From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3BC31431A27; Wed, 15 Jul 2026 18:04:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784138691; cv=none; b=a5G3h2Uk/kXaEm1TAB9hmDKm3faME8uXRafU4jWZET6p1sXMH/sMKIeHC0MYfjf1gGB+8UZVMVQuqqL3GttlJE0SfLfr6EuRHq95XqCecuZ89tzBaULvgsuPZ8IjUk/2yXDLTHIfCEa+xICQ5CbGlYw3aNY2DBXqH6o8bnpO29E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784138691; c=relaxed/simple; bh=Hk7VnBZ0ZdY0C1zu84f7T9IkMd+Uct33zyrZ1r3c1Rg=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=PnomGb1sbgi+1uUC7BdfPytsvG+iiuXDJ0kp46uIFkD5ZGmHMe5OVt+cjAIqT6f1k+hHFutaB0NWBCgJgwB3Te8uMN0um+zVkFHlVb1ZJd/zhGDg+eRTB8lLPSEmyfgZ29gsrjNolN+Nr5Hft65jqxtw2Tw/cUjiK8j8px47G9s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FnWjnD8q; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FnWjnD8q" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC1FF1F000E9; Wed, 15 Jul 2026 18:04:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784138676; bh=z1bcCig/w+n8T1oUsM8SsxcefJTzaUQb15/bkmwPnMs=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=FnWjnD8q2wlfLJI1T6KORtV9Ktm+l3x9iOZi8E3DSQwgH0Q04A0HwiJdztZigdhbS s7bDbMn3OqVzbhDG3eVZ9eVfJdHspgoVMeveM1WRK8vxS7aBUY9HMh+XZEiMK7CiJ7 icwsVbbvl3OC1kjODbpT0Mhfei5I/gyI3mQmqZs7p639YIKLDeUmCWnjeqybPfKF/5 HbOF9D0wLPvpCCD6OAh9otvPzS/TN+6eGCCfGUGW63IBsQfvKaYj/ypg6RjIS6Znoh ycficcla2aRMl9gTQiLg5ew6ZYfUQJZS9xYMzLk2iTCFx10fETO9sn+UPpblOknC8r xzEgYWE23cypg== From: sashiko-bot@kernel.org Subject: Re: [PATCH 4/8] misc: make all reg_write callbacks take const void * Reply-To: sashiko-reviews@lists.linux.dev To: "Link Mauve" Cc: ojeda@kernel.org, neil.armstrong@linaro.org, "Alexandre Belloni" , lee@kernel.org, linux-sunxi@lists.linux.dev, linux-rtc@vger.kernel.org, Frank.Li@kernel.org, linux-amlogic@lists.infradead.org, imx@lists.linux.dev, mfd@lists.linux.dev In-Reply-To: <20260715175229.24672-5-linkmauve@linkmauve.fr> References: <20260715175229.24672-1-linkmauve@linkmauve.fr> <20260715175229.24672-5-linkmauve@linkmauve.fr> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Wed, 15 Jul 2026 18:04:35 +0000 Message-Id: <20260715180435.EC1FF1F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: linux-rtc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 4 potential issue(= s) to consider: New issues: - [Low] Passing `const void *` to `nvmem_device_write` discards the `const`= qualifier, causing