From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 72989C531D0 for ; Sat, 25 Jul 2026 05:18:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=+wVra+fAVbQt2hAFuoJ9pIWWaMJm3w8VfUYDvN1+7M0=; b=eoayCKDmiXC2xN M00J4tnisvq1w1xw/OEqtYbEJuor3Sly2/i20/X937fbtp0D8TbWnfjHKs9KKDKkXZSBdQIjJjH42 xPtqrP9vH/4J2+N4LQi7MUFJBPlqi2+Bc1Bm+XHY5TDTRZuzwRnijW+BqALjyEDqVPJn7TO8yAloD /HTSnmMLMwdTsS2VODIPyfGH2Y453FbE7xFvQwSAt1G7HJXF79OzP/QoTpJHtAv28ltN9ahHdzath ehtNhbk7Zl6R31CXTEM/Cfe3H5t2ondgtE7Kjf7bHgIy3rVSIwspX59NTuBtJAjUgCd0DQAh9qlky z5fw8WV3uqlv4zqRSxFw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wnUm3-0000000042d-0aFb; Sat, 25 Jul 2026 05:18:11 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wnUm2-0000000042X-1qUk for linux-phy@lists.infradead.org; Sat, 25 Jul 2026 05:18:10 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 3460A44098; Sat, 25 Jul 2026 05:18:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6C041F000E9; Sat, 25 Jul 2026 05:18:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784956690; bh=FGTOwC9l0p3K39rI4nwYUnhRdmfc8VuDMzntBdqs1BA=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=cpQGxhpKZsAKU/iPBxxJS3gqNQU6LnkiR3SQklpgZm1crcAMJoop2FHYgzVGWLNHn l6/RoeZ0r/EuSS4WvVURetDv68dsBlTKz0MFihslUqQB0POWr0W+rZ0I3QE1ZpVLdY j2sc5J9yymoVjlksSdsfYsKAP89DKnt4xbNcDBImbE6CnjuFdyqFxxTahmL1e6Cs13 nukD2ZxyvM52VIaTQMZo54iytqcWBc1glXwt/ft1F8/c9sbFUXSZMLXoDABHxv+mCb HhrNVLsQJRxCo6zwOGJFGX/4yZi+Vo2lgOP1K9HW0RzsuYdnElHecXOHw1La5oGZ8r FnbuSkYRvwHlA== From: sashiko-bot@kernel.org Subject: Re: [PATCH 10/17] drm/spacemit: add Saturn DPU KMS pipeline To: "Cody Kang" Cc: olteanv@gmail.com, neil.armstrong@linaro.org, conor+dt@kernel.org, dri-devel@lists.freedesktop.org, robh@kernel.org, vkoul@kernel.org, linux-phy@lists.infradead.org, devicetree@vger.kernel.org In-Reply-To: <20260724-k3-display-v1-10-f22a10a52867@gmail.com> References: <20260724-k3-display-v1-0-f22a10a52867@gmail.com> <20260724-k3-display-v1-10-f22a10a52867@gmail.com> Date: Sat, 25 Jul 2026 05:18:09 +0000 Message-Id: <20260725051809.B6C041F000E9@smtp.kernel.org> X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MTMgcG90ZW50aWFsIGlzc3VlKHMpIHRvIGNvbnNpZGVyOgotIFtDcml0aWNhbF0gSWdub3JlZCBy ZXR1cm4gdmFsdWUgb2YgYGdldF9jbF9yZG1hX2J1ZigpYCBpbiBgc3BhY2VtaXRfcGxhbmVfYXRv bWljX3VwZGF0ZWAgbGVhZHMgdG8gVXNlLUFmdGVyLUZyZWUgYW5kIERvdWJsZS1GcmVlLgotIFtI aWdoXSBTbGVlcGluZyBmdW5jdGlvbnMgY2FsbGVkIGZyb20gQ1JUQyBhdG9taWMgY29tbWl0IGNh bGxiYWNrcyAoYGF0b21pY19lbmFibGVgIC8gYGF0b21pY19kaXNhYmxlYCksIHZpb2xhdGluZyBh dG9taWMgY29udGV4dCByZXF1aXJlbWVudHMuCi0gW0hpZ2hdIGBzcGFjZW1pdF9wbGFuZV9yZXNl dGAgb3Blbi1jb2RlcyBzdGF0ZSBkZXN0cnVjdGlvbiwgcGVybWFuZW50bHkgbGVha2luZyB0aGUg cGxhbmUncyBETUEgYWxsb2NhdGlvbnMuCi0gW0hpZ2hdIER5bmFtaWMgbWVtb3J5IGFsbG9jYXRp b24gb2NjdXJzIGluIHRoZSBgYXRvbWljX3VwZGF0ZWAgZmFzdCBwYXRoLgotIFtIaWdoXSBFbmFi bGluZyB0aGUgRFBVIElSUSBiZWZvcmUgaGFyZHdhcmUgcmVzZXQgY2F1c2VzIGFuIGludGVycnVw dCBzdG9ybS4KLSBbSGlnaF0gVE9DVE9VIHJhY2UgY29uZGl0aW9uIGluIGBzcGFjZW1pdF9jcnRj X2F0b21pY19kaXNhYmxlYCBhbGxvd3MgTU1JTyBhY2Nlc3Mgd2hpbGUgY2xvY2tzIGFyZSBnYXRl ZC4KLSBbSGlnaF0gVW5ib3VuZGVkIERNQSBhbGxvY2F0aW9ucyBpbiBgYXRvbWljX2NoZWNrYCBs ZWFkIHRvIG1lbW9yeSBsZWFrcyBvbiByZXRyaWVzIGFuZCB1bnByaXZpbGVnZWQgRGVuaWFsIG9m IFNlcnZpY2UuCi0gW0hpZ2hdIEluY29ycmVjdCB0ZWFyZG93biBvcmRlciBpbiBgc3BhY2VtaXRf ZHJtX21hc3Rlcl91bmJpbmRgIGNhdXNlcyBWQkxBTksgdGltZW91dHMuCi0gW0hpZ2hdIERSTSBp b2N0bHMgY2FuIGFjY2VzcyBmcmVlZCBgcHJpdmAgYW5kIGBod2RldmAgYWZ0ZXIgZHJpdmVyIHVu YmluZCBkdWUgdG8gbWlzc2luZyB1bnBsdWcgc3RhdGUuCi0gW01lZGl1bV0gVE9DVE9VIHJhY2Ug