From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 63D391F0E25 for ; Wed, 1 Jul 2026 07:23:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782890601; cv=none; b=QE1CqmUTzSULzxkyaBOq/SgxTGlREGy0fGe9OqahWtP0ddS0Pt7prm5me6WR7a96XD5hOUGzpyZw/qHZuPmKYuEGkQV6Nnc0yjOelWOZqinDhoagvOrocDUv3nKq24BdCjpkkH+E1OkaPhivajYMkXn4YjmsTUdMNGcVKJpiPOY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782890601; c=relaxed/simple; bh=M8GTPhS5KDTydLB3emXiO+e+Hk6UMiZitAI4lwY9M4c=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=F+gE9d4Z712rR45I2G5EBTQJpVW/KQDqf26Sit+SwM43wEUiAtH1/HnV3l/piijqc49J3msipOPAdmsD9R2D5w1hddbQnoUiGJYdVQ8o5lU72YAel+AqtUfUsvCZo3l+AyUZXPJGaDsmSZ0gh0Bp+3CQl6e3ULmwNsYb6x9h5vw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=dDejbA76; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="dDejbA76" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 165A41F000E9; Wed, 1 Jul 2026 07:23:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1782890600; bh=lKDSZqrNyc22qyxi6uNVTHql3X+zn18X14YoKohXkdg=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=dDejbA76UZEXbANWP+SEpZ33XNjVSxv8gyCDf8JtxyvJNQbmSBoJPIxGYEhqKnc/D ylfOzJ1NgyuoGCdCb+sOuZeNIqtkf9Je12PbJxJ0TSmaKHzTbvt22zc5+5iZPRFbtA zmVEqbHOzn+z4uL23XGrY386G+3uNPfc7d3/ietfl2x8tu6jIvnShqYH4iZt0g28d4 z7LHmCInWV2GZwerYNLjB17zTENZ5XtNirhc/Btmml4RUXTPXAagICzB58beA5xV94 1w4bxJoAIQ09m/yTeRPZ/6CVSi6txA1/ipL3PMO9K7l4Z6rvgmV1IbJi2wsEcRK4Ov 43JwkJZtN5C/w== From: sashiko-bot@kernel.org Subject: Re: [PATCH v13 5/7] i3c: hub: Add support for the I3C interface in the I3C hub Reply-To: sashiko-reviews@lists.linux.dev To: "Lakshay Piplani" Cc: linux-i3c@lists.infradead.org, robh@kernel.org, "Alexandre Belloni" , devicetree@vger.kernel.org, conor+dt@kernel.org, Frank.Li@kernel.org In-Reply-To: <20260701065755.2067793-6-lakshay.piplani@nxp.com> References: <20260701065755.2067793-1-lakshay.piplani@nxp.com> <20260701065755.2067793-6-lakshay.piplani@nxp.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Wed, 01 Jul 2026 07:23:18 +0000 Message-Id: <20260701072319.165A41F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 7 potential issue(= s) to consider: - [Critical] `i3c_hub_request_ibi()` intentionally frees `desc->ibi` out fr= om under its caller without cleaning up its workqueue, causing a memory lea= k and a double-free on failure. - [High] `i3c_hub_free_ibi()` causes a guaranteed NULL pointer dereference = in the core IBI free path by recursively clearing `dev->ibi`. - [High] Address spoofing in `i3c_hub_master_priv_xfers` corrupts parent bu= s address reservations and suffers from an unprotected race window. - [High] Missing `xfer_lock` in several hub operations allows concurrent po= rt enabling, breaking virtual bus isolation. - [High] `i3c_hub_free_ibi()` permanently destroys downstream device addres= s reservations on the parent bus. - [High] `i3c_hub_do_daa` delegates DAA entirely to the parent controller, = breaking boardinfo matching and DT topology for downstream devices. - [Medium] Acquiring `parent->bus.lock` while holding `child->bus.lock` tri= ggers a lockdep splat due to unannotated same-class