a compiler warning/error. Pre-existing issues: - [Critical] The `m24lr_write` function uses the device offset to index the= source memory buffer, causing a critical out-of-bounds read of kernel memo= ry. - [High] Writing a dereferenced `const char *` byte to a 32-bit memory-mapp= ed register triggers sign-extension, potentially writing corrupted values t= o the hardware. - [High] Silent data loss when writing an odd number of bytes in 16-bit mod= e. -- --- Patch [4]: [PATCH 4/8] misc: make all reg_write callbacks take const vo= id * --- commit 8fae9381bce13733c89619440fc083ff647125a4 Author: Link Mauve misc: make all reg_write callbacks take const void * The previous commit switched from a pointer to mutable data to a pointer to immutable data, so let's fix all users of the nvmem_config API. [ ... ] > diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/ee= prom_93xx46.c > index 5230e910a1d11..8de85433d593c 100644 > --- a/drivers/misc/eeprom/eeprom_93xx46.c > +++ b/drivers/misc/eeprom/eeprom_93xx46.c > @@ -269,10 +269,10 @@ eeprom_93xx46_write_word(struct eeprom_93xx46_dev *= edev, > } > =20 > static int eeprom_93xx46_write(void *priv, unsigned int off, > - void *val, size_t count) > + const void *val, size_t count) > { > struct eeprom_93xx46_dev *edev =3D priv; > - char *buf =3D val; > + const char *buf =3D val; [Severity: High] This is a pre-existing issue, but does this function silently drop data when writing an odd number of bytes in 16-bit mode? In 16-bit word mode (EE_ADDR16), the driver intercepts the call and truncat= es the count: count &=3D ~1; If count is 1, it becomes 0, skipping the write loop entirely and returning= 0. Because the nvmem core interprets a 0 return value as success, the caller believes the data was written even though the hardware was unmodified. [ ... ] > diff --git a/drivers/misc/eeprom/m24lr.c b/drivers/misc/eeprom/m24lr.c > index 7a9fd45a8e460..22f3221e232b5 100644 > --- a/drivers/misc/eeprom/m24lr.c > +++ b/drivers/misc/eeprom/m24lr.c > @@ -374,7 +374,7 @@ static int m24lr_nvmem_read(void *priv, unsigned int = offset, void *val, > return 0; > } > =20 > -static int m24lr_nvmem_write(void *priv, unsigned int offset, void *val, > +static int m24lr_nvmem_write(void *priv, unsigned int offset, const void= *val, > size_t bytes) [Severity: Critical] This is a pre-existing issue, but does m24lr_write() use