From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B93C3E1689 for ; Fri, 17 Jul 2026 08:04:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275446; cv=none; b=VH2ZljNSgtZsAV+XwgJ1FPME05rEOmV/o8/EDu+1OToAmaaLyRzgJmimpWS+BIWKPEPfQ+spbti/AgmtQJfSk1OPJaljDKh+mZJSUBmky7naGa2ES01t9/bd0OH9Q35bhE5zTkUe2tTjMGYNTlmoFfpVA5721XGzvJZ2/FItQp8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784275446; c=relaxed/simple; bh=wAOUV999ROhkzt50m9xWAwQ2jf8Fo+MNYzK04yKphcI=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=IQKHmqYT9Kz7ffdfbcKxiuJX0eXdPcRw5yKbzMiA5I/7Rfce7ARguiqkHRNOlSbgDBAZ983gb7KCMUg0VT+SncRGvYijJKHg4EWwuCDcWdxyuFl9xomiVWn6oQT2VToCgOPLCU72AP03+LVxDHYooFcU7Ticd9Zv0vRd9H4vY20= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=LEtvljTf; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="LEtvljTf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 76DD91F000E9; Fri, 17 Jul 2026 08:04:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784275444; bh=0CbAhbRA8Tg4xKwUdb4WXdDz/GTyZXdxx/wUbgFU6Yc=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=LEtvljTfBWJ7FdQA5PUubV71KAM5/cR40ELQ8o7uN5va6hpC8/PmSWoqfvT0KX6E+ QcpQ+094y+ZciBQv30kxPYxu0os3Xhv1bOaNK9sGDLk8yLCaPIivn7zgb6vIQuVgN9 Yq7TTFy5NZGcu4P9TAvBXZ/EE1dQMT1z4Q7f3E993TBPHOYSZ1OxcK+YSPtjdit558 KV2ibr1fCecabwPx8dndvHbU3bLzBjqJi9aWSCbiq1J4339acZ1bFdE2JdKhIgbP3L Lwk7SdZy7TKJSv1/rsIPhXzvboqGRDZBwLgZpqZaHyOwjtLrmtIQBZHDautanvqjJh lhH0XDJq4ZrXg== From: sashiko-bot@kernel.org Subject: Re: [PATCH 3/3] spi: amlogic: spisg: Add support for A9 controller features Reply-To: sashiko-reviews@lists.linux.dev To: "Xianwei Zhao" Cc: conor+dt@kernel.org, devicetree@vger.kernel.org, neil.armstrong@linaro.org, linux-amlogic@lists.infradead.org, robh@kernel.org In-Reply-To: <20260717-a9-spisg-v1-3-2eeea77be19f@amlogic.com> References: <20260717-a9-spisg-v1-0-2eeea77be19f@amlogic.com> <20260717-a9-spisg-v1-3-2eeea77be19f@amlogic.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Fri, 17 Jul 2026 08:04:03 +0000 Message-Id: <20260717080404.76DD91F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 3 potential issue(= s) to consider: New issues: - [High] The calculated CFG_CS_HOLD delay value lacks bounds checking befor= e being written via FIELD_MODIFY, leading to silent bitwise truncation and = incorrectly shortened hold