From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8C04DC5AD4E for ; Sun, 9 Aug 2026 13:32:38 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id E837110E577; Sun, 9 Aug 2026 13:32:37 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.b="j4Sa+1D5"; dkim-atps=neutral Received: from tor.source.kernel.org (tor.source.kernel.org [172.105.4.254]) by gabe.freedesktop.org (Postfix) with ESMTPS id E519510E577 for ; Sun, 9 Aug 2026 13:32:36 +0000 (UTC) Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 409F560008; Sun, 9 Aug 2026 13:32:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F325B1F000E9; Sun, 9 Aug 2026 13:32:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786282356; bh=lEXjqIf8lufJp/FLdgsOxISP2ZL1yVis2DgezW671Eg=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=j4Sa+1D53xHlPJRHF0373NAIgSRcBvxs5xfHdWX5xScKwNUpESULi6rka9gDA2m2r IXoNZei/AL2wSsXVbKJSloeYfEx5PXvTjtyn7VZsg6YhADWIyufgeNoZK6X1E9KxQ5 BKiGDS5VuJ5RuJpQ6mkAqBDS7BRmkNNwBx957Z39dsDu0s24oG7DVB7gBLJMGAoLxL IyNBhjiU/ikyGueViLejDKoaNKIVNoH3lJu7w+wYln74BIXHsMBzg2FJAw2WoocOr8 XLYhv4dExjqiDjKWH3i8/spS7AReSWd48fWnc3GTHieAy7r5VmEFMMkSlofC8UBzI3 T7bgC9wj1QhnQ== From: sashiko-bot@kernel.org Subject: Re: [PATCH v2 08/17] drm/spacemit: add Saturn DPU core types, cmdlist and display MMU To: "Cody Kang" Cc: dri-devel@lists.freedesktop.org, devicetree@vger.kernel.org, conor+dt@kernel.org, linux-phy@lists.infradead.org, vkoul@kernel.org, robh@kernel.org, neil.armstrong@linaro.org, olteanv@gmail.com In-Reply-To: <20260809-k3-display-v2-8-327d7910bf71@gmail.com> References: <20260809-k3-display-v2-0-327d7910bf71@gmail.com> <20260809-k3-display-v2-8-327d7910bf71@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Sun, 09 Aug 2026 13:32:34 +0000 Message-Id: <20260809133234.F325B1F000E9@smtp.kernel.org> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Thank you for your contribution! Sashiko AI review found 10 potential issue= (s) to consider: - [Critical] Modifying the command list of unmodified planes during CRTC co= mmits leads to unbounded growth of `cl->nod_len` and DMA buffer overflow. - [High] Command list DMA buffers are embedded in transient atomic states, = leading to lifecycle conflicts and shared buffer corruption. - [High] Unconditional dereference of `priv->cmdlist_groups[i]` leads to a = NULL pointer dereference in `cmdlist_atomic_commit`. - [High] Directly accessing `plane->state` and `crtc->state` during atomic = commits creates TOCTOU races with subsequent non-blocking commits. - [High] Hardware DMMU reads out of bounds if the page table entries exceed= the pre-allocated buffer size limit. - [High] NULL pointer dereference on `fb` in the `dpu_plane_info` tracepoin= t. - [High] Potential NULL pointer dereference of `a_crtc->crtc.dev` in `cmdli= st_regs_packing` if a plane is being disabled. - [High] Calling `spacemit_dmmu_map` sleeps in an atomic context and introd= uces data races on the command list. - [Medium] Unprotected read-modify-write on MMIO registers in the `__dpu_mm= io_field_write` macro. - [Medium] Unvalidated `rdma_id` is used directly as an array index, leadin= g to out-of-bounds writes. -- --- Patch [8]: [PATCH v2 08/17] drm/spacemit: add Saturn DPU core types, cm= dlist and display MMU --- commit 4c661acb763f61ae82caefcc3ef85c607c0b6ffe Author: Cody Kang drm/spacemit: add Saturn DPU core types, cmdlist and display MMU Register programming of the Saturn DPU is batched: the driver builds per-module register lists in memory and the hardware command-list engine replays them at frame boundaries, while scanout buffers are mapped through the DPU's private address translation unit (DMMU) rather than scanned out by physical address. > diff --git a/drivers/gpu/drm/spacemit/dpu/dpu_trace.h b/drivers/gpu/drm/s= pacemit/dpu/dpu_trace.h > index 0000000000000..abfe34a67a4bd 100644 > --- /dev/null > +++ b/drivers/gpu/drm/spacemit/dpu/dpu_trace.h [ ... ] > + TP_fast_assign( > + __entry->rdma_id =3D rdma_id; > + __entry->src_w =3D state->src_w >> 16; > + __entry->src_h =3D state->src_h >> 16; > + __entry->src_x =3D state->src_x >> 16; > + __entry->src_y =3D state->src_y >> 16; > + __entry->crtc_w =3D state->crtc_w; > + __entry->crtc_h =3D state->crtc_h; > + __entry->crtc_x =3D state->crtc_x; > + __entry->crtc_y =3D state->crtc_y; > + __entry->width =3D fb->width; > + __entry->height =3D fb->height; > + __entry->format =3D fb->format->format; [Severity: High] Is it possible for fb to be NULL here?