lock nesting. -- commit 22c2a31197952a434777498d93a1ed925009d6de Author: Lakshay Piplani Subject: i3c: hub: Add support for the I3C interface in the I3C hub This patch adds virtual I3C bus support for the hub and provides an interface to enable or disable downstream ports. Virtual master controllers are created for the downstream ports, and bus operations are forwarded through the hub device. > diff --git a/drivers/i3c/hub.c b/drivers/i3c/hub.c > new file mode 100644 > index 0000000000000..d29ed40b6f735 > --- /dev/null > +++ b/drivers/i3c/hub.c > @@ -0,0 +1,566 @@ [ ... ] > +static int i3c_hub_do_daa(struct i3c_hub *hub, > + struct i3c_master_controller *controller) > +{ > + struct i3c_master_controller *parent; > + int ret; > + > + if (!hub || !hub->hub_dev) > + return -ENODEV; > + > + parent =3D i3c_dev_get_master(hub->hub_dev->desc); > + if (!parent) > + return -ENODEV; > + > + i3c_hub_enable_port(controller); > + ret =3D i3c_master_do_daa(parent); [Severity: High] Does delegating DAA directly to the parent controller bypass the virtual hub bus entirely? By calling i3c_master_do_daa(parent), it appears the parent discovers and attaches downstream devices to the physical bus instead of the virtual controller. Does this cause boardinfo matching to fail since the devices are defined under the hub's device tree node? > + i3c_hub_disable_port(controller); > + > + return ret; > +} [ ... ] > +static int i3c_hub_send_ccc_cmd(struct i3c_hub *hub, > + struct i3c_master_controller *controller, > + struct i3c_ccc_cmd *cmd) > +{ > + struct i3c_master_controller *parent; > + int ret; > + > + if (!hub || !hub->hub_dev) > + return -ENODEV; > + > + parent =3D i3c_dev_get_master(hub->hub_dev->desc); > + if (!parent) > + return -ENODEV; > + > + i3c_hub_enable_port(controller); > + ret =3D i3c_master_send_ccc_cmd(parent, cmd); [Severity: High] Could the omission of hub->xfer_lock in this function allow concurrent port enabling? The lock is used to serialize private transfers, but callbacks like i3c_hub_send_ccc_cmd(), i3c_hub_do_daa(), and i3c_hub_enable_ibi() do not acquire it. If a private transfer runs concurrently with a CCC command, could multiple downstream ports be enabled simultaneously and cause the hub to broadcast traffic incorrectly? > + i3c_hub_disable_port(controller); > + > + return ret; > +} [ ... ] > +static int i3c_hub_master_priv_xfers(struct i3c_dev_desc *dev, > + struct i3c_xfer *xfers, > + int nxfers, > + enum i3c_xfer_mode mode) > +{ > + struct i3c_master_controller *controller =3D i3c_dev_get_master(dev); > + struct i3c_hub_controller *hub_controller; > + struct i3c_dev_desc *hub_dev; > + struct i3c_master_controller *parent; > + u8 hub_addr, target_addr; > + struct i3c_hub *hub; > + int ret, xfer_ret; [ ... ] > + if (hub_addr !