times. Pre-existing issues: - [High] The driver fails to abort the hardware operation when a transfer t= imes out, leading to DMA use-after-free and cascading synchronization failu= res. - [High] `spi_delay_to_sclk()` suffers from a 32-bit integer overflow when = calculating delay cycles, resulting in drastically shorter setup and hold t= imes than requested. -- --- Patch [3]: [PATCH 3/3] spi: amlogic: spisg: Add support for A9 controll= er features --- commit 850f7cb5955f8bd514dfd78b459ee02b15378db4 Author: Xianwei Zhao spi: amlogic: spisg: Add support for A9 controller features =20 The Amlogic A9 SPISG controller extends the A4 controller with additional configuration options. Add SoC-specific capability data and configure these features when supported by the hardware, while keeping compatibility with existing A4 controllers. > diff --git a/drivers/spi/spi-amlogic-spisg.c b/drivers/spi/spi-amlogic-sp= isg.c > index 0f026d3e43e0b..845eb81d483a3 100644 > --- a/drivers/spi/spi-amlogic-spisg.c > +++ b/drivers/spi/spi-amlogic-spisg.c [ ... ] > @@ -525,9 +541,17 @@ static int aml_spisg_transfer_one_message(struct spi= _controller *ctlr, > } > =20 > /* calculate cs-setup delay with the first xfer speed */ > - if (list_is_first(&xfer->transfer_list, &msg->transfers)) > - desc->cfg_bus |=3D FIELD_PREP(CFG_CS_SETUP, > - spi_delay_to_sclk(xfer->effective_speed_hz, &msg->spi->cs_setup)); > + if (list_is_first(&xfer->transfer_list, &msg->transfers)) { > + val =3D spi_delay_to_sclk(xfer->effective_speed_hz, &msg->spi->cs_set= up); [Severity: High] This is a pre-existing issue, but can spi_delay_to_sclk() suffer from a 32-bit integer overflow when calculating delay cycles? Looking at spi_delay_to_sclk(): drivers/spi/spi-amlogic-spisg.c:spi_delay_to_sclk() { ... return DIV_ROUND_UP_ULL(slck_speed_hz * ns, NSEC_PER_SEC); } If a client requests a large delay, the multiplication of the two 32-bit integers (slck_speed_hz and ns) can wrap around before being cast to a 64-bit integer by DIV_ROUND_UP_ULL. Could this result in drastically shorter setup and hold times than requested? > + if (data && data->cs_setup_extend_ctrl) { > + val =3D min_t(u32, 0xFF, val); > + desc->cfg_bus |=3D FIELD_PREP(CFG_CS_SETUP, val & 0xF); > + FIELD_MODIFY(CFG_CS_SETUP_EXTEND, &spisg->cfg_spi, val >> 4); > + } else { > + val =3D min_t(u32, 0xF, val); > + desc->cfg_bus |=3D FIELD_PREP(CFG_CS_SETUP, val); > + } > + } > =20 > /* calculate cs-hold delay with the last xfer speed */ > if (list_is_last(&xfer->transfer_list, &msg->transfers)) { > @@ -542,7 +566,12 @@ static int aml_spisg_transfer_one_message(struct spi= _controller *ctlr, > xfer->effective_speed_hz); > } > =20 > - if (cs_hold_in_sclk) { > + if (data && data->cs_hold_ctrl) { > + cs_hold_in_sclk =3D cs_hold_in_sclk ? : 1; > + val =3D cs_hold_in_sclk * (FIELD_GET(CFG_CLK_DIV, spisg->cfg_bus) + 1); > + FIELD_MODIFY(CFG_CS_HOLD, &spisg->cfg_spi, val); [Severity: High] Does the calculated CFG_CS_HOLD delay value lack bounds checking before being written via FIELD_MODIFY? Unlike CFG_CS_SETUP which safely uses min_t(), cs_hold is left unbounded. Since CFG_CS_HOLD is a 15-bit field, if an SPI client requests a large CS hold time, the FIELD_MODIFY macro will silently apply a bitwise mask. Will this cause the delay to wrap around (e.g. 32768 becomes 0) rather than clamping at the maximum supported hardware limit, leading to hardware timing violations? [Severity: High] This isn't a bug introduced by this patch, but is it possible for the timeout error path to free DMA-mapped memory without halting the active hardware? Looking further down in aml_spisg_transfer_one_message(): drivers/spi/spi-amlogic-spisg.c:aml_spisg_transfer_one_message() { ... if (wait_for_completion_timeout(&spisg->completion, ...)) ret =3D spisg->status ? -EIO : 0; else ret =3D -ETIMEDOUT; dma_unmap_single(dev, descs_paddr, descs_len, DMA_TO_DEVICE); end: ... kfree(descs); ... } If an SPI transfer times out and wait_for_completion_timeout() expires, the code proceeds directly to unmap the DMA memory and free the descriptor array. However, the hardware is never halted or reset (e.g. by writing 0 to the descriptor list register). Might the hardware still be actively performing DMA, resulting in memory corruption from a use-after-free? Furthermore, if the hardware eventually completes, could the delayed interrupt falsely wake up subsequent transfers? > + desc--; > + } else if (cs_hold_in_sclk) { > /* additional null-descriptor to achieve the cs-hold delay */ > aml_spisg_setup_null_desc(spisg, desc, cs_hold_in_sclk); > desc--; --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260717-a9-spisg-v= 