From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id CFCB2C55162 for ; Thu, 30 Jul 2026 01:48:25 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 35A6D10E0F2; Thu, 30 Jul 2026 01:48:25 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.b="bQhnw86V"; dkim-atps=neutral Received: from sea.source.kernel.org (sea.source.kernel.org [172.234.252.31]) by gabe.freedesktop.org (Postfix) with ESMTPS id C110610E0F2 for ; Thu, 30 Jul 2026 01:48:24 +0000 (UTC) Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 827F943D9F; Thu, 30 Jul 2026 01:48:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 30DBD1F000E9; Thu, 30 Jul 2026 01:48:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785376103; bh=ly437AdX5E5kKzXqL5w45v8tqhUMN3mpfh17s9iQu9Q=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=bQhnw86VU4R7rQDmlPwPLAHe6Y9DXS3VM1EBkVHVXNSuF3d1xFJmCuTHOItKnshld 64G6daGWsaWFKGrNgtxzc7d4T7TI9+XKJA1njGBxoXbvSvyT+QUzq0y1wpLFDUeQzQ uB++iPsNvrVsO3I8eUjqT37+ebxBnB+WWDQSgWF4pflgLNEMyuUKGEtsmeRJL2G+17 0U20GzNGVwV+xJZpP1z4YEG3s4UIecs3J8CnjB6YIuMEKnbWDUeNlE49m1TrXX/jxD X4B+i5HOfdzrTZdmaKHFWigW8pJm9URSbPIHpnrzYFTuyizcMEDhDHw/E3R4ClzpvC 3vB5Ltn9bFTWQ== From: sashiko-bot@kernel.org Subject: Re: [PATCH v5 6/6] drm/rockchip: cdn-dp: Add multiple bridges to support PHY port selection To: "Chaoyi Chen" Cc: linux-phy@lists.infradead.org, vkoul@kernel.org, neil.armstrong@linaro.org, olteanv@gmail.com, dri-devel@lists.freedesktop.org In-Reply-To: <20260730013349.51-7-kernel@airkyi.com> References: <20260730013349.51-1-kernel@airkyi.com> <20260730013349.51-7-kernel@airkyi.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Thu, 30 Jul 2026 01:48:22 +0000 Message-Id: <20260730014823.30DBD1F000E9@smtp.kernel.org> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Thank you for your contribution! Sashiko AI review found 7 potential issue(= s) to consider: New issues: - [High] Stale pointers in `dp->next_bridge_list` cause a double free / ref= count underflow on repeated or failed bind cycles. - [High] `cdn_dp_switch_port` unconditionally configures video, breaking ED= ID reads for newly connected monitors. - [High] Missing `atomic_check` allows simultaneous activation of multiple = conflicting encoders. - [High] `cdn_dp_connected_port` bypasses the physical lane check for extco= n configurations, breaking hotplug detection. - [High] Index mismatch between packed PHY ports and DT endpoints causes un= initialized memory reads and guaranteed NULL dereferences. - [Medium] Device tree endpoint iteration lacks a bounds check against `MAX= _PHY`, leading to a heap buffer overflow. Pre-existing issues: - [High] Extcon notifiers can schedule work after `cancel_work_sync()`, lea= ding to Use-After-Free. -- --- Patch [6]: [PATCH v5 6/6] drm/rockchip: cdn-dp: Add multiple bridges to= support PHY port selection --- commit 8377956184d44f77846e2394e562e31ea5099865 Author: Chaoyi Chen drm/rockchip: cdn-dp: Add multiple bridges to support PHY port selection This commit adds support for multiple bridges in the Rockchip