=3D target_addr) { > + down_write(&parent->bus.lock); [Severity: Medium] Will acquiring parent->bus.lock here trigger a lockdep warning? Since virtual hub operations are invoked by the I3C core with the child bus's lock already held, acquiring the parent bus's lock (which belongs to the same lock class) without nesting annotations might produce a false positive lockdep splat. This also happens in i3c_hub_enable_ibi() and i3c_hub_disable_ibi(). > + hub_dev->info.dyn_addr =3D target_addr; > + > + ret =3D i3c_master_reattach_i3c_dev_locked(hub_dev, hub_addr); > + if (ret) { > + up_write(&parent->bus.lock); > + hub_dev->info.dyn_addr =3D hub_addr; > + goto disable; > + } > + up_write(&parent->bus.lock); > + } > + > + ret =3D i3c_device_do_xfers(hub->hub_dev, xfers, nxfers, mode); > + > + if (hub_addr !=3D target_addr) { > + down_write(&parent->bus.lock); > + hub_dev->info.dyn_addr =3D hub_addr; > + > + xfer_ret =3D i3c_master_reattach_i3c_dev_locked(hub_dev, > + target_addr); [Severity: High] Does this sequence permanently destroy device tree static address reservations? When the hub's dynamic address is altered via i3c_master_reattach_i3c_dev_locked(), the hub's original address slot is set to free on the parent bus, leaving it vulnerable to DAA theft since the parent write-lock is dropped during the transfer. When the address is restored later by passing target_addr to i3c_master_reattach_i3c_dev_locked, this marks the downstream device's address as free, which seems to wipe out its reservation. > + > + up_write(&parent->bus.lock); > + if (!ret) > + ret =3D xfer_ret; > + } > +disable: > + i3c_hub_disable_port(controller); > + mutex_unlock(&hub->xfer_lock); > + return ret; > +} [ ... ] > +static int i3c_hub_request_ibi(struct i3c_dev_desc *desc, > + const struct i3c_ibi_setup *req) > +{ > + struct i3c_master_controller *controller =3D i3c_dev_get_master(desc); > + struct i3c_hub_controller *hub_controller; > + struct i3c_master_controller *orig_parent; > + struct i3c_master_controller *parent; > + struct i3c_hub *hub; > + int ret; [ ... ] > + orig_parent =3D i3c_hub_update_desc_parent(&desc->common, parent); > + > + ret =3D i3c_master_direct_attach_i3c_dev_locked(parent, desc); > + if (ret) { > + i3c_hub_update_desc_parent(&desc->common, orig_parent); > + up_write(&parent->bus.lock); > + return ret; > + } > + > + kfree(desc->ibi); > + desc->ibi =3D NULL; > + ret =3D i3c_dev_request_ibi_locked(desc, req); [Severity: Critical] Can freeing desc->ibi here cause a memory leak and a double-free? If a downstream device requests an IBI, the core i3c_dev_request_ibi_locked= () allocates ibi and ibi->wq before calling this hub operation. By calling kfree(desc->ibi) here, the outer workqueue is leaked. Furthermore, if the recursive call to i3c_dev_request_ibi_locked() fails, the outer caller will execute: if (ret) { kfree(ibi); dev->ibi =3D NULL; } Could this result in a double-free on the original allocation? > + if (ret) > + i3c_master_direct_detach_i3c_dev_locked(desc); > + > + i3c_hub_update_desc_parent(&desc->common, orig_parent); > + > + up_write(&parent->bus.lock); > + > + return ret; > +} > + > +static void i3c_hub_free_ibi(struct i3c_dev_desc *desc) > +{ > + struct i3c_master_controller *controller =3D i3c_dev_get_master(desc); > + struct i3c_hub_controller *hub_controller; > + struct i3c_master_controller *orig_parent; > + struct i3c_master_controller *parent; > + struct i3c_hub *hub; [ ... ] > + i3c_hub_enable_port(controller); > + > + down_write(&parent->bus.lock); > + orig_parent =3D i3c_hub_update_desc_parent(&desc->common, parent); > + i3c_dev_free_ibi_locked(desc); > + i3c_master_direct_detach_i3c_dev_locked(desc); [Severity: High] Does reparenting the device to the upstream master before detaching it destroy its address reservations? The detach logic calls i3c_master_put_i3c_addrs(), which resets the device's static and dynamic address slots to free. Because the device is temporarily parented to the upstream master, this frees the addresses on the parent bus. [Severity: High] Also, does the recursive call to i3c_dev_free_ibi_locked(desc) guarantee a NULL pointer dereference? The core i3c_dev_free_ibi_locked() function calls master->ops->free_ibi(dev= ). When this hub implementation recursively calls i3c_dev_free_ibi_locked(), it frees the IBI and sets desc->ibi =3D NULL. Upon returning to the outer func= tion, it executes: if (dev->ibi->wq) { destroy_workqueue(dev->ibi->wq); =20 which unconditionally dereferences the newly set NULL pointer. > + i3c_hub_update_desc_parent(&desc->common, orig_parent); > + up_write(&parent->bus.lock); > + > + i3c_hub_disable_port(controller); > +} --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260701065755.2067= 793-1-lakshay.piplani@nxp.com?part=3D5 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 81634C43327 for ; Wed, 1 Jul 2026 07:23:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Sa1ujbTncBR2WioNBN1isRoKEJpt2AU75ajSB9z7H18=; b=QmzRQaF817M6C2 ScXr0m4g1tUYK14Ftzk24rLQe5TMrI2JRmOUJkJiaFnUglr/LAcJOo/LU3eGnXS4y9lLupmnBa/Bp G0bjgyYK3FkQkMHw8pHp0sNMN/FWE7WUKS6Q11InrQ4YeMjlWzWjD8KEljuSfDKWZuZ8N+FQMl/7r Gg9MJwFcPDP/zcD9kS0LmbSw4D2Z/JoMfAK5XOu3dGzV3N8AWpZtW/SciHHEdn3r1eIVts5MO69tC 7IQmLBNpcYT3uLGsfke11qCPioHv7/w2zNF0nqKqgGdzuHCHw/iKH/P/AJuqVDGs1bqFj9603ZhH8 AqC8QfwVWmxy5/d59amA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wepI2-00000000tKP-13XY; Wed, 01 Jul 2026 07:23:22 +0000 Received: from tor.source.kernel.org ([172.105.4.254]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wepI0-00000000tK3-3hha for linux-i3c@lists.infradead.org; Wed, 01 Jul 2026 07:23:21 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 52CBA6001D; Wed, 1 Jul 2026 07:23:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 165A41F000E9; Wed, 1 Jul 2026 07:23:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1782890600; bh=lKDSZqrNyc22qyxi6uNVTHql3X+zn18X14YoKohXkdg=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=dDejbA76UZEXbANWP+SEpZ33XNjVSxv8gyCDf8JtxyvJNQbmSBoJPIxGYEhqKnc/D ylfOzJ1NgyuoGCdCb+sOuZeNIqtkf9Je12PbJxJ0TSmaKHzTbvt22zc5+5iZPRFbtA zmVEqbHOzn+z4uL23XGrY386G+3uNPfc7d3/ietfl2x8tu6jIvnShqYH4iZt0g28d4 z7LHmCInWV2GZwerYNLjB17zTENZ5XtNirhc/Btmml4RUXTPXAagICzB58beA5xV94 1w4bxJoAIQ09m/yTeRPZ/6CVSi6txA1/ipL3PMO9K7l4Z6rvgmV1IbJi2wsEcRK4Ov 43JwkJZtN5C/w== From: sashiko-bot@kernel.org Subject: Re: [PATCH v13 5/7] i3c: hub: Add support for the I3C interface in the I3C hub To: "Lakshay Piplani" Cc: linux-i3c@lists.infradead.org, robh@kernel.org, "Alexandre