From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D39EC63798 for ; Thu, 26 Nov 2020 14:27:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A6C37221F1 for ; Thu, 26 Nov 2020 14:27:07 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=ffwll.ch header.i=@ffwll.ch header.b="CXzsjSr/" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390810AbgKZO0v (ORCPT ); Thu, 26 Nov 2020 09:26:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37534 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390457AbgKZO0u (ORCPT ); Thu, 26 Nov 2020 09:26:50 -0500 Received: from mail-oo1-xc42.google.com (mail-oo1-xc42.google.com [IPv6:2607:f8b0:4864:20::c42]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7968EC0613D4 for ; Thu, 26 Nov 2020 06:26:50 -0800 (PST) Received: by mail-oo1-xc42.google.com with SMTP id l10so443316ooh.1 for ; Thu, 26 Nov 2020 06:26:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=0EgbywxA+4sIDLWiLToUErSIiqJfS8oiujhpJBsJzR4=; b=CXzsjSr/LySmKrLzCjMzHQDW5ZbGijvcn+5lWCgXW7Ps+upKzWn9EC4MJquI3QahoH jPQkQHG72wTvNeLZLKaNz0w8szCwlk6YrBuTR/gSjORtaBSm4CBmhYPPyn3P9QDCHD5y I0QGfcvkHEC2XiOqvmuh38G7DuwAmh/dzXu7E= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=0EgbywxA+4sIDLWiLToUErSIiqJfS8oiujhpJBsJzR4=; b=t/7LKiLOJuUs73gn3pVJGjcBRHvEzMXlaLfIWBcKhIQS9wElbAEbNxfaE9H5GJ6CEr 2+9nJEF+wYWCVVOsDPXXoeBpjXS9rG0I5UqEqYMjIXIHG5z10n+P9hcLw1g+0gMsfmDZ rJPkDqirm8WENvL73Qp2zCQCEMDIq6w6LSRxCX53+wmvywml7TRf356jlnP9Tnz8UbE2 t97yf68MNzywvXgtT0Ttst4d9QZScDNmINLb+d4O77rM5+ViBKvHYYJZKbJBjbquzsFC ax+nusUzb30jI6wJM8tecUlBOkB8rn2oyYYTPsYH44NjWqPps2oIBWES0I5LCqdTo1yn 7D+A== X-Gm-Message-State: AOAM531Sq2cTOK1ScTcgx9fMailIYE2Ch3s7NAwHThau46oLSmAwEGlg NyVv7BRoDzTUNDjc4R7BDuQsX74LhtD3sG1E9Hy5VbRMHwOdyA== X-Google-Smtp-Source: ABdhPJwDw9/tK9Nhd9vwyktsfs20EHzhzqTAQOtoTIqN65dd5HrDmbhpn9hLgp3rrI/tFy3hsZOCjQJ95dI25IDbb70= X-Received: by 2002:a4a:84c9:: with SMTP id o9mr2164600oog.28.1606400809735; Thu, 26 Nov 2020 06:26:49 -0800 (PST) MIME-Version: 1.0 References: <20201125090903.4436-1-kuohsiang_chou@aspeedtech.com> <4d9d5c42-842b-1152-1b81-da634fe4f124@suse.de> In-Reply-To: <4d9d5c42-842b-1152-1b81-da634fe4f124@suse.de> From: Daniel Vetter Date: Thu, 26 Nov 2020 15:26:38 +0100 Message-ID: Subject: Re: [PATCH] drm/ast: Fixed CVE for DP501 To: Thomas Zimmermann Cc: KuoHsiang Chou , dri-devel , Linux Kernel Mailing List , Dave Airlie , jenmin_yuan@aspeedtech.com, tommy_huang@aspeedtech.com, arc_sung@aspeedtech.com, Dave Airlie Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Nov 26, 2020 at 1:51 PM Thomas Zimmermann wro= te: > > Hi, > > please see below for a review. > > Am 25.11.20 um 10:09 schrieb KuoHsiang Chou: > > [Bug][DP501] > > 1. For security concerning, P2A have to be disabled by CVE regulation. > > 2. FrameBuffer reverses last 2MB used for the image of DP501 > > 3. If P2A is disallowed, the default "ioremap()" behavior is non-cached > > and could be an alternative accessing on the image of DP501. > > Please provide a more verbose description of the change. Which problem > does this patch solve? We also need a signed-off-by line per https://dri.freedesktop.org/docs/drm/process/submitting-patches.html#sign-y= our-work-the-developer-s-certificate-of-origin Otherwise we cannot merge a patch. -Daniel > > --- > > drivers/gpu/drm/ast/ast_dp501.c | 131 +++++++++++++++++++++++--------= - > > drivers/gpu/drm/ast/ast_drv.h | 2 + > > drivers/gpu/drm/ast/ast_main.c | 12 +++ > > drivers/gpu/drm/ast/ast_mm.c | 1 + > > 4 files changed, 110 insertions(+), 36 deletions(-) > > > > diff --git a/drivers/gpu/drm/ast/ast_dp501.c b/drivers/gpu/drm/ast/ast_= dp501.c > > index 88121c0e0d05..7640364ef2bc 100644 > > --- a/drivers/gpu/drm/ast/ast_dp501.c > > +++ b/drivers/gpu/drm/ast/ast_dp501.c > > @@ -189,6 +189,8 @@ bool ast_backup_fw(struct drm_device *dev, u8 *addr= , u32 size) > > u32 i, data; > > u32 boot_address; > > > > + if (ast->config_mode !=3D ast_use_p2a) return false; > > + > > The coding style is incorrect. 