the device offset = to index the source memory buffer? When m24lr_nvmem_write() calls m24lr_write(..., val, bytes, offset, true), m24lr_write() passes buf + offset to the regmap write instead of advancing by the number of bytes written: err =3D m24lr_regmap_write(regmap, buf + offset, n, offset); Since buf is only sized for the data chunk being written, adding the device offset pushes the pointer far past the end of buf, leading to an out-of-bou= nds read of kernel memory that gets written to the external EEPROM. > { > ssize_t err; [ ... ] > diff --git a/drivers/misc/keba/cp500.c b/drivers/misc/keba/cp500.c > index 6c65fbf22e756..ee7889cb63a8b 100644 > --- a/drivers/misc/keba/cp500.c > +++ b/drivers/misc/keba/cp500.c > @@ -590,7 +590,7 @@ static int cp500_nvmem_read(void *priv, unsigned int = offset, void *val, > return 0; > } > =20 > -static int cp500_nvmem_write(void *priv, unsigned int offset, void *val, > +static int cp500_nvmem_write(void *priv, unsigned int offset, const void= *val, > size_t bytes) > { > struct cp500_nvmem *nvmem =3D priv; [Severity: Low] Does passing the now-const val directly to nvmem_device_write() discard the const qualifier? nvmem_device_write() expects a mutable void pointer, which will cause a bui= ld warning (and potentially break the build if -Werror is enabled): ret =3D nvmem_device_write(nvmem->base_nvmem, nvmem->offset + offset, bytes, val); [ ... ] > diff --git a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c b/drivers/= misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c > index a2ed477e0370b..f2759e9b41386 100644 > --- a/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c > +++ b/drivers/misc/mchp_pci1xxxx/mchp_pci1xxxx_otpe2p.c > @@ -159,11 +159,11 @@ static int pci1xxxx_eeprom_read(void *priv_t, unsig= ned int off, > } > =20 > static int pci1xxxx_eeprom_write(void *priv_t, unsigned int off, > - void *value_t, size_t count) > + const void *value_t, size_t count) > { > struct pci1xxxx_otp_eeprom_device *priv =3D priv_t; > void __iomem *rb =3D priv->reg_base; > - char *value =3D value_t; > + const char *value =3D value_t; [Severity: High] This is a pre-existing issue, but does dereferencing this const char pointer trigger sign-extension when passed to writel()? Later in this function, the byte is written like this: writel(*(value + byte), rb + MMAP_EEPROM_OFFSET(EEPROM_DATA_REG)); If