c2V0dGluZyBgYV9jcnRjLT5jbG9ja3Nfb24gPSB0cnVlYCBiZWZvcmUgdGhlIGhhcmR3YXJlIGNs b2NrcyBhcmUgYWN0dWFsbHkgcmVzdW1lZC4KLSBbTWVkaXVtXSBVbmJvdW5kZWQgYWNjdW11bGF0 aW9uIG9mIGB1c2VfY250YCBpbiBgc2F0dXJuX2NvdW50X3JkbWFfdXNlYC4KLSBbTWVkaXVtXSBg c3BhY2VtaXRfY3J0Y19kdXBsaWNhdGVfc3RhdGVgIGxlYWtzIERSTSBwcm9wZXJ0eSBibG9icyBv biBlcnJvciBwYXRoLgotIFtNZWRpdW1dIEhhcmR3YXJlIHJlc2V0cyBhcmUgZGVhc3NlcnRlZCBi ZWZvcmUgY2xvY2tzIGFyZSBlbmFibGVkIGR1cmluZyBQTSByZXN1bWUuCi0tCgotLS0gUGF0Y2gg WzEwXTogW1BBVENIIDEwLzE3XSBkcm0vc3BhY2VtaXQ6IGFkZCBTYXR1cm4gRFBVIEtNUyBwaXBl bGluZSAtLS0KY29tbWl0IGY2Yzk0OWY4NDhjYThmYTQzNzc3ZWYyMjRkMGJlNDI5ZDI5NjZmZjYK QXV0aG9yOiBDb2R5IEthbmcgPGNvZHlrYW5nLmhrQGdtYWlsLmNvbT4KCmRybS9zcGFjZW1pdDog YWRkIFNhdHVybiBEUFUgS01TIHBpcGVsaW5lCgpBZGQgdGhlIGF0b21pYyBLTVMgaW1wbGVtZW50 YXRpb24gb24gdG9wIG9mIHRoZSBoYXJkd2FyZSBiYWNrZW5kOiBvbmUKQ1JUQyBhbmQgb25lIHBy aW1hcnkgcGxhbmUgcGVyIERQVSBpbnN0YW5jZS4gYXRvbWljX2NoZWNrIHZhbGlkYXRlcwp0aGUg cGxhbmUgcmVjdGFuZ2xlIDE6MSBhZ2FpbnN0IHRoZSBtb2RlIGFuZCBzaXplcyB0aGUgcGVyLWNo YW5uZWwgRkJDCmxpbmUgYnVmZmVyOyBhdG9taWMgY29tbWl0IGJ1aWxkcyB0aGUgY21kbGlzdCBi YXRjaGVzLCBtYXBzIHRoZQpmcmFtZWJ1ZmZlciB0aHJvdWdoIHRoZSBETU1VIGFuZCBhcm1zIHRo ZSBjZmctcmVhZHkgaGFuZHNoYWtlLCB3aXRoCnZibGFuayBldmVudHMgZHJpdmVuIGZyb20gdGhl IERQVSBpbnRlcnJ1cHQuCgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vc3BhY2VtaXQv c3BhY2VtaXRfY3J0Yy5jIGIvZHJpdmVycy9ncHUvZHJtL3NwYWNlbWl0L3NwYWNlbWl0X2NydGMu Ywo+IC0tLSBhL2RyaXZlcnMvZ3B1L2RybS9zcGFjZW1pdC9zcGFjZW1pdF9jcnRjLmMKPiArKysg Yi9kcml2ZXJzL2dwdS9kcm0vc3BhY2VtaXQvc3BhY2VtaXRfY3J0Yy5jCj4gQEAgLTQzLDE4ICs0 MywxNSBAQAo+ICBzdGF0aWMgdm9pZCBzYXR1cm5fY291bnRfcmRtYV91c2Uoc3RydWN0IGRybV9j cnRjX3N0YXRlICpjcnRjX3N0YXRlKQo+ICB7Cj4gIAlzdHJ1Y3QgZHJtX3BsYW5lICpwbGFuZTsK PiAgCXN0cnVjdCBzcGFjZW1pdF9jcnRjX3N0YXRlICpzcGFjZW1pdF9zdGF0ZSA9Cj4gIAkJCXRv X3NwYWNlbWl0X2NydGNfc3RhdGUoY3J0Y19zdGF0ZSk7Cj4gIAlzdHJ1Y3Qgc3BhY2VtaXRfY3J0 Y19yZG1hICpyZG1hcyA9IHNwYWNlbWl0X3N0YXRlLT5yZG1hczsKPiAgCXUzMiByZG1hX2lkID0g MDsKPiAgCWNvbnN0IHN0cnVjdCBkcm1fcGxhbmVfc3RhdGUgKnBzdGF0ZTsKPiAgCj4gIAlkcm1f YXRvbWljX2NydGNfc3RhdGVfZm9yX2VhY2hfcGxhbmVfc3RhdGUocGxhbmUsIHBzdGF0ZSwgY3J0 Y19zdGF0ZSkgewo+ICAJCXJkbWFfaWQgPSB0b19zcGFjZW1pdF9wbGFuZV9zdGF0ZShwc3RhdGUp LT5yZG1hX2lkOwo+ICAJCWlmIChyZG1hX2lkICE9IFJETUFfSU5WQUxJRF9JRCkKPiAgCQkJcmRt YXNbcmRtYV9pZF0udXNlX2NudCsrOwoKW1NldmVyaXR5OiBNZWRpdW1dCldpbGwgdGhpcyBjb3Vu dGVyIGFjY3VtdWxhdGUgdmFsdWVzIGluY29ycmVjdGx5IGlmIGF0b21pY19jaGVjayBpcyBjYWxs ZWQKbXVsdGlwbGUgdGltZXMgb24gdGhlIHNhbWUgQ1JUQyBzdGF0ZT8gSWYgdGhlIERSTSBjb3Jl IHJldHJpZXMgdGhlIGNvbW1pdCBkdWUKdG8gLUVERUFETEsgYmFja29mZiwgaXQgc2VlbXMgdGhl IGNvdW50ZXIgbWlnaHQgaW5jcmVtZW50IHJlcGVhdGVkbHkgc2luY2UgaXQKaXMgbm90IGNsZWFy ZWQgZmlyc3QuCgo+ICAJfQo+ICB9Cj4gIApbIC4uLiBdCj4gQEAgLTk1LDIxICs5MiwyMCBAQAo+ ICBzdGF0aWMgdm9pZCBzcGFjZW1pdF9jcnRjX2F0b21pY19lbmFibGUoc3RydWN0IGRybV9jcnRj ICpjcnRjLAo+ICAJCQkJCXN0cnVjdCBkcm1fYXRvbWljX2NvbW1pdCAqb2xkX3N0YXRlKQo+ICB7 Cj4gIAlzdHJ1Y3Qgc3BhY2VtaXRfY3J0YyAqYV9jcnRjID0gdG9fc3BhY2VtaXRfY3J0YyhjcnRj KTsKPiAgCWludCBpZHg7Cj4gIAo+ICAJaWYgKCFkcm1fZGV2X2VudGVyKGNydGMtPmRldiwgJmlk eCkpCj4gIAkJcmV0dXJuOwo+ICAKPiAgCXRyYWNlX3NwYWNlbWl0X2NydGNfYXRvbWljX2VuYWJs ZShhX2NydGMtPmRldl9pZCk7Cj4gIAo+ICAJLyoKPiAgCSAqIFUtQm9vdCBsZWF2ZXMgaXRzIGJv b3QtbG9nbyBwaXBlbGluZSBydW5uaW5nLiBIYXJkLXN0b3AgaXQgd2l0aCB0aGUKPiAgCSAqIHJl c2V0cyBhbG9uZTsgdGhlIGNsb2NrcyBhcmUgbm90IG91cnMgdG8gZ2F0ZSB1bnRpbCB3ZSBoYXZl IGVuYWJsZWQKPiAgCSAqIHRoZW0uCj4gIAkgKi8KPiAgCWlmICh1bmxpa2VseShhX2NydGMtPmZp cnN0X21vZGVzZXQpKSB7Cj4gIAkJZHB1X3Jlc2V0X2Fzc2VydChhX2NydGMtPmRldiwgImxjZCIs IGFfY3J0Yy0+bGNkX3Jlc2V0KTsKPiAgCQlkcHVfcmVzZXRfYXNzZXJ0KGFfY3J0Yy0+ZGV2LCAi