aW1lb3V0KG1hc3Rlci0+cmVncyArIFNWQ19JM0NfTVNU QVRVUywgcmVnLAo+ICsJCQkJCSBTVkNfSTNDX01TVEFUVVNfU1RBVEVfSURMRShyZWcpLAo+ICsJ CQkJCSAwLCAxMDAwKTsKCltTZXZlcml0eTogSGlnaF0KVGhpcyBpc24ndCBhIGJ1ZyBpbnRyb2R1 Y2VkIGJ5IHRoaXMgcGF0Y2gsIGJ1dCBkb2VzIHRoaXMgY29kZSB1c2UgYQpzbGVlcGluZyBwb2xs aW5nIG1hY3JvIGluIGFuIGF0b21pYyBjb250ZXh0PwoKVGhlIHJlYWRsX3BvbGxfdGltZW91dCBt YWNybyB1c2VzIGt0aW1lX2dldCgpIGZvciBub24temVybyB0aW1lb3V0cy4KQ2FsbGluZyB0aGlz IGZyb20gYW4gYXRvbWljIGNvbnRleHQsIHN1Y2ggYXMgd2hpbGUgaG9sZGluZyBhIHNwaW5sb2Nr CndpdGggaW50ZXJydXB0cyBkaXNhYmxlZCwgY2FuIGNhdXNlIGtlcm5lbCBkZWFkbG9ja3Mgd2hl bgpDT05GSUdfREVCVUdfQVRPTUlDX1NMRUVQIGlzIGVuYWJsZWQuCgpUaGlzIGFsc28gYXBwZWFy cyBpbiBzdmNfaTNjX21hc3Rlcl9oYW5kbGVfaWJpKCkgd2hlcmUKcmVhZGxfcmVsYXhlZF9wb2xs X3RpbWVvdXQoKSBpcyB1c2VkIGluc2lkZSBhIGhhcmRpcnEgaGFuZGxlci4KCj4gKwkJaWYgKHJl dCkKPiArCQkJZ290byBjbGVhbnVwOwo+ICAJfQo+ICAKPiAgCXJldHVybiAwOwo+IEBAIC0xNTAw LDYgKzE1MDMsNyBAQCBzdGF0aWMgaW50IHN2Y19pM2NfbWFzdGVyX3hmZXIoc3RydWN0IHN2Y19p M2NfbWFzdGVyICptYXN0ZXIsCj4gIAllbHNlCj4gIAkJc3ZjX2kzY19tYXN0ZXJfZW1pdF9mb3Jj ZV9leGl0KG1hc3Rlcik7Cj4gIAo+ICtjbGVhbnVwOgo+ICAJc3ZjX2kzY19tYXN0ZXJfY2xlYXJf bWVycndhcm4obWFzdGVyKTsKPiAgCXN2Y19pM2NfbWFzdGVyX2ZsdXNoX2ZpZm8obWFzdGVyKTsK CldoaWxlIHJldmlld2luZyB0aGlzIGZpbGUsIEkgbm90aWNlZCBhIGZldyBvdGhlciBwcmUtZXhp c3RpbmcgaXNzdWVzOgoKW1NldmVyaXR5OiBIaWdoXQpUaGlzIGlzIGEgcHJlLWV4aXN0aW5nIGlz c3VlLCBidXQgZG9lcyB0aGlzIGNvZGUgd3JpdGUgdGhlIEREUiBwYXlsb2FkIHRvCnRoZSBGSUZP IHR3aWNlIHdoZW4gdGhlIFNWQ19JM0NfUVVJUktfRklGT19FTVBUWSBxdWlyayBpcyBhY3RpdmU/ CgpJbiBzdmNfaTNjX21hc3Rlcl94ZmVyKCksIGlmIHRoZSB0cmFuc2ZlciBpcyBTVkNfSTNDX01D VFJMX1RZUEVfRERSIGFuZAppcyBhIHdyaXRlLCB0aGUgZnVsbCBwYXlsb2FkIGlzIHB1c2hlZCBp