'Return false' needs to be on the next > line, indented by an additional tab. Here and in other place. > > > > data =3D ast_mindwm(ast, 0x1e6e2100) & 0x01; > > if (data) { > > boot_address =3D get_fw_base(ast); > > @@ -207,6 +209,8 @@ static bool ast_launch_m68k(struct drm_device *dev) > > u8 *fw_addr =3D NULL; > > u8 jreg; > > > > + if (ast->config_mode !=3D ast_use_p2a) return false; > > + > > Coding style. > > > data =3D ast_mindwm(ast, 0x1e6e2100) & 0x01; > > if (!data) { > > > > @@ -272,24 +276,51 @@ u8 ast_get_dp501_max_clk(struct drm_device *dev) > > u32 boot_address, offset, data; > > u8 linkcap[4], linkrate, linklanes, maxclk =3D 0xff; > > > > - boot_address =3D get_fw_base(ast); > > - > > - /* validate FW version */ > > - offset =3D 0xf000; > > - data =3D ast_mindwm(ast, boot_address + offset); > > - if ((data & 0xf0) !=3D 0x10) /* version: 1x */ > > - return maxclk; > > - > > - /* Read Link Capability */ > > - offset =3D 0xf014; > > - *(u32 *)linkcap =3D ast_mindwm(ast, boot_address + offset); > > - if (linkcap[2] =3D=3D 0) { > > - linkrate =3D linkcap[0]; > > - linklanes =3D linkcap[1]; > > - data =3D (linkrate =3D=3D 0x0a) ? (90 * linklanes) : (54 = * linklanes); > > - if (data > 0xff) > > - data =3D 0xff; > > - maxclk =3D (u8)data; > > + if (ast->config_mode =3D=3D ast_use_p2a) { > > + boot_address =3D get_fw_base(ast); > > + > > + /* validate FW version */ > > + offset =3D 0xf000; > > + data =3D ast_mindwm(ast, boot_address + offset); > > + if ((data & 0xf0) !=3D 0x10) /* version: 1x */ > > + return maxclk; > > Please give these constants some meaningful names. I suggest something li= ke > > #define AST_DP501_FW_VERSION_MASK GENMASK(7, 4) > #define AST_DP501_FW_VERSION_1 BIT(4) > > There are already a few constants in ast_drv.h. I'd put them there as > well. It's better than a comment. > > > + > > + /* Read Link Capability */ > > + offset =3D 0xf014; > > Please give the offset a meaningful name. > > > > + *(u32 *)linkcap =3D ast_mindwm(ast, boot_address + offset= ); > > The cast shoudl go to the right-hand side of the assignment. > > > + if (linkcap[2] =3D=3D 0) { > > + linkrate =3D linkcap[0]; > > + linklanes =3D linkcap[1]; > > + data =3D (linkrate =3D=3D 0x0a) ? (90 * linklanes= ) : (54 * linklanes); > > + if (data > 0xff) > > + data =3D 0xff; > > + maxclk =3D (u8)data; > > + } > > + } > > + else { > > else goes on the same line as } > > > + if (!ast->reservedbuffer) return 65; /* 1024x768 as de= fault */ > > Coding style. Please give a meaningful name to 65. > > > + > > + /* dummy read */ > > + offset =3D 0x0000; > > + data =3D *(u32 *) (ast->reservedbuffer + offset); > > Why is this required? > > reservedbuffer is I/O memory accessed in 32-bit chunks. You should use > readl and writel to access its content. > > > + > > + /* validate FW version */ > > + offset =3D 0xf000; > > The indention is off. > > > + data =3D *(u32 *) (ast->reservedbuffer + offset); > > + if ((data & 0xf0) !=3D 0x10) /* version: 1x */ > > + return maxclk; > > Indention. > > > + > > + /* Read Link Capability */ > > + offset =3D 0xf014; > > + *(u32 *)linkcap =3D *(u32 *) (ast->reservedbuffer + offse= t); > > + if (linkcap[2] =3D=3D 0) { > > + linkrate =3D linkcap[0]; > > + linklanes =3D linkcap[1]; > > + data =3D (linkrate =3D=3D 0x0a) ? (90 * linklanes= ) : (54 * linklanes); > > + if (data > 0xff) > > + data =3D 0xff; > > + maxclk =3D (u8)data; > > + } > > } > > return maxclk; > > } > > @@ -299,25 +330,53 @@ bool ast_dp501_read_edid(struct drm_device *dev, = u8 *ediddata) > > struct ast_private *ast =3D to_ast_private(dev); > > u32 i, boot_address, offset, data; > > > > - boot_address =3D get_fw_base(ast); > > - > > - /* validate FW version */ > > - offset =3D 0xf000; > > - data =3D ast_mindwm(ast, boot_address + offset); > > - if ((data & 0xf0) !=3D 0x10) > > - return false; > > - > > - /* validate PnP Monitor */ > > - offset =3D 0xf010; > > - data =3D ast_mindwm(ast, boot_address + offset); > > - if (!