ZXNjIiwgYV9jcnRjLT5lc2NfcmVzZXQpOwo+ICAJCWRwdV9yZXNldF9hc3NlcnQoYV9jcnRjLT5k ZXYsICJtY2xrIiwgYV9jcnRjLT5tY2xrX3Jlc2V0KTsKPiAgCQlkcHVfcmVzZXRfYXNzZXJ0KGFf Y3J0Yy0+ZGV2LCAiYWNsayIsIGFfY3J0Yy0+YWNsa19yZXNldCk7Cj4gIAkJZHB1X3Jlc2V0X2Fz c2VydChhX2NydGMtPmRldiwgImRzYyIsIGFfY3J0Yy0+ZHNjX3Jlc2V0KTsKPiAgCQl1c2xlZXBf cmFuZ2UoMTAwMDAsIDIwMDAwKTsKCltTZXZlcml0eTogSGlnaF0KSXMgaXQgc2FmZSB0byBjYWxs IHVzbGVlcF9yYW5nZSgpIGhlcmU/IENSVEMgYXRvbWljIGVuYWJsZSBjYWxsYmFja3MgYXJlCmlu dm9rZWQgaW4gYXRvbWljIGNvbnRleHQgZHVyaW5nIG5vbi1ibG9ja2luZyBjb21taXRzLCB3aGVy ZSBzbGVlcGluZyBmdW5jdGlvbnMKYXJlIHN0cmljdGx5IGZvcmJpZGRlbiBhbmQgY2FuIGNhdXNl IGtlcm5lbCBwYW5pY3Mgb3Igc3lzdGVtIGluc3RhYmlsaXR5LgoKPiAgCQlhX2NydGMtPmZpcnN0 X21vZGVzZXQgPSBmYWxzZTsKPiAgCX0KPiAgCj4gIAlpZiAoIWFfY3J0Yy0+Y2xvY2tzX29uKSB7 Cj4gIAkJYV9jcnRjLT5jbG9ja3Nfb24gPSB0cnVlOwo+ICAJCWRwdV9wbV9yZXN1bWUoYV9jcnRj LT5kZXYpOwoKW1NldmVyaXR5OiBNZWRpdW1dCkRvZXMgc2V0dGluZyBhX2NydGMtPmNsb2Nrc19v biB0byB0cnVlIGJlZm9yZSB0aGUgaGFyZHdhcmUgY2xvY2tzIGFyZSBhY3R1YWxseQpyZXN1bWVk IGluIGRwdV9wbV9yZXN1bWUoKSBpbnRyb2R1Y2UgYSBUT0NUT1UgcmFjZT8gSWYgYSBzcHVyaW91 cyBvciBwZW5kaW5nCmludGVycnVwdCBmaXJlcyBpbiB0aGlzIHdpbmRvdywgdGhlIElTUiBtaWdo dCByZWFkIE1NSU8gcmVnaXN0ZXJzIGJlZm9yZSB0aGUKY2xvY2tzIGFyZSBmdWxseSByZXN1bWVk LCB3aGljaCBjb3VsZCBsZWFkIHRvIGEgYnVzIHN0YWxsLgoKPiAgCj4gIAkJLyoKPiAgCQkgKiBU aGUgRFBVIG11c3Qgc2V0dGxlIGFmdGVyIHJlc2V0IGRlYXNzZXJ0IG9yIENGR19SRFkgcmFjZXMK PiAgCQkgKiB0aGUgZmx1c2guCj4gIAkJICovCj4gIAkJdXNsZWVwX3JhbmdlKDEwMDAwLCAyMDAw MCk7Cj4gIAl9Cj4gIApbIC4uLiBdCj4gQEAgLTEyNCwzMSArMTIwLDI5IEBACj4gIHN0YXRpYyB2 b2lkIHNwYWNlbWl0X2NydGNfYXRvbWljX2Rpc2FibGUoc3RydWN0IGRybV9jcnRjICpjcnRjLAo+ ICAJCQkJCSBzdHJ1Y3QgZHJtX2F0b21pY19jb21taXQgKm9sZF9zdGF0ZSkKPiAgewo+ICAJc3Ry dWN0IHNwYWNlbWl0X2NydGMgKmFfY3J0YyA9IHRvX3NwYWNlbWl0X2NydGMoY3J0Yyk7Cj4gIAlz dHJ1Y3QgZHJtX2RldmljZSAqZHJtID0gYV9jcnRjLT5jcnRjLmRldjsKPiAgCWludCBpZHg7Cj4g IAo+ICAJaWYgKCFkcm1fZGV2X2VudGVyKGRybSwgJmlkeCkpCj4gIAkJcmV0dXJuOwo+ICAKPiAg CXRyYWNlX3NwYWNlbWl0X2NydGNfYXRvbWljX2Rpc2FibGUoYV9jcnRjLT5kZXZfaWQpOwo+ICAK PiAgCXNwYWNlbWl0X2NydGNfdW5pbml0KGFfY3J0Yyk7Cj4gIAo+ICAJZHJtX2NydGNfdmJsYW5r X29mZigmYV9jcnRjLT5jcnRjKTsKPiAgCj4gIAkvKgo+ICAJICogTU1JTyBvbiBhIGNsb2NrLWdh dGVkIERQVSBzdGFsbHMgdGhlIGJ1cywgc28gYW4gaW4tZmxpZ2h0IGhhbmRsZXIKPiAgCSAqIG11 c3QgZmluaXNoIGl0cyBzdGF0dXMgcmVhZHMgYmVmb3JlIGRwdV9wbV9zdXNwZW5kKCkgZ2F0ZXMg dGhlCj4gIAkgKiBjbG9ja3MuCj4gIAkgKi8KPiAgCWlmIChhX2NydGMtPmlycV9vbmxpbmUgPiAw KQo+ICAJCXN5bmNocm9uaXplX2lycShhX2NydGMtPmlycV9vbmxpbmUpOwo+ICAKPiAgCS8qCj4g IAkgKiBOb3RoaW5nIGVsc2UgY2FuY2VscyB0aGUgd2F0Y2hkb2c7IGl0IHdvdWxkIGZpcmUgYWdh aW5zdCBmcmVlZCBzdGF0ZS4KPiAgCSAqLwo+ICAJdGltZXJfZGVsZXRlX3N5bmMoJmFfY3J0Yy0+ Y2ZnX3JkeV90aW1lcik7Cj4gIAo+ICAJLyogQ2xvc2UgdGhlIElTUidzIE1NSU8gZ2F0ZSBiZWZv cmUgdGhlIGNsb2NrcyBhY3R1YWxseSBzdG9wLiAqLwo+ICAJYV9jcnRjLT5jbG9ja3Nfb24gPSBm YWxzZTsKPiAgCWRwdV9wbV9zdXNwZW5kKGFfY3J0Yy0+ZGV2KTsKCltTZXZlcml0eTogSGlnaF0K QXJlIHRoZXJlIGNhbGxzIHRvIG11bHRpcGxlIGJsb2NraW5nIGFuZCBzbGVlcGluZyBmdW5jdGlv bnMgd2l0aGluIHRoaXMgYXRvbWljCmRpc2FibGUgcGF0aD8gRnVuY3Rpb25zIGxpa2Ugc3luY2hy b25pemVfaXJxKCksIHRpbWVyX2RlbGV0ZV9zeW5jKCksIGFuZCBhbnkKcG90ZW50aWFsIHNsZWVw aW5nIGluc2lkZSBkcHVfcG1fc3VzcGVuZCgpIHZpb2xhdGUgYXRvbWljIGNvbnRleHQgcmVxdWly ZW1lbnRzLgoKW1NldmVyaXR5OiBIaWdoXQpDb3VsZCBzZXR0aW5nIGFfY3J0Yy0+Y2xvY2tzX29u ID0gZmFsc2UgYWZ0ZXIgY2FsbGluZyBzeW5jaHJvbml6ZV9pcnEoKSBjcmVhdGUKYSBUT0NUT1Ug cmFjZSB3aW5kb3c/IEEgbmV3IGludGVycnVwdCBjb3VsZCBmaXJlIGltbWVkaWF0ZWx5IGFmdGVy CnN5bmNocm9uaXplX2lycSgpIHJldHVybnMsIGFuZCB0aGUgbmV3IElTUiBpbnN0YW5jZSB3b3Vs