1-0-2eeea77be19f@amlogic.com?part=3D3 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 776B6C44514 for ; Fri, 17 Jul 2026 08:04:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=00M7PsfzgLPCV1edIMn0J+ONJsM9YI1VoQdngdkWENI=; b=dU+SGi8sVRoavB Iji7e1p8ia/Ja235ieTtZiBEF+jWFX5U2/V2al9yif9tr9OBRuhARd57DilvXA3pP7YHkACZG+Rw4 GYl7Ku2ojuIxleDzknvJB4m0clnjkUHAv3ZUPLfyBm1O6oQPMZKIrGvl2To52kDcQtw9C+Wof/qH/ h6gUe1pcRPv0fY87vVLCtWoPpd7PnSi8Tn1s/Q5xaSGnbbnDb0e+ivJy4a+8sizY6vVNhz6H5U7De 1Ea/QRgpkDu4Xap6g9Beg081nFNeaD+rwrNEiCdQrnDmVXHWdlf5omd7epYJUp76Isnf1xAnOk8yR Km60ebywDSwZSuALB1Mw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wkdYF-00000001YXJ-08Kg; Fri, 17 Jul 2026 08:04:07 +0000 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wkdYD-00000001YXB-3f83 for linux-amlogic@lists.infradead.org; Fri, 17 Jul 2026 08:04:06 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 3BBF560A6C; Fri, 17 Jul 2026 08:04:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 76DD91F000E9; Fri, 17 Jul 2026 08:04:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784275444; bh=0CbAhbRA8Tg4xKwUdb4WXdDz/GTyZXdxx/wUbgFU6Yc=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=LEtvljTfBWJ7FdQA5PUubV71KAM5/cR40ELQ8o7uN5va6hpC8/PmSWoqfvT0KX6E+ QcpQ+094y+ZciBQv30kxPYxu0os3Xhv1bOaNK9sGDLk8yLCaPIivn7zgb6vIQuVgN9 Yq7TTFy5NZGcu4P9TAvBXZ/EE1dQMT1z4Q7f3E993TBPHOYSZ1OxcK+YSPtjdit558 KV2ibr1fCecabwPx8dndvHbU3bLzBjqJi9aWSCbiq1J4339acZ1bFdE2JdKhIgbP3L Lwk7SdZy7TKJSv1/rsIPhXzvboqGRDZBwLgZpqZaHyOwjtLrmtIQBZHDautanvqjJh lhH0XDJq4ZrXg== From: sashiko-bot@kernel.org Subject: Re: [PATCH 3/3] spi: amlogic: spisg: Add support for A9 controller features To: "Xianwei Zhao" Cc: conor+dt@kernel.org, devicetree@vger.kernel.org, neil.armstrong@linaro.org, linux-amlogic@lists.infradead.org, robh@kernel.org In-Reply-To: <20260717-a9-spisg-v1-3-2eeea77be19f@amlogic.com> References: <20260717-a9-spisg-v1-0-2eeea77be19f@amlogic.com> <20260717-a9-spisg-v1-3-2eeea77be19f@amlogic.com> Date: Fri, 17 Jul 2026 08:04:03 +0000 Message-Id: <20260717080404.76DD91F000E9@smtp.kernel.org> X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MyBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpOZXcgaXNzdWVzOgotIFtIaWdoXSBU aGUgY2FsY3VsYXRlZCBDRkdfQ1NfSE9MRCBkZWxheSB2YWx1ZSBsYWNrcyBib3VuZHMgY2hlY2tp