CDN-DP driver to enable PHY port selection via the DRM AUX HPD bridge framework. It parses device tree endpoints to register one or two bridges and handles switching the DP controller output between them based on plug states. > diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/roc= kchip/cdn-dp-core.c > index 74e1f5422a6e2..5e513f6930cb9 100644 > --- a/drivers/gpu/drm/rockchip/cdn-dp-core.c > +++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c [ ... ] > @@ -192,14 +193,27 @@ static int cdn_dp_get_sink_count(struct cdn_dp_devi= ce *dp, u8 *sink_count) > static struct cdn_dp_port *cdn_dp_connected_port(struct cdn_dp_device *d= p) > { > struct cdn_dp_port *port; > - int i, lanes; > + int i, lanes[MAX_PHY]; > =20 > for (i =3D 0; i < dp->ports; i++) { > port =3D dp->port[i]; > - lanes =3D cdn_dp_get_port_lanes(port); > - if (lanes) > + lanes[i] =3D cdn_dp_get_port_lanes(port); > + if (!dp->next_bridge_valid) > return port; [Severity: High] Does this break hotplug detection for legacy extcon-based devices? If dp->next_bridge_valid is false, this loop unconditionally returns dp->port[0] on the first iteration without verifying if the physical lanes are greater than zero. This causes the driver to perpetually report the display as connected. > } > + > + if (dp->next_bridge_valid) { > + /* If more than one port is available, pick the last active port */ > + if (dp->active_port >=3D 0 && lanes[dp->active_port]) > + return dp->port[dp->active_port]; > + > + /* If the last active port is not available, pick an available port in= order */ > + for (i =3D 0; i < dp->bridge_count; i++) { > + if (lanes[i]) > + return dp->port[i]; [Severity: High] Can this loop read uninitialized stack memory? The lanes array is populated in the previous loop up to dp->ports, which tracks successfully probed PHYs. However, this loop iterates up to dp->bridge_count, which tracks DT endpoints. If a device tree specifies more endpoints than successfully probed PHYs, this will read out of bounds on the stack. > + } > + } > + > return NULL; > } [ ... ] > @@ -254,12 +268,45 @@ static const struct drm_edid * > cdn_dp_bridge_edid_read(struct drm_bridge *bridge, struct drm_connector = *connector) > { > struct cdn_dp_device *dp =3D bridge_to_dp(bridge); > - const struct drm_edid *drm_edid; > + struct cdn_dp_bridge *dp_bridge =3D bridge_to_dp_bridge(bridge); > + struct cdn_dp_port *port =3D dp->port[dp_bridge->id]; > + struct cdn_dp_port *prev_port =3D NULL; > + const struct drm_edid *drm_edid =3D NULL; > + int i, ret; > =20 > mutex_lock(&dp->lock); > + > + /* More than one port is available */ > + if (dp->bridge_count > 1 && !port->phy_enabled) { [Severity: High] Is there a risk of a NULL pointer dereference here? If the device tree has more endpoints than successfully probed PHYs, dp_bridge->id could exceed the bounds of initialized dp->port pointers. In that scenario, port would be NULL, and evaluating !port->phy_enabled will crash. > + for (i =3D 0; i < dp->bridge_count; i++) { > + /* Another port already enable */ > + if (dp->bridge_list[i] !