Belloni" , devicetree@vger.kernel.org, conor+dt@kernel.org, Frank.Li@kernel.org In-Reply-To: <20260701065755.2067793-6-lakshay.piplani@nxp.com> References: <20260701065755.2067793-1-lakshay.piplani@nxp.com> <20260701065755.2067793-6-lakshay.piplani@nxp.com> Date: Wed, 01 Jul 2026 07:23:18 +0000 Message-Id: <20260701072319.165A41F000E9@smtp.kernel.org> X-BeenThere: linux-i3c@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-i3c" Errors-To: linux-i3c-bounces+linux-i3c=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg NyBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6Ci0gW0NyaXRpY2FsXSBgaTNjX2h1Yl9y ZXF1ZXN0X2liaSgpYCBpbnRlbnRpb25hbGx5IGZyZWVzIGBkZXNjLT5pYmlgIG91dCBmcm9tIHVu ZGVyIGl0cyBjYWxsZXIgd2l0aG91dCBjbGVhbmluZyB1cCBpdHMgd29ya3F1ZXVlLCBjYXVzaW5n IGEgbWVtb3J5IGxlYWsgYW5kIGEgZG91YmxlLWZyZWUgb24gZmFpbHVyZS4KLSBbSGlnaF0gYGkz Y19odWJfZnJlZV9pYmkoKWAgY2F1c2VzIGEgZ3VhcmFudGVlZCBOVUxMIHBvaW50ZXIgZGVyZWZl cmVuY2UgaW4gdGhlIGNvcmUgSUJJIGZyZWUgcGF0aCBieSByZWN1cnNpdmVseSBjbGVhcmluZyBg ZGV2LT5pYmlgLgotIFtIaWdoXSBBZGRyZXNzIHNwb29maW5nIGluIGBpM2NfaHViX21hc3Rlcl9w cml2X3hmZXJzYCBjb3JydXB0cyBwYXJlbnQgYnVzIGFkZHJlc3MgcmVzZXJ2YXRpb25zIGFuZCBz dWZmZXJzIGZyb20gYW4gdW5wcm90ZWN0ZWQgcmFjZSB3aW5kb3cuCi0gW0hpZ2hdIE1pc3Npbmcg YHhmZXJfbG9ja2AgaW4gc2V2ZXJhbCBodWIgb3BlcmF0aW9ucyBhbGxvd3MgY29uY3VycmVudCBw b3J0IGVuYWJsaW5nLCBicmVha2luZyB2aXJ0dWFsIGJ1cyBpc29sYXRpb24uCi0gW0hpZ2hdIGBp M2NfaHViX2ZyZWVfaWJpKClgIHBlcm1hbmVudGx5IGRlc3Ryb3lzIGRvd25zdHJlYW0gZGV2aWNl IGFkZHJlc3MgcmVzZXJ2YXRpb25zIG9uIHRoZSBwYXJlbnQgYnVzLgotIFtIaWdoXSBgaTNjX2h1 Yl9kb19kYWFgIGRlbGVnYXRlcyBEQUEgZW50aXJlbHkgdG8gdGhlIHBhcmVudCBjb250cm9sbGVy LCBicmVha2luZyBib2FyZGluZm8gbWF0Y2hpbmcgYW5kIERUIHRvcG9sb2d5IGZvciBkb3duc3Ry ZWFtIGRldmljZXMuCi0gW01lZGl1bV0gQWNxdWlyaW5nIGBwYXJlbnQtPmJ1cy5sb2NrYCB3aGls ZSBob2xkaW5nIGBjaGlsZC0+YnVzLmxvY2tgIHRyaWdnZXJzIGEgbG9ja2RlcCBzcGxhdCBkdWUg dG8gdW5hbm5vdGF0ZWQgc2FtZS1jbGFzcyBsb2NrIG5lc3RpbmcuCi0tCgpjb21taXQgMjJjMmEz MTE5Nzk1MmE0MzQ3Nzc0OThkOTNhMWVkOTI1MDA5ZDZkZQpBdXRob3I6IExha3NoYXkgUGlwbGFu aSA8bGFrc2hheS5waXBsYW5pQG54cC5jb20+ClN1YmplY3Q6IGkzYzogaHViOiBBZGQgc3VwcG9y dCBmb3IgdGhlIEkzQyBpbnRlcmZhY2UgaW4gdGhlIEkzQyBodWIKClRoaXMgcGF0Y2ggYWRkcyB2 aXJ0dWFsIEkzQyBidXMgc3VwcG9ydCBmb3IgdGhlIGh1YiBhbmQgcHJvdmlkZXMgYW4KaW50ZXJm YWNlIHRvIGVuYWJsZSBvciBkaXNhYmxlIGRvd25zdHJlYW0gcG9ydHMuIFZpcnR1YWwgbWFzdGVy IGNvbnRyb2xsZXJzCmFyZSBjcmVhdGVkIGZvciB0aGUgZG93bnN0cmVhbSBwb3J0cywgYW5kIGJ1 cyBvcGVyYXRpb25zIGFyZSBmb3J3YXJkZWQKdGhyb3VnaCB0aGUgaHViIGRldmljZS4KCj4gZGlm ZiAtLWdpdCBhL2RyaXZlcnMvaTNjL2h1Yi5jIGIvZHJpdmVycy9pM2MvaHViLmMKPiBuZXcgZmls ZSBtb2RlIDEwMDY0NAo+IGluZGV4IDAwMDAwMDAwMDAwMDAuLmQyOWVkNDBiNmY3MzUKPiAtLS0g L2Rldi9udWxsCj4gKysrIGIvZHJpdmVycy9pM2MvaHViLmMKPiBAQCAtMCwwICsxLDU2NiBAQAoK WyAuLi4gXQoKPiArc3RhdGljIGludCBpM2NfaHViX2RvX2RhYShzdHJ1Y3QgaTNjX2h1YiAqaHVi LAo+ICsJCQkgIHN0cnVjdCBpM2NfbWFzdGVyX2NvbnRyb2xsZXIgKmNvbnRyb2xsZXIpCj4gK3sK PiArCXN0cnVjdCBpM2NfbWFzdGVyX2NvbnRyb2xsZXIgKnBhcmVudDsKPiArCWludCByZXQ7Cj4g Kwo+ICsJaWYgKCFodWIgfHwgIWh1Yi0+aHViX2RldikKPiArCQlyZXR1cm4gLUVOT0RFVjsKPiAr Cj4gKwlwYXJlbnQgPSBpM2NfZGV2X2dldF9tYXN0ZXIoaHViLT5odWJfZGV2LT5kZXNjKTsKPiAr CWlmICghcGFyZW50KQo+ICsJCXJldHVybiAtRU5PREVWOwo+ICsKPiArCWkzY19odWJfZW5hYmxl