bnRvIHRoZSBGSUZPOgoKZHJpdmVycy9pM2MvbWFzdGVyL3N2Yy1pM2MtbWFzdGVyLmM6c3ZjX2kz Y19tYXN0ZXJfeGZlcigpIHsKICAgIC4uLgogICAgaWYgKHhmZXJfdHlwZSA9PSBTVkNfSTNDX01D VFJMX1RZUEVfRERSKSB7CiAgICAgICAgd3JpdGVsKHJud19jbWQsIG1hc3Rlci0+cmVncyArIFNW Q19JM0NfTVdEQVRBQik7CiAgICAgICAgaWYgKCFybncpIHsKICAgICAgICAgICAgcmV0ID0gc3Zj X2kzY19tYXN0ZXJfd3JpdGUobWFzdGVyLCBvdXQsIHhmZXJfbGVuKTsKICAgIC4uLgp9CgpIb3dl dmVyLCB4ZmVyX2xlbiBpcyBub3QgbW9kaWZpZWQuIExhdGVyLCB0aGUgcXVpcmsgd29ya2Fyb3Vu ZCB0cmlnZ2VycwphbmQgcHVzaGVzIHRoZSBzYW1lIHBheWxvYWQgYnl0ZXMgaW50byB0aGUgRklG TyBhZ2FpbjoKCmRyaXZlcnMvaTNjL21hc3Rlci9zdmMtaTNjLW1hc3Rlci5jOnN2Y19pM2NfbWFz dGVyX3hmZXIoKSB7CiAgICAuLi4KICAgICAgICBpZiAoc3ZjX2hhc19xdWlyayhtYXN0ZXIsIFNW Q19JM0NfUVVJUktfRklGT19FTVBUWSkgJiYgIXJudyAmJiB4ZmVyX2xlbikgewogICAgICAgICAg ICAuLi4KICAgICAgICAgICAgd3JpdGVzYihtYXN0ZXItPnJlZ3MgKyBTVkNfSTNDX01XREFUQUIx LCBvdXQsIGxlbiAtIDEpOwogICAgLi4uCn0KCltTZXZlcml0eTogSGlnaF0KVGhpcyBpcyBhIHBy ZS1leGlzdGluZyBpc3N1ZSwgYnV0IGRvZXMgdGhpcyBjb2RlIG1peCBzdHJlYW0gYW5kIHJlZ2lz dGVyCkkvTyBhY2Nlc3NvcnMgb24gdGhlIHNhbWUgRklGTywgcG90ZW50aWFsbHkgY2F1c2luZyBk YXRhIGNvcnJ1cHRpb24gb24KYmlnLWVuZGlhbiBhcmNoaXRlY3R1cmVzPwoKVGhlIHN1YnN5c3Rl bSBhcmNoaXRlY3R1cmUgZ3VpZGVsaW5lcyBleHBsaWNpdGx5IGZvcmJpZCBtaXhpbmcgYWNjZXNz b3JzCmxpa2Ugd3JpdGVzYigpIGFuZCB3cml0ZWwoKSBvbiB0aGUgc2FtZSBGSUZPIGFkZHJlc3Mg YmVjYXVzZSByZWdpc3RlcgphY2Nlc3NvcnMgcGVyZm9ybSBpbXBsaWNpdCBieXRlLXN3YXBwaW5n IHdoaWxlIHN0cmVhbSBhY2Nlc3NvcnMgZG8gbm90LgoKSW4gc3ZjX2kzY19tYXN0ZXJfeGZlcigp LCBib3RoIGFyZSBtaXhlZCBmb3IgYnVsayBhbmQgcmVtYWluZGVyIHdyaXRlczoKCmRyaXZlcnMv aTNjL21hc3Rlci9zdmMtaTNjLW1hc3Rlci5jOnN2Y19pM2NfbWFzdGVyX3hmZXIoKSB7CiAgICAu Li4KICAgICAgICAgICAgd3JpdGVzYihtYXN0ZXItPnJlZ3MgKyBTVkNfSTNDX01XREFUQUIxLCBv