(data & 0x01)) > > - return false; > > + if (ast->config_mode =3D=3D ast_use_p2a) { > > + boot_address =3D get_fw_base(ast); > > > > - /* Read EDID */ > > - offset =3D 0xf020; > > - for (i =3D 0; i < 128; i +=3D 4) { > > - data =3D ast_mindwm(ast, boot_address + offset + i); > > - *(u32 *)(ediddata + i) =3D data; > > + /* validate FW version */ > > + offset =3D 0xf000; > > + data =3D ast_mindwm(ast, boot_address + offset); > > + if ((data & 0xf0) !=3D 0x10) > > + return false; > > + > > + /* validate PnP Monitor */ > > + offset =3D 0xf010; > > Please name the constant. > > > + data =3D ast_mindwm(ast, boot_address + offset); > > + if (!(data & 0x01)) > > Please name the constant. > > > + return false; > > + > > + /* Read EDID */ > > + offset =3D 0xf020; > > + for (i =3D 0; i < 128; i +=3D 4) { > > + data =3D ast_mindwm(ast, boot_address + offset + = i); > > + *(u32 *)(ediddata + i) =3D data; > > writel for I/O access > > > + } > > + } > > + else { > > else on wrong line > > > + if (!ast->reservedbuffer) return false; > > + > > + /* dummy read */ > > + offset =3D 0x0000; > > + data =3D *(u32 *) (ast->reservedbuffer + offset); > > + > > + /* validate FW version */ > > + offset =3D 0xf000; > > + data =3D *(u32 *) (ast->reservedbuffer + offset); > > + if ((data & 0xf0) !=3D 0x10) > > + return false; > > + > > + /* validate PnP Monitor */ > > + offset =3D 0xf010; > > + data =3D *(u32 *) (ast->reservedbuffer + offset); > > + if (!(data & 0x01)) > > + return false; > > + > > + /* Read EDID */ > > + offset =3D 0xf020; > > + for (i =3D 0; i < 128; i+=3D4) { > > + data =3D *(u32 *) (ast->reservedbuffer + offset += i); > > + *(u32 *)(ediddata + i) =3D data; > > + } > > } > > > > return true; > > diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_dr= v.h > > index 6b9e3b94a712..cd17e0683fd7 100644 > > --- a/drivers/gpu/drm/ast/ast_drv.h > > +++ b/drivers/gpu/drm/ast/ast_drv.h > > @@ -121,12 +121,14 @@ struct ast_private { > > > > void __iomem *regs; > > void __iomem *ioregs; > > + void __iomem *reservedbuffer; > > reservedbuffer has no meaning. As it stores the DP501's firmware, I'd > call it dp501_fw. > > > > > enum ast_chip chip; > > bool vga2_clone; > > uint32_t dram_bus_width; > > uint32_t dram_type; > > uint32_t mclk; > > + uint32_t vram_size; > > > > int fb_mtrr; > > > > diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_m= ain.c > > index 4ec6884f6c65..4477b4cf1b06 100644 > > --- a/drivers/gpu/drm/ast/ast_main.c > > +++ b/drivers/gpu/drm/ast/ast_main.c > > @@ -393,6 +393,7 @@ static void ast_device_release(void *data) > > > > /* enable standard VGA decode */ > > ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x04); > > + pci_iounmap(ast->base.pdev, ast->reservedbuffer); > > } > > > > struct ast_private *ast_device_create(struct drm_driver *drv, > > @@ -449,6 +450,17 @@ struct ast_private *ast_device_create(struct drm_d= river *drv, > > if (ret) > > return ERR_PTR(ret); > > > > + /* map reserved buffer */ > > + ast->reservedbuffer =3D NULL; > > + if (ast->vram_size < pci_resource_len(dev->pdev, 0)) { > > + ast->reservedbuffer =3D ioremap( \ > > + pci_resource_start(ast->base.pdev, 0) + (unsigned= long)ast->vram_size, \ > > + pci_resource_len(dev->pdev, 0) - ast->vram_size); > > Use pci_iomap_range() instead. The function's offset parameter is > vram_size, the function's maxlen parameter is 0. > > You also won't need pci_iounmap(). pci_iomap_range() sets up the cleanup > for you. > > > + if (!ast->reservedbuffer) { > > No braces around single-line branch. > > > + DRM_INFO("failed to map reserved buffer! \n"); > > Use drm_info() instead > > > + } > > + } > > + > > ret =3D ast_mode_config_init(ast); > > if (ret) > > return ERR_PTR(ret); > > diff --git a/drivers/gpu/drm/ast/ast_mm.c b/drivers/gpu/drm/ast/ast_mm.