ZCBzZWUgY2xvY2tzX29uIGFzCnRydWUgYW5kIGFjY2VzcyBNTUlPIGNvbmN1cnJlbnRseSB3aGls ZSBkcHVfcG1fc3VzcGVuZCgpIGdhdGVzIHRoZSBjbG9ja3MsCnBvdGVudGlhbGx5IGhhbmdpbmcg dGhlIGJ1cy4KCj4gIAo+ICAJc3Bpbl9sb2NrX2lycSgmZHJtLT5ldmVudF9sb2NrKTsKPiAgCWlm IChjcnRjLT5zdGF0ZS0+ZXZlbnQpIHsKPiAgCQlkcm1fY3J0Y19zZW5kX3ZibGFua19ldmVudChj cnRjLCBjcnRjLT5zdGF0ZS0+ZXZlbnQpOwo+ICAJCWNydGMtPnN0YXRlLT5ldmVudCA9IE5VTEw7 ClsgLi4uIF0KPiBAQCAtMTcxLDE1ICsxNjUsMTQgQEAKPiAgc3RhdGljIGludCBzcGFjZW1pdF9j cnRjX2F0b21pY19jaGVjayhzdHJ1Y3QgZHJtX2NydGMgKmNydGMsCj4gIAkJCQkgICAgICBzdHJ1 Y3QgZHJtX2F0b21pY19jb21taXQgKmF0b21pY19zdGF0ZSkKPiAgewo+ICAJc3RydWN0IGRybV9j cnRjX3N0YXRlICpzdGF0ZSA9Cj4gIAkJCWRybV9hdG9taWNfZ2V0X25ld19jcnRjX3N0YXRlKGF0 b21pY19zdGF0ZSwgY3J0Yyk7Cj4gIAlzdHJ1Y3Qgc3BhY2VtaXRfY3J0Y19zdGF0ZSAqY3N0YXRl ID0gdG9fc3BhY2VtaXRfY3J0Y19zdGF0ZShzdGF0ZSk7Cj4gIAlzdHJ1Y3Qgc3BhY2VtaXRfY3J0 YyAqYV9jcnRjID0gdG9fc3BhY2VtaXRfY3J0YyhjcnRjKTsKPiAgCWludCByZXQgPSAwOwo+ICAK PiAgCXRyYWNlX3NwYWNlbWl0X2NydGNfYXRvbWljX2NoZWNrKGFfY3J0Yy0+ZGV2X2lkKTsKPiAg Cj4gIAlyZXQgPSBzcGFjZW1pdF9jcnRjX2F0b21pY19jaGVja19mYm1lbShjcnRjLCBzdGF0ZSk7 Cj4gIAlpZiAocmV0KSB7Cj4gIAkJZHJtX2RiZ19rbXMoY3J0Yy0+ZGV2LAo+ICAJCQkgICAgImZh aWxlZCB0byBzYXRpc2Z5IGZiY21lbSBzaXplIGZvciBhbGwgcmRtYXNcbiIpOwo+ICAJCXJldHVy biByZXQ7Cj4gIAl9Cj4gIAo+ICAJc2F0dXJuX2NvdW50X3JkbWFfdXNlKHN0YXRlKTsKPiAgCj4g IAlyZXQgPSBzcGFjZW1pdF9jbWRsaXN0X2FsbG9jKGFfY3J0Yy0+ZGV2LCAmY3N0YXRlLT5jbCk7 Cj4gIAlpZiAocmV0KQo+ICAJCXJldHVybiByZXQ7CgpbU2V2ZXJpdHk6IEhpZ2hdCklzIGl0IHBv c3NpYmxlIGZvciB0aGlzIERNQSBhbGxvY2F0aW9uIGluIGF0b21pY19jaGVjaygpIHRvIGNhdXNl IG1lbW9yeSBsZWFrcz8KSWYgdGhlIERSTSBjb3JlIHJldHJpZXMgdGhlIGNvbW1pdCAoZm9yIGV4 YW1wbGUsIGR1ZSB0byAtRURFQURMSyBiYWNrb2ZmKSwKYXRvbWljX2NoZWNrKCkgaXMgY2FsbGVk IGFnYWluIG9uIHRoZSBzYW1lIHN0YXRlLiBUaGlzIHdvdWxkIG92ZXJ3cml0ZSB0aGUKcG9pbnRl ciBhbmQgcGVybWFuZW50bHkgbGVhayB0aGUgcHJldmlvdXMgYWxsb2NhdGlvbiwgYWxsb3dpbmcg dW5wcml2aWxlZ2VkCnVzZXJzcGFjZSB0byB0cmlnZ2VyIGEgZGVuaWFsIG9mIHNlcnZpY2Ugdmlh IFRFU1RfT05MWSBjb21taXRzLgoKPiAgCj4gIAlyZXR1cm4gMDsKPiAgfQo+ICAKWyAuLi4gXQo+ IEBAIC0yMTEsMjEgKzIwNCwxOCBAQAo+ICBzdGF0aWMgc3RydWN0IGRybV9jcnRjX3N0YXRlICoK PiAgc3BhY2VtaXRfY3J0Y19kdXBsaWNhdGVfc3RhdGUoc3RydWN0IGRybV9jcnRjICpjcnRjKQo+ ICB7Cj4gIAlzdHJ1Y3Qgc3BhY2VtaXRfY3J0Y19zdGF0ZSAqc3RhdGU7Cj4gIAlzdHJ1Y3Qgc3Bh Y2VtaXRfZHJtX3ByaXZhdGUgKnByaXYgPSBjcnRjLT5kZXYtPmRldl9wcml2YXRlOwo+ICAJc3Ry dWN0IHNwYWNlbWl0X2h3X2RldmljZSAqaHdkZXYgPSBwcml2LT5od2RldjsKPiAgCXU4IG5fcmRt YTsKPiAgCj4gIAlpZiAoV0FSTl9PTighY3J0Yy0+c3RhdGUpKQo+ICAJCXJldHVybiBOVUxMOwo+ ICAKPiAgCXN0YXRlID0ga3phbGxvY19vYmooKnN0YXRlKTsKPiAgCWlmICghc3RhdGUpCj4gIAkJ cmV0dXJuIE5VTEw7Cj4gIAo+ICAJX19kcm1fYXRvbWljX2hlbHBlcl9jcnRjX2R1cGxpY2F0ZV9z dGF0ZShjcnRjLCAmc3RhdGUtPmJhc2UpOwo+ICAKPiAgCW5fcmRtYSA9IGh3ZGV2LT5yZG1hX251 bXM7Cj4gIAlzdGF0ZS0+cmRtYXMgPSBremFsbG9jX29ianMoKnN0YXRlLT5yZG1hcywgbl9yZG1h KTsKPiAgCWlmICghc3RhdGUtPnJkbWFzKSB7Cj4gIAkJa2ZyZWUoc3RhdGUpOwo+ICAJCXJldHVy biBOVUxMOwo+ICAJfQoKW1NldmVyaXR5OiBNZWRpdW1dCldpbGwgdGhpcyBlcnJvciBwYXRoIGxl YWsgRFJNIHByb3BlcnR5IGJsb2IgcmVmZXJlbmNlcz8gVGhlIGNhbGwgdG8KX19kcm1fYXRvbWlj X2hlbHBlcl9jcnRjX2R1cGxpY2F0ZV9zdGF0ZSgpIGluY3JlbWVudHMgYmxvYiByZWZjb3VudHMs IGJ1dCBpZgpremFsbG9jX29ianMoKSBmYWlscywga2ZyZWUoc3RhdGUpIGlzIGNhbGxlZCB3aXRo b3V0IGRyb3BwaW5nIHRob3NlIGJsb2IKcmVmZXJlbmNlcyB2aWEgX19kcm1fYXRvbWljX2hlbHBl cl9jcnRjX2Rlc3Ryb3lfc3RhdGUoKS4KCj4gIAo+ICAJc3RhdGUtPmNsLnR5cGUgPSBDTURMSVNU X0NSVEM7Cj4gIAo+ICAJcmV0dXJuICZzdGF0ZS0+YmFzZTsKPiAgfQpbIC4uLiBdCj4gQEAgLTQ4 MSwyNiArNDcxLDIxIEBACj4gIHN0YXRpYyBpbnQgc3BhY2VtaXRfZHJtX21hc3Rlcl9iaW5kKHN0 cnVjdCBkZXZpY2UgKmRldikKPiAgewo+ICAJc3RydWN0IHNwYWNlbWl0X2RybV9wcml2YXRlICpw