=3D dp_bridge && dp->bridge_list[i]->enabled) > + goto get_cache; > + /* Find already enabled port */ > + if (dp->port[i]->phy_enabled) > + prev_port =3D dp->port[i]; > + } > + > + /* Switch to current port */ > + if (prev_port) { > + ret =3D cdn_dp_switch_port(dp, prev_port, port); [Severity: High] Will this sequence fail to read the EDID for a newly connected monitor? Switching the port here calls cdn_dp_switch_port(), which unconditionally executes cdn_dp_config_video(dp). During EDID probing, no DRM display mode has been committed yet, so dp->mode.clock is 0.=20 This causes cdn_dp_config_video() to fail its bandwidth calculation loop and return -EINVAL, which aborts the port switch and forces the driver to fall back to a cached EDID. > + if (ret) > + goto get_cache; > + } > + } [ ... ] > @@ -838,6 +948,7 @@ static const struct drm_bridge_funcs cdn_dp_bridge_fu= ncs =3D { > .atomic_disable =3D cdn_dp_bridge_atomic_disable, > .mode_valid =3D cdn_dp_bridge_mode_valid, > .mode_set =3D cdn_dp_bridge_mode_set, > + .hpd_notify =3D cdn_dp_bridge_hpd_notify, > =20 > .dp_audio_prepare =3D cdn_dp_audio_prepare, [Severity: High] Because there is only a single DP hardware controller backing multiple potential bridges, is there a risk of hardware state corruption if userspace commits a state that maps CRTCs to both ports simultaneously? Without an .atomic_check callback in cdn_dp_bridge_funcs to enforce mutual exclusivity, cdn_dp_bridge_atomic_enable() could execute for the second port and overwrite the video configuration while the first is active. [ ... ] > @@ -1030,6 +1142,101 @@ static int cdn_dp_bind(struct device *dev, struct= device *master, void *data) [ ... ] > +static int cdn_dp_parse_next_bridge_dt(struct cdn_dp_device *dp) > +{ [ ... ] > + /* One endpoint may correspond to one next bridge. */ > + for_each_of_graph_port_endpoint(port, dp_ep) { > + struct device_node *next_bridge_node __free(device_node) =3D > + of_graph_get_remote_port_parent(dp_ep); > + > + bridge =3D of_drm_find_bridge(next_bridge_node); > + if (!bridge) { > + ret =3D -EPROBE_DEFER; > + goto out; > + } > + > + dp->next_bridge_valid =3D true; > + dp->next_bridge_list[count] =3D drm_bridge_get(bridge); > + count++; [Severity: Medium] Is there a potential heap buffer overflow here? The count variable is incremented and used as an index for dp->next_bridge_list[count], but there is no bounds check against MAX_PHY. If a misconfigured device tree provides 3 or more endpoints, this will overwrite adjacent fields in the cdn_dp_device structure. > + } [ ... ] > @@ -1052,15 +1259,29 @@ static int cdn_dp_bind(struct device *dev, struct= device *master, void *data) > schedule_work(&dp->event_work); > =20 > return 0; > + > +out: > + for (i =3D 0; i < MAX_PHY; i++) > + drm_bridge_put(dp->next_bridge_list[i]); [Severity: High] Can this result in a double free and refcount underflow? If cdn_dp_bind() fails and executes this error path, it calls drm_bridge_put() but leaves the pointers intact in dp->next_bridge_list. If the master bind is retried later and fails again, it will perform another drm_bridge_put() on the same stale pointers.