the byte has its most significant bit set (e.g. is negative), the C comp= iler will sign-extend it to a 32-bit negative integer before passing it to write= l(), which writes 1s into the upper 24 bits of the register. Should value be cas= t to const u8 * to ensure safe zero-extension? > u32 regval; > u32 byte; > int ret; > @@ -262,11 +262,11 @@ static int pci1xxxx_otp_read(void *priv_t, unsigned= int off, > } > =20 > static int pci1xxxx_otp_write(void *priv_t, unsigned int off, > - void *value_t, size_t count) > + const void *value_t, size_t count) > { > struct pci1xxxx_otp_eeprom_device *priv =3D priv_t; > void __iomem *rb =3D priv->reg_base; > - char *value =3D value_t; > + const char *value =3D value_t; [Severity: High] This is a pre-existing issue, but this has the same sign-extension behavior when writing to OTP_PRGM_DATA_OFFSET: writel(*(value + byte), rb + MMAP_OTP_OFFSET(OTP_PRGM_DATA_OFFSET)); Should this pointer also be changed to const u8 *? > u32 regval; > u32 byte; > int ret; --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260715175229.2467= 2-1-linkmauve@linkmauve.fr?part=3D4 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id ECA7AC44501 for ; Wed, 15 Jul 2026 18:04:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Bc4Onoq467EUOdNVP/ypauONDFyYUL0YIqY2bc6sstQ=; b=XgLrQJR5jFIQ68 /Mq/rPiw/dFqRYbs7Q09WX3EHxXkk/jvzDZT1YhMkcpUiNQhUIASoFz0sPHvhY2EMehIQQC5UYdTm Nus98SSTejH0dRGsYNFgOcgyMjgr6mppolBKu1JF8pdjtx1XkmTIURSvpjOR7W058YFEgQVcqgjgh 900fNo/ksnQoFrBsuBTOsotgU2IKiBIhSvOpRzQ2D6Q10cAzCdyd+PbhWUbSdyAhlbGSn5Bl9I4it XEnbeONZfTeGJxsKszNB83OP08iz4MJ0A8v/0P+Skd/RYlbBwm/zpqY9+xNmvWRF9eG4Nlutiwk7e ueNiw8PhbIxG06K2BMaA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wk3yJ-0000000FcCE-1Dsp; Wed, 15 Jul 2026 18:04:39 +0000 Received: from tor.source.kernel.org ([172.105.4.254]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wk3yH-0000000FcC5-2owx for linux-amlogic@lists.infradead.org; Wed, 15 Jul 2026 18:04:37 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id C755D61838; Wed, 15 Jul 2026 18:04:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC1FF1F000E9; Wed, 15 Jul 2026 18:04:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784138676; bh=z1bcCig/w+n8T1oUsM8SsxcefJTzaUQb15/bkmwPnMs=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=FnWjnD8q2wlfLJI1T6KORtV9Ktm+l3x9iOZi8E3DSQwgH0Q04A0HwiJdztZigdhbS