= c > > index 8392ebde504b..c6fd24493fb3 100644 > > --- a/drivers/gpu/drm/ast/ast_mm.c > > +++ b/drivers/gpu/drm/ast/ast_mm.c > > @@ -90,6 +90,7 @@ int ast_mm_init(struct ast_private *ast) > > int ret; > > > > vram_size =3D ast_get_vram_size(ast); > > + ast->vram_size =3D (uint32_t) vram_size; > > You don't need to store vram_size. Look at dev->vram_mm->vram_size instea= d. > > > > > ret =3D drmm_vram_helper_init(dev, pci_resource_start(dev->pdev, = 0), > > vram_size); > > -- > > 2.18.4 > > > > _______________________________________________ > > dri-devel mailing list > > dri-devel@lists.freedesktop.org > > https://lists.freedesktop.org/mailman/listinfo/dri-devel > > > > -- > Thomas Zimmermann > Graphics Driver Developer > SUSE Software Solutions Germany GmbH > Maxfeldstr. 5, 90409 N=C3=BCrnberg, Germany > (HRB 36809, AG N=C3=BCrnberg) > Gesch=C3=A4ftsf=C3=BChrer: Felix Imend=C3=B6rffer > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/dri-devel --=20 Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.5 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A04E5C56202 for ; Thu, 26 Nov 2020 14:26:54 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 8977520872 for ; Thu, 26 Nov 2020 14:26:53 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=ffwll.ch header.i=@ffwll.ch header.b="CXzsjSr/" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8977520872 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ffwll.ch Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 9126D6E94E; Thu, 26 Nov 2020 14:26:52 +0000 (UTC) Received: from mail-oo1-xc42.google.com (mail-oo1-xc42.google.com [IPv6:2607:f8b0:4864:20::c42]) by gabe.freedesktop.org (Postfix) with ESMTPS id 916E46E94E for ; Thu, 26 Nov 2020 14:26:50 +0000 (UTC) Received: by mail-oo1-xc42.google.com with SMTP id l10so439935oom.6 for ; Thu, 26 Nov 2020 06:26:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=0EgbywxA+4sIDLWiLToUErSIiqJfS8oiujhpJBsJzR4=; b=CXzsjSr/LySmKrLzCjMzHQDW5ZbGijvcn+5lWCgXW7Ps+upKzWn9EC4MJquI3QahoH jPQkQHG72wTvNeLZLKaNz0w8szCwlk6YrBuTR/gSjORtaBSm4CBmhYPPyn3P9QDCHD5y I0QGfcvkHEC2XiOqvmuh38G7DuwAmh/dzXu7E= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=0EgbywxA+4sIDLWiLToUErSIiqJfS8oiujhpJBsJzR4=; b=aKlNffKMiUNv/ysNV4O8qyLAtrXOqlsFaYqFk1hWrLO5qnScaRwiewNA+3eXAeyzGH FR80pXfDFTGCNhqOm1VmdbHpQkG561D/9Pr0y4BdQDcxhp6ef+jtEdAkdIhHuClojq/R zdbvz0QKrlVRnZxDlgFFHHbFZWGftMjziYAjdk4SVS8eqcYCXPbCDMaYoYyyL3+14B+i WSd3gzqDv8n8zbIlfsgKzTdqoWEg+HOhQpUQ7SCvGB5S6SIIjwSuab2x9FS1NLcfGKD6 zPdNIXJdl5P05HChhPY4bZSigJjvrWmI7HCZz/iiKJF9PCi20CdRifPHPputqWWxXpK0 FFaA== X-Gm-Message-State: AOAM530R6bnHdtaGQegFENpvznNDc5J7/IL0NR93uBp10xNaueGxcTSa Tfbvi1mf6VpwF0MzrU9qjMDXNhLwayFK6MHxjHoprg== X-Google-Smtp-Source: ABdhPJwDw9/tK9Nhd9vwyktsfs20EHzhzqTAQOtoTIqN65dd5HrDmbhpn9hLgp3rrI/tFy3hsZOCjQJ95dI25IDbb70= X-Received: by 2002:a4a:84c9:: with SMTP id o9mr2164600oog.28.1606400809735; Thu, 26 Nov 2020 06:26:49 -0800 (PST) MIME-Version: 1.0 References: <20201125090903.4436-1-kuohsiang_chou@aspeedtech.com> <4d9d5c42-842b-1152-1b81-da634fe4f124@suse.de> In-Reply-To: <4d9d5c42-842b-1152-1b81-da634fe4f124@suse.de> From: Daniel Vetter Date: Thu, 26 Nov 2020 15:26:38 +0100 Message-ID: Subject: Re: [PATCH] drm/ast: Fixed CVE for DP501 To: Thomas Zimmermann X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Dave Airlie , Linux Kernel Mailing List , dri-devel , tommy_huang@aspeedtech.com, jenmin_yuan@aspeedtech.com, Dave Airlie , arc_sung@aspeedtech.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" T24gVGh1LCBOb3YgMjYsIDIwMjAgYXQgMTo1MSBQTSBUaG9tYXMgWmltbWVybWFubiA8dHppbW1l cm1hbm5Ac3VzZS5kZT4gd3JvdGU6Cj4KPiBIaSwKPgo+IHBsZWFzZSBzZWUgYmVsb3cgZm9yIGEg cmV2aWV3Lgo+Cj4gQW0gMjUuMTEuMjAgdW0gMTA6MDkgc2NocmllYiBLdW9Ic2lhbmcgQ2hvdToK PiA+IFtCdWddW0RQNTAxXQo+ID4gMS4gRm9yIHNlY3VyaXR5IGNvbmNlcm5pbmcsIFAyQSBoYXZl IHRvIGJlIGRpc2FibGVkIGJ5IENWRSByZWd1bGF0aW9uLgo+ID4gMi4gRnJhbWVCdWZmZXIgcmV2 ZXJzZXMgbGFzdCAyTUIgdXNlZCBmb3IgdGhlIGltYWdlIG9mIERQNTAxCj4gPiAzLiBJZiBQMkEg aXMgZGlzYWxsb3dlZCwgdGhlIGRlZmF1bHQgImlvcmVtYXAoKSIgYmVoYXZpb3IgaXMgbm9uLWNh Y2hlZAo+ID4gICAgIGFuZCBjb3VsZCBiZSBhbiBhbHRlcm5hdGl2ZSBhY2Nlc3Npbmcgb24gdGhl