X3BvcnQoY29udHJvbGxlcik7Cj4gKwlyZXQgPSBpM2NfbWFzdGVyX2RvX2RhYShwYXJlbnQpOwoK W1NldmVyaXR5OiBIaWdoXQpEb2VzIGRlbGVnYXRpbmcgREFBIGRpcmVjdGx5IHRvIHRoZSBwYXJl bnQgY29udHJvbGxlciBieXBhc3MgdGhlIHZpcnR1YWwgaHViCmJ1cyBlbnRpcmVseT8KCkJ5IGNh bGxpbmcgaTNjX21hc3Rlcl9kb19kYWEocGFyZW50KSwgaXQgYXBwZWFycyB0aGUgcGFyZW50IGRp c2NvdmVycyBhbmQKYXR0YWNoZXMgZG93bnN0cmVhbSBkZXZpY2VzIHRvIHRoZSBwaHlzaWNhbCBi dXMgaW5zdGVhZCBvZiB0aGUgdmlydHVhbApjb250cm9sbGVyLiBEb2VzIHRoaXMgY2F1c2UgYm9h cmRpbmZvIG1hdGNoaW5nIHRvIGZhaWwgc2luY2UgdGhlIGRldmljZXMKYXJlIGRlZmluZWQgdW5k ZXIgdGhlIGh1YidzIGRldmljZSB0cmVlIG5vZGU/Cgo+ICsJaTNjX2h1Yl9kaXNhYmxlX3BvcnQo Y29udHJvbGxlcik7Cj4gKwo+ICsJcmV0dXJuIHJldDsKPiArfQoKWyAuLi4gXQoKPiArc3RhdGlj IGludCBpM2NfaHViX3NlbmRfY2NjX2NtZChzdHJ1Y3QgaTNjX2h1YiAqaHViLAo+ICsJCQkJc3Ry dWN0IGkzY19tYXN0ZXJfY29udHJvbGxlciAqY29udHJvbGxlciwKPiArCQkJCXN0cnVjdCBpM2Nf Y2NjX2NtZCAqY21kKQo+ICt7Cj4gKwlzdHJ1Y3QgaTNjX21hc3Rlcl9jb250cm9sbGVyICpwYXJl bnQ7Cj4gKwlpbnQgcmV0Owo+ICsKPiArCWlmICghaHViIHx8ICFodWItPmh1Yl9kZXYpCj4gKwkJ cmV0dXJuIC1FTk9ERVY7Cj4gKwo+ICsJcGFyZW50ID0gaTNjX2Rldl9nZXRfbWFzdGVyKGh1Yi0+ aHViX2Rldi0+ZGVzYyk7Cj4gKwlpZiAoIXBhcmVudCkKPiArCQlyZXR1cm4gLUVOT0RFVjsKPiAr Cj4gKwlpM2NfaHViX2VuYWJsZV9wb3J0KGNvbnRyb2xsZXIpOwo+ICsJcmV0ID0gaTNjX21hc3Rl cl9zZW5kX2NjY19jbWQocGFyZW50LCBjbWQpOwoKW1NldmVyaXR5OiBIaWdoXQpDb3VsZCB0aGUg b21pc3Npb24gb2YgaHViLT54ZmVyX2xvY2sgaW4gdGhpcyBmdW5jdGlvbiBhbGxvdyBjb25jdXJy ZW50IHBvcnQKZW5hYmxpbmc/CgpUaGUgbG9jayBpcyB1c2VkIHRvIHNlcmlhbGl6ZSBwcml2YXRl IHRyYW5zZmVycywgYnV0IGNhbGxiYWNrcyBsaWtlCmkzY19odWJfc2VuZF9jY2NfY21kKCksIGkz Y19odWJfZG9fZGFhKCksIGFuZCBpM2NfaHViX2VuYWJsZV9pYmkoKSBkbyBub3QKYWNxdWlyZSBp dC4gSWYgYSBwcml2YXRlIHRyYW5zZmVyIHJ1bnMgY29uY3VycmVudGx5IHdpdGggYSBDQ0MgY29t bWFuZCwKY291bGQgbXVsdGlwbGUgZG93bnN0cmVhbSBwb3J0cyBiZSBlbmFibGVkIHNpbXVsdGFu ZW91c2x5IGFuZCBjYXVzZSB0aGUgaHViCnRvIGJyb2FkY2FzdCB0cmFmZmljIGluY29ycmVjdGx5 PwoKPiArCWkzY19odWJfZGlzYWJsZV9wb3J0KGNvbnRyb2xsZXIpOwo+ICsKPiArCXJldHVybiBy ZXQ7Cj4gK30KClsgLi4uIF0KCj4gK3N0YXRpYyBpbnQgaTNjX2h1Yl9tYXN0ZXJfcHJpdl94ZmVy cyhzdHJ1Y3QgaTNjX2Rldl9kZXNjICpkZXYsCj4gKwkJCQkgICAgIHN0cnVjdCBpM2NfeGZlciAq eGZlcnMsCj4gKwkJCQkgICAgIGludCBueGZlcnMsCj4gKwkJCQkgICAgIGVudW0gaTNjX3hmZXJf bW9kZSBtb2RlKQo+ICt7Cj4gKwlzdHJ1Y3QgaTNjX21hc3Rlcl9jb250cm9sbGVyICpjb250cm9s bGVyID0gaTNjX2Rldl9nZXRfbWFzdGVyKGRldik7Cj4gKwlzdHJ1Y3QgaTNjX2h1Yl9jb250cm9s bGVyICpodWJfY29udHJvbGxlcjsKPiArCXN0cnVjdCBpM2NfZGV2X2Rlc2MgKmh1Yl9kZXY7Cj4g KwlzdHJ1Y3QgaTNjX21hc3Rlcl9jb250cm9sbGVyICpwYXJlbnQ7Cj4gKwl1OCBodWJfYWRkciwg dGFyZ2V0X2FkZHI7Cj4gKwlzdHJ1Y3QgaTNjX2h1YiAqaHViOwo+ICsJaW50IHJldCwgeGZlcl9y ZXQ7CgpbIC4uLiBdCgo+ICsJaWYgKGh1Yl9hZGRyICE9IHRhcmdldF9hZGRyKSB7Cj4gKwkJZG93 bl93cml0ZSgmcGFyZW50LT5idXMubG9jayk7CgpbU2V2ZXJpdHk6IE1lZGl1bV0KV2lsbCBhY3F1 aXJpbmcgcGFyZW50LT5idXMubG9jayBoZXJlIHRyaWdnZXIgYSBsb2NrZGVwIHdhcm5pbmc/CgpT aW5jZSB2aXJ0dWFsIGh1YiBvcGVyYXRpb25zIGFyZSBpbnZva2VkIGJ5IHRoZSBJM0MgY29yZSB3 aXRoIHRoZSBjaGlsZApidXMncyBsb2NrIGFscmVhZHkgaGVsZCwgYWNxdWlyaW5nIHRoZSBwYXJl bnQgYnVzJ3MgbG9jayAod2hpY2ggYmVsb25ncyB0bwp0aGUgc2FtZSBsb2NrIGNsYXNzKSB3aXRo b3V0IG5lc3RpbmcgYW5ub3RhdGlvbnMgbWlnaHQgcHJvZHVjZSBhIGZhbHNlCnBvc2l0aXZlIGxv