s7bDbMn3OqVzbhDG3eVZ9eVfJdHspgoVMeveM1WRK8vxS7aBUY9HMh+XZEiMK7CiJ7 icwsVbbvl3OC1kjODbpT0Mhfei5I/gyI3mQmqZs7p639YIKLDeUmCWnjeqybPfKF/5 HbOF9D0wLPvpCCD6OAh9otvPzS/TN+6eGCCfGUGW63IBsQfvKaYj/ypg6RjIS6Znoh ycficcla2aRMl9gTQiLg5ew6ZYfUQJZS9xYMzLk2iTCFx10fETO9sn+UPpblOknC8r xzEgYWE23cypg== From: sashiko-bot@kernel.org Subject: Re: [PATCH 4/8] misc: make all reg_write callbacks take const void * To: "Link Mauve" Cc: ojeda@kernel.org, neil.armstrong@linaro.org, "Alexandre Belloni" , lee@kernel.org, linux-sunxi@lists.linux.dev, linux-rtc@vger.kernel.org, Frank.Li@kernel.org, linux-amlogic@lists.infradead.org, imx@lists.linux.dev, mfd@lists.linux.dev In-Reply-To: <20260715175229.24672-5-linkmauve@linkmauve.fr> References: <20260715175229.24672-1-linkmauve@linkmauve.fr> <20260715175229.24672-5-linkmauve@linkmauve.fr> Date: Wed, 15 Jul 2026 18:04:35 +0000 Message-Id: <20260715180435.EC1FF1F000E9@smtp.kernel.org> X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg NCBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpOZXcgaXNzdWVzOgotIFtMb3ddIFBh c3NpbmcgYGNvbnN0IHZvaWQgKmAgdG8gYG52bWVtX2RldmljZV93cml0ZWAgZGlzY2FyZHMgdGhl IGBjb25zdGAgcXVhbGlmaWVyLCBjYXVzaW5nIGEgY29tcGlsZXIgd2FybmluZy9lcnJvci4KClBy ZS1leGlzdGluZyBpc3N1ZXM6Ci0gW0NyaXRpY2FsXSBUaGUgYG0yNGxyX3dyaXRlYCBmdW5jdGlv biB1c2VzIHRoZSBkZXZpY2Ugb2Zmc2V0IHRvIGluZGV4IHRoZSBzb3VyY2UgbWVtb3J5IGJ1ZmZl ciwgY2F1c2luZyBhIGNyaXRpY2FsIG91dC1vZi1ib3VuZHMgcmVhZCBvZiBrZXJuZWwgbWVtb3J5 LgotIFtIaWdoXSBXcml0aW5nIGEgZGVyZWZlcmVuY2VkIGBjb25zdCBjaGFyICpgIGJ5dGUgdG8g YSAzMi1iaXQgbWVtb3J5LW1hcHBlZCByZWdpc3RlciB0cmlnZ2VycyBzaWduLWV4dGVuc2lvbiwg cG90ZW50aWFsbHkgd3JpdGluZyBjb3JydXB0ZWQgdmFsdWVzIHRvIHRoZSBoYXJkd2FyZS4KLSBb SGlnaF0gU2lsZW50IGRhdGEgbG9zcyB3aGVuIHdyaXRpbmcgYW4gb2RkIG51bWJlciBvZiBieXRl cyBpbiAxNi1iaXQgbW9kZS4KLS0KCi0tLSBQYXRjaCBbNF06IFtQQVRDSCA0LzhdIG1pc2M6IG1h a2UgYWxsIHJlZ193cml0ZSBjYWxsYmFja3MgdGFrZSBjb25zdCB2b2lkICogLS0tCmNvbW1pdCA4 ZmFlOTM4MWJjZTEzNzMzYzg5NjE5NDQwZmMwODNmZjY0NzEyNWE0CkF1dGhvcjogTGluayBNYXV2 ZSA8bGlua21hdXZlQGxpbmttYXV2ZS5mcj4KCm1pc2M6IG1ha2UgYWxsIHJlZ193cml0ZSBjYWxs YmFja3MgdGFrZSBjb25zdCB2b2lkICoKClRoZSBwcmV2aW91cyBjb21taXQgc3dpdGNoZWQgZnJv bSBhIHBvaW50ZXIgdG8gbXV0YWJsZSBkYXRhIHRvIGEgcG9pbnRlcgp0byBpbW11dGFibGUgZGF0 YSwgc28gbGV0J3MgZml4IGFsbCB1c2VycyBvZiB0aGUgbnZtZW1fY29uZmlnIEFQSS4KClsgLi4u IF0KPiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9taXNjL2VlcHJvbS9lZXByb21fOTN4eDQ2LmMgYi9k