bmcgYmVmb3JlIGJlaW5nIHdyaXR0ZW4gdmlhIEZJRUxEX01PRElGWSwgbGVhZGluZyB0byBzaWxl bnQgYml0d2lzZSB0cnVuY2F0aW9uIGFuZCBpbmNvcnJlY3RseSBzaG9ydGVuZWQgaG9sZCB0aW1l cy4KClByZS1leGlzdGluZyBpc3N1ZXM6Ci0gW0hpZ2hdIFRoZSBkcml2ZXIgZmFpbHMgdG8gYWJv cnQgdGhlIGhhcmR3YXJlIG9wZXJhdGlvbiB3aGVuIGEgdHJhbnNmZXIgdGltZXMgb3V0LCBsZWFk aW5nIHRvIERNQSB1c2UtYWZ0ZXItZnJlZSBhbmQgY2FzY2FkaW5nIHN5bmNocm9uaXphdGlvbiBm YWlsdXJlcy4KLSBbSGlnaF0gYHNwaV9kZWxheV90b19zY2xrKClgIHN1ZmZlcnMgZnJvbSBhIDMy LWJpdCBpbnRlZ2VyIG92ZXJmbG93IHdoZW4gY2FsY3VsYXRpbmcgZGVsYXkgY3ljbGVzLCByZXN1 bHRpbmcgaW4gZHJhc3RpY2FsbHkgc2hvcnRlciBzZXR1cCBhbmQgaG9sZCB0aW1lcyB0aGFuIHJl cXVlc3RlZC4KLS0KCi0tLSBQYXRjaCBbM106IFtQQVRDSCAzLzNdIHNwaTogYW1sb2dpYzogc3Bp c2c6IEFkZCBzdXBwb3J0IGZvciBBOSBjb250cm9sbGVyIGZlYXR1cmVzIC0tLQpjb21taXQgODUw ZjdjYjU5NTVmOGJkNTE0ZGZkNzhiNDU5ZWUwMmIxNTM3OGRiNApBdXRob3I6IFhpYW53ZWkgWmhh byA8eGlhbndlaS56aGFvQGFtbG9naWMuY29tPgoKc3BpOiBhbWxvZ2ljOiBzcGlzZzogQWRkIHN1 cHBvcnQgZm9yIEE5IGNvbnRyb2xsZXIgZmVhdHVyZXMKICAgIApUaGUgQW1sb2dpYyBBOSBTUElT RyBjb250cm9sbGVyIGV4dGVuZHMgdGhlIEE0IGNvbnRyb2xsZXIgd2l0aCBhZGRpdGlvbmFsCmNv bmZpZ3VyYXRpb24gb3B0aW9ucy4gQWRkIFNvQy1zcGVjaWZpYyBjYXBhYmlsaXR5IGRhdGEgYW5k IGNvbmZpZ3VyZQp0aGVzZSBmZWF0dXJlcyB3aGVuIHN1cHBvcnRlZCBieSB0aGUgaGFyZHdhcmUs IHdoaWxlIGtlZXBpbmcgY29tcGF0aWJpbGl0eQp3aXRoIGV4aXN0aW5nIEE0IGNvbnRyb2xsZXJz LgoKPiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9zcGkvc3BpLWFtbG9naWMtc3Bpc2cuYyBiL2RyaXZl cnMvc3BpL3NwaS1hbWxvZ2ljLXNwaXNnLmMKPiBpbmRleCAwZjAyNmQzZTQzZTBiLi44NDVlYjgx ZDQ4M2EzIDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvc3BpL3NwaS1hbWxvZ2ljLXNwaXNnLmMKPiAr KysgYi9kcml2ZXJzL3NwaS9zcGktYW1sb2dpYy1zcGlzZy5jClsgLi4uIF0KPiBAQCAtNTI1LDkg KzU0MSwxNyBAQCBzdGF0aWMgaW50IGFtbF9zcGlzZ190cmFuc2Zlcl9vbmVfbWVzc2FnZShzdHJ1 Y3Qgc3BpX2NvbnRyb2xsZXIgKmN0bHIsCj4gIAkJfQo+ICAKPiAgCQkvKiBjYWxjdWxhdGUgY3Mt c2V0dXAgZGVsYXkgd2l0aCB0aGUgZmlyc3QgeGZlciBzcGVlZCAqLwo+IC0JCWlmIChsaXN0X2lz X2ZpcnN0KCZ4ZmVyLT50cmFuc2Zlcl9saXN0LCAmbXNnLT50cmFuc2ZlcnMpKQo+IC0JCQlkZXNj LT5jZmdfYnVzIHw9IEZJRUxEX1BSRVAoQ0ZHX0NTX1NFVFVQLAo+IC0JCQkJc3BpX2RlbGF5X3Rv X3NjbGsoeGZlci0+ZWZmZWN0aXZlX3NwZWVkX2h6LCAmbXNnLT5zcGktPmNzX3NldHVwKSk7Cj4g KwkJaWYgKGxpc3RfaXNfZmlyc3QoJnhmZXItPnRyYW5zZmVyX2xpc3QsICZtc2ctPnRyYW5zZmVy cykpIHsKPiArCQkJdmFsID0gc3BpX2RlbGF5X3RvX3NjbGsoeGZlci0+ZWZmZWN0aXZlX3NwZWVk