cml2ID0gZGV2X2dldF9kcnZkYXRhKGRldik7Cj4gIAlzdHJ1Y3QgZGV2aWNlX25vZGUgKm5wID0g ZGV2LT5vZl9ub2RlOwo+ICAJc3RydWN0IGRldmljZV9ub2RlICpwb3J0cyA9IE5VTEwsICpwb3J0 ID0gTlVMTDsKPiAgCXN0cnVjdCBzcGFjZW1pdF9jcnRjICphX2NydGM7Cj4gIAlzdHJ1Y3QgZHJt X3BsYW5lICpwbGFuZTsKPiAgCXN0cnVjdCBzcGFjZW1pdF9rbXMgKmttczsKPiAgCXN0cnVjdCBk cm1fZGV2aWNlICpkcm07Cj4gIAlpbnQgcmV0Owo+ICAKPiAgCXJldCA9IGFwZXJ0dXJlX3JlbW92 ZV9hbGxfY29uZmxpY3RpbmdfZGV2aWNlcyhzcGFjZW1pdF9kcm1fZHJ2Lm5hbWUpOwo+ICAJaWYg KHJldCkgewo+ICAJCWRldl9lcnIoZGV2LCAiZmFpbGVkIHRvIHJlbW92ZSBleGlzdGluZyBmcmFt ZWJ1ZmZlcnM6ICVkXG4iLAo+ICAJCQlyZXQpOwo+ICAJCXJldHVybiByZXQ7Cj4gIAl9Cj4gIAo+ ICAJa21zID0gZGV2bV9kcm1fZGV2X2FsbG9jKGRldiwgJnNwYWNlbWl0X2RybV9kcnYsCj4gIAkJ CQkgc3RydWN0IHNwYWNlbWl0X2ttcywgZHJtKTsKPiAgCWlmIChJU19FUlIoa21zKSkKPiAgCQly ZXR1cm4gUFRSX0VSUihrbXMpOwo+ICAJZHJtID0gJmttcy0+ZHJtOwo+ICAJcHJpdi0+ZGRldiA9 IGRybTsKPiAgCWRybS0+ZGV2X3ByaXZhdGUgPSBwcml2Owo+ICAKPiAgCXJldCA9IHNwYWNlbWl0 X2RybV9tb2RlX2NvbmZpZ19pbml0KGRybSk7Cj4gIAlpZiAocmV0KQo+ICAJCXJldHVybiByZXQ7 Cj4gIAo+ICAJYV9jcnRjID0gZHJtbV9remFsbG9jKGRybSwgc2l6ZW9mKCphX2NydGMpLCBHRlBf S0VSTkVMKTsKPiAgCWlmICghYV9jcnRjKSB7Cj4gIAkJcmV0ID0gLUVOT01FTTsKPiAgCQlnb3Rv IGVycl9kYzsKPiAgCX0KPiAgCWFfY3J0Yy0+ZGV2ID0gZGV2Owo+ICAJYV9jcnRjLT5maXJzdF9t b2Rlc2V0ID0gdHJ1ZTsKPiAgCXByaXYtPmFfY3J0YyA9IGFfY3J0YzsKPiAgCj4gIAlhX2NydGMt PmNsa19jdHggPSBwcml2LT5jbGtfY3R4Owo+ICAJYV9jcnRjLT5hY2xrID0gRFBVX0FYSUNMS19E RUZBVUxUOwo+ICAJYV9jcnRjLT5tY2xrX3Jlc2V0ID0gcHJpdi0+bWNsa19yZXNldDsKPiAgCWFf Y3J0Yy0+ZXNjX3Jlc2V0ID0gcHJpdi0+ZXNjX3Jlc2V0Owo+ICAJYV9jcnRjLT5sY2RfcmVzZXQg PSBwcml2LT5sY2RfcmVzZXQ7Cj4gIAlhX2NydGMtPmFjbGtfcmVzZXQgPSBwcml2LT5hY2xrX3Jl c2V0Owo+ICAJYV9jcnRjLT5kc2NfcmVzZXQgPSBwcml2LT5kc2NfcmVzZXQ7Cj4gIAlhX2NydGMt PmlycV9vbmxpbmUgPSBwcml2LT5pcnFfb25saW5lOwo+ICAKPiAgCS8qIEJvdGggSzMgRFBVIGlu c3RhbmNlcyBhcmUgQ09NUE9TRVIxIGluIHRoZSBTYXR1cm4gSVJRIHRhYmxlcy4gKi8KPiAgCWFf Y3J0Yy0+ZGV2X2lkID0gQ09NUE9TRVIxOwo+ICAKPiAgCS8qIFRoZSBLMyBwaXBlbGluZSBhbHdh eXMgaGFuZHMgUkdCODg4IHRvIHRoZSBEUC9lRFAgZW5jb2Rlci4gKi8KPiAgCWFfY3J0Yy0+b3V0 X2Zvcm1hdCA9IE9VVEZNVF9SR0I4ODg7Cj4gIAo+ICAJYV9jcnRjLT5jb3JlID0gJmRwdV9zYXR1 cm5fb3BzOwo+ICAKPiAgCXRpbWVyX3NldHVwKCZhX2NydGMtPmNmZ19yZHlfdGltZXIsIHNwYWNl bWl0X2NmZ19yZHlfdGltZXJfaGFuZGxlciwgMCk7Cj4gIAo+ICAJcGxhbmUgPSBzcGFjZW1pdF9w bGFuZV9pbml0KGRybSwgYV9jcnRjKTsKPiAgCWlmIChJU19FUlIocGxhbmUpKSB7Cj4gIAkJcmV0 ID0gUFRSX0VSUihwbGFuZSk7Cj4gIAkJZ290byBlcnJfZGM7Cj4gIAl9Cj4gIAo+ICAJcG9ydHMg PSBvZl9nZXRfY2hpbGRfYnlfbmFtZShucCwgInBvcnRzIik7Cj4gIAlpZiAoIXBvcnRzKSB7Cj4g IAkJZGV2X2VycihkZXYsICJDUlRDICVwT0YgaGFzIG5vIHBvcnRzIG5vZGVcbiIsIG5wKTsKPiAg CQlyZXQgPSAtRUlOVkFMOwo+ICAJCWdvdG8gZXJyX2RjOwo+ICAJfQo+ICAKPiAgCXBvcnQgPSBv Zl9nZXRfY2hpbGRfYnlfbmFtZShwb3J0cywgInBvcnQiKTsKPiAgCWlmICghcG9ydCkgewo+ICAJ CWRldl9lcnIoZGV2LCAiQ1JUQyAlcE9GIGhhcyBubyBwb3J0QFggbm9kZVxuIiwgbnApOwo+ICAJ CXJldCA9IC1FSU5WQUw7Cj4gIAkJZ290byBlcnJfcG9ydHNfcHV0Owo+ICAJfQo+ICAKPiAgCXJl dCA9IHNwYWNlbWl0X2NydGNfYmluZF9pbml0KGRybSwgJmFfY3J0Yy0+Y3J0YywgcGxhbmUsIHBv cnQpOwo+ICAJb2Zfbm9kZV9wdXQocG9ydCk7Cj4gIAlvZl9ub2RlX3B1dChwb3J0cyk7Cj4gIAlw b3J0ID0gTlVMTDsKPiAgCXBvcnRzID0gTlVMTDsKPiAgCWlmIChyZXQpCj4gIAkJZ290byBlcnJf ZGM7Cj4gIAo+ICAJLyoKPiAgCSAqIGNvbXBvbmVudF9iaW5kX2FsbCgpIHVuYmluZHMgd2hhdCBp dCBib3VuZCBiZWZvcmUgcmV0dXJuaW5nIGFuIGVycm9yLgo+ICAJICovCj4gIAlyZXQgPSBjb21w b25lbnRfYmluZF9hbGwoZGV2LCBkcm0pOwo+ICAJaWYgKHJldCkgewo+ICAJCWRldl9lcnIoZGV2 LCAiZmFpbGVkIHRvIGJpbmQgYWxsIGNvbXBvbmVudHNcbiIpOwo+ICAJCWdvdG8gZXJyX2RjOwo+ ICAJfQo+ICAKPiAgCXJldCA9IGRybV92YmxhbmtfaW5pdChkcm0sIGRybS0+bW9kZV9jb25maWcu bnVtX2NydGMpOwo+ICAJaWYgKHJldCkgewo+ICAJCWRldl9lcnIoZGV2LCAiZmFpbGVkIHRvIGlu