cml2ZXJzL21pc2MvZWVwcm9tL2VlcHJvbV85M3h4NDYuYwo+IGluZGV4IDUyMzBlOTEwYTFkMTEu LjhkZTg1NDMzZDU5M2MgMTAwNjQ0Cj4gLS0tIGEvZHJpdmVycy9taXNjL2VlcHJvbS9lZXByb21f OTN4eDQ2LmMKPiArKysgYi9kcml2ZXJzL21pc2MvZWVwcm9tL2VlcHJvbV85M3h4NDYuYwo+IEBA IC0yNjksMTAgKzI2OSwxMCBAQCBlZXByb21fOTN4eDQ2X3dyaXRlX3dvcmQoc3RydWN0IGVlcHJv bV85M3h4NDZfZGV2ICplZGV2LAo+ICB9Cj4gIAo+ICBzdGF0aWMgaW50IGVlcHJvbV85M3h4NDZf d3JpdGUodm9pZCAqcHJpdiwgdW5zaWduZWQgaW50IG9mZiwKPiAtCQkJCSAgIHZvaWQgKnZhbCwg c2l6ZV90IGNvdW50KQo+ICsJCQkgICAgICAgY29uc3Qgdm9pZCAqdmFsLCBzaXplX3QgY291bnQp Cj4gIHsKPiAgCXN0cnVjdCBlZXByb21fOTN4eDQ2X2RldiAqZWRldiA9IHByaXY7Cj4gLQljaGFy ICpidWYgPSB2YWw7Cj4gKwljb25zdCBjaGFyICpidWYgPSB2YWw7CgpbU2V2ZXJpdHk6IEhpZ2hd ClRoaXMgaXMgYSBwcmUtZXhpc3RpbmcgaXNzdWUsIGJ1dCBkb2VzIHRoaXMgZnVuY3Rpb24gc2ls ZW50bHkgZHJvcCBkYXRhIHdoZW4Kd3JpdGluZyBhbiBvZGQgbnVtYmVyIG9mIGJ5dGVzIGluIDE2 LWJpdCBtb2RlPwoKSW4gMTYtYml0IHdvcmQgbW9kZSAoRUVfQUREUjE2KSwgdGhlIGRyaXZlciBp bnRlcmNlcHRzIHRoZSBjYWxsIGFuZCB0cnVuY2F0ZXMKdGhlIGNvdW50OgoKICAgIGNvdW50ICY9 IH4xOwoKSWYgY291bnQgaXMgMSwgaXQgYmVjb21lcyAwLCBza2lwcGluZyB0aGUgd3JpdGUgbG9v cCBlbnRpcmVseSBhbmQgcmV0dXJuaW5nIDAuCkJlY2F1c2UgdGhlIG52bWVtIGNvcmUgaW50ZXJw cmV0cyBhIDAgcmV0dXJuIHZhbHVlIGFzIHN1Y2Nlc3MsIHRoZSBjYWxsZXIKYmVsaWV2ZXMgdGhl IGRhdGEgd2FzIHdyaXR0ZW4gZXZlbiB0aG91Z2ggdGhlIGhhcmR3YXJlIHdhcyB1bm1vZGlmaWVk LgoKWyAuLi4gXQo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL21pc2MvZWVwcm9tL20yNGxyLmMgYi9k cml2ZXJzL21pc2MvZWVwcm9tL20yNGxyLmMKPiBpbmRleCA3YTlmZDQ1YThlNDYwLi4yMmYzMjIx ZTIzMmI1IDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvbWlzYy9lZXByb20vbTI0bHIuYwo+ICsrKyBi L2RyaXZlcnMvbWlzYy9lZXByb20vbTI0bHIuYwo+IEBAIC0zNzQsNyArMzc0LDcgQEAgc3RhdGlj IGludCBtMjRscl9udm1lbV9yZWFkKHZvaWQgKnByaXYsIHVuc2lnbmVkIGludCBvZmZzZXQsIHZv aWQgKnZhbCwKPiAgCXJldHVybiAwOwo+ICB9Cj4gIAo+IC1zdGF0aWMgaW50IG0yNGxyX252bWVt X3dyaXRlKHZvaWQgKnByaXYsIHVuc2lnbmVkIGludCBvZmZzZXQsIHZvaWQgKnZhbCwKPiArc3Rh dGljIGludCBtMjRscl9udm1lbV93cml0ZSh2b2lkICpwcml2LCB1bnNpZ25lZCBpbnQgb2Zmc2V0 LCBjb25zdCB2b2lkICp2YWwsCj4gIAkJCSAgICAgc2l6ZV90IGJ5dGVzKQoKW1NldmVyaXR5OiBD cml0aWNhbF0KVGhpcyBpcyBhIHByZS1leGlzdGluZyBpc3N1ZSwgYnV0IGRvZXMgbTI0bHJfd3Jp dGUoKSB1c2UgdGhlIGRldmljZSBvZmZzZXQgdG8KaW5kZXggdGhlIHNvdXJjZSBtZW1vcnkgYnVm ZmVyPwoKV2hlbiBtMjRscl9udm1lbV93cml0ZSgpIGNhbGxzIG0yNGxyX3dyaXRlKC4uLiwgdmFs LCBieXRlcywgb2Zmc2V0LCB0cnVlKSwKbTI0bHJfd3JpdGUoKSBwYXNzZXMgYnVmICsgb2Zmc2V0 