IGltYWdlIG9mIERQNTAxLgo+Cj4gUGxlYXNlIHByb3ZpZGUgYSBtb3JlIHZlcmJvc2UgZGVzY3Jp cHRpb24gb2YgdGhlIGNoYW5nZS4gV2hpY2ggcHJvYmxlbQo+IGRvZXMgdGhpcyBwYXRjaCBzb2x2 ZT8KCldlIGFsc28gbmVlZCBhIHNpZ25lZC1vZmYtYnkgbGluZSBwZXIKCmh0dHBzOi8vZHJpLmZy ZWVkZXNrdG9wLm9yZy9kb2NzL2RybS9wcm9jZXNzL3N1Ym1pdHRpbmctcGF0Y2hlcy5odG1sI3Np Z24teW91ci13b3JrLXRoZS1kZXZlbG9wZXItcy1jZXJ0aWZpY2F0ZS1vZi1vcmlnaW4KCk90aGVy d2lzZSB3ZSBjYW5ub3QgbWVyZ2UgYSBwYXRjaC4KLURhbmllbAoKPiA+IC0tLQo+ID4gICBkcml2 ZXJzL2dwdS9kcm0vYXN0L2FzdF9kcDUwMS5jIHwgMTMxICsrKysrKysrKysrKysrKysrKysrKysr LS0tLS0tLS0tCj4gPiAgIGRyaXZlcnMvZ3B1L2RybS9hc3QvYXN0X2Rydi5oICAgfCAgIDIgKwo+ ID4gICBkcml2ZXJzL2dwdS9kcm0vYXN0L2FzdF9tYWluLmMgIHwgIDEyICsrKwo+ID4gICBkcml2 ZXJzL2dwdS9kcm0vYXN0L2FzdF9tbS5jICAgIHwgICAxICsKPiA+ICAgNCBmaWxlcyBjaGFuZ2Vk LCAxMTAgaW5zZXJ0aW9ucygrKSwgMzYgZGVsZXRpb25zKC0pCj4gPgo+ID4gZGlmZiAtLWdpdCBh L2RyaXZlcnMvZ3B1L2RybS9hc3QvYXN0X2RwNTAxLmMgYi9kcml2ZXJzL2dwdS9kcm0vYXN0L2Fz dF9kcDUwMS5jCj4gPiBpbmRleCA4ODEyMWMwZTBkMDUuLjc2NDAzNjRlZjJiYyAxMDA2NDQKPiA+ IC0tLSBhL2RyaXZlcnMvZ3B1L2RybS9hc3QvYXN0X2RwNTAxLmMKPiA+ICsrKyBiL2RyaXZlcnMv Z3B1L2RybS9hc3QvYXN0X2RwNTAxLmMKPiA+IEBAIC0xODksNiArMTg5LDggQEAgYm9vbCBhc3Rf YmFja3VwX2Z3KHN0cnVjdCBkcm1fZGV2aWNlICpkZXYsIHU4ICphZGRyLCB1MzIgc2l6ZSkKPiA+ ICAgICAgIHUzMiBpLCBkYXRhOwo+ID4gICAgICAgdTMyIGJvb3RfYWRkcmVzczsKPiA+Cj4gPiAr ICAgICBpZiAoYXN0LT5jb25maWdfbW9kZSAhPSBhc3RfdXNlX3AyYSkgcmV0dXJuIGZhbHNlOwo+ ID4gKwo+Cj4gVGhlIGNvZGluZyBzdHlsZSBpcyBpbmNvcnJlY3QuICdSZXR1cm4gZmFsc2UnIG5l ZWRzIHRvIGJlIG9uIHRoZSBuZXh0Cj4gbGluZSwgaW5kZW50ZWQgYnkgYW4gYWRkaXRpb25hbCB0 YWIuIEhlcmUgYW5kIGluIG90aGVyIHBsYWNlLgo+Cj4KPiA+ICAgICAgIGRhdGEgPSBhc3RfbWlu ZHdtKGFzdCwgMHgxZTZlMjEwMCkgJiAweDAxOwo+ID4gICAgICAgaWYgKGRhdGEpIHsKPiA+ICAg ICAgICAgICAgICAgYm9vdF9hZGRyZXNzID0gZ2V0X2Z3X2Jhc2UoYXN0KTsKPiA+IEBAIC0yMDcs NiArMjA5LDggQEAgc3RhdGljIGJvb2wgYXN0X2xhdW5jaF9tNjhrKHN0cnVjdCBkcm1fZGV2aWNl ICpkZXYpCj4gPiAgICAgICB1OCAqZndfYWRkciA9IE5VTEw7Cj4gPiAgICAgICB1OCBqcmVnOwo+ ID4KPiA+ICsgICAgIGlmIChhc3QtPmNvbmZpZ19tb2RlICE9IGFzdF91c2VfcDJhKSByZXR1cm4g ZmFsc2U7Cj4gPiArCj4KPiBDb2Rpbmcgc3R5bGUuCj4KPiA+ICAgICAgIGRhdGEgPSBhc3RfbWlu ZHdtKGFzdCwgMHgxZTZlMjEwMCkgJiAweDAxOwo+ID4gICAgICAgaWYgKCFkYXRhKSB7Cj4gPgo+ ID4gQEAgLTI3MiwyNCArMjc2LDUxIEBAIHU4IGFzdF9nZXRfZHA1MDFfbWF4X2NsayhzdHJ1Y3Qg ZHJtX2RldmljZSAqZGV2KQo+ID4gICAgICAgdTMyIGJvb3RfYWRkcmVzcywgb2Zmc2V0LCBkYXRh Owo+ID4gICAgICAgdTggbGlua2NhcFs0XSwgbGlua3JhdGUsIGxpbmtsYW5lcywgbWF4Y2xrID0g MHhmZjsKPiA+Cj4gPiAtICAgICBib290X2FkZHJlc3MgPSBnZXRfZndfYmFzZShhc3QpOwo+ID4g LQo+ID4gLSAgICAgLyogdmFsaWRhdGUgRlcgdmVyc2lvbiAqLwo+ID4gLSAgICAgb2Zmc2V0ID0g MHhmMDAwOwo+ID4gLSAgICAgZGF0YSA9IGFzdF9taW5kd20oYXN0LCBib290X2FkZHJlc3MgKyBv ZmZzZXQpOwo+ID4gLSAgICAgaWYgKChkYXRhICYgMHhmMCkgIT0gMHgxMCkgLyogdmVyc2lvbjog MXggKi8KPiA+IC0gICAgICAgICAgICAgcmV0dXJuIG1heGNsazsKPiA+IC0KPiA+IC0gICAgIC8q IFJlYWQgTGluayBDYXBhYmlsaXR5ICovCj4gPiAtICAgICBvZmZzZXQgID0gMHhmMDE0Owo+ID4g LSAgICAgKih1MzIgKilsaW5rY2FwID0gYXN0X21pbmR3bShhc3QsIGJvb3RfYWRkcmVzcyArIG9m ZnNldCk7Cj4gPiAtICAgICBpZiAobGlua2NhcFsyXSA9PSAwKSB7Cj4gPiAtICAgICAgICAgICAg IGxpbmtyYXRlID0gbGlua2NhcFswXTsKPiA+IC0gICAgICAgICAgICAgbGlua2xhbmVzID0gbGlu a2NhcFsxXTsKPiA+IC0gICAgICAgICAgICAgZGF0YSA9IChsaW5rcmF0ZSA9PSAweDBhKSA/ICg5 MCAqIGxpbmtsYW5lcykgOiAoNTQgKiBsaW5rbGFuZXMpOwo+ID4gLSAgICAgICAgICAgICBpZiAo ZGF0YSA+IDB4ZmYpCj4gPiAtICAgICAgICAgICAgICAgICAgICAgZGF0YSA9IDB4ZmY7Cj4gPiAt ICAgICAgICAgICAgIG1heGNsayA9ICh1OClkYXRhOwo+ID4gKyAgICAgaWYgKGFzdC0+Y29uZmln X21vZGUgPT0gYXN0X3VzZV9wMmEpIHsKPiA+ICsgICAgICAgICAgICAgYm9vdF9hZGRyZXNzID0g Z2V0X2Z3X2Jhc2UoYXN0KTsKPiA+ICsKPiA+ICsgICAgICAgICAgICAgLyogdmFsaWRhdGUgRlcg dmVyc2lvbiAqLwo+ID4gKyAgICAgICAgICAgICBvZmZzZXQgPSAweGYwMDA7Cj4gPiArICAgICAg ICAgICAgIGRhdGEgPSBhc3RfbWluZHdtKGFzdCwgYm9vdF9hZGRyZXNzICsgb2Zmc2V0KTsKPiA+ ICsgICAgICAgICAgICAgaWYgKChkYXRhICYgMHhmMCkgIT0gMHgxMCkgLyogdmVyc2lvbjogMXgg Ki8KPiA+ICsgICAgICAgICAgICAgICAgICAgICByZXR1cm4gbWF4Y2xrOwo+Cj4gUGxlYXNlIGdp dmUgdGhlc2UgY29uc3RhbnRzIHNvbWUgbWVhbmluZ2Z1bCBuYW1lcy4gSSBzdWdnZXN0IHNvbWV0 