Y2tkZXAgc3BsYXQuIFRoaXMgYWxzbyBoYXBwZW5zIGluIGkzY19odWJfZW5hYmxlX2liaSgpIGFu ZAppM2NfaHViX2Rpc2FibGVfaWJpKCkuCgo+ICsJCWh1Yl9kZXYtPmluZm8uZHluX2FkZHIgPSB0 YXJnZXRfYWRkcjsKPiArCj4gKwkJcmV0ID0gaTNjX21hc3Rlcl9yZWF0dGFjaF9pM2NfZGV2X2xv Y2tlZChodWJfZGV2LCBodWJfYWRkcik7Cj4gKwkJaWYgKHJldCkgewo+ICsJCQl1cF93cml0ZSgm cGFyZW50LT5idXMubG9jayk7Cj4gKwkJCWh1Yl9kZXYtPmluZm8uZHluX2FkZHIgPSBodWJfYWRk cjsKPiArCQkJZ290byBkaXNhYmxlOwo+ICsJCX0KPiArCQl1cF93cml0ZSgmcGFyZW50LT5idXMu bG9jayk7Cj4gKwl9Cj4gKwo+ICsJcmV0ID0gaTNjX2RldmljZV9kb194ZmVycyhodWItPmh1Yl9k ZXYsIHhmZXJzLCBueGZlcnMsIG1vZGUpOwo+ICsKPiArCWlmIChodWJfYWRkciAhPSB0YXJnZXRf YWRkcikgewo+ICsJCWRvd25fd3JpdGUoJnBhcmVudC0+YnVzLmxvY2spOwo+ICsJCWh1Yl9kZXYt PmluZm8uZHluX2FkZHIgPSBodWJfYWRkcjsKPiArCj4gKwkJeGZlcl9yZXQgPSBpM2NfbWFzdGVy X3JlYXR0YWNoX2kzY19kZXZfbG9ja2VkKGh1Yl9kZXYsCj4gKwkJCQkJCQkgICAgICB0YXJnZXRf YWRkcik7CgpbU2V2ZXJpdHk6IEhpZ2hdCkRvZXMgdGhpcyBzZXF1ZW5jZSBwZXJtYW5lbnRseSBk ZXN0cm95IGRldmljZSB0cmVlIHN0YXRpYyBhZGRyZXNzCnJlc2VydmF0aW9ucz8KCldoZW4gdGhl IGh1YidzIGR5bmFtaWMgYWRkcmVzcyBpcyBhbHRlcmVkIHZpYQppM2NfbWFzdGVyX3JlYXR0YWNo X2kzY19kZXZfbG9ja2VkKCksIHRoZSBodWIncyBvcmlnaW5hbCBhZGRyZXNzIHNsb3QgaXMKc2V0 IHRvIGZyZWUgb24gdGhlIHBhcmVudCBidXMsIGxlYXZpbmcgaXQgdnVsbmVyYWJsZSB0byBEQUEg dGhlZnQgc2luY2UgdGhlCnBhcmVudCB3cml0ZS1sb2NrIGlzIGRyb3BwZWQgZHVyaW5nIHRoZSB0 cmFuc2Zlci4gV2hlbiB0aGUgYWRkcmVzcyBpcwpyZXN0b3JlZCBsYXRlciBieSBwYXNzaW5nIHRh cmdldF9hZGRyIHRvIGkzY19tYXN0ZXJfcmVhdHRhY2hfaTNjX2Rldl9sb2NrZWQsCnRoaXMgbWFy a3MgdGhlIGRvd25zdHJlYW0gZGV2aWNlJ3MgYWRkcmVzcyBhcyBmcmVlLCB3aGljaCBzZWVtcyB0 byB3aXBlIG91dAppdHMgcmVzZXJ2YXRpb24uCgo+ICsKPiArCQl1cF93cml0ZSgmcGFyZW50LT5i dXMubG9jayk7Cj4gKwkJaWYgKCFyZXQpCj4gKwkJCXJldCA9IHhmZXJfcmV0Owo+ICsJfQo+ICtk aXNhYmxlOgo+ICsJaTNjX2h1Yl9kaXNhYmxlX3BvcnQoY29udHJvbGxlcik7Cj4gKwltdXRleF91 bmxvY2soJmh1Yi0+eGZlcl9sb2NrKTsKPiArCXJldHVybiByZXQ7Cj4gK30KClsgLi4uIF0KCj4g K3N0YXRpYyBpbnQgaTNjX2h1Yl9yZXF1ZXN0X2liaShzdHJ1Y3QgaTNjX2Rldl9kZXNjICpkZXNj LAo+ICsJCQkgICAgICAgY29uc3Qgc3RydWN0IGkzY19pYmlfc2V0dXAgKnJlcSkKPiArewo+ICsJ c3RydWN0IGkzY19tYXN0ZXJfY29udHJvbGxlciAqY29udHJvbGxlciA9IGkzY19kZXZfZ2V0X21h c3RlcihkZXNjKTsKPiArCXN0cnVjdCBpM2NfaHViX2NvbnRyb2xsZXIgKmh1Yl9jb250cm9sbGVy Owo+ICsJc3RydWN0IGkzY19tYXN0ZXJfY29udHJvbGxlciAqb3JpZ19wYXJlbnQ7Cj4gKwlzdHJ1 Y3QgaTNjX21hc3Rlcl9jb250cm9sbGVyICpwYXJlbnQ7Cj4gKwlzdHJ1Y3QgaTNjX2h1YiAqaHVi Owo+ICsJaW50IHJldDsKClsgLi4uIF0KCj4gKwlvcmlnX3BhcmVudCA9IGkzY19odWJfdXBkYXRl X2Rlc2NfcGFyZW50KCZkZXNjLT5jb21tb24sIHBhcmVudCk7Cj4gKwo+ICsJcmV0ID0gaTNjX21h c3Rlcl9kaXJlY3RfYXR0YWNoX2kzY19kZXZfbG9ja2VkKHBhcmVudCwgZGVzYyk7Cj4gKwlpZiAo cmV0KSB7Cj4gKwkJaTNjX2h1Yl91cGRhdGVfZGVzY19wYXJlbnQoJmRlc2MtPmNvbW1vbiwgb3Jp Z19wYXJlbnQpOwo+ICsJCXVwX3dyaXRlKCZwYXJlbnQtPmJ1cy5sb2NrKTsKPiArCQlyZXR1cm4g cmV0Owo+ICsJfQo+ICsKPiArCWtmcmVlKGRlc2MtPmliaSk7Cj4gKwlkZXNjLT5pYmkgPSBOVUxM Owo+ICsJcmV0ID0gaTNjX2Rldl9yZXF1ZXN0X2liaV9sb2NrZWQoZGVzYywgcmVxKTsKCltTZXZl cml0eTogQ3JpdGljYWxdCkNhbiBmcmVlaW5nIGRlc2MtPmliaSBoZXJlIGNhdXNlIGEgbWVtb3J5 IGxlYWsgYW5kIGEgZG91YmxlLWZyZWU/CgpJZiBhIGRvd25zdHJlYW0gZGV2aWNlIHJlcXVlc3Rz IGFuIElCSSwgdGhlIGNvcmUgaTNjX2Rldl9yZXF1ZXN0X2liaV9sb2NrZWQoKQphbGxvY2F0ZXMg aWJpIGFuZCBpYmktPndxIGJlZm9yZSBjYWxsaW5nIHRoaXMgaHViIG9wZXJhdGlvbi4gQnkgY2Fs