X2h6LCAmbXNnLT5zcGktPmNzX3NldHVwKTsKCltTZXZlcml0eTogSGlnaF0KVGhpcyBpcyBhIHBy ZS1leGlzdGluZyBpc3N1ZSwgYnV0IGNhbiBzcGlfZGVsYXlfdG9fc2NsaygpIHN1ZmZlciBmcm9t IGEKMzItYml0IGludGVnZXIgb3ZlcmZsb3cgd2hlbiBjYWxjdWxhdGluZyBkZWxheSBjeWNsZXM/ CgpMb29raW5nIGF0IHNwaV9kZWxheV90b19zY2xrKCk6Cgpkcml2ZXJzL3NwaS9zcGktYW1sb2dp Yy1zcGlzZy5jOnNwaV9kZWxheV90b19zY2xrKCkgewogICAgLi4uCiAgICByZXR1cm4gRElWX1JP VU5EX1VQX1VMTChzbGNrX3NwZWVkX2h6ICogbnMsIE5TRUNfUEVSX1NFQyk7Cn0KCklmIGEgY2xp ZW50IHJlcXVlc3RzIGEgbGFyZ2UgZGVsYXksIHRoZSBtdWx0aXBsaWNhdGlvbiBvZiB0aGUgdHdv IDMyLWJpdAppbnRlZ2VycyAoc2xja19zcGVlZF9oeiBhbmQgbnMpIGNhbiB3cmFwIGFyb3VuZCBi ZWZvcmUgYmVpbmcgY2FzdCB0byBhCjY0LWJpdCBpbnRlZ2VyIGJ5IERJVl9ST1VORF9VUF9VTEwu CgpDb3VsZCB0aGlzIHJlc3VsdCBpbiBkcmFzdGljYWxseSBzaG9ydGVyIHNldHVwIGFuZCBob2xk IHRpbWVzIHRoYW4KcmVxdWVzdGVkPwoKPiArCQkJaWYgKGRhdGEgJiYgZGF0YS0+Y3Nfc2V0dXBf ZXh0ZW5kX2N0cmwpIHsKPiArCQkJCXZhbCA9IG1pbl90KHUzMiwgMHhGRiwgdmFsKTsKPiArCQkJ CWRlc2MtPmNmZ19idXMgfD0gRklFTERfUFJFUChDRkdfQ1NfU0VUVVAsIHZhbCAmIDB4Rik7Cj4g KwkJCQlGSUVMRF9NT0RJRlkoQ0ZHX0NTX1NFVFVQX0VYVEVORCwgJnNwaXNnLT5jZmdfc3BpLCB2 YWwgPj4gNCk7Cj4gKwkJCX0gZWxzZSB7Cj4gKwkJCQl2YWwgPSBtaW5fdCh1MzIsIDB4RiwgdmFs KTsKPiArCQkJCWRlc2MtPmNmZ19idXMgfD0gRklFTERfUFJFUChDRkdfQ1NfU0VUVVAsIHZhbCk7 Cj4gKwkJCX0KPiArCQl9Cj4gIAo+ICAJCS8qIGNhbGN1bGF0ZSBjcy1ob2xkIGRlbGF5IHdpdGgg dGhlIGxhc3QgeGZlciBzcGVlZCAqLwo+ICAJCWlmIChsaXN0X2lzX2xhc3QoJnhmZXItPnRyYW5z ZmVyX2xpc3QsICZtc2ctPnRyYW5zZmVycykpIHsKPiBAQCAtNTQyLDcgKzU2NiwxMiBAQCBzdGF0 aWMgaW50IGFtbF9zcGlzZ190cmFuc2Zlcl9vbmVfbWVzc2FnZShzdHJ1Y3Qgc3BpX2NvbnRyb2xs ZXIgKmN0bHIsCj4gIAkJCQkgICAgICAgeGZlci0+ZWZmZWN0aXZlX3NwZWVkX2h6KTsKPiAgCX0K PiAgCj4gLQlpZiAoY3NfaG9sZF9pbl9zY2xrKSB7Cj4gKwlpZiAoZGF0YSAmJiBkYXRhLT5jc19o b2xkX2N0cmwpIHsKPiArCQljc19ob2xkX2luX3NjbGsgPSBjc19ob2xkX2luX3NjbGsgPyA6IDE7 Cj4gKwkJdmFsID0gY3NfaG9sZF9pbl9zY2xrICogKEZJRUxEX0dFVChDRkdfQ0xLX0RJViwgc3Bp c2ctPmNmZ19idXMpICsgMSk7Cj4gKwkJRklFTERfTU9ESUZZKENGR19DU19IT0xELCAmc3Bpc2ct PmNmZ19zcGksIHZhbCk7CgpbU2V2ZXJpdHk6IEhpZ2hdCkRvZXMgdGhlIGNhbGN1bGF0ZWQgQ0ZH X0NTX0hPTEQgZGVsYXkgdmFsdWUgbGFjayBib3VuZHMgY2hlY2tpbmcgYmVmb3JlCmJlaW5nIHdy aXR0ZW4gdmlhIEZJRUxEX01PRElGWT8KClVubGlrZSBDRkdfQ1NfU0VUVVAgd2hpY2ggc2FmZWx5 IHVzZXMgbWluX3QoKSwgY3NfaG9sZCBpcyBsZWZ0IHVuYm91bmRlZC4KU2luY2UgQ0ZHX0NTX0hP TEQgaXMgYSAxNS1iaXQgZmllbGQsIGlmIGFuIFNQSSBjbGllbnQgcmVxdWVzdHMgYSBsYXJnZSBD