=20 The same pattern also appears below during unbind. > + > + return ret; > } > =20 > static void cdn_dp_unbind(struct device *dev, struct device *master, voi= d *data) > { > struct cdn_dp_device *dp =3D dev_get_drvdata(dev); > - struct drm_encoder *encoder =3D &dp->encoder.encoder; > + struct drm_encoder *encoder; > + int i; > =20 > cancel_work_sync(&dp->event_work); [Severity: High] This is a pre-existing issue, but can this lead to a use-after-free during unbind? Extcon notifiers are registered using devm_extcon_register_notifier(). While cancel_work_sync(&dp->event_work) cancels pending work here, the devm-managed notifier remains active until devres cleanup, which happens after unbind returns.=20 A hotplug event in this window could reschedule dp->event_work, executing it after the structures are freed. > - encoder->funcs->destroy(encoder); > + for (i =3D 0; i < dp->bridge_count; i++) { > + encoder =3D &dp->bridge_list[i]->encoder.encoder; > + encoder->funcs->destroy(encoder); > + drm_bridge_put(dp->next_bridge_list[i]); > + } --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260730013349.51-1= -kernel@airkyi.com?part=3D6 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C33ABC54FCD for ; Thu, 30 Jul 2026 01:48:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Xm6LPGdDvCzOUd9cKg7SOUUQX59B8aOztinvvoY8b0o=; b=G8Xr+v7xL0Cook FqoJ6E6/lpdG59u+CP15yWtGNsJZDOV1HdbMNDIbdMzBcJIcPOjOapKRTH+FEJEpugm/QpKj2sGaa iwoR2+S5nUC0VmjCZ4zpNuj4mbsmjdT3h/+H0A9s3sQHx6olS16dH//6zN2n6hGMeVyb8WKnokDY/ L9Mg5QvIn2kLhxaKY3+XD3Wm76vZJjbV06hWWwkAnpCfSQyDHKtYGURSnnvuAC8PM0OZdiREpGNRG ZluWjtZNc1A7e/ITVMINMXZh4SsNJlZd/0oHhprz8Cl7VidswE/RGBNS2DiOyJuIqgeY6elfcOtUk y2P5gLIgwDQtqTsBLvUA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wpFsm-00000009I8h-3Pqg; Thu, 30 Jul 2026 01:48:24 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wpFsl-00000009I8a-3rq1 for linux-phy@lists.infradead.org; Thu, 30 Jul 2026 01:48:23 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 827F943D9F; Thu, 30 Jul 2026 01:48:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 30DBD1F000E9; Thu, 30 Jul 2026 01:48:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785376103; bh=ly437AdX5E5kKzXqL5w45v8tqhUMN3mpfh17s9iQu9Q=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=bQhnw86VU4R7rQDmlPwPLAHe6Y9DXS3VM1EBkVHVXNSuF3d1xFJmCuTHOItKnshld 64G6daGWsaWFKGrNgtxzc7d4T7TI9+XKJA1njGBxoXbvSvyT+QUzq0y1wpLFDUeQzQ uB++iPsNvrVsO3I8eUjqT37+ebxBnB+WWDQSgWF4pflgLNEMyuUKGEtsmeRJL2G+17 0U20GzNGVwV+xJZpP1z4YEG3s4UIecs3J8CnjB6YIuMEKnbWDUeNlE49m1TrXX/jxD X4B+i5HOfdzrTZdmaKHFWigW8pJm9URSbPIHpnrzYFTuyizcMEDhDHw/E3R4ClzpvC 3vB5Ltn9bFTWQ== From: sashiko-bot@kernel.org Subject: Re: [PATCH v5 6/6] drm/rockchip: cdn-dp: Add multiple bridges to support PHY port selection To: "Chaoyi Chen" Cc: linux-phy@lists.infradead.org, vkoul@kernel.org, neil.armstrong@linaro.org, olteanv@gmail.com, dri-devel@lists.freedesktop.org