dXQsIGxlbiAtIDEpOwogICAgICAgICAgICAvKiBNYXJrIEVORCBiaXQgaWYgdGhpcyBpcyB0aGUg bGFzdCBieXRlICovCiAgICAgICAgICAgIHdyaXRlbChvdXRbbGVuIC0gMV0gfCBlbmQsIG1hc3Rl ci0+cmVncyArIFNWQ19JM0NfTVdEQVRBQik7CiAgICAuLi4KfQoKU2ltaWxhcmx5LCByZWFkc2Io KSBpcyB1c2VkIGluIHN2Y19pM2NfbWFzdGVyX2hhbmRsZV9pYmkoKSBvbiB0aGUgUlggRklGTywK d2hlcmVhcyBzdmNfaTNjX21hc3Rlcl9yZWFkKCkgdXNlcyByZWFkbCgpIG9uIHRoZSBzYW1lIEZJ Rk8uCgpbU2V2ZXJpdHk6IENyaXRpY2FsXQpUaGlzIGlzIGEgcHJlLWV4aXN0aW5nIGlzc3VlLCBi dXQgaXMgdGhlcmUgbWlzc2luZyBzeW5jaHJvbml6YXRpb24gYmV0d2VlbgpJQkkgcHJvY2Vzc2lu ZyBhbmQgZGV2aWNlIGRldGFjaG1lbnQgdGhhdCBjb3VsZCBjYXVzZSBhIHVzZS1hZnRlci1mcmVl PwoKSW4gc3ZjX2kzY19tYXN0ZXJfaWJpX2lzcigpLCB0aGUgZGV2aWNlIGRlc2NyaXB0b3IgaXMg ZmV0Y2hlZCB1bmRlcgptYXN0ZXItPmliaS5sb2NrLCBidXQgdGhlIGxvY2sgaXMgZHJvcHBlZCBi ZWZvcmUgaGFuZGxpbmcgdGhlIElCSToKCmRyaXZlcnMvaTNjL21hc3Rlci9zdmMtaTNjLW1hc3Rl ci5jOnN2Y19pM2NfbWFzdGVyX2liaV9pc3IoKSB7CiAgICAuLi4KICAgIHNwaW5fbG9jaygmbWFz dGVyLT5pYmkubG9jayk7CiAgICBkZXYgPSBtYXN0ZXItPmliaS5zbG90c1tpYmlhZGRyXTsKICAg IHNwaW5fdW5sb2NrKCZtYXN0ZXItPmliaS5sb2NrKTsKICAgIC4uLgogICAgc3ZjX2kzY19tYXN0 ZXJfaGFuZGxlX2liaShtYXN0ZXIsIGRldik7CiAgICAuLi4KfQoKSWYgdGhlIEkzQyBjb3JlIGRl dGFjaGVzIHRoZSBkZXZpY2UgY29uY3VycmVudGx5LApzdmNfaTNjX21hc3Rlcl9kZXRhY2hfaTNj X2RldigpIGNhbiBmcmVlIHRoZSBkZXZpY2UgZGF0YSB3aXRob3V0CnN5bmNocm9uaXppbmcgYWdh aW5zdCB0aGUgSVJRIGhhbmRsZXI6Cgpkcml2ZXJzL2kzYy9tYXN0ZXIvc3ZjLWkzYy1tYXN0ZXIu YzpzdmNfaTNjX21hc3Rlcl9kZXRhY2hfaTNjX2RldigpIHsKICAgIC4uLgogICAga2ZyZWUoZGF0 YSk7CiAgICAuLi4KfQoKW1NldmVyaXR5OiBDcml0aWNhbF0KVGhpcyBpcyBhIHByZS1leGlzdGlu ZyBpc3N1ZSwgYnV0IGRvZXMgdGhpcyBjb2RlIGxhY2sgYm91bmRzIGNoZWNraW5nIG9uCmRldl9u