=20 During a plane disable operation in the DRM atomic framework, the plane state will have a NULL framebuffer. Would this tracepoint cause a NULL pointer dereference when capturing these fields? > diff --git a/drivers/gpu/drm/spacemit/spacemit_cmdlist.c b/drivers/gpu/dr= m/spacemit/spacemit_cmdlist.c > index 0000000000000..f4f14eaa12a0f 100644 > --- /dev/null > +++ b/drivers/gpu/drm/spacemit/spacemit_cmdlist.c [ ... ] > +void cmdlist_regs_packing(struct cmdlist *cl, enum cmdlist_mode_type mod, > + struct cmdlist_regs *cl_regs) > +{ [ ... ] > + if (cl->type =3D=3D CMDLIST_PLANE) { > + struct spacemit_plane_state *spacemit_pstate =3D > + cl_to_spacemit_pstate(cl); > + > + a_crtc =3D to_spacemit_crtc(spacemit_pstate->state.crtc); > + > + drm_dbg(a_crtc->crtc.dev, "rch_id =3D %d, ch_y =3D %u\n", [Severity: High] When a plane is disabled, its state.crtc is set to NULL. Could a_crtc end up being NULL here, leading to a dereference when accessing a_crtc->crtc.dev for logging? > + spacemit_pstate->rdma_id, > + spacemit_pstate->state.crtc_y); > + } else if (cl->type =3D=3D CMDLIST_CRTC) { [ ... ] > +void cmdlist_sort_by_group(struct drm_crtc *crtc) > +{ > + struct cmdlist *first_cl; > + struct cmdlist *last_cl; > + struct cmdlist *p; > + struct cmdlist *prev; > + struct drm_plane *plane; > + struct spacemit_crtc_rdma *rdmas =3D > + to_spacemit_crtc_state(crtc->state)->rdmas; > + struct spacemit_drm_private *priv =3D crtc->dev->dev_private; > + > + drm_atomic_crtc_for_each_plane(plane, crtc) { > + struct spacemit_plane_state *spacemit_pstate =3D > + to_spacemit_plane_state(plane->state); [Severity: High] Does directly accessing the current plane->state create a TOCTOU race with subsequent non-blocking commits?=20 In asynchronous commit tails, the DRM core swaps these pointers. Using plane->state directly instead of the passed drm_atomic_state might result in reading uncommitted state. > + u32 rdma_id =3D spacemit_pstate->rdma_id; > + > + first_cl =3D &spacemit_pstate->cl; > + if (!first_cl->va) > + continue; > + > + last_cl =3D first_cl; > + last_cl->next =3D NULL; [Severity: Critical] What happens to the command list of unmodified planes during CRTC commits?= =20 It looks like we mutate last_cl->next for all active planes, even those not modified by the current commit. Later in cmdlist_atomic_commit(), cmdlist_fill_conf_row() appends configuration rows to it. Since the plane state isn't duplicated, does cl->nod_len grow unboundedly on every update until it overflows the fixed DMA buffer? > + > + rdmas[rdma_id].in_use =3D true; > + if (priv->cmdlist_groups[rdma_id]) { [Severity: Medium] Is there a guarantee that rdma_id is within bounds?=20 We are using it as an index into rdmas[] and priv->cmdlist_groups[] without validating it against the hardware limit (hwdev->rdma_nums) or checking for RDMA_INVALID_ID. [ ... ] > +void cmdlist_atomic_commit(struct drm_crtc *crtc, > + struct drm_crtc_state *old_state) > +{ > + int i; > + struct cmdlist *cur_cl, *first_cl; > + struct spacemit_crtc *a_crtc =3D NULL; > + u32 chy, addrl, addrh; > + struct spacemit_drm_private *priv =3D crtc->dev->dev_private; > + struct spacemit_hw_device *hwdev =3D priv->hwdev; > + struct spacemit_crtc_rdma *cur_rdmas =3D > + to_spacemit_crtc_state(crtc->state)->rdmas; [Severity: High] Similar to the plane state access earlier, does accessing crtc->state directly create a race condition with asynchronous commits? > + struct spacemit_crtc_rdma *old_rdmas =3D > + to_spacemit_crtc_state(old_state)->rdmas; > + > + a_crtc =3D to_spacemit_crtc(crtc); > + > + for (i =3D 0; i < hwdev->rdma_nums; i++) { > + if (old_rdmas[i].in_use) > + hwdev->enable_cmdlist(a_crtc, hwdev, i, false); > + > + if (cur_rdmas[i].in_use) { > + drm_dbg(crtc->dev, "cmdlist group =3D %d\n", i); > + cur_cl =3D priv->cmdlist_groups[i]; > + first_cl =3D cur_cl; > + while (cur_cl) { > + hwdev->cmdlist_fill_conf_row(cur_cl, hwdev, > + CMDLIST_CMP_INVALID); > + cmdlist_dump_node(cur_cl); > + cur_cl =3D cur_cl->next; > + } > + chy =3D cl_to_spacemit_pstate(first_cl)->state.crtc_y; [Severity: High] If cmdlist_sort_by_group() skips populating priv->cmdlist_groups[i] because first_cl->va was NULL, but cur_rdmas[i].in_use remains true (inherited from the old state before disabling), could cur_cl become NULL? If so, this would lead to a NULL pointer dereference when accessing first_cl or priv->cmdlist_groups[i]->pa just below. > + addrl =3D (lower_32_bits(priv->cmdlist_groups[i]->pa) & > + CMDLIST_ADDRL_ALIGN_MASK) >> CMDLIST_ADDRL_ALIGN_BITS; [ ... ] > +int spacemit_cmdlist_alloc(struct device *dev, struct cmdlist *cl) > +{ > + if (cl->va) > + return 0; > + > + cl->size =3D PER_CMDLIST_SIZE; > + cl->va =3D dma_alloc_coherent(dev, cl->size, &cl->pa, > + GFP_KERNEL | __GFP_ZERO); [Severity: High] Should the command list DMA buffer be embedded directly in the transient plane state?=20 By skipping allocation when cl->va is non-NULL, duplicating plane states results in a shallow copy where all states share the same physical DMA buffer. Mutating this buffer during a new atomic commit might overwrite the command list actively being scanned out by the hardware. > diff --git a/drivers/gpu/drm/spacemit/spacemit_dmmu.c b/drivers/gpu/drm/s= pacemit/spacemit_dmmu.c > index 0000000000000..ff4b3378a087c 100644 > --- /dev/null > +++ b/drivers/gpu/drm/spacemit/spacemit_dmmu.c [ ... ] > +static inline void spacemit_dmmu_fill_pgtable(struct dpu_mmu_tbl *tbl, > + struct sg_table *sgt) > +{ > + struct sg_dma_page_iter dma_iter; > + u32 max_entries =3D tbl->size / 4; > + u32 *ttbr =3D tbl->va; > + u32 i =3D 0, n =3D 0, temp =3D 0; > + > + for_each_sgtable_dma_page(sgt, &dma_iter, 0) { > + /* > + * atomic_check sized the table off this same fb; catch a drift > + */ > + if (WARN_ON_ONCE(n + HW_ALIGN_TTB_NUM >=3D max_entries)) > + break; [Severity: High] If we hit this WARN_ON_ONCE and break early, we don't communicate the truncated size back to the caller.=20 > + ttbr[n++] =3D (sg_page_iter_dma_address(&dma_iter) >> PAGE_SHIFT) & 0x= 3FFFFFF; > + } [ ... ] > +int spacemit_dmmu_map(struct drm_framebuffer *fb, struct dpu_mmu_tbl *mm= u_tbl, > + u8 tbu_id, struct cmdlist_regs *cl_rdma, > + struct drm_plane *plane) > +{ > + struct spacemit_drm_private *priv =3D fb->dev->dev_private; > + struct spacemit_hw_device *hwdev =3D priv->hwdev; > + struct sg_table *sgt =3D NULL; > + struct tbu_instance tbu =3D { }; > + u32 val; > + > + sgt =3D drm_gem_shmem_get_pages_sgt(to_drm_gem_shmem_obj(fb->obj[0])); [Severity: High] Is it safe to call this here?=20 drm_gem_shmem_get_pages_sgt() performs a sleepable allocation (GFP_KERNEL) and acquires a mutex. If called during atomic_update (the standard hardware programming phase), it sleeps in an atomic context. If called during prepare_fb to avoid the atomic context, does mutating the cl_rdma buffer below introduce data races with the hardware processing the previous frame? > + if (IS_ERR(sgt)) > + return PTR_ERR(sgt); > + > + /* Every advertised format is single-planar */ > + tbu.ttb_pa[0] =3D mmu_tbl->pa; > + tbu.tbu_va[0] =3D TBU_BASE_VA(tbu_id); > + tbu.ttb_size[0] =3D roundup(fb->obj[0]->size, PAGE_SIZE) >> PAGE_SHIFT; [Severity: High] Since tbu.ttb_size[0] is programmed to the full FB size regardless of whether spacemit_dmmu_fill_pgtable() truncated the table, could this cause the hardware DMMU to read out of bounds past the physical allocation of mmu_tbl? > + > + spacemit_dmmu_fill_pgtable(mmu_tbl, sgt); > + > + /* > + * enable =3D 1, fbc_mode =3D 0 (linear only) > + * single plane in bits [3:2] > + */ > + val =3D 0x1; > + /* tbu_burst_limit_en =3D 1, tlb_fetch_active_en =3D 1 */ > + val |=3D BIT(4) | BIT(5); > + val =3D val | (DPU_QOS_URGENT << 8); > + hwdev->rdma_dmmu(hwdev, tbu_id, &tbu, fb, val, cl_rdma, plane); > diff --git a/drivers/gpu/drm/spacemit/spacemit_dpu_reg.h b/drivers/gpu/dr= m/spacemit/spacemit_dpu_reg.h > index 0000000000000..a57ed34d38e2f 100644 > --- /dev/null > +++ b/drivers/gpu/drm/spacemit/spacemit_dpu_reg.h [ ... ] > +#define __dpu_mmio_field_write(__addr, __mask, data) \ > +do { \ > + if ((__mask) =3D=3D 0xffU) \ > + writeb((u8)((data) & 0xffU), __addr); \ > + else if ((__mask) =3D=3D 0xff00U) \ > + writeb((u8)((data) & 0xffU), (__addr) + 1); \ > + else if ((__mask) =3D=3D 0xff0000U) \ > + writeb((u8)((data) & 0xffU), (__addr) + 2); \ > + else if ((__mask) =3D=3D 0xff000000U) \ > + writeb((u8)((data) & 0xffU), (__addr) + 3); \ > + else if ((__mask) =3D=3D 0xffffU) \ > + writew((u16)((data) & 0xffffU), __addr); \ > + else if ((__mask) =3D=3D 0xffff0000U) \ > + writew((u16)((data) & 0xffffU), (__addr) + 2); \ > + else if ((__mask) =3D=3D 0xffffffffU) \ > + writel((u32)(data), __addr); \ > + else \ > + writel((readl(__addr) & ~(__mask)) | \ > + FIELD_PREP(__mask, (u32)(data)), __addr); \ [Severity: Medium] Could concurrent updates corrupt the hardware state here?=20 This is an unprotected read-modify-write sequence. If a register contains multiple fields updated from different contexts (e.g., process context during atomic commits and interrupt context during ISR handling), it might lose updates without a spinlock. > +} while (0) --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260809-k3-display= -v2-0-327d7910bf71@gmail.com?part=3D8 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9D445C5AC80 for ; Sun, 9 Aug 2026 13:32:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=uyOicvWcG+D0OgOlaFkpas9qdL4POJjKtnUAzMlgCVU=; b=RCO3funy6lWGMd Y+WxOu8vbKortBHTpFIJA6oDB1sNsUe9gMXlYPegAPRZhFQlcLThteJsSjaINYIDQEj0djDvCq37g VzgDq1pOLTivvw9w7Bkh/Pn9nj2XxEi1B7502QCvUqQ6k95/L5IRKyxEMXHyskTYbgDu92XsYoxgW vJoplLHRuOPiXVP9mkR/uwCpGokn1XT0oFqhntAkOU1VHD6u3c3NBW1QZISJgGnf+SZjy6PVcILyX ygCWUOhVq/Xpt9X76pXdgniNPolu7uJYUejO/XSefQCIBXnf472fYHXFiMMltyNLSKY4RLp7ySOLp 1Yyuf8ENCo3tskXEGUrw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wt3dl-0000000AMGr-1Qdb; Sun, 09 Aug 2026 13:32:37 +0000 Received: from tor.source.kernel.org ([172.105.4.254]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wt3dk-0000000AMGl-3a6k for linux-phy@lists.infradead.org; Sun, 09 Aug 2026 13:32:36 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 409F560008; Sun, 9 Aug 2026 13:32:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F325B1F000E9; Sun, 9 Aug 2026 13:32:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786282356; bh=lEXjqIf8lufJp/FLdgsOxISP2ZL1yVis2DgezW671Eg=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=j4Sa+1D53xHlPJRHF0373NAIgSRcBvxs5xfHdWX5xScKwNUpESULi6rka9gDA2m2r IXoNZei/AL2wSsXVbKJSloeYfEx5PXvTjtyn7VZsg6YhADWIyufgeNoZK6X1E9KxQ5 BKiGDS5VuJ5RuJpQ6mkAqBDS7BRmkNNwBx957Z39dsDu0s24oG7DVB7gBLJMGAoLxL IyNBhjiU/ikyGueViLejDKoaNKIVNoH3lJu7w+wYln74BIXHsMBzg2FJAw2WoocOr8 XLYhv4dExjqiDjKWH3i8/spS7AReSWd48fWnc3GTHieAy7r5VmEFMMkSlofC8UBzI3 T7bgC9wj1QhnQ== From: sashiko-bot@kernel.org Subject: Re: [PATCH v2 08/17] drm/spacemit: add Saturn DPU core types, cmdlist and display MMU To: "Cody Kang" Cc: dri-devel@lists.freedesktop.org, devicetree@vger.kernel.org, conor+dt@kernel.org, linux-phy@lists.infradead.org, vkoul@kernel.org, robh@kernel.org, neil.armstrong@linaro.org, olteanv@gmail.com In-Reply-To: <20260809-k3-display-v2-8-327d7910bf71@gmail.com> References: <20260809-k3-display-v2-0-327d7910bf71@gmail.com> <20260809-k3-display-v2-8-327d7910bf71@gmail.com> Date: Sun, 09 Aug 2026 13:32:34 +0000 Message-Id: <20260809133234.F325B1F000E9@smtp.kernel.org> X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MTAgcG90ZW50aWFsIGlzc3VlKHMpIHRvIGNvbnNpZGVyOgotIFtDcml0aWNhbF0gTW9kaWZ5aW5n IHRoZSBjb21tYW5kIGxpc3Qgb2YgdW5tb2RpZmllZCBwbGFuZXMgZHVyaW5nIENSVEMgY29tbWl0 