aXRpYWxpemUgdmJsYW5rXG4iKTsKPiAgCQlnb3RvIGVycl91bmJpbmRfYWxsOwo+ICAJfQo+ICAK PiAgCWRybV9tb2RlX2NvbmZpZ19yZXNldChkcm0pOwo+ICAJZHJtbV9rbXNfaGVscGVyX3BvbGxf aW5pdChkcm0pOwo+ICAJZHJtX2hlbHBlcl9ocGRfaXJxX2V2ZW50KGRybSk7Cj4gIAo+ICAJZW5h YmxlX2lycShwcml2LT5pcnFfb25saW5lKTsKCltTZXZlcml0eTogSGlnaF0KRG9lcyB1bm1hc2tp bmcgdGhlIE9TIElSUSBoZXJlIGJlZm9yZSB0aGUgaGFyZHdhcmUgc3RhdGUgaXMgcHJlcGFyZWQg Y2F1c2UgYW4KaW50ZXJydXB0IHN0b3JtPyBJZiB0aGUgYm9vdGxvYWRlciBsZWZ0IHRoZSBkaXNw bGF5IHBpcGVsaW5lIGFjdGl2ZSwgYW4KaW50ZXJydXB0IGZpcmVzIGltbWVkaWF0ZWx5LiBUaGUg SVNSIGluIHNwYWNlbWl0X2RwdV9pc3IoKSB3aWxsIHNlZQpjbG9ja3Nfb24gPT0gZmFsc2UgYW5k IGJhaWwgb3V0IHdpdGggSVJRX05PTkUgd2l0aG91dCBhY2tub3dsZWRnaW5nIHRoZQppbnRlcnJ1 cHQsIGZvcmNpbmcgdGhlIGtlcm5lbCB0byBwZXJtYW5lbnRseSBkaXNhYmxlIHRoZSBJUlEgbGlu ZS4KCj4gIAo+ICAJcmV0ID0gZHJtX2Rldl9yZWdpc3Rlcihkcm0sIDApOwo+ICAJaWYgKHJldCA8 IDApCj4gIAkJZ290byBlcnJfZGlzYWJsZV9pcnE7Cj4gIAlkcm1fY2xpZW50X3NldHVwKGRybSwg TlVMTCk7Cj4gIAo+ICAJcmV0dXJuIDA7ClsgLi4uIF0KPiBAQCAtNTkxLDE2ICs1NzYsMTQgQEAK PiAgc3RhdGljIHZvaWQgc3BhY2VtaXRfZHJtX21hc3Rlcl91bmJpbmQoc3RydWN0IGRldmljZSAq ZGV2KQo+ICB7Cj4gIAlzdHJ1Y3Qgc3BhY2VtaXRfZHJtX3ByaXZhdGUgKnByaXYgPSBkZXZfZ2V0 X2RydmRhdGEoZGV2KTsKPiAgCXN0cnVjdCBkcm1fZGV2aWNlICpkcm0gPSBwcml2LT5kZGV2Owo+ ICAKPiAgCWRpc2FibGVfaXJxKHByaXYtPmlycV9vbmxpbmUpOwo+ICAKPiAgCWRybV9kZXZfdW5y ZWdpc3Rlcihkcm0pOwo+ICAJZHJtX2F0b21pY19oZWxwZXJfc2h1dGRvd24oZHJtKTsKCltTZXZl cml0eTogSGlnaF0KSXMgdGhlIHRlYXJkb3duIG9yZGVyIGNvcnJlY3QgaGVyZT8gQ2FsbGluZyBk aXNhYmxlX2lycSgpIGJlZm9yZQpkcm1fYXRvbWljX2hlbHBlcl9zaHV0ZG93bigpIGNhbiBjYXVz ZSBtdWx0aS1zZWNvbmQgc3RhbGxzLCBhcyB0aGUgc2h1dGRvd24KcHJvY2VzcyBpc3N1ZXMgYSBm dWxsIG1vZGVzZXQgdG8gZGlzYWJsZSBDUlRDcyBhbmQgd2FpdHMgZm9yIHZibGFuayBpbnRlcnJ1 cHRzCnRoYXQgd2lsbCBuZXZlciBhcnJpdmUgc2luY2UgdGhlIElSUSBpcyBkaXNhYmxlZC4KCltT ZXZlcml0eTogSGlnaF0KQ291bGQgY2FsbGluZyBkcm1fZGV2X3VucmVnaXN0ZXIoKSB3aXRob3V0 IHNldHRpbmcgdGhlIHVucGx1Z2dlZCBzdGF0ZSB2aWEKZHJtX2Rldl91bnBsdWcoKSBsZWF2ZSBp b2N0bCBlbnRyeSBwYXRocyBvcGVuIHdoaWxlIGRldm0gcmVzb3VyY2VzIGFyZSBmcmVlZD8KSWYg dXNlcnNwYWNlIGhvbGRzIGFuIG9wZW4gRFJNIGZpbGUgZGVzY3JpcHRvciwgaW9jdGxzIGNhbiBz dGlsbCBleGVjdXRlCmJlY2F1c2UgZHJtX2Rldl9lbnRlcigpIHdpbGwgc3VjY2VlZCwgbGVhZGlu ZyB0byBhIFVzZS1BZnRlci1GcmVlIHdoZW4gdGhleQpkZXJlZmVyZW5jZSB0aGUgZnJlZWQgcHJp diBwb2ludGVyLgoKPiAgCWNvbXBvbmVudF91bmJpbmRfYWxsKGRldiwgZHJtKTsKPiAgCj4gIAkv KiAuc2h1dGRvd24gYW5kIGEgbGF0ZXIgcmUtYmluZCBtdXN0IG5vdCB0b3VjaCB0aGUgc3RhbGUg aW5zdGFuY2UuICovCj4gIAlwcml2LT5kZGV2ID0gTlVMTDsKPiAgCXByaXYtPmFfY3J0YyA9IE5V TEw7Cj4gIH0KWyAuLi4gXQo+IEBAIC03NDcsMjEgKzczMCwxNyBAQAo+ICBzdGF0aWMgaW50IGRw dV9wbV9yZXN1bWUoc3RydWN0IGRldmljZSAqZGV2KQo+ICB7Cj4gIAlzdHJ1Y3Qgc3BhY2VtaXRf ZHJtX3ByaXZhdGUgKnByaXYgPSBkZXZfZ2V0X2RydmRhdGEoZGV2KTsKPiAgCXN0cnVjdCBzcGFj ZW1pdF9jcnRjICphX2NydGMgPSBwcml2LT5hX2NydGM7Cj4gIAo+ICAJZHB1X3Jlc2V0X2RlYXNz ZXJ0KGRldiwgIm1jbGsiLCBhX2NydGMtPm1jbGtfcmVzZXQpOwo+ICAJZHB1X3Jlc2V0X2RlYXNz ZXJ0KGRldiwgImVzYyIsIGFfY3J0Yy0+ZXNjX3Jlc2V0KTsKPiAgCWRwdV9yZXNldF9kZWFzc2Vy dChkZXYsICJsY2QiLCBhX2NydGMtPmxjZF9yZXNldCk7Cj4gIAlkcHVfcmVzZXRfZGVhc3NlcnQo ZGV2LCAiYWNsayIsIGFfY3J0Yy0+YWNsa19yZXNldCk7Cj4gIAlkcHVfcmVzZXRfZGVhc3NlcnQo ZGV2LCAiZHNjIiwgYV9jcnRjLT5kc2NfcmVzZXQpOwo+ICAKPiAgCWlmIChhX2NydGMtPmNvcmUg JiYgYV9jcnRjLT5jb3JlLT5lbmFibGVfY2xrKQo+ICAJCWFfY3J0Yy0+Y29yZS0+ZW5hYmxlX2Ns ayhhX2NydGMpOwoKW1NldmVyaXR5OiBNZWRpdW1dCkFyZSBoYXJkd2FyZSByZXNldHMgYmVpbmcg ZGVhc3NlcnRlZCBiZWZvcmUgY2xvY2tzIGFyZSBlbmFibGVkPyBSZXNldCBlZGdlcwpjYW5ub3Qg cHJvcGFnYXRlIHRocm91Z2ggZ2F0ZWQgaGFyZHdhcmUgYmxvY2tzLCBzbyB0aGUgY2xvY2tzIHNo