aGluZyBsaWtlCj4KPiAjZGVmaW5lIEFTVF9EUDUwMV9GV19WRVJTSU9OX01BU0sgICAgICAgR0VO TUFTSyg3LCA0KQo+ICNkZWZpbmUgQVNUX0RQNTAxX0ZXX1ZFUlNJT05fMSAgICAgICAgICBCSVQo NCkKPgo+IFRoZXJlIGFyZSBhbHJlYWR5IGEgZmV3IGNvbnN0YW50cyBpbiBhc3RfZHJ2LmguIEkn ZCBwdXQgdGhlbSB0aGVyZSBhcwo+IHdlbGwuIEl0J3MgYmV0dGVyIHRoYW4gYSBjb21tZW50Lgo+ Cj4gPiArCj4gPiArICAgICAgICAgICAgIC8qIFJlYWQgTGluayBDYXBhYmlsaXR5ICovCj4gPiAr ICAgICAgICAgICAgIG9mZnNldCAgPSAweGYwMTQ7Cj4KPiBQbGVhc2UgZ2l2ZSB0aGUgb2Zmc2V0 IGEgbWVhbmluZ2Z1bCBuYW1lLgo+Cj4KPiA+ICsgICAgICAgICAgICAgKih1MzIgKilsaW5rY2Fw ID0gYXN0X21pbmR3bShhc3QsIGJvb3RfYWRkcmVzcyArIG9mZnNldCk7Cj4KPiBUaGUgY2FzdCBz aG91ZGwgZ28gdG8gdGhlIHJpZ2h0LWhhbmQgc2lkZSBvZiB0aGUgYXNzaWdubWVudC4KPgo+ID4g KyAgICAgICAgICAgICBpZiAobGlua2NhcFsyXSA9PSAwKSB7Cj4gPiArICAgICAgICAgICAgICAg ICAgICAgbGlua3JhdGUgPSBsaW5rY2FwWzBdOwo+ID4gKyAgICAgICAgICAgICAgICAgICAgIGxp bmtsYW5lcyA9IGxpbmtjYXBbMV07Cj4gPiArICAgICAgICAgICAgICAgICAgICAgZGF0YSA9IChs aW5rcmF0ZSA9PSAweDBhKSA/ICg5MCAqIGxpbmtsYW5lcykgOiAoNTQgKiBsaW5rbGFuZXMpOwo+ ID4gKyAgICAgICAgICAgICAgICAgICAgIGlmIChkYXRhID4gMHhmZikKPiA+ICsgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIGRhdGEgPSAweGZmOwo+ID4gKyAgICAgICAgICAgICAgICAgICAg IG1heGNsayA9ICh1OClkYXRhOwo+ID4gKyAgICAgICAgICAgICB9Cj4gPiArICAgICB9Cj4gPiAr ICAgICBlbHNlIHsKPgo+IGVsc2UgZ29lcyBvbiB0aGUgc2FtZSBsaW5lIGFzIH0KPgo+ID4gKyAg ICAgICAgICAgICBpZiAoIWFzdC0+cmVzZXJ2ZWRidWZmZXIpIHJldHVybiA2NTsgICAgLyogMTAy NHg3NjggYXMgZGVmYXVsdCAqLwo+Cj4gQ29kaW5nIHN0eWxlLiBQbGVhc2UgZ2l2ZSBhIG1lYW5p bmdmdWwgbmFtZSB0byA2NS4KPgo+ID4gKwo+ID4gKyAgICAgICAgICAgICAvKiBkdW1teSByZWFk ICovCj4gPiArICAgICAgICAgICAgIG9mZnNldCA9IDB4MDAwMDsKPiA+ICsgICAgICAgICAgICAg ZGF0YSA9ICoodTMyICopIChhc3QtPnJlc2VydmVkYnVmZmVyICsgb2Zmc2V0KTsKPgo+IFdoeSBp cyB0aGlzIHJlcXVpcmVkPwo+Cj4gcmVzZXJ2ZWRidWZmZXIgaXMgSS9PIG1lbW9yeSBhY2Nlc3Nl ZCBpbiAzMi1iaXQgY2h1bmtzLiBZb3Ugc2hvdWxkIHVzZQo+IHJlYWRsIGFuZCB3cml0ZWwgdG8g YWNjZXNzIGl0cyBjb250ZW50Lgo+Cj4gPiArCj4gPiArICAgICAgICAgICAgICAgICAgICAgLyog dmFsaWRhdGUgRlcgdmVyc2lvbiAqLwo+ID4gKyAgICAgICAgICAgICAgICAgICAgIG9mZnNldCA9 IDB4ZjAwMDsKPgo+IFRoZSBpbmRlbnRpb24gaXMgb2ZmLgo+Cj4gPiArICAgICAgICAgICAgIGRh dGEgPSAqKHUzMiAqKSAoYXN0LT5yZXNlcnZlZGJ1ZmZlciArIG9mZnNldCk7Cj4gPiArICAgICAg ICAgICAgICAgICAgICAgaWYgKChkYXRhICYgMHhmMCkgIT0gMHgxMCkgLyogdmVyc2lvbjogMXgg Ki8KPiA+ICsgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHJldHVybiBtYXhjbGs7Cj4KPiBJ bmRlbnRpb24uCj4KPiA+ICsKPiA+ICsgICAgICAgICAgICAgLyogUmVhZCBMaW5rIENhcGFiaWxp dHkgKi8KPiA+ICsgICAgICAgICAgICAgb2Zmc2V0ICA9IDB4ZjAxNDsKPiA+ICsgICAgICAgICAg ICAgKih1MzIgKilsaW5rY2FwID0gKih1MzIgKikgKGFzdC0+cmVzZXJ2ZWRidWZmZXIgKyBvZmZz ZXQpOwo+ID4gKyAgICAgICAgICAgICBpZiAobGlua2NhcFsyXSA9PSAwKSB7Cj4gPiArICAgICAg ICAgICAgICAgICAgICAgbGlua3JhdGUgPSBsaW5rY2FwWzBdOwo+ID4gKyAgICAgICAgICAgICAg ICAgICAgIGxpbmtsYW5lcyA9IGxpbmtjYXBbMV07Cj4gPiArICAgICAgICAgICAgICAgICAgICAg ZGF0YSA9IChsaW5rcmF0ZSA9PSAweDBhKSA/ICg5MCAqIGxpbmtsYW5lcykgOiAoNTQgKiBsaW5r bGFuZXMpOwo+ID4gKyAgICAgICAgICAgICAgICAgICAgIGlmIChkYXRhID4gMHhmZikKPiA+ICsg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRhdGEgPSAweGZmOwo+ID4gKyAgICAgICAgICAg ICAgICAgICAgIG1heGNsayA9ICh1OClkYXRhOwo+ID4gKyAgICAgICAgICAgICB9Cj4gPiAgICAg ICB9Cj4gPiAgICAgICByZXR1cm4gbWF4Y2xrOwo+ID4gICB9Cj4gPiBAQCAtMjk5LDI1ICszMzAs NTMgQEAgYm9vbCBhc3RfZHA1MDFfcmVhZF9lZGlkKHN0cnVjdCBkcm1fZGV2aWNlICpkZXYsIHU4 ICplZGlkZGF0YSkKPiA+ICAgICAgIHN0cnVjdCBhc3RfcHJpdmF0ZSAqYXN0ID0gdG9fYXN0X3By aXZhdGUoZGV2KTsKPiA+ICAgICAgIHUzMiBpLCBib290X2FkZHJlc3MsIG9mZnNldCwgZGF0YTsK PiA+Cj4gPiAtICAgICBib290X2FkZHJlc3MgPSBnZXRfZndfYmFzZShhc3QpOwo+ID4gLQo+ID4g LSAgICAgLyogdmFsaWRhdGUgRlcgdmVyc2lvbiAqLwo+ID4gLSAgICAgb2Zmc2V0ID0gMHhmMDAw Owo+ID4gLSAgICAgZGF0YSA9IGFzdF9taW5kd20oYXN0LCBib290X2FkZHJlc3MgKyBvZmZzZXQp Owo+ID4gLSAgICAgaWYgKChkYXRhICYgMHhmMCkgIT0gMHgxMCkKPiA+IC0gICAgICAgICAgICAg cmV0dXJuIGZhbHNlOwo+ID4gLQo+ID4gLSAgICAgLyogdmFsaWRhdGUgUG5QIE1vbml0b3IgKi8K PiA+IC0gICAgIG9mZnNldCA9IDB4ZjAxMDsKPiA+IC0gICAgIGRhdGEgPSBhc3RfbWluZHdtKGFz dCwgYm9vdF9hZGRyZXNzICsgb2Zmc2V0KTsKPiA+IC0gICAgIGlmICghKGRhdGEgJiAweDAxKSkK