cyBsZWFkcyB0byB1bmJvdW5kZWQgZ3Jvd3RoIG9mIGBjbC0+bm9kX2xlbmAgYW5kIERNQSBidWZm ZXIgb3ZlcmZsb3cuCi0gW0hpZ2hdIENvbW1hbmQgbGlzdCBETUEgYnVmZmVycyBhcmUgZW1iZWRk ZWQgaW4gdHJhbnNpZW50IGF0b21pYyBzdGF0ZXMsIGxlYWRpbmcgdG8gbGlmZWN5Y2xlIGNvbmZs aWN0cyBhbmQgc2hhcmVkIGJ1ZmZlciBjb3JydXB0aW9uLgotIFtIaWdoXSBVbmNvbmRpdGlvbmFs IGRlcmVmZXJlbmNlIG9mIGBwcml2LT5jbWRsaXN0X2dyb3Vwc1tpXWAgbGVhZHMgdG8gYSBOVUxM IHBvaW50ZXIgZGVyZWZlcmVuY2UgaW4gYGNtZGxpc3RfYXRvbWljX2NvbW1pdGAuCi0gW0hpZ2hd IERpcmVjdGx5IGFjY2Vzc2luZyBgcGxhbmUtPnN0YXRlYCBhbmQgYGNydGMtPnN0YXRlYCBkdXJp bmcgYXRvbWljIGNvbW1pdHMgY3JlYXRlcyBUT0NUT1UgcmFjZXMgd2l0aCBzdWJzZXF1ZW50IG5v bi1ibG9ja2luZyBjb21taXRzLgotIFtIaWdoXSBIYXJkd2FyZSBETU1VIHJlYWRzIG91dCBvZiBi b3VuZHMgaWYgdGhlIHBhZ2UgdGFibGUgZW50cmllcyBleGNlZWQgdGhlIHByZS1hbGxvY2F0ZWQg YnVmZmVyIHNpemUgbGltaXQuCi0gW0hpZ2hdIE5VTEwgcG9pbnRlciBkZXJlZmVyZW5jZSBvbiBg ZmJgIGluIHRoZSBgZHB1X3BsYW5lX2luZm9gIHRyYWNlcG9pbnQuCi0gW0hpZ2hdIFBvdGVudGlh bCBOVUxMIHBvaW50ZXIgZGVyZWZlcmVuY2Ugb2YgYGFfY3J0Yy0+Y3J0Yy5kZXZgIGluIGBjbWRs aXN0X3JlZ3NfcGFja2luZ2AgaWYgYSBwbGFuZSBpcyBiZWluZyBkaXNhYmxlZC4KLSBbSGlnaF0g Q2FsbGluZyBgc3BhY2VtaXRfZG1tdV9tYXBgIHNsZWVwcyBpbiBhbiBhdG9taWMgY29udGV4dCBh bmQgaW50cm9kdWNlcyBkYXRhIHJhY2VzIG9uIHRoZSBjb21tYW5kIGxpc3QuCi0gW01lZGl1bV0g VW5wcm90ZWN0ZWQgcmVhZC1tb2RpZnktd3JpdGUgb24gTU1JTyByZWdpc3RlcnMgaW4gdGhlIGBf X2RwdV9tbWlvX2ZpZWxkX3dyaXRlYCBtYWNyby4KLSBbTWVkaXVtXSBVbnZhbGlkYXRlZCBgcmRt YV9pZGAgaXMgdXNlZCBkaXJlY3RseSBhcyBhbiBhcnJheSBpbmRleCwgbGVhZGluZyB0byBvdXQt b2YtYm91bmRzIHdyaXRlcy4KLS0KCi0tLSBQYXRjaCBbOF06IFtQQVRDSCB2MiAwOC8xN10gZHJt L3NwYWNlbWl0OiBhZGQgU2F0dXJuIERQVSBjb3JlIHR5cGVzLCBjbWRsaXN0IGFuZCBkaXNwbGF5 IE1NVSAtLS0KY29tbWl0IDRjNjYxYWNiNzYzZjYxYWU4MmNhZWZjYzNlZjg1YzYwN2MwYjZmZmUK QXV0aG9yOiBDb2R5IEthbmcgPGNvZHlrYW5nLmhrQGdtYWlsLmNvbT4KCmRybS9zcGFjZW1pdDog YWRkIFNhdHVybiBEUFUgY29yZSB0eXBlcywgY21kbGlzdCBhbmQgZGlzcGxheSBNTVUKClJlZ2lz dGVyIHByb2dyYW1taW5nIG9mIHRoZSBTYXR1cm4gRFBVIGlzIGJhdGNoZWQ6IHRoZSBkcml2ZXIg YnVpbGRzCnBlci1tb2R1bGUgcmVnaXN0ZXIgbGlzdHMgaW4gbWVtb3J5IGFuZCB0aGUgaGFyZHdh cmUgY29tbWFuZC1saXN0CmVuZ2luZSByZXBsYXlzIHRoZW0gYXQgZnJhbWUgYm91bmRhcmllcywg d2hpbGUgc2Nhbm91dCBidWZmZXJzIGFyZQptYXBwZWQgdGhyb3VnaCB0aGUgRFBVJ3MgcHJpdmF0 ZSBhZGRyZXNzIHRyYW5zbGF0aW9uIHVuaXQgKERNTVUpCnJhdGhlciB0aGFuIHNjYW5uZWQgb3V0 IGJ5IHBoeXNpY2FsIGFkZHJlc3MuCgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vc3Bh Y2VtaXQvZHB1L2RwdV90cmFjZS5oIGIvZHJpdmVycy9ncHUvZHJtL3NwYWNlbWl0L2RwdS9kcHVf dHJhY2UuaAo+IGluZGV4IDAwMDAwMDAwMDAwMDAuLmFiZmUzNGE2N2E0YmQgMTAwNjQ0Cj4gLS0t IC9kZXYvbnVsbAo+ICsrKyBiL2RyaXZlcnMvZ3B1L2RybS9zcGFjZW1pdC9kcHUvZHB1X3RyYWNl LmgKWyAuLi4gXQo+ICsJVFBfZmFzdF9hc3NpZ24oCj4gKwkJCV9fZW50cnktPnJkbWFfaWQgPSBy ZG1hX2lkOwo+ICsJCQlfX2VudHJ5LT5zcmNfdyA9IHN0YXRlLT5zcmNfdyA+PiAxNjsKPiArCQkJ X19lbnRyeS0+c3JjX2ggPSBzdGF0ZS0+c3JjX2ggPj4gMTY7Cj4gKwkJCV9fZW50cnktPnNyY194 ID0gc3RhdGUtPnNyY194ID4+IDE2Owo+ICsJCQlfX2VudHJ5LT5zcmNfeSA9IHN0YXRlLT5zcmNf eSA+PiAxNjsKPiArCQkJX19lbnRyeS0+Y3J0Y193ID0gc3RhdGUtPmNydGNfdzsKPiArCQkJX19l bnRyeS0+Y3J0Y19oID0gc3RhdGUtPmNydGNfaDsKPiArCQkJX19lbnRyeS0+Y3J0Y194ID0gc3Rh dGUtPmNydGNfeDsKPiArCQkJX19lbnRyeS0+Y3J0Y195ID0gc3RhdGUtPmNydGNfeTsKPiArCQkJ X19lbnRyeS0+d2lkdGggPSBmYi0+d2lkdGg7Cj4gKwkJCV9fZW50cnktPmhlaWdodCA9IGZiLT5o ZWlnaHQ7Cj4gKwkJCV9fZW50cnktPmZvcm1hdCA9IGZiLT5mb3JtYXQtPmZvcm1hdDsKCltTZXZl cml0eTogSGlnaF0KSXMgaXQgcG9zc2libGUgZm9yIGZiIHRvIGJlIE5VTEwgaGVyZT8gCgpEdXJp bmcgYSBwbGFuZSBkaXNhYmxlIG9wZXJhdGlvbiBpbiB0aGUgRFJNIGF0b21pYyBmcmFtZXdvcmss IHRoZSBwbGFuZQpzdGF0ZSB3aWxsIGhhdmUgYSBOVUxMIGZyYW1lYnVmZmVyLiBXb3VsZCB0aGlz IHRyYWNlcG9pbnQgY2F1c2UgYSBOVUxMCnBvaW50ZXIgZGVyZWZlcmVuY2Ugd2hlbiBjYXB0dXJp bmcgdGhlc2UgZmllbGRzPwoKPiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL3NwYWNlbWl0 L3NwYWNlbWl0X2NtZGxpc3QuYyBiL2RyaXZlcnMvZ3B1L2RybS9zcGFjZW1pdC9zcGFjZW1pdF9j bWRsaXN0LmMKPiBpbmRleCAwMDAwMDAwMDAwMDAwLi5mNGYxNGVhYTEyYTBmIDEwMDY0NAo+IC0t LSAvZGV2L251bGwKPiArKysgYi9kcml2ZXJzL2dwdS9kcm0vc3BhY2VtaXQvc3BhY2VtaXRfY21k bGlzdC5jClsgLi4uIF0KPiArdm9pZCBjbWRsaXN0X3JlZ3NfcGFja2luZyhzdHJ1Y3QgY21kbGlz dCAqY2wsIGVudW0gY21kbGlzdF9tb2RlX3R5cGUgbW9kLAo+ICsJCQkgIHN0cnVjdCBjbWRsaXN0 