b3VsZCBsaWtlbHkgYmUKZW5hYmxlZCBiZWZvcmUgZGVhc3NlcnRpbmcgcmVzZXRzIHRvIGVuc3Vy ZSBhIGNsZWFuIGluaXRpYWxpemF0aW9uIGFuZCBhdm9pZApoYXJkd2FyZSBzdGF0ZSBtYWNoaW5l IHZpb2xhdGlvbnMuCgo+ICAKPiAgCXJldHVybiAwOwo+ICB9Cj4gIAo+ICBzdGF0aWMgY29uc3Qg c3RydWN0IG9mX2RldmljZV9pZCBkcHVfbWF0Y2hfdGFibGVbXSA9IHsKPiAgCXsKPiAgCQkuY29t cGF0aWJsZSA9ICJzcGFjZW1pdCxrMy1zYXR1cm4tZHB1IiwKPiAgCQkuZGF0YSA9ICZrM19zYXR1 cm5fZHB1LAo+ICAJfSwKPiAgCXt9LAo+ICB9Owo+ICBNT0RVTEVfREVWSUNFX1RBQkxFKG9mLCBk cHVfbWF0Y2hfdGFibGUpOwo+ICAKPiAgc3RhdGljIHN0cnVjdCBwbGF0Zm9ybV9kcml2ZXIgc3Bh Y2VtaXRfZHB1X2RyaXZlciA9IHsKPiAgCS5wcm9iZSA9IHNwYWNlbWl0X2RwdV9wcm9iZSwKPiAg CS5yZW1vdmUgPSBzcGFjZW1pdF9kcHVfcmVtb3ZlLAo+ICAJLnNodXRkb3duID0gc3BhY2VtaXRf ZHB1X3NodXRkb3duLAo+ICAJLmRyaXZlciA9IHsKPiAgCQkubmFtZSA9ICJzcGFjZW1pdC1kcHUt ZHJ2IiwKPiAgCQkub2ZfbWF0Y2hfdGFibGUgPSBkcHVfbWF0Y2hfdGFibGUsCj4gIAkJLnN1cHBy ZXNzX2JpbmRfYXR0cnMgPSB0cnVlLAo+ICAJfSwKPiAgfTsKPiAgbW9kdWxlX3BsYXRmb3JtX2Ry aXZlcihzcGFjZW1pdF9kcHVfZHJpdmVyKTsKPiAgCj4gIE1PRFVMRV9ERVNDUklQVElPTigiU3Bh Y2VtaVQgRFJNIEtNUyBtYXN0ZXIgZHJpdmVyIik7Cj4gIE1PRFVMRV9MSUNFTlNFKCJHUEwiKTsK PiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9ncHUvZHJtL3NwYWNlbWl0L3NwYWNlbWl0X3BsYW5lcy5j IGIvZHJpdmVycy9ncHUvZHJtL3NwYWNlbWl0L3NwYWNlbWl0X3BsYW5lcy5jCj4gLS0tIGEvZHJp dmVycy9ncHUvZHJtL3NwYWNlbWl0L3NwYWNlbWl0X3BsYW5lcy5jCj4gKysrIGIvZHJpdmVycy9n cHUvZHJtL3NwYWNlbWl0L3NwYWNlbWl0X3BsYW5lcy5jCj4gQEAgLTEwNywzMSArMTA0LDI3IEBA Cj4gIHN0YXRpYyBpbnQgc3BhY2VtaXRfcGxhbmVfYXRvbWljX2NoZWNrKHN0cnVjdCBkcm1fcGxh bmUgKnBsYW5lLAo+ICAJCQkJICAgICAgIHN0cnVjdCBkcm1fYXRvbWljX2NvbW1pdCAqYXRvbWlj X3N0YXRlKQo+ICB7Cj4gIAlzdHJ1Y3QgZHJtX3BsYW5lX3N0YXRlICpzdGF0ZSA9Cj4gIAkJCWRy bV9hdG9taWNfZ2V0X25ld19wbGFuZV9zdGF0ZShhdG9taWNfc3RhdGUsIHBsYW5lKTsKPiAgCXN0 cnVjdCBkcm1fZnJhbWVidWZmZXIgKmZiID0gc3RhdGUtPmZiOwo+ICAJdTMyIHNyY193LCBzcmNf aCwgc3JjX3gsIHNyY195Owo+ICAJdTMyIGNydGNfdywgY3J0Y19oOwo+ICAJc3RydWN0IHNwYWNl bWl0X3BsYW5lX3N0YXRlICpjdXJfc3RhdGUgPSB0b19zcGFjZW1pdF9wbGFuZV9zdGF0ZShzdGF0 ZSk7Cj4gIAl1MzIgY3VyX3JkbWFfaWQgPSBjdXJfc3RhdGUtPnJkbWFfaWQ7Cj4gIAlzdHJ1Y3Qg c3BhY2VtaXRfZHJtX3ByaXZhdGUgKnByaXYgPSBwbGFuZS0+ZGV2LT5kZXZfcHJpdmF0ZTsKPiAg CXN0cnVjdCBzcGFjZW1pdF9od19kZXZpY2UgKmh3ZGV2ID0gcHJpdi0+aHdkZXY7Cj4gIAlzdHJ1 Y3Qgc3BhY2VtaXRfY3J0YyAqYV9jcnRjID0gTlVMTDsKPiAgCj4gIAlzdHJ1Y3QgZHJtX2NydGNf c3RhdGUgKmNydGNfc3RhdGUgPSBOVUxMOwo+ICAJaW50IHJldDsKPiAgCj4gIAlpZiAoc3RhdGUt PmNydGMpCj4gIAkJY3J0Y19zdGF0ZSA9IGRybV9hdG9taWNfZ2V0X25ld19jcnRjX3N0YXRlKGF0 b21pY19zdGF0ZSwKPiAgCQkJCQkJCSAgIHN0YXRlLT5jcnRjKTsKPiAgCj4gIAlyZXQgPSBkcm1f YXRvbWljX2hlbHBlcl9jaGVja19wbGFuZV9zdGF0ZShzdGF0ZSwgY3J0Y19zdGF0ZSwKPiAgCQkJ CQkJICBEUk1fUExBTkVfTk9fU0NBTElORywKPiAgCQkJCQkJICBEUk1fUExBTkVfTk9fU0NBTElO RywKPiAgCQkJCQkJICB0cnVlLCBmYWxzZSk7Cj4gIAlpZiAocmV0KQo+ICAJCXJldHVybiByZXQ7 Cj4gIAo+ICAJaWYgKCFzdGF0ZS0+dmlzaWJsZSkKPiAgCQlyZXR1cm4gMDsKPiAgCj4gIAlhX2Ny dGMgPSB0b19zcGFjZW1pdF9jcnRjKHN0YXRlLT5jcnRjKTsKPiAgCXRyYWNlX3NwYWNlbWl0X3Bs YW5lX2F0b21pY19jaGVjayhhX2NydGMtPmRldl9pZCk7Cj4gIAo+ICAJc3JjX3ggPSBzdGF0ZS0+ c3JjX3ggPj4gMTY7Cj4gIAlzcmNfeSA9IHN0YXRlLT5zcmNfeSA+PiAxNjsKPiAgCXNyY193ID0g c3RhdGUtPnNyY193ID4+IDE2Owo+ICAJc3JjX2ggPSBzdGF0ZS0+c3JjX2ggPj4gMTY7Cj4gIAlj cnRjX3cgPSBzdGF0ZS0+Y3J0Y193Owo+ICAJY3J0Y19oID0gc3RhdGUtPmNydGNfaDsKPiAgCj4g IAkvKiBUaGUgcHJvZ3JhbW1pbmcgcGF0aHMgdXNlIHRoZSByYXcgcmVjdGFuZ2xlcywgc28gcmVm dXNlIHRvIGNsaXAuICovCj4gIAlpZiAoKHN0YXRlLT5zcmMueDEgPj4gMTYpICE9IHNyY194IHx8 IChzdGF0ZS0+c3JjLnkxID4+IDE2KSAhPSBzcmNfeSB8fAo+ICAJICAgIChkcm1fcmVjdF93aWR0 aCgmc3RhdGUtPnNyYykgPj4gMTYpICE9IHNyY193IHx8Cj4gIAkgICAgKGRybV9yZWN0X2hlaWdo