bGluZwprZnJlZShkZXNjLT5pYmkpIGhlcmUsIHRoZSBvdXRlciB3b3JrcXVldWUgaXMgbGVha2Vk LgoKRnVydGhlcm1vcmUsIGlmIHRoZSByZWN1cnNpdmUgY2FsbCB0byBpM2NfZGV2X3JlcXVlc3Rf aWJpX2xvY2tlZCgpIGZhaWxzLAp0aGUgb3V0ZXIgY2FsbGVyIHdpbGwgZXhlY3V0ZToKCiAgICBp ZiAocmV0KSB7CiAgICAgICAgICAgIGtmcmVlKGliaSk7CiAgICAgICAgICAgIGRldi0+aWJpID0g TlVMTDsKICAgIH0KCkNvdWxkIHRoaXMgcmVzdWx0IGluIGEgZG91YmxlLWZyZWUgb24gdGhlIG9y aWdpbmFsIGFsbG9jYXRpb24/Cgo+ICsJaWYgKHJldCkKPiArCQlpM2NfbWFzdGVyX2RpcmVjdF9k ZXRhY2hfaTNjX2Rldl9sb2NrZWQoZGVzYyk7Cj4gKwo+ICsJaTNjX2h1Yl91cGRhdGVfZGVzY19w YXJlbnQoJmRlc2MtPmNvbW1vbiwgb3JpZ19wYXJlbnQpOwo+ICsKPiArCXVwX3dyaXRlKCZwYXJl bnQtPmJ1cy5sb2NrKTsKPiArCj4gKwlyZXR1cm4gcmV0Owo+ICt9Cj4gKwo+ICtzdGF0aWMgdm9p ZCBpM2NfaHViX2ZyZWVfaWJpKHN0cnVjdCBpM2NfZGV2X2Rlc2MgKmRlc2MpCj4gK3sKPiArCXN0 cnVjdCBpM2NfbWFzdGVyX2NvbnRyb2xsZXIgKmNvbnRyb2xsZXIgPSBpM2NfZGV2X2dldF9tYXN0 ZXIoZGVzYyk7Cj4gKwlzdHJ1Y3QgaTNjX2h1Yl9jb250cm9sbGVyICpodWJfY29udHJvbGxlcjsK PiArCXN0cnVjdCBpM2NfbWFzdGVyX2NvbnRyb2xsZXIgKm9yaWdfcGFyZW50Owo+ICsJc3RydWN0 IGkzY19tYXN0ZXJfY29udHJvbGxlciAqcGFyZW50Owo+ICsJc3RydWN0IGkzY19odWIgKmh1YjsK ClsgLi4uIF0KCj4gKwlpM2NfaHViX2VuYWJsZV9wb3J0KGNvbnRyb2xsZXIpOwo+ICsKPiArCWRv d25fd3JpdGUoJnBhcmVudC0+YnVzLmxvY2spOwo+ICsJb3JpZ19wYXJlbnQgPSBpM2NfaHViX3Vw ZGF0ZV9kZXNjX3BhcmVudCgmZGVzYy0+Y29tbW9uLCBwYXJlbnQpOwo+ICsJaTNjX2Rldl9mcmVl X2liaV9sb2NrZWQoZGVzYyk7Cj4gKwlpM2NfbWFzdGVyX2RpcmVjdF9kZXRhY2hfaTNjX2Rldl9s b2NrZWQoZGVzYyk7CgpbU2V2ZXJpdHk6IEhpZ2hdCkRvZXMgcmVwYXJlbnRpbmcgdGhlIGRldmlj ZSB0byB0aGUgdXBzdHJlYW0gbWFzdGVyIGJlZm9yZSBkZXRhY2hpbmcgaXQKZGVzdHJveSBpdHMg YWRkcmVzcyByZXNlcnZhdGlvbnM/CgpUaGUgZGV0YWNoIGxvZ2ljIGNhbGxzIGkzY19tYXN0ZXJf cHV0X2kzY19hZGRycygpLCB3aGljaCByZXNldHMgdGhlIGRldmljZSdzCnN0YXRpYyBhbmQgZHlu YW1pYyBhZGRyZXNzIHNsb3RzIHRvIGZyZWUuIEJlY2F1c2UgdGhlIGRldmljZSBpcyB0ZW1wb3Jh cmlseQpwYXJlbnRlZCB0byB0aGUgdXBzdHJlYW0gbWFzdGVyLCB0aGlzIGZyZWVzIHRoZSBhZGRy ZXNzZXMgb24gdGhlIHBhcmVudCBidXMuCgpbU2V2ZXJpdHk6IEhpZ2hdCkFsc28sIGRvZXMgdGhl IHJlY3Vyc2l2ZSBjYWxsIHRvIGkzY19kZXZfZnJlZV9pYmlfbG9ja2VkKGRlc2MpIGd1YXJhbnRl ZSBhCk5VTEwgcG9pbnRlciBkZXJlZmVyZW5jZT8KClRoZSBjb3JlIGkzY19kZXZfZnJlZV9pYmlf bG9ja2VkKCkgZnVuY3Rpb24gY2FsbHMgbWFzdGVyLT5vcHMtPmZyZWVfaWJpKGRldikuCldoZW4g dGhpcyBodWIgaW1wbGVtZW50YXRpb24gcmVjdXJzaXZlbHkgY2FsbHMgaTNjX2Rldl9mcmVlX2li aV9sb2NrZWQoKSwgaXQKZnJlZXMgdGhlIElCSSBhbmQgc2V0cyBkZXNjLT5pYmkgPSBOVUxMLiBV cG9uIHJldHVybmluZyB0byB0aGUgb3V0ZXIgZnVuY3Rpb24sCml0IGV4ZWN1dGVzOgoKICAgIGlm IChkZXYtPmliaS0+d3EpIHsKICAgICAgICAgICAgZGVzdHJveV93b3JrcXVldWUoZGV2LT5pYmkt PndxKTsKICAgIAp3aGljaCB1bmNvbmRpdGlvbmFsbHkgZGVyZWZlcmVuY2VzIHRoZSBuZXdseSBz ZXQgTlVMTCBwb2ludGVyLgoKPiArCWkzY19odWJfdXBkYXRlX2Rlc2NfcGFyZW50KCZkZXNjLT5j b21tb24sIG9yaWdfcGFyZW50KTsKPiArCXVwX3dyaXRlKCZwYXJlbnQtPmJ1cy5sb2NrKTsKPiAr Cj4gKwlpM2NfaHViX2Rpc2FibGVfcG9ydChjb250cm9sbGVyKTsKPiArfQoKLS0gClNhc2hpa28g QUkgcmV2aWV3IMK3IGh0dHBzOi8vc2FzaGlrby5kZXYvIy9wYXRjaHNldC8yMDI2MDcwMTA2NTc1 NS4yMDY3NzkzLTEtbGFrc2hheS5waXBsYW5pQG54cC5jb20/cGFydD01CgotLSAKbGludXgtaTNj IG1haWxpbmcgbGlzdApsaW51eC1pM2NAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMu aW5mcmFkZWFkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LWkzYwo=