In-Reply-To: <20260730013349.51-7-kernel@airkyi.com> References: <20260730013349.51-1-kernel@airkyi.com> <20260730013349.51-7-kernel@airkyi.com> Date: Thu, 30 Jul 2026 01:48:22 +0000 Message-Id: <20260730014823.30DBD1F000E9@smtp.kernel.org> X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg NyBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpOZXcgaXNzdWVzOgotIFtIaWdoXSBT dGFsZSBwb2ludGVycyBpbiBgZHAtPm5leHRfYnJpZGdlX2xpc3RgIGNhdXNlIGEgZG91YmxlIGZy ZWUgLyByZWZjb3VudCB1bmRlcmZsb3cgb24gcmVwZWF0ZWQgb3IgZmFpbGVkIGJpbmQgY3ljbGVz LgotIFtIaWdoXSBgY2RuX2RwX3N3aXRjaF9wb3J0YCB1bmNvbmRpdGlvbmFsbHkgY29uZmlndXJl cyB2aWRlbywgYnJlYWtpbmcgRURJRCByZWFkcyBmb3IgbmV3bHkgY29ubmVjdGVkIG1vbml0b3Jz LgotIFtIaWdoXSBNaXNzaW5nIGBhdG9taWNfY2hlY2tgIGFsbG93cyBzaW11bHRhbmVvdXMgYWN0 aXZhdGlvbiBvZiBtdWx0aXBsZSBjb25mbGljdGluZyBlbmNvZGVycy4KLSBbSGlnaF0gYGNkbl9k cF9jb25uZWN0ZWRfcG9ydGAgYnlwYXNzZXMgdGhlIHBoeXNpY2FsIGxhbmUgY2hlY2sgZm9yIGV4 dGNvbiBjb25maWd1cmF0aW9ucywgYnJlYWtpbmcgaG90cGx1ZyBkZXRlY3Rpb24uCi0gW0hpZ2hd IEluZGV4IG1pc21hdGNoIGJldHdlZW4gcGFja2VkIFBIWSBwb3J0cyBhbmQgRFQgZW5kcG9pbnRz IGNhdXNlcyB1bmluaXRpYWxpemVkIG1lbW9yeSByZWFkcyBhbmQgZ3VhcmFudGVlZCBOVUxMIGRl cmVmZXJlbmNlcy4KLSBbTWVkaXVtXSBEZXZpY2UgdHJlZSBlbmRwb2ludCBpdGVyYXRpb24gbGFj a3MgYSBib3VuZHMgY2hlY2sgYWdhaW5zdCBgTUFYX1BIWWAsIGxlYWRpbmcgdG8gYSBoZWFwIGJ1 ZmZlciBvdmVyZmxvdy4KClByZS1leGlzdGluZyBpc3N1ZXM6Ci0gW0hpZ2hdIEV4dGNvbiBub3Rp ZmllcnMgY2FuIHNjaGVkdWxlIHdvcmsgYWZ0ZXIgYGNhbmNlbF93b3JrX3N5bmMoKWAsIGxlYWRp bmcgdG8gVXNlLUFmdGVyLUZyZWUuCi0tCgotLS0gUGF0Y2ggWzZdOiBbUEFUQ0ggdjUgNi82XSBk cm0vcm9ja2NoaXA6IGNkbi1kcDogQWRkIG11bHRpcGxlIGJyaWRnZXMgdG8gc3VwcG9ydCBQSFkg cG9ydCBzZWxlY3Rpb24gLS0tCmNvbW1pdCA4Mzc3OTU2MTg0ZDQ0Zjc3ODQ2ZTIzOTRlNTYyZTMx ZWE1MDk5ODY1CkF1dGhvcjogQ2hhb3lpIENoZW4gPGNoYW95aS5jaGVuQHJvY2stY2hpcHMuY29t PgoKZHJtL3JvY2tjaGlwOiBjZG4tZHA6IEFkZCBtdWx0aXBsZSBicmlkZ2VzIHRvIHN1cHBvcnQg UEhZIHBvcnQgc2VsZWN0aW9uCgpUaGlzIGNvbW1pdCBhZGRzIHN1cHBvcnQgZm9yIG11bHRpcGxl IGJyaWRnZXMgaW4gdGhlIFJvY2tjaGlwIENETi1EUApkcml2ZXIgdG8gZW5hYmxlIFBIWSBwb3J0 IHNlbGVjdGlvbiB2aWEgdGhlIERSTSBBVVggSFBEIGJyaWRnZSBmcmFtZXdvcmsuCkl0IHBhcnNl cyBkZXZpY2UgdHJlZSBlbmRwb2ludHMgdG8gcmVnaXN0ZXIgb25lIG9yIHR3byBicmlkZ2VzIGFu ZCBoYW5kbGVzCnN3aXRjaGluZyB0aGUgRFAgY29udHJvbGxlciBvdXRwdXQgYmV0d2VlbiB0aGVt IGJhc2VkIG9uIHBsdWcgc3RhdGVzLgoKPiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL3Jv Y2tjaGlwL2Nkbi1kcC1jb3JlLmMgYi9kcml2ZXJzL2dwdS9kcm0vcm9ja2NoaXAvY2RuLWRwLWNv cmUuYwo+IGluZGV4IDc0ZTFmNTQyMmE2ZTIuLjVlNTEzZjY5MzBjYjkgMTAwNjQ0Cj4gLS0tIGEv ZHJpdmVycy9ncHUvZHJtL3JvY2tjaGlwL2Nkbi1kcC1jb3JlLmMKPiArKysgYi9kcml2ZXJzL2dw dS9kcm0vcm9ja2NoaXAvY2RuLWRwLWNvcmUuYwpbIC4uLiBdCj4gQEAgLTE5MiwxNCArMTkzLDI3 IEBAIHN0YXRpYyBpbnQgY2RuX2RwX2dldF9zaW5rX2NvdW50KHN0cnVjdCBjZG5fZHBfZGV2aWNl ICpkcCwgdTggKnNpbmtfY291bnQpCj4gIHN0YXRpYyBzdHJ1Y3QgY2RuX2RwX3BvcnQgKmNkbl9k cF9jb25uZWN0ZWRfcG9ydChzdHJ1Y3QgY2RuX2RwX2RldmljZSAqZHApCj4gIHsKPiAgCXN0cnVj dCBjZG5fZHBfcG9ydCAqcG9ydDsKPiAtCWludCBpLCBsYW5lczsKPiArCWludCBpLCBsYW5lc1tN QVhfUEhZXTsKPiAgCj4gIAlmb3IgKGkgPSAwOyBpIDwgZHAtPnBvcnRzOyBpKyspIHsKPiAgCQlw