Uwpob2xkIHRpbWUsIHRoZSBGSUVMRF9NT0RJRlkgbWFjcm8gd2lsbCBzaWxlbnRseSBhcHBseSBh IGJpdHdpc2UgbWFzay4KCldpbGwgdGhpcyBjYXVzZSB0aGUgZGVsYXkgdG8gd3JhcCBhcm91bmQg KGUuZy4gMzI3NjggYmVjb21lcyAwKSByYXRoZXIKdGhhbiBjbGFtcGluZyBhdCB0aGUgbWF4aW11 bSBzdXBwb3J0ZWQgaGFyZHdhcmUgbGltaXQsIGxlYWRpbmcgdG8gaGFyZHdhcmUKdGltaW5nIHZp b2xhdGlvbnM/CgpbU2V2ZXJpdHk6IEhpZ2hdClRoaXMgaXNuJ3QgYSBidWcgaW50cm9kdWNlZCBi eSB0aGlzIHBhdGNoLCBidXQgaXMgaXQgcG9zc2libGUgZm9yIHRoZQp0aW1lb3V0IGVycm9yIHBh dGggdG8gZnJlZSBETUEtbWFwcGVkIG1lbW9yeSB3aXRob3V0IGhhbHRpbmcgdGhlIGFjdGl2ZQpo YXJkd2FyZT8KCkxvb2tpbmcgZnVydGhlciBkb3duIGluIGFtbF9zcGlzZ190cmFuc2Zlcl9vbmVf bWVzc2FnZSgpOgoKZHJpdmVycy9zcGkvc3BpLWFtbG9naWMtc3Bpc2cuYzphbWxfc3Bpc2dfdHJh bnNmZXJfb25lX21lc3NhZ2UoKSB7CiAgICAuLi4KICAgIGlmICh3YWl0X2Zvcl9jb21wbGV0aW9u X3RpbWVvdXQoJnNwaXNnLT5jb21wbGV0aW9uLCAuLi4pKQogICAgICAgIHJldCA9IHNwaXNnLT5z dGF0dXMgPyAtRUlPIDogMDsKICAgIGVsc2UKICAgICAgICByZXQgPSAtRVRJTUVET1VUOwoKICAg IGRtYV91bm1hcF9zaW5nbGUoZGV2LCBkZXNjc19wYWRkciwgZGVzY3NfbGVuLCBETUFfVE9fREVW SUNFKTsKZW5kOgogICAgLi4uCiAgICBrZnJlZShkZXNjcyk7CiAgICAuLi4KfQoKSWYgYW4gU1BJ IHRyYW5zZmVyIHRpbWVzIG91dCBhbmQgd2FpdF9mb3JfY29tcGxldGlvbl90aW1lb3V0KCkgZXhw aXJlcywKdGhlIGNvZGUgcHJvY2VlZHMgZGlyZWN0bHkgdG8gdW5tYXAgdGhlIERNQSBtZW1vcnkg YW5kIGZyZWUgdGhlIGRlc2NyaXB0b3IKYXJyYXkuIEhvd2V2ZXIsIHRoZSBoYXJkd2FyZSBpcyBu ZXZlciBoYWx0ZWQgb3IgcmVzZXQgKGUuZy4gYnkgd3JpdGluZyAwCnRvIHRoZSBkZXNjcmlwdG9y IGxpc3QgcmVnaXN0ZXIpLgoKTWlnaHQgdGhlIGhhcmR3YXJlIHN0aWxsIGJlIGFjdGl2ZWx5IHBl cmZvcm1pbmcgRE1BLCByZXN1bHRpbmcgaW4gbWVtb3J5CmNvcnJ1cHRpb24gZnJvbSBhIHVzZS1h ZnRlci1mcmVlPyBGdXJ0aGVybW9yZSwgaWYgdGhlIGhhcmR3YXJlIGV2ZW50dWFsbHkKY29tcGxl dGVzLCBjb3VsZCB0aGUgZGVsYXllZCBpbnRlcnJ1cHQgZmFsc2VseSB3YWtlIHVwIHN1YnNlcXVl bnQgdHJhbnNmZXJzPwoKPiArCQlkZXNjLS07Cj4gKwl9IGVsc2UgaWYgKGNzX2hvbGRfaW5fc2Ns aykgewo+ICAJCS8qIGFkZGl0aW9uYWwgbnVsbC1kZXNjcmlwdG9yIHRvIGFjaGlldmUgdGhlIGNz LWhvbGQgZGVsYXkgKi8KPiAgCQlhbWxfc3Bpc2dfc2V0dXBfbnVsbF9kZXNjKHNwaXNnLCBkZXNj LCBjc19ob2xkX2luX3NjbGspOwo+ICAJCWRlc2MtLTsKCi0tIApTYXNoaWtvIEFJIHJldmlldyDC tyBodHRwczovL3Nhc2hpa28uZGV2LyMvcGF0Y2hzZXQvMjAyNjA3MTctYTktc3Bpc2ctdjEtMC0y ZWVlYTc3YmUxOWZAYW1sb2dpYy5jb20/cGFydD0zCgpfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXwpsaW51eC1hbWxvZ2ljIG1haWxpbmcgbGlzdApsaW51eC1h bWxvZ2ljQGxpc3RzLmluZnJhZGVhZC5vcmcKaHR0cDovL2xpc3RzLmluZnJhZGVhZC5vcmcvbWFp bG1hbi9saXN0aW5mby9saW51eC1hbWxvZ2ljCg==