YiwgcG90ZW50aWFsbHkgY2F1c2luZyBhIHN0YWNrIGJ1ZmZlciBvdmVyZmxvdz8KClRoZSBzdmNf aTNjX21hc3Rlcl9kb19kYWFfbG9ja2VkKCkgZnVuY3Rpb24gZGVmaW5lcyBmaXhlZC1zaXplIGFy cmF5cyBvbgp0aGUgc3RhY2sgZm9yIHVwIHRvIFNWQ19JM0NfTUFYX0RFVlMgKDMyKSBkZXZpY2Vz OgoKZHJpdmVycy9pM2MvbWFzdGVyL3N2Yy1pM2MtbWFzdGVyLmM6c3ZjX2kzY19tYXN0ZXJfZG9f ZGFhX2xvY2tlZCgpIHsKICAgIHU2NCBwcm92X2lkW1NWQ19JM0NfTUFYX0RFVlNdID0ge30sIG5h Y2tpbmdfcHJvdl9pZCA9IDA7CiAgICB1bnNpZ25lZCBpbnQgZGV2X25iID0gMCwgbGFzdF9hZGRy ID0gMCwgZHluX2FkZHIgPSAwOwogICAgLi4uCn0KClRoZSBsb29wIGFzc2lnbnMgYWRkcmVzc2Vz IHRvIHJlc3BvbmRpbmcgZGV2aWNlcyBhbmQgd3JpdGVzIHRvIHRoZXNlIGFycmF5cwp1c2luZyBk ZXZfbmIgd2l0aG91dCB2ZXJpZnlpbmcgaXQgaGFzbid0IGV4Y2VlZGVkIHRoZSBhcnJheSBib3Vu ZHM6Cgpkcml2ZXJzL2kzYy9tYXN0ZXIvc3ZjLWkzYy1tYXN0ZXIuYzpzdmNfaTNjX21hc3Rlcl9k b19kYWFfbG9ja2VkKCkgewogICAgLi4uCiAgICBhZGRyc1tkZXZfbmJdID0gZHluX2FkZHI7CiAg ICAuLi4KICAgIGRldl9uYisrOwogICAgLi4uCn0KCltTZXZlcml0eTogQ3JpdGljYWxdClRoaXMg aXMgYSBwcmUtZXhpc3RpbmcgaXNzdWUsIGJ1dCBkb2VzIHRoZSBsb29wIGRyYWluaW5nIHRoZSBo YXJkd2FyZQpSWCBGSUZPIHVzZSBhIGhhcmRjb2RlZCBib3VuZCB0aGF0IGNvdWxkIGV4Y2VlZCB0 aGUgZHluYW1pY2FsbHkgYWxsb2NhdGVkCmJ1ZmZlciBzaXplPwoKVGhlIHNsb3QtPmRhdGEgYnVm ZmVyIGlzIGFsbG9jYXRlZCBiYXNlZCBvbiB0aGUgZGV2aWNlJ3MgbWF4X3BheWxvYWRfbGVuLAp3 aGljaCBjYW4gYmUgc21hbGwuIEhvd2V2ZXIsIHRoZSBsb29wIGNvbmRpdGlvbiBjaGVja3MgYWdh aW5zdApTVkNfSTNDX0ZJRk9fU0laRSAoMTYgYnl0ZXMpOgoKZHJpdmVycy9pM2MvbWFzdGVyL3N2 Yy1pM2MtbWFzdGVyLmM6c3ZjX2kzY19tYXN0ZXJfaGFuZGxlX2liaSgpIHsKICAgIC4uLgogICAg d2hpbGUgKFNWQ19JM0NfTVNUQVRVU19SWFBFTkQocmVhZGwobWFzdGVyLT5yZWdzICsgU1ZDX0kz Q19NU1RBVFVTKSkgJiYKICAgICAgICAgICBzbG90LT5sZW4gPCBTVkNfSTNDX0ZJRk9fU0laRSkg ewogICAgICAgIC4uLgogICAgICAgIGNvdW50ID0gU1ZDX0kzQ19NREFUQUNUUkxfUlhDT1VOVCht