b3J0ID0gZHAtPnBvcnRbaV07Cj4gLQkJbGFuZXMgPSBjZG5fZHBfZ2V0X3BvcnRfbGFuZXMocG9y dCk7Cj4gLQkJaWYgKGxhbmVzKQo+ICsJCWxhbmVzW2ldID0gY2RuX2RwX2dldF9wb3J0X2xhbmVz KHBvcnQpOwo+ICsJCWlmICghZHAtPm5leHRfYnJpZGdlX3ZhbGlkKQo+ICAJCQlyZXR1cm4gcG9y dDsKCltTZXZlcml0eTogSGlnaF0KRG9lcyB0aGlzIGJyZWFrIGhvdHBsdWcgZGV0ZWN0aW9uIGZv ciBsZWdhY3kgZXh0Y29uLWJhc2VkIGRldmljZXM/CgpJZiBkcC0+bmV4dF9icmlkZ2VfdmFsaWQg aXMgZmFsc2UsIHRoaXMgbG9vcCB1bmNvbmRpdGlvbmFsbHkgcmV0dXJucwpkcC0+cG9ydFswXSBv biB0aGUgZmlyc3QgaXRlcmF0aW9uIHdpdGhvdXQgdmVyaWZ5aW5nIGlmIHRoZSBwaHlzaWNhbCBs YW5lcwphcmUgZ3JlYXRlciB0aGFuIHplcm8uIFRoaXMgY2F1c2VzIHRoZSBkcml2ZXIgdG8gcGVy cGV0dWFsbHkgcmVwb3J0IHRoZQpkaXNwbGF5IGFzIGNvbm5lY3RlZC4KCj4gIAl9Cj4gKwo+ICsJ aWYgKGRwLT5uZXh0X2JyaWRnZV92YWxpZCkgewo+ICsJCS8qIElmIG1vcmUgdGhhbiBvbmUgcG9y dCBpcyBhdmFpbGFibGUsIHBpY2sgdGhlIGxhc3QgYWN0aXZlIHBvcnQgKi8KPiArCQlpZiAoZHAt PmFjdGl2ZV9wb3J0ID49IDAgJiYgbGFuZXNbZHAtPmFjdGl2ZV9wb3J0XSkKPiArCQkJcmV0dXJu IGRwLT5wb3J0W2RwLT5hY3RpdmVfcG9ydF07Cj4gKwo+ICsJCS8qIElmIHRoZSBsYXN0IGFjdGl2 ZSBwb3J0IGlzIG5vdCBhdmFpbGFibGUsIHBpY2sgYW4gYXZhaWxhYmxlIHBvcnQgaW4gb3JkZXIg Ki8KPiArCQlmb3IgKGkgPSAwOyBpIDwgZHAtPmJyaWRnZV9jb3VudDsgaSsrKSB7Cj4gKwkJCWlm IChsYW5lc1tpXSkKPiArCQkJCXJldHVybiBkcC0+cG9ydFtpXTsKCltTZXZlcml0eTogSGlnaF0K Q2FuIHRoaXMgbG9vcCByZWFkIHVuaW5pdGlhbGl6ZWQgc3RhY2sgbWVtb3J5PwoKVGhlIGxhbmVz IGFycmF5IGlzIHBvcHVsYXRlZCBpbiB0aGUgcHJldmlvdXMgbG9vcCB1cCB0byBkcC0+cG9ydHMs IHdoaWNoCnRyYWNrcyBzdWNjZXNzZnVsbHkgcHJvYmVkIFBIWXMuIEhvd2V2ZXIsIHRoaXMgbG9v cCBpdGVyYXRlcyB1cCB0bwpkcC0+YnJpZGdlX2NvdW50LCB3aGljaCB0cmFja3MgRFQgZW5kcG9p bnRzLiBJZiBhIGRldmljZSB0cmVlIHNwZWNpZmllcwptb3JlIGVuZHBvaW50cyB0aGFuIHN1Y2Nl c3NmdWxseSBwcm9iZWQgUEhZcywgdGhpcyB3aWxsIHJlYWQgb3V0IG9mIGJvdW5kcwpvbiB0aGUg c3RhY2suCgo+ICsJCX0KPiArCX0KPiArCj4gIAlyZXR1cm4gTlVMTDsKPiAgfQpbIC4uLiBdCj4g QEAgLTI1NCwxMiArMjY4LDQ1IEBAIHN0YXRpYyBjb25zdCBzdHJ1Y3QgZHJtX2VkaWQgKgo+ICBj ZG5fZHBfYnJpZGdlX2VkaWRfcmVhZChzdHJ1Y3QgZHJtX2JyaWRnZSAqYnJpZGdlLCBzdHJ1Y3Qg ZHJtX2Nvbm5lY3RvciAqY29ubmVjdG9yKQo+ICB7Cj4gIAlzdHJ1Y3QgY2RuX2RwX2RldmljZSAq ZHAgPSBicmlkZ2VfdG9fZHAoYnJpZGdlKTsKPiAtCWNvbnN0IHN0cnVjdCBkcm1fZWRpZCAqZHJt X2VkaWQ7Cj4gKwlzdHJ1Y3QgY2RuX2RwX2JyaWRnZSAqZHBfYnJpZGdlID0gYnJpZGdlX3RvX2Rw X2JyaWRnZShicmlkZ2UpOwo+ICsJc3RydWN0IGNkbl9kcF9wb3J0ICpwb3J0ID0gZHAtPnBvcnRb ZHBfYnJpZGdlLT5pZF07Cj4gKwlzdHJ1Y3QgY2RuX2RwX3BvcnQgKnByZXZfcG9ydCA9IE5VTEw7 Cj4gKwljb25zdCBzdHJ1Y3QgZHJtX2VkaWQgKmRybV9lZGlkID0gTlVMTDsKPiArCWludCBpLCBy ZXQ7Cj4gIAo+ICAJbXV0ZXhfbG9jaygmZHAtPmxvY2spOwo+ICsKPiArCS8qIE1vcmUgdGhhbiBv bmUgcG9ydCBpcyBhdmFpbGFibGUgKi8KPiArCWlmIChkcC0+YnJpZGdlX2NvdW50ID4gMSAmJiAh cG9ydC0+cGh5X2VuYWJsZWQpIHsKCltTZXZlcml0eTogSGlnaF0KSXMgdGhlcmUgYSByaXNrIG9m IGEgTlVMTCBwb2ludGVyIGRlcmVmZXJlbmNlIGhlcmU/CgpJZiB0aGUgZGV2aWNlIHRyZWUgaGFz IG1vcmUgZW5kcG9pbnRzIHRoYW4gc3VjY2Vzc2Z1bGx5IHByb2JlZCBQSFlzLApkcF9icmlkZ2Ut PmlkIGNvdWxkIGV4Y2VlZCB0aGUgYm91bmRzIG9mIGluaXRpYWxpemVkIGRwLT5wb3J0IHBvaW50 ZXJzLgpJbiB0aGF0IHNjZW5hcmlvLCBwb3J0IHdvdWxkIGJlIE5VTEwsIGFuZCBldmFsdWF0aW5n ICFwb3J0LT5waHlfZW5hYmxlZAp3aWxsIGNyYXNoLgoKPiArCQlmb3IgKGkgPSAwOyBpIDwgZHAt PmJyaWRnZV9jb3VudDsgaSsrKSB7Cj4gKwkJCS8qIEFub3RoZXIgcG9ydCBhbHJlYWR5IGVuYWJs