X3JlZ3MgKmNsX3JlZ3MpCj4gK3sKWyAuLi4gXQo+ICsJaWYgKGNsLT50eXBlID09IENNRExJU1Rf UExBTkUpIHsKPiArCQlzdHJ1Y3Qgc3BhY2VtaXRfcGxhbmVfc3RhdGUgKnNwYWNlbWl0X3BzdGF0 ZSA9Cj4gKwkJCQljbF90b19zcGFjZW1pdF9wc3RhdGUoY2wpOwo+ICsKPiArCQlhX2NydGMgPSB0 b19zcGFjZW1pdF9jcnRjKHNwYWNlbWl0X3BzdGF0ZS0+c3RhdGUuY3J0Yyk7Cj4gKwo+ICsJCWRy bV9kYmcoYV9jcnRjLT5jcnRjLmRldiwgInJjaF9pZCA9ICVkLCBjaF95ID0gJXVcbiIsCgpbU2V2 ZXJpdHk6IEhpZ2hdCldoZW4gYSBwbGFuZSBpcyBkaXNhYmxlZCwgaXRzIHN0YXRlLmNydGMgaXMg c2V0IHRvIE5VTEwuIENvdWxkIGFfY3J0YyBlbmQKdXAgYmVpbmcgTlVMTCBoZXJlLCBsZWFkaW5n IHRvIGEgZGVyZWZlcmVuY2Ugd2hlbiBhY2Nlc3NpbmcKYV9jcnRjLT5jcnRjLmRldiBmb3IgbG9n Z2luZz8KCj4gKwkJCXNwYWNlbWl0X3BzdGF0ZS0+cmRtYV9pZCwKPiArCQkJc3BhY2VtaXRfcHN0 YXRlLT5zdGF0ZS5jcnRjX3kpOwo+ICsJfSBlbHNlIGlmIChjbC0+dHlwZSA9PSBDTURMSVNUX0NS VEMpIHsKWyAuLi4gXQo+ICt2b2lkIGNtZGxpc3Rfc29ydF9ieV9ncm91cChzdHJ1Y3QgZHJtX2Ny dGMgKmNydGMpCj4gK3sKPiArCXN0cnVjdCBjbWRsaXN0ICpmaXJzdF9jbDsKPiArCXN0cnVjdCBj bWRsaXN0ICpsYXN0X2NsOwo+ICsJc3RydWN0IGNtZGxpc3QgKnA7Cj4gKwlzdHJ1Y3QgY21kbGlz dCAqcHJldjsKPiArCXN0cnVjdCBkcm1fcGxhbmUgKnBsYW5lOwo+ICsJc3RydWN0IHNwYWNlbWl0 X2NydGNfcmRtYSAqcmRtYXMgPQo+ICsJCQl0b19zcGFjZW1pdF9jcnRjX3N0YXRlKGNydGMtPnN0 YXRlKS0+cmRtYXM7Cj4gKwlzdHJ1Y3Qgc3BhY2VtaXRfZHJtX3ByaXZhdGUgKnByaXYgPSBjcnRj LT5kZXYtPmRldl9wcml2YXRlOwo+ICsKPiArCWRybV9hdG9taWNfY3J0Y19mb3JfZWFjaF9wbGFu ZShwbGFuZSwgY3J0Yykgewo+ICsJCXN0cnVjdCBzcGFjZW1pdF9wbGFuZV9zdGF0ZSAqc3BhY2Vt aXRfcHN0YXRlID0KPiArCQkJdG9fc3BhY2VtaXRfcGxhbmVfc3RhdGUocGxhbmUtPnN0YXRlKTsK CltTZXZlcml0eTogSGlnaF0KRG9lcyBkaXJlY3RseSBhY2Nlc3NpbmcgdGhlIGN1cnJlbnQgcGxh bmUtPnN0YXRlIGNyZWF0ZSBhIFRPQ1RPVSByYWNlCndpdGggc3Vic2VxdWVudCBub24tYmxvY2tp bmcgY29tbWl0cz8gCgpJbiBhc3luY2hyb25vdXMgY29tbWl0IHRhaWxzLCB0aGUgRFJNIGNvcmUg c3dhcHMgdGhlc2UgcG9pbnRlcnMuIFVzaW5nCnBsYW5lLT5zdGF0ZSBkaXJlY3RseSBpbnN0ZWFk IG9mIHRoZSBwYXNzZWQgZHJtX2F0b21pY19zdGF0ZSBtaWdodCByZXN1bHQKaW4gcmVhZGluZyB1 bmNvbW1pdHRlZCBzdGF0ZS4KCj4gKwkJdTMyIHJkbWFfaWQgPSBzcGFjZW1pdF9wc3RhdGUtPnJk bWFfaWQ7Cj4gKwo+ICsJCWZpcnN0X2NsID0gJnNwYWNlbWl0X3BzdGF0ZS0+Y2w7Cj4gKwkJaWYg KCFmaXJzdF9jbC0+dmEpCj4gKwkJCWNvbnRpbnVlOwo+ICsKPiArCQlsYXN0X2NsID0gZmlyc3Rf Y2w7Cj4gKwkJbGFzdF9jbC0+bmV4dCA9IE5VTEw7CgpbU2V2ZXJpdHk6IENyaXRpY2FsXQpXaGF0 IGhhcHBlbnMgdG8gdGhlIGNvbW1hbmQgbGlzdCBvZiB1bm1vZGlmaWVkIHBsYW5lcyBkdXJpbmcg Q1JUQyBjb21taXRzPyAKCkl0IGxvb2tzIGxpa2Ugd2UgbXV0YXRlIGxhc3RfY2wtPm5leHQgZm9y IGFsbCBhY3RpdmUgcGxhbmVzLCBldmVuIHRob3NlCm5vdCBtb2RpZmllZCBieSB0aGUgY3VycmVu dCBjb21taXQuIExhdGVyIGluIGNtZGxpc3RfYXRvbWljX2NvbW1pdCgpLApjbWRsaXN0X2ZpbGxf Y29uZl9yb3coKSBhcHBlbmRzIGNvbmZpZ3VyYXRpb24gcm93cyB0byBpdC4gU2luY2UgdGhlIHBs YW5lCnN0YXRlIGlzbid0IGR1cGxpY2F0ZWQsIGRvZXMgY2wtPm5vZF9sZW4gZ3JvdyB1bmJvdW5k ZWRseSBvbiBldmVyeSB1cGRhdGUKdW50aWwgaXQgb3ZlcmZsb3dzIHRoZSBmaXhlZCBETUEgYnVm ZmVyPwoKPiArCj4gKwkJcmRtYXNbcmRtYV9pZF0uaW5fdXNlID0gdHJ1ZTsKPiArCQlpZiAocHJp di0+Y21kbGlzdF9ncm91cHNbcmRtYV9pZF0pIHsKCltTZXZlcml0eTogTWVkaXVtXQpJcyB0aGVy ZSBhIGd1YXJhbnRlZSB0aGF0IHJkbWFfaWQgaXMgd2l0aGluIGJvdW5kcz8gCgpXZSBhcmUgdXNp bmcgaXQgYXMgYW4gaW5kZXggaW50byByZG1hc1tdIGFuZCBwcml2LT5jbWRsaXN0X2dyb3Vwc1td CndpdGhvdXQgdmFsaWRhdGluZyBpdCBhZ2FpbnN0IHRoZSBoYXJkd2FyZSBsaW1pdCAoaHdkZXYt PnJkbWFfbnVtcykgb3IKY2hlY2tpbmcgZm9yIFJETUFfSU5WQUxJRF9JRC4KClsgLi4uIF0KPiAr dm9pZCBjbWRsaXN0X2F0b21pY19jb21taXQoc3RydWN0IGRybV9jcnRjICpjcnRjLAo+ICsJCQkg ICBzdHJ1Y3QgZHJtX2NydGNfc3RhdGUgKm9sZF9zdGF0ZSkKPiArewo+ICsJaW50IGk7Cj4gKwlz dHJ1Y3QgY21kbGlzdCAqY3VyX2NsLCAqZmlyc3RfY2w7Cj4gKwlzdHJ1Y3Qgc3BhY2VtaXRfY3J0 YyAqYV9jcnRjID0gTlVMTDsKPiArCXUzMiBjaHksIGFkZHJsLCBhZGRyaDsKPiArCXN0cnVjdCBz cGFjZW1pdF9kcm1fcHJpdmF0ZSAqcHJpdiA9IGNydGMtPmRldi0+ZGV2X3ByaXZhdGU7Cj4gKwlz dHJ1Y3Qgc3BhY2VtaXRfaHdfZGV2aWNlICpod2RldiA9IHByaXYtPmh3ZGV2Owo+ICsJc3RydWN0 IHNwYWNlbWl0X2NydGNfcmRtYSAqY3VyX3JkbWFzID0KPiArCQkJdG9fc3BhY2VtaXRfY3J0Y19z dGF0ZShjcnRjLT5zdGF0ZSktPnJkbWFzOwoKW1NldmVyaXR5OiBIaWdoXQpTaW1pbGFyIHRvIHRo ZSBwbGFuZSBzdGF0ZSBhY2Nlc3MgZWFybGllciwgZG9lcyBhY2Nlc3NpbmcgY3J0Yy0+c3RhdGUK ZGlyZWN0bHkgY3JlYXRlIGEgcmFjZSBjb25kaXRpb24gd2l0aCBhc3luY2hyb25vdXMgY29tbWl0 cz8KCj4gKwlzdHJ1Y3Qgc3BhY2VtaXRfY3J0Y19yZG1hICpvbGRfcmRtYXMgPQo+ICsJCQl0b19z