PiA+IC0gICAgICAgICAgICAgcmV0dXJuIGZhbHNlOwo+ID4gKyAgICAgaWYgKGFzdC0+Y29uZmln X21vZGUgPT0gYXN0X3VzZV9wMmEpIHsKPiA+ICsgICAgICAgICAgICAgYm9vdF9hZGRyZXNzID0g Z2V0X2Z3X2Jhc2UoYXN0KTsKPiA+Cj4gPiAtICAgICAvKiBSZWFkIEVESUQgKi8KPiA+IC0gICAg IG9mZnNldCA9IDB4ZjAyMDsKPiA+IC0gICAgIGZvciAoaSA9IDA7IGkgPCAxMjg7IGkgKz0gNCkg ewo+ID4gLSAgICAgICAgICAgICBkYXRhID0gYXN0X21pbmR3bShhc3QsIGJvb3RfYWRkcmVzcyAr IG9mZnNldCArIGkpOwo+ID4gLSAgICAgICAgICAgICAqKHUzMiAqKShlZGlkZGF0YSArIGkpID0g ZGF0YTsKPiA+ICsgICAgICAgICAgICAgLyogdmFsaWRhdGUgRlcgdmVyc2lvbiAqLwo+ID4gKyAg ICAgICAgICAgICBvZmZzZXQgPSAweGYwMDA7Cj4gPiArICAgICAgICAgICAgIGRhdGEgPSBhc3Rf bWluZHdtKGFzdCwgYm9vdF9hZGRyZXNzICsgb2Zmc2V0KTsKPiA+ICsgICAgICAgICAgICAgaWYg KChkYXRhICYgMHhmMCkgIT0gMHgxMCkKPiA+ICsgICAgICAgICAgICAgICAgICAgICByZXR1cm4g ZmFsc2U7Cj4gPiArCj4gPiArICAgICAgICAgICAgIC8qIHZhbGlkYXRlIFBuUCBNb25pdG9yICov Cj4gPiArICAgICAgICAgICAgIG9mZnNldCA9IDB4ZjAxMDsKPgo+IFBsZWFzZSBuYW1lIHRoZSBj b25zdGFudC4KPgo+ID4gKyAgICAgICAgICAgICBkYXRhID0gYXN0X21pbmR3bShhc3QsIGJvb3Rf YWRkcmVzcyArIG9mZnNldCk7Cj4gPiArICAgICAgICAgICAgIGlmICghKGRhdGEgJiAweDAxKSkK Pgo+IFBsZWFzZSBuYW1lIHRoZSBjb25zdGFudC4KPgo+ID4gKyAgICAgICAgICAgICAgICAgICAg IHJldHVybiBmYWxzZTsKPiA+ICsKPiA+ICsgICAgICAgICAgICAgLyogUmVhZCBFRElEICovCj4g PiArICAgICAgICAgICAgIG9mZnNldCA9IDB4ZjAyMDsKPiA+ICsgICAgICAgICAgICAgZm9yIChp ID0gMDsgaSA8IDEyODsgaSArPSA0KSB7Cj4gPiArICAgICAgICAgICAgICAgICAgICAgZGF0YSA9 IGFzdF9taW5kd20oYXN0LCBib290X2FkZHJlc3MgKyBvZmZzZXQgKyBpKTsKPiA+ICsgICAgICAg ICAgICAgICAgICAgICAqKHUzMiAqKShlZGlkZGF0YSArIGkpID0gZGF0YTsKPgo+IHdyaXRlbCBm b3IgSS9PIGFjY2Vzcwo+Cj4gPiArICAgICAgICAgICAgIH0KPiA+ICsgICAgIH0KPiA+ICsgICAg IGVsc2Ugewo+Cj4gZWxzZSBvbiB3cm9uZyBsaW5lCj4KPiA+ICsgICAgICAgICAgICAgaWYgKCFh c3QtPnJlc2VydmVkYnVmZmVyKSByZXR1cm4gZmFsc2U7Cj4gPiArCj4gPiArICAgICAgICAgICAg IC8qIGR1bW15IHJlYWQgKi8KPiA+ICsgICAgICAgICAgICAgb2Zmc2V0ID0gMHgwMDAwOwo+ID4g KyAgICAgICAgICAgICBkYXRhID0gKih1MzIgKikgKGFzdC0+cmVzZXJ2ZWRidWZmZXIgKyBvZmZz ZXQpOwo+ID4gKwo+ID4gKyAgICAgICAgICAgICAvKiB2YWxpZGF0ZSBGVyB2ZXJzaW9uICovCj4g PiArICAgICAgICAgICAgIG9mZnNldCA9IDB4ZjAwMDsKPiA+ICsgICAgICAgICAgICAgZGF0YSA9 ICoodTMyICopIChhc3QtPnJlc2VydmVkYnVmZmVyICsgb2Zmc2V0KTsKPiA+ICsgICAgICAgICAg ICAgaWYgKChkYXRhICYgMHhmMCkgIT0gMHgxMCkKPiA+ICsgICAgICAgICAgICAgICAgICAgICBy ZXR1cm4gZmFsc2U7Cj4gPiArCj4gPiArICAgICAgICAgICAgIC8qIHZhbGlkYXRlIFBuUCBNb25p dG9yICovCj4gPiArICAgICAgICAgICAgIG9mZnNldCA9IDB4ZjAxMDsKPiA+ICsgICAgICAgICAg ICAgZGF0YSA9ICoodTMyICopIChhc3QtPnJlc2VydmVkYnVmZmVyICsgb2Zmc2V0KTsKPiA+ICsg ICAgICAgICAgICAgaWYgKCEoZGF0YSAmIDB4MDEpKQo+ID4gKyAgICAgICAgICAgICAgICAgICAg IHJldHVybiBmYWxzZTsKPiA+ICsKPiA+ICsgICAgICAgICAgICAgLyogUmVhZCBFRElEICovCj4g PiArICAgICAgICAgICAgIG9mZnNldCA9IDB4ZjAyMDsKPiA+ICsgICAgICAgICAgICAgZm9yIChp ID0gMDsgaSA8IDEyODsgaSs9NCkgewo+ID4gKyAgICAgICAgICAgICAgICAgICAgIGRhdGEgPSAq KHUzMiAqKSAoYXN0LT5yZXNlcnZlZGJ1ZmZlciArIG9mZnNldCArIGkpOwo+ID4gKyAgICAgICAg ICAgICAgICAgICAgICoodTMyICopKGVkaWRkYXRhICsgaSkgPSBkYXRhOwo+ID4gKyAgICAgICAg ICAgICB9Cj4gPiAgICAgICB9Cj4gPgo+ID4gICAgICAgcmV0dXJuIHRydWU7Cj4gPiBkaWZmIC0t Z2l0IGEvZHJpdmVycy9ncHUvZHJtL2FzdC9hc3RfZHJ2LmggYi9kcml2ZXJzL2dwdS9kcm0vYXN0 L2FzdF9kcnYuaAo+ID4gaW5kZXggNmI5ZTNiOTRhNzEyLi5jZDE3ZTA2ODNmZDcgMTAwNjQ0Cj4g PiAtLS0gYS9kcml2ZXJzL2dwdS9kcm0vYXN0L2FzdF9kcnYuaAo+ID4gKysrIGIvZHJpdmVycy9n cHUvZHJtL2FzdC9hc3RfZHJ2LmgKPiA+IEBAIC0xMjEsMTIgKzEyMSwxNCBAQCBzdHJ1Y3QgYXN0 X3ByaXZhdGUgewo+ID4KPiA+ICAgICAgIHZvaWQgX19pb21lbSAqcmVnczsKPiA+ICAgICAgIHZv aWQgX19pb21lbSAqaW9yZWdzOwo+ID4gKyAgICAgdm9pZCBfX2lvbWVtICpyZXNlcnZlZGJ1ZmZl cjsKPgo+IHJlc2VydmVkYnVmZmVyIGhhcyBubyBtZWFuaW5nLiBBcyBpdCBzdG9yZXMgdGhlIERQ NTAxJ3MgZmlybXdhcmUsIEknZAo+IGNhbGwgaXQgZHA1MDFfZncuCj4KPiA+Cj4gPiAgICAgICBl bnVtIGFzdF9jaGlwIGNoaXA7Cj4gPiAgICAgICBib29sIHZnYTJfY2xvbmU7Cj4gPiAgICAgICB1 aW50MzJfdCBkcmFtX2J1c193aWR0aDsKPiA+ICAgICAgIHVpbnQzMl90IGRyYW1fdHlwZTsKPiA+ ICAgICAgIHVpbnQzMl90IG1jbGs7Cj4gPiArICAgICB1aW50MzJfdCB2cmFtX3NpemU7Cj4gPgo+ ID4gICAgICAgaW50IGZiX210cnI7Cj4gPgo+ID4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvZ3B1L2Ry