ZSAqLwo+ICsJCQlpZiAoZHAtPmJyaWRnZV9saXN0W2ldICE9IGRwX2JyaWRnZSAmJiBkcC0+YnJp ZGdlX2xpc3RbaV0tPmVuYWJsZWQpCj4gKwkJCQlnb3RvIGdldF9jYWNoZTsKPiArCQkJLyogRmlu ZCBhbHJlYWR5IGVuYWJsZWQgcG9ydCAqLwo+ICsJCQlpZiAoZHAtPnBvcnRbaV0tPnBoeV9lbmFi bGVkKQo+ICsJCQkJcHJldl9wb3J0ID0gZHAtPnBvcnRbaV07Cj4gKwkJfQo+ICsKPiArCQkvKiBT d2l0Y2ggdG8gY3VycmVudCBwb3J0ICovCj4gKwkJaWYgKHByZXZfcG9ydCkgewo+ICsJCQlyZXQg PSBjZG5fZHBfc3dpdGNoX3BvcnQoZHAsIHByZXZfcG9ydCwgcG9ydCk7CgpbU2V2ZXJpdHk6IEhp Z2hdCldpbGwgdGhpcyBzZXF1ZW5jZSBmYWlsIHRvIHJlYWQgdGhlIEVESUQgZm9yIGEgbmV3bHkg Y29ubmVjdGVkIG1vbml0b3I/CgpTd2l0Y2hpbmcgdGhlIHBvcnQgaGVyZSBjYWxscyBjZG5fZHBf c3dpdGNoX3BvcnQoKSwgd2hpY2ggdW5jb25kaXRpb25hbGx5CmV4ZWN1dGVzIGNkbl9kcF9jb25m aWdfdmlkZW8oZHApLiBEdXJpbmcgRURJRCBwcm9iaW5nLCBubyBEUk0gZGlzcGxheSBtb2RlCmhh cyBiZWVuIGNvbW1pdHRlZCB5ZXQsIHNvIGRwLT5tb2RlLmNsb2NrIGlzIDAuIAoKVGhpcyBjYXVz ZXMgY2RuX2RwX2NvbmZpZ192aWRlbygpIHRvIGZhaWwgaXRzIGJhbmR3aWR0aCBjYWxjdWxhdGlv biBsb29wCmFuZCByZXR1cm4gLUVJTlZBTCwgd2hpY2ggYWJvcnRzIHRoZSBwb3J0IHN3aXRjaCBh bmQgZm9yY2VzIHRoZSBkcml2ZXIgdG8KZmFsbCBiYWNrIHRvIGEgY2FjaGVkIEVESUQuCgo+ICsJ CQlpZiAocmV0KQo+ICsJCQkJZ290byBnZXRfY2FjaGU7Cj4gKwkJfQo+ICsJfQpbIC4uLiBdCj4g QEAgLTgzOCw2ICs5NDgsNyBAQCBzdGF0aWMgY29uc3Qgc3RydWN0IGRybV9icmlkZ2VfZnVuY3Mg Y2RuX2RwX2JyaWRnZV9mdW5jcyA9IHsKPiAgCS5hdG9taWNfZGlzYWJsZSA9IGNkbl9kcF9icmlk Z2VfYXRvbWljX2Rpc2FibGUsCj4gIAkubW9kZV92YWxpZCA9IGNkbl9kcF9icmlkZ2VfbW9kZV92 YWxpZCwKPiAgCS5tb2RlX3NldCA9IGNkbl9kcF9icmlkZ2VfbW9kZV9zZXQsCj4gKwkuaHBkX25v dGlmeSA9IGNkbl9kcF9icmlkZ2VfaHBkX25vdGlmeSwKPiAgCj4gIAkuZHBfYXVkaW9fcHJlcGFy ZSA9IGNkbl9kcF9hdWRpb19wcmVwYXJlLAoKW1NldmVyaXR5OiBIaWdoXQpCZWNhdXNlIHRoZXJl IGlzIG9ubHkgYSBzaW5nbGUgRFAgaGFyZHdhcmUgY29udHJvbGxlciBiYWNraW5nIG11bHRpcGxl CnBvdGVudGlhbCBicmlkZ2VzLCBpcyB0aGVyZSBhIHJpc2sgb2YgaGFyZHdhcmUgc3RhdGUgY29y cnVwdGlvbiBpZgp1c2Vyc3BhY2UgY29tbWl0cyBhIHN0YXRlIHRoYXQgbWFwcyBDUlRDcyB0byBi b3RoIHBvcnRzIHNpbXVsdGFuZW91c2x5PwoKV2l0aG91dCBhbiAuYXRvbWljX2NoZWNrIGNhbGxi YWNrIGluIGNkbl9kcF9icmlkZ2VfZnVuY3MgdG8gZW5mb3JjZSBtdXR1YWwKZXhjbHVzaXZpdHks IGNkbl9kcF9icmlkZ2VfYXRvbWljX2VuYWJsZSgpIGNvdWxkIGV4ZWN1dGUgZm9yIHRoZSBzZWNv bmQKcG9ydCBhbmQgb3ZlcndyaXRlIHRoZSB2aWRlbyBjb25maWd1cmF0aW9uIHdoaWxlIHRoZSBm aXJzdCBpcyBhY3RpdmUuCgpbIC4uLiBdCj4gQEAgLTEwMzAsNiArMTE0MiwxMDEgQEAgc3RhdGlj IGludCBjZG5fZHBfYmluZChzdHJ1Y3QgZGV2aWNlICpkZXYsIHN0cnVjdCBkZXZpY2UgKm1hc3Rl ciwgdm9pZCAqZGF0YSkKWyAuLi4gXQo+ICtzdGF0aWMgaW50IGNkbl9kcF9wYXJzZV9uZXh0X2Jy aWRnZV9kdChzdHJ1Y3QgY2RuX2RwX2RldmljZSAqZHApCj4gK3sKWyAuLi4gXQo+ICsJLyogT25l IGVuZHBvaW50IG1heSBjb3JyZXNwb25kIHRvIG9uZSBuZXh0IGJyaWRnZS4gKi8KPiArCWZvcl9l YWNoX29mX2dyYXBoX3BvcnRfZW5kcG9pbnQocG9ydCwgZHBfZXApIHsKPiArCQlzdHJ1Y3QgZGV2 aWNlX25vZGUgKm5leHRfYnJpZGdlX25vZGUgX19mcmVlKGRldmljZV9ub2RlKSA9Cj4gKwkJCW9m X2dyYXBoX2dldF9yZW1vdGVfcG9ydF9wYXJlbnQoZHBfZXApOwo+ICsKPiArCQlicmlkZ2UgPSBv Zl9kcm1fZmluZF9icmlkZ2UobmV4dF9icmlkZ2Vfbm9kZSk7Cj4gKwkJaWYgKCFicmlkZ2UpIHsK PiArCQkJcmV0ID0gLUVQUk9CRV9ERUZFUjsKPiArCQkJZ290byBvdXQ7Cj4gKwkJfQo+ICsKPiAr CQlkcC0+bmV4dF9icmlkZ2VfdmFsaWQgPSB0cnVlOwo+ICsJCWRwLT5uZXh0X2JyaWRnZV9saXN0 