cGFjZW1pdF9jcnRjX3N0YXRlKG9sZF9zdGF0ZSktPnJkbWFzOwo+ICsKPiArCWFfY3J0YyA9IHRv X3NwYWNlbWl0X2NydGMoY3J0Yyk7Cj4gKwo+ICsJZm9yIChpID0gMDsgaSA8IGh3ZGV2LT5yZG1h X251bXM7IGkrKykgewo+ICsJCWlmIChvbGRfcmRtYXNbaV0uaW5fdXNlKQo+ICsJCQlod2Rldi0+ ZW5hYmxlX2NtZGxpc3QoYV9jcnRjLCBod2RldiwgaSwgZmFsc2UpOwo+ICsKPiArCQlpZiAoY3Vy X3JkbWFzW2ldLmluX3VzZSkgewo+ICsJCQlkcm1fZGJnKGNydGMtPmRldiwgImNtZGxpc3QgZ3Jv dXAgPSAlZFxuIiwgaSk7Cj4gKwkJCWN1cl9jbCA9IHByaXYtPmNtZGxpc3RfZ3JvdXBzW2ldOwo+ ICsJCQlmaXJzdF9jbCA9IGN1cl9jbDsKPiArCQkJd2hpbGUgKGN1cl9jbCkgewo+ICsJCQkJaHdk ZXYtPmNtZGxpc3RfZmlsbF9jb25mX3JvdyhjdXJfY2wsIGh3ZGV2LAo+ICsJCQkJCUNNRExJU1Rf Q01QX0lOVkFMSUQpOwo+ICsJCQkJY21kbGlzdF9kdW1wX25vZGUoY3VyX2NsKTsKPiArCQkJCWN1 cl9jbCA9IGN1cl9jbC0+bmV4dDsKPiArCQkJfQo+ICsJCQljaHkgPSBjbF90b19zcGFjZW1pdF9w c3RhdGUoZmlyc3RfY2wpLT5zdGF0ZS5jcnRjX3k7CgpbU2V2ZXJpdHk6IEhpZ2hdCklmIGNtZGxp c3Rfc29ydF9ieV9ncm91cCgpIHNraXBzIHBvcHVsYXRpbmcgcHJpdi0+Y21kbGlzdF9ncm91cHNb aV0KYmVjYXVzZSBmaXJzdF9jbC0+dmEgd2FzIE5VTEwsIGJ1dCBjdXJfcmRtYXNbaV0uaW5fdXNl IHJlbWFpbnMgdHJ1ZQooaW5oZXJpdGVkIGZyb20gdGhlIG9sZCBzdGF0ZSBiZWZvcmUgZGlzYWJs aW5nKSwgY291bGQgY3VyX2NsIGJlY29tZSBOVUxMPwoKSWYgc28sIHRoaXMgd291bGQgbGVhZCB0 byBhIE5VTEwgcG9pbnRlciBkZXJlZmVyZW5jZSB3aGVuIGFjY2Vzc2luZwpmaXJzdF9jbCBvciBw cml2LT5jbWRsaXN0X2dyb3Vwc1tpXS0+cGEganVzdCBiZWxvdy4KCj4gKwkJCWFkZHJsID0gKGxv d2VyXzMyX2JpdHMocHJpdi0+Y21kbGlzdF9ncm91cHNbaV0tPnBhKSAmCj4gKwkJCQkgQ01ETElT VF9BRERSTF9BTElHTl9NQVNLKSA+PiBDTURMSVNUX0FERFJMX0FMSUdOX0JJVFM7ClsgLi4uIF0K PiAraW50IHNwYWNlbWl0X2NtZGxpc3RfYWxsb2Moc3RydWN0IGRldmljZSAqZGV2LCBzdHJ1Y3Qg Y21kbGlzdCAqY2wpCj4gK3sKPiArCWlmIChjbC0+dmEpCj4gKwkJcmV0dXJuIDA7Cj4gKwo+ICsJ Y2wtPnNpemUgPSBQRVJfQ01ETElTVF9TSVpFOwo+ICsJY2wtPnZhID0gZG1hX2FsbG9jX2NvaGVy ZW50KGRldiwgY2wtPnNpemUsICZjbC0+cGEsCj4gKwkJCQkgICAgR0ZQX0tFUk5FTCB8IF9fR0ZQ X1pFUk8pOwoKW1NldmVyaXR5OiBIaWdoXQpTaG91bGQgdGhlIGNvbW1hbmQgbGlzdCBETUEgYnVm ZmVyIGJlIGVtYmVkZGVkIGRpcmVjdGx5IGluIHRoZSB0cmFuc2llbnQKcGxhbmUgc3RhdGU/IAoK Qnkgc2tpcHBpbmcgYWxsb2NhdGlvbiB3aGVuIGNsLT52YSBpcyBub24tTlVMTCwgZHVwbGljYXRp bmcgcGxhbmUgc3RhdGVzCnJlc3VsdHMgaW4gYSBzaGFsbG93IGNvcHkgd2hlcmUgYWxsIHN0YXRl cyBzaGFyZSB0aGUgc2FtZSBwaHlzaWNhbCBETUEKYnVmZmVyLiBNdXRhdGluZyB0aGlzIGJ1ZmZl ciBkdXJpbmcgYSBuZXcgYXRvbWljIGNvbW1pdCBtaWdodCBvdmVyd3JpdGUKdGhlIGNvbW1hbmQg bGlzdCBhY3RpdmVseSBiZWluZyBzY2FubmVkIG91dCBieSB0aGUgaGFyZHdhcmUuCgo+IGRpZmYg LS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vc3BhY2VtaXQvc3BhY2VtaXRfZG1tdS5jIGIvZHJpdmVy cy9ncHUvZHJtL3NwYWNlbWl0L3NwYWNlbWl0X2RtbXUuYwo+IGluZGV4IDAwMDAwMDAwMDAwMDAu LmZmNGIzMzc4YTA4N2MgMTAwNjQ0Cj4gLS0tIC9kZXYvbnVsbAo+ICsrKyBiL2RyaXZlcnMvZ3B1 L2RybS9zcGFjZW1pdC9zcGFjZW1pdF9kbW11LmMKWyAuLi4gXQo+ICtzdGF0aWMgaW5saW5lIHZv aWQgc3BhY2VtaXRfZG1tdV9maWxsX3BndGFibGUoc3RydWN0IGRwdV9tbXVfdGJsICp0YmwsCj4g KwkJCQkJICAgICAgc3RydWN0IHNnX3RhYmxlICpzZ3QpCj4gK3sKPiArCXN0cnVjdCBzZ19kbWFf cGFnZV9pdGVyIGRtYV9pdGVyOwo+ICsJdTMyIG1heF9lbnRyaWVzID0gdGJsLT5zaXplIC8gNDsK PiArCXUzMiAqdHRiciA9IHRibC0+dmE7Cj4gKwl1MzIgaSA9IDAsIG4gPSAwLCB0ZW1wID0gMDsK PiArCj4gKwlmb3JfZWFjaF9zZ3RhYmxlX2RtYV9wYWdlKHNndCwgJmRtYV9pdGVyLCAwKSB7Cj4g KwkJLyoKPiArCQkgKiBhdG9taWNfY2hlY2sgc2l6ZWQgdGhlIHRhYmxlIG9mZiB0aGlzIHNhbWUg ZmI7IGNhdGNoIGEgZHJpZnQKPiArCQkgKi8KPiArCQlpZiAoV0FSTl9PTl9PTkNFKG4gKyBIV19B TElHTl9UVEJfTlVNID49IG1heF9lbnRyaWVzKSkKPiArCQkJYnJlYWs7CgpbU2V2ZXJpdHk6IEhp Z2hdCklmIHdlIGhpdCB0aGlzIFdBUk5fT05fT05DRSBhbmQgYnJlYWsgZWFybHksIHdlIGRvbid0 IGNvbW11bmljYXRlIHRoZQp0cnVuY2F0ZWQgc2l6ZSBiYWNrIHRvIHRoZSBjYWxsZXIuIAoKPiAr CQl0dGJyW24rK10gPSAoc2dfcGFnZV9pdGVyX2RtYV9hZGRyZXNzKCZkbWFfaXRlcikgPj4gUEFH RV9TSElGVCkgJiAweDNGRkZGRkY7Cj4gKwl9ClsgLi4uIF0KPiAraW50IHNwYWNlbWl0X2RtbXVf bWFwKHN0cnVjdCBkcm1fZnJhbWVidWZmZXIgKmZiLCBzdHJ1Y3QgZHB1X21tdV90YmwgKm1tdV90 YmwsCj4gKwkJICAgICAgdTggdGJ1X2lkLCBzdHJ1Y3QgY21kbGlzdF9yZWdzICpjbF9yZG1hLAo+ ICsJCSBzdHJ1Y3QgZHJtX3BsYW5lICpwbGFuZSkKPiArewo+ICsJc3RydWN0IHNwYWNlbWl0X2Ry bV9wcml2YXRlICpwcml2ID0gZmItPmRldi0+ZGV2X3ByaXZhdGU7Cj4gKwlzdHJ1Y3Qgc3BhY2Vt aXRfaHdfZGV2aWNlICpod2RldiA9IHByaXYtPmh3ZGV2Owo+ICsJc3RydWN0IHNnX3RhYmxlICpz Z3QgPSBOVUxMOwo+ICsJc3RydWN0IHRidV9pbnN0YW5jZSB0YnUgPSB7IH07Cj4gKwl1MzIgdmFs