IHRvIHRoZSByZWdtYXAgd3JpdGUgaW5zdGVhZCBvZiBhZHZhbmNpbmcKYnkgdGhlIG51bWJlciBv ZiBieXRlcyB3cml0dGVuOgoKICAgIGVyciA9IG0yNGxyX3JlZ21hcF93cml0ZShyZWdtYXAsIGJ1 ZiArIG9mZnNldCwgbiwgb2Zmc2V0KTsKClNpbmNlIGJ1ZiBpcyBvbmx5IHNpemVkIGZvciB0aGUg ZGF0YSBjaHVuayBiZWluZyB3cml0dGVuLCBhZGRpbmcgdGhlIGRldmljZQpvZmZzZXQgcHVzaGVz IHRoZSBwb2ludGVyIGZhciBwYXN0IHRoZSBlbmQgb2YgYnVmLCBsZWFkaW5nIHRvIGFuIG91dC1v Zi1ib3VuZHMKcmVhZCBvZiBrZXJuZWwgbWVtb3J5IHRoYXQgZ2V0cyB3cml0dGVuIHRvIHRoZSBl eHRlcm5hbCBFRVBST00uCgo+ICB7Cj4gIAlzc2l6ZV90IGVycjsKClsgLi4uIF0KPiBkaWZmIC0t Z2l0IGEvZHJpdmVycy9taXNjL2tlYmEvY3A1MDAuYyBiL2RyaXZlcnMvbWlzYy9rZWJhL2NwNTAw LmMKPiBpbmRleCA2YzY1ZmJmMjJlNzU2Li5lZTc4ODljYjYzYThiIDEwMDY0NAo+IC0tLSBhL2Ry aXZlcnMvbWlzYy9rZWJhL2NwNTAwLmMKPiArKysgYi9kcml2ZXJzL21pc2Mva2ViYS9jcDUwMC5j Cj4gQEAgLTU5MCw3ICs1OTAsNyBAQCBzdGF0aWMgaW50IGNwNTAwX252bWVtX3JlYWQodm9pZCAq cHJpdiwgdW5zaWduZWQgaW50IG9mZnNldCwgdm9pZCAqdmFsLAo+ICAJcmV0dXJuIDA7Cj4gIH0K PiAgCj4gLXN0YXRpYyBpbnQgY3A1MDBfbnZtZW1fd3JpdGUodm9pZCAqcHJpdiwgdW5zaWduZWQg aW50IG9mZnNldCwgdm9pZCAqdmFsLAo+ICtzdGF0aWMgaW50IGNwNTAwX252bWVtX3dyaXRlKHZv aWQgKnByaXYsIHVuc2lnbmVkIGludCBvZmZzZXQsIGNvbnN0IHZvaWQgKnZhbCwKPiAgCQkJICAg ICBzaXplX3QgYnl0ZXMpCj4gIHsKPiAgCXN0cnVjdCBjcDUwMF9udm1lbSAqbnZtZW0gPSBwcml2 OwoKW1NldmVyaXR5OiBMb3ddCkRvZXMgcGFzc2luZyB0aGUgbm93LWNvbnN0IHZhbCBkaXJlY3Rs eSB0byBudm1lbV9kZXZpY2Vfd3JpdGUoKSBkaXNjYXJkIHRoZQpjb25zdCBxdWFsaWZpZXI/Cgpu dm1lbV9kZXZpY2Vfd3JpdGUoKSBleHBlY3RzIGEgbXV0YWJsZSB2b2lkIHBvaW50ZXIsIHdoaWNo IHdpbGwgY2F1c2UgYSBidWlsZAp3YXJuaW5nIChhbmQgcG90ZW50aWFsbHkgYnJlYWsgdGhlIGJ1 aWxkIGlmIC1XZXJyb3IgaXMgZW5hYmxlZCk6CgogICAgcmV0ID0gbnZtZW1fZGV2aWNlX3dyaXRl KG52bWVtLT5iYXNlX252bWVtLCBudm1lbS0+b2Zmc2V0ICsgb2Zmc2V0LAogICAgICAgICAgICAg ICAgICAgICAgICAgICAgIGJ5dGVzLCB2YWwpOwoKWyAuLi4gXQo+IGRpZmYgLS1naXQgYS9kcml2 ZXJzL21pc2MvbWNocF9wY2kxeHh4eC9tY2hwX3BjaTF4eHh4X290cGUycC5jIGIvZHJpdmVycy9t aXNjL21jaHBfcGNpMXh4eHgvbWNocF9wY2kxeHh4eF9vdHBlMnAuYwo+IGluZGV4IGEyZWQ0Nzdl MDM3MGIuLmYyNzU5ZTliNDEzODYgMTAwNjQ0Cj4gLS0tIGEvZHJpdmVycy9taXNjL21jaHBfcGNp MXh4eHgvbWNocF9wY2kxeHh4eF9vdHBlMnAuYwo+ICsrKyBiL2RyaXZlcnMvbWlzYy9tY2hwX3Bj aTF4eHh4L21jaHBfcGNpMXh4eHhfb3RwZTJwLmMKPiBAQCAtMTU5LDExICsxNTksMTEgQEAgc3Rh dGljIGludCBwY2kxeHh4eF9lZXByb21fcmVhZCh2b2lkICpwcml2X3QsIHVuc2lnbmVkIGludCBv ZmYsCj4gIH0KPiAgCj4gIHN0YXRpYyBpbnQgcGNpMXh4eHhfZWVwcm9tX3dyaXRlKHZvaWQgKnBy aXZfdCwgdW5zaWduZWQgaW50IG9mZiwKPiAtCQkJCSB2b2lkICp2YWx1ZV90LCBzaXplX3QgY291 