ZGF0YWN0cmwpOwogICAgICAgIHJlYWRzYihtYXN0ZXItPnJlZ3MgKyBTVkNfSTNDX01SREFUQUIs IGJ1ZiwgY291bnQpOwogICAgICAgIHNsb3QtPmxlbiArPSBjb3VudDsKICAgICAgICAuLi4KfQoK QmVjYXVzZSB0aGUgY2hlY2sgZXZhbHVhdGVzIHNsb3QtPmxlbiA8IDE2IGJlZm9yZSBhZGRpbmcg Y291bnQgKHdoaWNoCmNhbiBhbHNvIGJlIHVwIHRvIDE2IGJ5dGVzKSwgdXAgdG8gMzEgYnl0ZXMg Y291bGQgYmUgd3JpdHRlbiB0byBhIGJ1ZmZlcgp0aGF0IG1pZ2h0IG9ubHkgYmUgMSBvciAyIGJ5 dGVzIGxvbmcuCgpbU2V2ZXJpdHk6IEhpZ2hdClRoaXMgaXMgYSBwcmUtZXhpc3RpbmcgaXNzdWUs IGJ1dCBjb3VsZCB0aGlzIGxvb3AgY2F1c2UgYSBoYXJkIGxvY2t1cCBpbgp0aGUgaGFyZGlycSBo YW5kbGVyIGlmIHRoZSBoYXJkd2FyZSByZXBvcnRzIFJYUEVORCBpcyB0cnVlIGJ1dCBSWENPVU5U CmlzIDA/Cgpkcml2ZXJzL2kzYy9tYXN0ZXIvc3ZjLWkzYy1tYXN0ZXIuYzpzdmNfaTNjX21hc3Rl cl9oYW5kbGVfaWJpKCkgewogICAgLi4uCiAgICB3aGlsZSAoU1ZDX0kzQ19NU1RBVFVTX1JYUEVO RChyZWFkbChtYXN0ZXItPnJlZ3MgKyBTVkNfSTNDX01TVEFUVVMpKSAmJgogICAgICAgICAgIHNs b3QtPmxlbiA8IFNWQ19JM0NfRklGT19TSVpFKSB7CiAgICAgICAgLi4uCiAgICAgICAgY291bnQg PSBTVkNfSTNDX01EQVRBQ1RSTF9SWENPVU5UKG1kYXRhY3RybCk7CiAgICAgICAgcmVhZHNiKG1h c3Rlci0+cmVncyArIFNWQ19JM0NfTVJEQVRBQiwgYnVmLCBjb3VudCk7CiAgICAgICAgc2xvdC0+ bGVuICs9IGNvdW50OwogICAgICAgIGJ1ZiArPSBjb3VudDsKICAgIH0KICAgIC4uLgp9CgpUaGUg bG9vcCByZWxpZXMgZW50aXJlbHkgb24gdGhlIGhhcmR3YXJlIHN0YXRlIHRvIHRlcm1pbmF0ZS4g SWYgUlhDT1VOVAppcyAwLCBjb3VudCB3aWxsIGJlIDAsIHNsb3QtPmxlbiB3aWxsIG5vdCBpbmNy ZWFzZSwgYW5kIHRoZSBsb29wIHdpbGwKc3BpbiBpbmRlZmluaXRlbHkuCgotLSAKU2FzaGlrbyBB SSByZXZpZXcgwrcgaHR0cHM6Ly9zYXNoaWtvLmRldi8jL3BhdGNoc2V0LzIwMjYwNjIzMDYwODIx LjIzMjM4LTEtcGVuZ3BlbmdAaXNjYXMuYWMuY24/cGFydD0xCgotLSAKbGludXgtaTNjIG1haWxp bmcgbGlzdApsaW51eC1pM2NAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFk ZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LWkzYwo=