W2NvdW50XSA9IGRybV9icmlkZ2VfZ2V0KGJyaWRnZSk7Cj4gKwkJY291bnQrKzsKCltTZXZlcml0 eTogTWVkaXVtXQpJcyB0aGVyZSBhIHBvdGVudGlhbCBoZWFwIGJ1ZmZlciBvdmVyZmxvdyBoZXJl PwoKVGhlIGNvdW50IHZhcmlhYmxlIGlzIGluY3JlbWVudGVkIGFuZCB1c2VkIGFzIGFuIGluZGV4 IGZvcgpkcC0+bmV4dF9icmlkZ2VfbGlzdFtjb3VudF0sIGJ1dCB0aGVyZSBpcyBubyBib3VuZHMg Y2hlY2sgYWdhaW5zdCBNQVhfUEhZLgpJZiBhIG1pc2NvbmZpZ3VyZWQgZGV2aWNlIHRyZWUgcHJv dmlkZXMgMyBvciBtb3JlIGVuZHBvaW50cywgdGhpcyB3aWxsCm92ZXJ3cml0ZSBhZGphY2VudCBm aWVsZHMgaW4gdGhlIGNkbl9kcF9kZXZpY2Ugc3RydWN0dXJlLgoKPiArCX0KWyAuLi4gXQo+IEBA IC0xMDUyLDE1ICsxMjU5LDI5IEBAIHN0YXRpYyBpbnQgY2RuX2RwX2JpbmQoc3RydWN0IGRldmlj ZSAqZGV2LCBzdHJ1Y3QgZGV2aWNlICptYXN0ZXIsIHZvaWQgKmRhdGEpCj4gIAlzY2hlZHVsZV93 b3JrKCZkcC0+ZXZlbnRfd29yayk7Cj4gIAo+ICAJcmV0dXJuIDA7Cj4gKwo+ICtvdXQ6Cj4gKwlm b3IgKGkgPSAwOyBpIDwgTUFYX1BIWTsgaSsrKQo+ICsJCWRybV9icmlkZ2VfcHV0KGRwLT5uZXh0 X2JyaWRnZV9saXN0W2ldKTsKCltTZXZlcml0eTogSGlnaF0KQ2FuIHRoaXMgcmVzdWx0IGluIGEg ZG91YmxlIGZyZWUgYW5kIHJlZmNvdW50IHVuZGVyZmxvdz8KCklmIGNkbl9kcF9iaW5kKCkgZmFp bHMgYW5kIGV4ZWN1dGVzIHRoaXMgZXJyb3IgcGF0aCwgaXQgY2FsbHMKZHJtX2JyaWRnZV9wdXQo KSBidXQgbGVhdmVzIHRoZSBwb2ludGVycyBpbnRhY3QgaW4gZHAtPm5leHRfYnJpZGdlX2xpc3Qu CklmIHRoZSBtYXN0ZXIgYmluZCBpcyByZXRyaWVkIGxhdGVyIGFuZCBmYWlscyBhZ2FpbiwgaXQg d2lsbCBwZXJmb3JtCmFub3RoZXIgZHJtX2JyaWRnZV9wdXQoKSBvbiB0aGUgc2FtZSBzdGFsZSBw b2ludGVycy4gCgpUaGUgc2FtZSBwYXR0ZXJuIGFsc28gYXBwZWFycyBiZWxvdyBkdXJpbmcgdW5i aW5kLgoKPiArCj4gKwlyZXR1cm4gcmV0Owo+ICB9Cj4gIAo+ICBzdGF0aWMgdm9pZCBjZG5fZHBf dW5iaW5kKHN0cnVjdCBkZXZpY2UgKmRldiwgc3RydWN0IGRldmljZSAqbWFzdGVyLCB2b2lkICpk YXRhKQo+ICB7Cj4gIAlzdHJ1Y3QgY2RuX2RwX2RldmljZSAqZHAgPSBkZXZfZ2V0X2RydmRhdGEo ZGV2KTsKPiAtCXN0cnVjdCBkcm1fZW5jb2RlciAqZW5jb2RlciA9ICZkcC0+ZW5jb2Rlci5lbmNv ZGVyOwo+ICsJc3RydWN0IGRybV9lbmNvZGVyICplbmNvZGVyOwo+ICsJaW50IGk7Cj4gIAo+ICAJ Y2FuY2VsX3dvcmtfc3luYygmZHAtPmV2ZW50X3dvcmspOwoKW1NldmVyaXR5OiBIaWdoXQpUaGlz IGlzIGEgcHJlLWV4aXN0aW5nIGlzc3VlLCBidXQgY2FuIHRoaXMgbGVhZCB0byBhIHVzZS1hZnRl ci1mcmVlCmR1cmluZyB1bmJpbmQ/CgpFeHRjb24gbm90aWZpZXJzIGFyZSByZWdpc3RlcmVkIHVz aW5nIGRldm1fZXh0Y29uX3JlZ2lzdGVyX25vdGlmaWVyKCkuCldoaWxlIGNhbmNlbF93b3JrX3N5 bmMoJmRwLT5ldmVudF93b3JrKSBjYW5jZWxzIHBlbmRpbmcgd29yayBoZXJlLCB0aGUKZGV2bS1t YW5hZ2VkIG5vdGlmaWVyIHJlbWFpbnMgYWN0aXZlIHVudGlsIGRldnJlcyBjbGVhbnVwLCB3aGlj aCBoYXBwZW5zCmFmdGVyIHVuYmluZCByZXR1cm5zLiAKCkEgaG90cGx1ZyBldmVudCBpbiB0aGlz IHdpbmRvdyBjb3VsZCByZXNjaGVkdWxlIGRwLT5ldmVudF93b3JrLCBleGVjdXRpbmcKaXQgYWZ0 ZXIgdGhlIHN0cnVjdHVyZXMgYXJlIGZyZWVkLgoKPiAtCWVuY29kZXItPmZ1bmNzLT5kZXN0cm95 KGVuY29kZXIpOwo+ICsJZm9yIChpID0gMDsgaSA8IGRwLT5icmlkZ2VfY291bnQ7IGkrKykgewo+ ICsJCWVuY29kZXIgPSAmZHAtPmJyaWRnZV9saXN0W2ldLT5lbmNvZGVyLmVuY29kZXI7Cj4gKwkJ ZW5jb2Rlci0+ZnVuY3MtPmRlc3Ryb3koZW5jb2Rlcik7Cj4gKwkJZHJtX2JyaWRnZV9wdXQoZHAt Pm5leHRfYnJpZGdlX2xpc3RbaV0pOwo+ICsJfQoKLS0gClNhc2hpa28gQUkgcmV2aWV3IMK3IGh0 dHBzOi8vc2FzaGlrby5kZXYvIy9wYXRjaHNldC8yMDI2MDczMDAxMzM0OS41MS0xLWtlcm5lbEBh aXJreWkuY29tP3BhcnQ9NgoKLS0gCmxpbnV4LXBoeSBtYWlsaW5nIGxpc3QKbGludXgtcGh5QGxp c3RzLmluZnJhZGVhZC5vcmcKaHR0cHM6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlz dGluZm8vbGludXgtcGh5Cg==