Owo+ICsKPiArCXNndCA9IGRybV9nZW1fc2htZW1fZ2V0X3BhZ2VzX3NndCh0b19kcm1fZ2VtX3No bWVtX29iaihmYi0+b2JqWzBdKSk7CgpbU2V2ZXJpdHk6IEhpZ2hdCklzIGl0IHNhZmUgdG8gY2Fs bCB0aGlzIGhlcmU/IAoKZHJtX2dlbV9zaG1lbV9nZXRfcGFnZXNfc2d0KCkgcGVyZm9ybXMgYSBz bGVlcGFibGUgYWxsb2NhdGlvbiAoR0ZQX0tFUk5FTCkKYW5kIGFjcXVpcmVzIGEgbXV0ZXguIElm IGNhbGxlZCBkdXJpbmcgYXRvbWljX3VwZGF0ZSAodGhlIHN0YW5kYXJkCmhhcmR3YXJlIHByb2dy YW1taW5nIHBoYXNlKSwgaXQgc2xlZXBzIGluIGFuIGF0b21pYyBjb250ZXh0LgoKSWYgY2FsbGVk IGR1cmluZyBwcmVwYXJlX2ZiIHRvIGF2b2lkIHRoZSBhdG9taWMgY29udGV4dCwgZG9lcyBtdXRh dGluZwp0aGUgY2xfcmRtYSBidWZmZXIgYmVsb3cgaW50cm9kdWNlIGRhdGEgcmFjZXMgd2l0aCB0 aGUgaGFyZHdhcmUKcHJvY2Vzc2luZyB0aGUgcHJldmlvdXMgZnJhbWU/Cgo+ICsJaWYgKElTX0VS UihzZ3QpKQo+ICsJCXJldHVybiBQVFJfRVJSKHNndCk7Cj4gKwo+ICsJLyogRXZlcnkgYWR2ZXJ0 aXNlZCBmb3JtYXQgaXMgc2luZ2xlLXBsYW5hciAqLwo+ICsJdGJ1LnR0Yl9wYVswXSA9IG1tdV90 YmwtPnBhOwo+ICsJdGJ1LnRidV92YVswXSA9IFRCVV9CQVNFX1ZBKHRidV9pZCk7Cj4gKwl0YnUu dHRiX3NpemVbMF0gPSByb3VuZHVwKGZiLT5vYmpbMF0tPnNpemUsIFBBR0VfU0laRSkgPj4gUEFH RV9TSElGVDsKCltTZXZlcml0eTogSGlnaF0KU2luY2UgdGJ1LnR0Yl9zaXplWzBdIGlzIHByb2dy YW1tZWQgdG8gdGhlIGZ1bGwgRkIgc2l6ZSByZWdhcmRsZXNzIG9mCndoZXRoZXIgc3BhY2VtaXRf ZG1tdV9maWxsX3BndGFibGUoKSB0cnVuY2F0ZWQgdGhlIHRhYmxlLCBjb3VsZCB0aGlzCmNhdXNl IHRoZSBoYXJkd2FyZSBETU1VIHRvIHJlYWQgb3V0IG9mIGJvdW5kcyBwYXN0IHRoZSBwaHlzaWNh bAphbGxvY2F0aW9uIG9mIG1tdV90Ymw/Cgo+ICsKPiArCXNwYWNlbWl0X2RtbXVfZmlsbF9wZ3Rh YmxlKG1tdV90YmwsIHNndCk7Cj4gKwo+ICsJLyoKPiArCSAqIGVuYWJsZSA9IDEsIGZiY19tb2Rl ID0gMCAobGluZWFyIG9ubHkpCj4gKwkgKiBzaW5nbGUgcGxhbmUgaW4gYml0cyBbMzoyXQo+ICsJ ICovCj4gKwl2YWwgPSAweDE7Cj4gKwkvKiB0YnVfYnVyc3RfbGltaXRfZW4gPSAxLCB0bGJfZmV0 Y2hfYWN0aXZlX2VuID0gMSAqLwo+ICsJdmFsIHw9IEJJVCg0KSB8IEJJVCg1KTsKPiArCXZhbCA9 IHZhbCB8IChEUFVfUU9TX1VSR0VOVCA8PCA4KTsKPiArCWh3ZGV2LT5yZG1hX2RtbXUoaHdkZXYs IHRidV9pZCwgJnRidSwgZmIsIHZhbCwgY2xfcmRtYSwgcGxhbmUpOwoKPiBkaWZmIC0tZ2l0IGEv ZHJpdmVycy9ncHUvZHJtL3NwYWNlbWl0L3NwYWNlbWl0X2RwdV9yZWcuaCBiL2RyaXZlcnMvZ3B1 L2RybS9zcGFjZW1pdC9zcGFjZW1pdF9kcHVfcmVnLmgKPiBpbmRleCAwMDAwMDAwMDAwMDAwLi5h NTdlZDM0ZDM4ZTJmIDEwMDY0NAo+IC0tLSAvZGV2L251bGwKPiArKysgYi9kcml2ZXJzL2dwdS9k cm0vc3BhY2VtaXQvc3BhY2VtaXRfZHB1X3JlZy5oClsgLi4uIF0KPiArI2RlZmluZSBfX2RwdV9t bWlvX2ZpZWxkX3dyaXRlKF9fYWRkciwgX19tYXNrLCBkYXRhKQkJCVwKPiArZG8gewkJCQkJCQkJ CVwKPiArCWlmICgoX19tYXNrKSA9PSAweGZmVSkJCQkJCQlcCj4gKwkJd3JpdGViKCh1OCkoKGRh dGEpICYgMHhmZlUpLCBfX2FkZHIpOwkJCVwKPiArCWVsc2UgaWYgKChfX21hc2spID09IDB4ZmYw MFUpCQkJCQlcCj4gKwkJd3JpdGViKCh1OCkoKGRhdGEpICYgMHhmZlUpLCAoX19hZGRyKSArIDEp OwkJXAo+ICsJZWxzZSBpZiAoKF9fbWFzaykgPT0gMHhmZjAwMDBVKQkJCQkJXAo+ICsJCXdyaXRl YigodTgpKChkYXRhKSAmIDB4ZmZVKSwgKF9fYWRkcikgKyAyKTsJCVwKPiArCWVsc2UgaWYgKChf X21hc2spID09IDB4ZmYwMDAwMDBVKQkJCQlcCj4gKwkJd3JpdGViKCh1OCkoKGRhdGEpICYgMHhm ZlUpLCAoX19hZGRyKSArIDMpOwkJXAo+ICsJZWxzZSBpZiAoKF9fbWFzaykgPT0gMHhmZmZmVSkJ CQkJCVwKPiArCQl3cml0ZXcoKHUxNikoKGRhdGEpICYgMHhmZmZmVSksIF9fYWRkcik7CQlcCj4g KwllbHNlIGlmICgoX19tYXNrKSA9PSAweGZmZmYwMDAwVSkJCQkJXAo+ICsJCXdyaXRldygodTE2 KSgoZGF0YSkgJiAweGZmZmZVKSwgKF9fYWRkcikgKyAyKTsJCVwKPiArCWVsc2UgaWYgKChfX21h c2spID09IDB4ZmZmZmZmZmZVKQkJCQlcCj4gKwkJd3JpdGVsKCh1MzIpKGRhdGEpLCBfX2FkZHIp OwkJCQlcCj4gKwllbHNlCQkJCQkJCQlcCj4gKwkJd3JpdGVsKChyZWFkbChfX2FkZHIpICYgfihf X21hc2spKSB8CQkJXAo+ICsJCSAgICAgICBGSUVMRF9QUkVQKF9fbWFzaywgKHUzMikoZGF0YSkp LCBfX2FkZHIpOwlcCgpbU2V2ZXJpdHk6IE1lZGl1bV0KQ291bGQgY29uY3VycmVudCB1cGRhdGVz IGNvcnJ1cHQgdGhlIGhhcmR3YXJlIHN0YXRlIGhlcmU/IAoKVGhpcyBpcyBhbiB1bnByb3RlY3Rl ZCByZWFkLW1vZGlmeS13cml0ZSBzZXF1ZW5jZS4gSWYgYSByZWdpc3RlciBjb250YWlucwptdWx0 aXBsZSBmaWVsZHMgdXBkYXRlZCBmcm9tIGRpZmZlcmVudCBjb250ZXh0cyAoZS5nLiwgcHJvY2Vz cyBjb250ZXh0CmR1cmluZyBhdG9taWMgY29tbWl0cyBhbmQgaW50ZXJydXB0IGNvbnRleHQgZHVy aW5nIElTUiBoYW5kbGluZyksIGl0Cm1pZ2h0IGxvc2UgdXBkYXRlcyB3aXRob3V0IGEgc3Bpbmxv Y2suCgo+ICt9IHdoaWxlICgwKQoKLS0gClNhc2hpa28gQUkgcmV2aWV3IMK3IGh0dHBzOi8vc2Fz aGlrby5kZXYvIy9wYXRjaHNldC8yMDI2MDgwOS1rMy1kaXNwbGF5LXYyLTAtMzI3ZDc5MTBiZjcx QGdtYWlsLmNvbT9wYXJ0PTgKCi0tIApsaW51eC1waHkgbWFpbGluZyBsaXN0CmxpbnV4LXBoeUBs aXN0cy5pbmZyYWRlYWQub3JnCmh0dHBzOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2xpbnV4LXBoeQo=