bS9hc3QvYXN0X21haW4uYyBiL2RyaXZlcnMvZ3B1L2RybS9hc3QvYXN0X21haW4uYwo+ID4gaW5k ZXggNGVjNjg4NGY2YzY1Li40NDc3YjRjZjFiMDYgMTAwNjQ0Cj4gPiAtLS0gYS9kcml2ZXJzL2dw dS9kcm0vYXN0L2FzdF9tYWluLmMKPiA+ICsrKyBiL2RyaXZlcnMvZ3B1L2RybS9hc3QvYXN0X21h aW4uYwo+ID4gQEAgLTM5Myw2ICszOTMsNyBAQCBzdGF0aWMgdm9pZCBhc3RfZGV2aWNlX3JlbGVh c2Uodm9pZCAqZGF0YSkKPiA+Cj4gPiAgICAgICAvKiBlbmFibGUgc3RhbmRhcmQgVkdBIGRlY29k ZSAqLwo+ID4gICAgICAgYXN0X3NldF9pbmRleF9yZWcoYXN0LCBBU1RfSU9fQ1JUQ19QT1JULCAw eGExLCAweDA0KTsKPiA+ICsgICAgIHBjaV9pb3VubWFwKGFzdC0+YmFzZS5wZGV2LCBhc3QtPnJl c2VydmVkYnVmZmVyKTsKPiA+ICAgfQo+ID4KPiA+ICAgc3RydWN0IGFzdF9wcml2YXRlICphc3Rf ZGV2aWNlX2NyZWF0ZShzdHJ1Y3QgZHJtX2RyaXZlciAqZHJ2LAo+ID4gQEAgLTQ0OSw2ICs0NTAs MTcgQEAgc3RydWN0IGFzdF9wcml2YXRlICphc3RfZGV2aWNlX2NyZWF0ZShzdHJ1Y3QgZHJtX2Ry aXZlciAqZHJ2LAo+ID4gICAgICAgaWYgKHJldCkKPiA+ICAgICAgICAgICAgICAgcmV0dXJuIEVS Ul9QVFIocmV0KTsKPiA+Cj4gPiArICAgICAvKiBtYXAgcmVzZXJ2ZWQgYnVmZmVyICovCj4gPiAr ICAgICBhc3QtPnJlc2VydmVkYnVmZmVyID0gTlVMTDsKPiA+ICsgICAgIGlmIChhc3QtPnZyYW1f c2l6ZSA8IHBjaV9yZXNvdXJjZV9sZW4oZGV2LT5wZGV2LCAwKSkgewo+ID4gKyAgICAgICAgICAg ICBhc3QtPnJlc2VydmVkYnVmZmVyID0gaW9yZW1hcCggXAo+ID4gKyAgICAgICAgICAgICAgICAg ICAgIHBjaV9yZXNvdXJjZV9zdGFydChhc3QtPmJhc2UucGRldiwgMCkgKyAodW5zaWduZWQgbG9u Zylhc3QtPnZyYW1fc2l6ZSwgXAo+ID4gKyAgICAgICAgICAgICAgICAgICAgIHBjaV9yZXNvdXJj ZV9sZW4oZGV2LT5wZGV2LCAwKSAtIGFzdC0+dnJhbV9zaXplKTsKPgo+IFVzZSBwY2lfaW9tYXBf cmFuZ2UoKSBpbnN0ZWFkLiBUaGUgZnVuY3Rpb24ncyBvZmZzZXQgcGFyYW1ldGVyIGlzCj4gdnJh bV9zaXplLCB0aGUgZnVuY3Rpb24ncyBtYXhsZW4gcGFyYW1ldGVyIGlzIDAuCj4KPiBZb3UgYWxz byB3b24ndCBuZWVkIHBjaV9pb3VubWFwKCkuIHBjaV9pb21hcF9yYW5nZSgpIHNldHMgdXAgdGhl IGNsZWFudXAKPiBmb3IgeW91Lgo+Cj4gPiArICAgICAgICAgICAgIGlmICghYXN0LT5yZXNlcnZl ZGJ1ZmZlcikgewo+Cj4gTm8gYnJhY2VzIGFyb3VuZCBzaW5nbGUtbGluZSBicmFuY2guCj4KPiA+ ICsgICAgICAgICAgICAgICAgICAgICBEUk1fSU5GTygiZmFpbGVkIHRvIG1hcCByZXNlcnZlZCBi dWZmZXIhIFxuIik7Cj4KPiBVc2UgZHJtX2luZm8oKSBpbnN0ZWFkCj4KPiA+ICsgICAgICAgICAg ICAgfQo+ID4gKyAgICAgfQo+ID4gKwo+ID4gICAgICAgcmV0ID0gYXN0X21vZGVfY29uZmlnX2lu aXQoYXN0KTsKPiA+ICAgICAgIGlmIChyZXQpCj4gPiAgICAgICAgICAgICAgIHJldHVybiBFUlJf UFRSKHJldCk7Cj4gPiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL2FzdC9hc3RfbW0uYyBi L2RyaXZlcnMvZ3B1L2RybS9hc3QvYXN0X21tLmMKPiA+IGluZGV4IDgzOTJlYmRlNTA0Yi4uYzZm ZDI0NDkzZmIzIDEwMDY0NAo+ID4gLS0tIGEvZHJpdmVycy9ncHUvZHJtL2FzdC9hc3RfbW0uYwo+ ID4gKysrIGIvZHJpdmVycy9ncHUvZHJtL2FzdC9hc3RfbW0uYwo+ID4gQEAgLTkwLDYgKzkwLDcg QEAgaW50IGFzdF9tbV9pbml0KHN0cnVjdCBhc3RfcHJpdmF0ZSAqYXN0KQo+ID4gICAgICAgaW50 IHJldDsKPiA+Cj4gPiAgICAgICB2cmFtX3NpemUgPSBhc3RfZ2V0X3ZyYW1fc2l6ZShhc3QpOwo+ ID4gKyAgICAgYXN0LT52cmFtX3NpemUgPSAodWludDMyX3QpIHZyYW1fc2l6ZTsKPgo+IFlvdSBk b24ndCBuZWVkIHRvIHN0b3JlIHZyYW1fc2l6ZS4gTG9vayBhdCBkZXYtPnZyYW1fbW0tPnZyYW1f c2l6ZSBpbnN0ZWFkLgo+Cj4gPgo+ID4gICAgICAgcmV0ID0gZHJtbV92cmFtX2hlbHBlcl9pbml0 KGRldiwgcGNpX3Jlc291cmNlX3N0YXJ0KGRldi0+cGRldiwgMCksCj4gPiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgdnJhbV9zaXplKTsKPiA+IC0tCj4gPiAyLjE4LjQKPiA+Cj4g PiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwo+ID4gZHJp LWRldmVsIG1haWxpbmcgbGlzdAo+ID4gZHJpLWRldmVsQGxpc3RzLmZyZWVkZXNrdG9wLm9yZwo+ ID4gaHR0cHM6Ly9saXN0cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2 ZWwKPiA+Cj4KPiAtLQo+IFRob21hcyBaaW1tZXJtYW5uCj4gR3JhcGhpY3MgRHJpdmVyIERldmVs b3Blcgo+IFNVU0UgU29mdHdhcmUgU29sdXRpb25zIEdlcm1hbnkgR21iSAo+IE1heGZlbGRzdHIu IDUsIDkwNDA5IE7DvHJuYmVyZywgR2VybWFueQo+IChIUkIgMzY4MDksIEFHIE7DvHJuYmVyZykK PiBHZXNjaMOkZnRzZsO8aHJlcjogRmVsaXggSW1lbmTDtnJmZmVyCj4gX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KPiBkcmktZGV2ZWwgbWFpbGluZyBsaXN0 Cj4gZHJpLWRldmVsQGxpc3RzLmZyZWVkZXNrdG9wLm9yZwo+IGh0dHBzOi8vbGlzdHMuZnJlZWRl c2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCgoKCi0tIApEYW5pZWwgVmV0dGVy ClNvZnR3YXJlIEVuZ2luZWVyLCBJbnRlbCBDb3Jwb3JhdGlvbgpodHRwOi8vYmxvZy5mZndsbC5j aApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpkcmktZGV2 ZWwgbWFpbGluZyBsaXN0CmRyaS1kZXZlbEBsaXN0cy5mcmVlZGVza3RvcC5vcmcKaHR0cHM6Ly9s aXN0cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2ZWwK