bnQpCj4gKwkJCQkgY29uc3Qgdm9pZCAqdmFsdWVfdCwgc2l6ZV90IGNvdW50KQo+ICB7Cj4gIAlz dHJ1Y3QgcGNpMXh4eHhfb3RwX2VlcHJvbV9kZXZpY2UgKnByaXYgPSBwcml2X3Q7Cj4gIAl2b2lk IF9faW9tZW0gKnJiID0gcHJpdi0+cmVnX2Jhc2U7Cj4gLQljaGFyICp2YWx1ZSA9IHZhbHVlX3Q7 Cj4gKwljb25zdCBjaGFyICp2YWx1ZSA9IHZhbHVlX3Q7CgpbU2V2ZXJpdHk6IEhpZ2hdClRoaXMg aXMgYSBwcmUtZXhpc3RpbmcgaXNzdWUsIGJ1dCBkb2VzIGRlcmVmZXJlbmNpbmcgdGhpcyBjb25z dCBjaGFyIHBvaW50ZXIKdHJpZ2dlciBzaWduLWV4dGVuc2lvbiB3aGVuIHBhc3NlZCB0byB3cml0 ZWwoKT8KCkxhdGVyIGluIHRoaXMgZnVuY3Rpb24sIHRoZSBieXRlIGlzIHdyaXR0ZW4gbGlrZSB0 aGlzOgoKICAgIHdyaXRlbCgqKHZhbHVlICsgYnl0ZSksIHJiICsgTU1BUF9FRVBST01fT0ZGU0VU KEVFUFJPTV9EQVRBX1JFRykpOwoKSWYgdGhlIGJ5dGUgaGFzIGl0cyBtb3N0IHNpZ25pZmljYW50 IGJpdCBzZXQgKGUuZy4gaXMgbmVnYXRpdmUpLCB0aGUgQyBjb21waWxlcgp3aWxsIHNpZ24tZXh0 ZW5kIGl0IHRvIGEgMzItYml0IG5lZ2F0aXZlIGludGVnZXIgYmVmb3JlIHBhc3NpbmcgaXQgdG8g d3JpdGVsKCksCndoaWNoIHdyaXRlcyAxcyBpbnRvIHRoZSB1cHBlciAyNCBiaXRzIG9mIHRoZSBy ZWdpc3Rlci4gU2hvdWxkIHZhbHVlIGJlIGNhc3QgdG8KY29uc3QgdTggKiB0byBlbnN1cmUgc2Fm ZSB6ZXJvLWV4dGVuc2lvbj8KCj4gIAl1MzIgcmVndmFsOwo+ICAJdTMyIGJ5dGU7Cj4gIAlpbnQg cmV0Owo+IEBAIC0yNjIsMTEgKzI2MiwxMSBAQCBzdGF0aWMgaW50IHBjaTF4eHh4X290cF9yZWFk KHZvaWQgKnByaXZfdCwgdW5zaWduZWQgaW50IG9mZiwKPiAgfQo+ICAKPiAgc3RhdGljIGludCBw Y2kxeHh4eF9vdHBfd3JpdGUodm9pZCAqcHJpdl90LCB1bnNpZ25lZCBpbnQgb2ZmLAo+IC0JCQkg ICAgICB2b2lkICp2YWx1ZV90LCBzaXplX3QgY291bnQpCj4gKwkJCSAgICAgIGNvbnN0IHZvaWQg KnZhbHVlX3QsIHNpemVfdCBjb3VudCkKPiAgewo+ICAJc3RydWN0IHBjaTF4eHh4X290cF9lZXBy b21fZGV2aWNlICpwcml2ID0gcHJpdl90Owo+ICAJdm9pZCBfX2lvbWVtICpyYiA9IHByaXYtPnJl Z19iYXNlOwo+IC0JY2hhciAqdmFsdWUgPSB2YWx1ZV90Owo+ICsJY29uc3QgY2hhciAqdmFsdWUg PSB2YWx1ZV90OwoKW1NldmVyaXR5OiBIaWdoXQpUaGlzIGlzIGEgcHJlLWV4aXN0aW5nIGlzc3Vl LCBidXQgdGhpcyBoYXMgdGhlIHNhbWUgc2lnbi1leHRlbnNpb24gYmVoYXZpb3IKd2hlbiB3cml0 aW5nIHRvIE9UUF9QUkdNX0RBVEFfT0ZGU0VUOgoKICAgIHdyaXRlbCgqKHZhbHVlICsgYnl0ZSks IHJiICsgTU1BUF9PVFBfT0ZGU0VUKE9UUF9QUkdNX0RBVEFfT0ZGU0VUKSk7CgpTaG91bGQgdGhp cyBwb2ludGVyIGFsc28gYmUgY2hhbmdlZCB0byBjb25zdCB1OCAqPwoKPiAgCXUzMiByZWd2YWw7 Cj4gIAl1MzIgYnl0ZTsKPiAgCWludCByZXQ7CgotLSAKU2FzaGlrbyBBSSByZXZpZXcgwrcgaHR0 cHM6Ly9zYXNoaWtvLmRldi8jL3BhdGNoc2V0LzIwMjYwNzE1MTc1MjI5LjI0NjcyLTEtbGlua21h dXZlQGxpbmttYXV2ZS5mcj9wYXJ0PTQKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fCmxpbnV4LWFtbG9naWMgbWFpbGluZyBsaXN0CmxpbnV4LWFtbG9naWNA bGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2xpbnV4LWFtbG9naWMK