dCgmc3RhdGUtPnNyYykgPj4gMTYpICE9IHNyY19oIHx8Cj4gIAkgICAgc3RhdGUtPmRzdC54MSAh PSBzdGF0ZS0+Y3J0Y194IHx8IHN0YXRlLT5kc3QueTEgIT0gc3RhdGUtPmNydGNfeSB8fAo+ICAJ ICAgIGRybV9yZWN0X3dpZHRoKCZzdGF0ZS0+ZHN0KSAhPSBjcnRjX3cgfHwKPiAgCSAgICBkcm1f cmVjdF9oZWlnaHQoJnN0YXRlLT5kc3QpICE9IGNydGNfaCkgewo+ICAJCWRybV9kYmdfa21zKHBs YW5lLT5kZXYsCj4gIAkJCSAgICAiY2xpcHBlZCBwbGFuZSByZWN0YW5nbGVzIG5vdCBzdXBwb3J0 ZWRcbiIpOwo+ICAJCXJldHVybiAtRUlOVkFMOwo+ICAJfQo+ICAKPiAgCS8qIE9uZS1kaW1lbnNp b25hbCBzb3VyY2VzIGFyZSBpbnZhbGlkIChvbmx5IDB4MCA9IGNvbnN0YW50IGZpbGwpICovCj4g IAlpZiAoKHNyY193ID09IDApICE9IChzcmNfaCA9PSAwKSkgewo+ICAJCWRybV9kYmdfa21zKHBs YW5lLT5kZXYsICJ1bnN1cHBvcnRlZCBzcmNfdyAlZCBzcmNfaCAlZFxuIiwKPiAgCQkJICAgIHNy Y193LCBzcmNfaCk7Cj4gIAkJcmV0dXJuIC1FSU5WQUw7Cj4gIAl9Cj4gIAo+ICAJaWYgKHNyY193 ID09IDAgJiYgc3JjX2ggPT0gMCkKPiAgCQljdXJfcmRtYV9pZCA9IFJETUFfSU5WQUxJRF9JRDsJ LyogY29uc3RhbnQtZmlsbCBsYXllciwgbm8gUkRNQSAqLwo+ICAJZWxzZSBpZiAoY3VyX3JkbWFf aWQgPT0gUkRNQV9JTlZBTElEX0lEKQo+ICAJCWN1cl9yZG1hX2lkID0gc3RhdGUtPnpwb3M7CS8q IGZpcnN0IGNvbW1pdDogYmluZCBjaGFubmVsIGJ5IHpwb3MgKi8KPiAgCWN1cl9zdGF0ZS0+cmRt YV9pZCA9IGN1cl9yZG1hX2lkOwo+ICAKPiAgCWlmIChjdXJfcmRtYV9pZCAhPSBSRE1BX0lOVkFM SURfSUQpIHsKPiAgCQlpZiAoY3VyX3JkbWFfaWQgPj0gaHdkZXYtPnJkbWFfbnVtcykgewo+ICAJ CQlkcm1fZGJnX2ttcyhwbGFuZS0+ZGV2LCAiaW52YWxpZCByZG1hIGlkICVkXG4iLAo+ICAJCQkJ ICAgIGN1cl9yZG1hX2lkKTsKPiAgCQkJcmV0dXJuIC1FSU5WQUw7Cj4gIAkJfQo+ICAKPiAgCQlp ZiAoYV9jcnRjLT5jb3JlLT5jYWxfbGF5ZXJfZmJjbWVtX3NpemUocGxhbmUsIHN0YXRlKSkgewo+ ICAJCQlkcm1fZGJnX2ttcyhwbGFuZS0+ZGV2LAo+ICAJCQkJICAgICJwbGFuZSAlZDogaW52YWxp ZCBmYmNtZW0gc2l6ZVxuIiwKPiAgCQkJCSAgICBzdGF0ZS0+enBvcyk7Cj4gIAkJCXJldHVybiAt RUlOVkFMOwo+ICAJCX0KPiAgCj4gIAkJY3VyX3N0YXRlLT5tbXVfdGJsLnNpemUgPQo+ICAJCQko KFBBR0VfQUxJR04oZmItPm9ialswXS0+c2l6ZSkgPj4gUEFHRV9TSElGVCkgKwo+ICAJCQkgSFdf QUxJR05fVFRCX05VTSkgKiA0Owo+ICAJCWN1cl9zdGF0ZS0+bW11X3RibC52YSA9Cj4gIAkJCWRt YV9hbGxvY19jb2hlcmVudChhX2NydGMtPmRldiwgY3VyX3N0YXRlLT5tbXVfdGJsLnNpemUsCj4g IAkJCQkJICAgJmN1cl9zdGF0ZS0+bW11X3RibC5wYSwKPiAgCQkJCQkgICBHRlBfS0VSTkVMIHwg X19HRlBfWkVSTyk7Cj4gIAkJaWYgKCFjdXJfc3RhdGUtPm1tdV90YmwudmEpCj4gIAkJCXJldHVy biAtRU5PTUVNOwoKW1NldmVyaXR5OiBIaWdoXQpEb2VzIGFsbG9jYXRpbmcgRE1BIG1lbW9yeSBk aXJlY3RseSBpbnRvIHRoZSBzdGF0ZSBoZXJlIGluIGF0b21pY19jaGVjaygpCmNhdXNlIG1lbW9y eSBsZWFrcyBvbiByZXRyaWVzPyBKdXN0IGxpa2Ugd2l0aCBzcGFjZW1pdF9jbWRsaXN0X2FsbG9j KCksIGlmIHRoZQpjb21taXQgaXMgcmV0cmllZCBkdWUgdG8gLUVERUFETEsgYmFja29mZiwgdGhp cyB3aWxsIG92ZXJ3cml0ZSB0aGUgcG9pbnRlciBhbmQKcGVybWFuZW50bHkgbGVhayB0aGUgcHJl dmlvdXMgYWxsb2NhdGlvbi4KCj4gIAl9Cj4gIAo+ICAJLyoKPiAgCSAqIFRoZSBjb21taXQgY2Fu bm90IGZhaWwsIHNvIHRha2UgdGhlIERNQSBidWZmZXIgd2hpbGUgLUVOT01FTSBpcyBhbgo+ICAJ ICogYW5zd2VyLgo+ICAJICovCj4gIAlyZXQgPSBzcGFjZW1pdF9jbWRsaXN0X2FsbG9jKGFfY3J0 Yy0+ZGV2LCAmY3VyX3N0YXRlLT5jbCk7Cj4gIAlpZiAocmV0KQo+ICAJCXJldHVybiByZXQ7Cj4g IAo+ICAJY3VyX3N0YXRlLT5mb3JtYXQgPSBzcGFjZW1pdF9wbGFuZV9od19nZXRfZm9ybWF0X2lk KGZiLT5mb3JtYXQtPmZvcm1hdCk7Cj4gIAlpZiAoY3VyX3N0YXRlLT5mb3JtYXQgPT0gU1BBQ0VN SVRfRFBVX0lOVkFMSURfRk9STUFUX0lEKSB7Cj4gIAkJZHJtX2RiZ19rbXMocGxhbmUtPmRldiwg InVuc3VwcG9ydGVkIGZvcm1hdCAlcDRjY1xuIiwKPiAgCQkJICAgICZmYi0+Zm9ybWF0LT5mb3Jt YXQpOwo+ICAJCXJldHVybiAtRUlOVkFMOwo+ICAJfQo+ICAKPiAgCXJldHVybiAwOwo+ICB9Cj4g IAo+ICBzdGF0aWMgdm9pZCBzcGFjZW1pdF9wbGFuZV9hdG9taWNfdXBkYXRlKHN0cnVjdCBkcm1f cGxhbmUgKnBsYW5lLAo+ICAJCQkJCSBzdHJ1Y3QgZHJtX2F0b21pY19jb21taXQgKnN0YXRlKQo+ ICB7Cj4gIAlpbnQgcmV0ID0gMDsKPiAgCXN0cnVjdCBzcGFjZW1pdF9jcnRjICphX2NydGMgPSB0 b19zcGFjZW1pdF9jcnRjKHBsYW5lLT5zdGF0ZS0+Y3J0Yyk7Cj4gIAlzdHJ1Y3Qgc3BhY2VtaXRf cGxhbmVfc3RhdGUgKnNwYWNlbWl0X3BzdGF0ZSA9Cj4gIAkJCXRvX3NwYWNlbWl0X3BsYW5lX3N0 YXRlKHBsYW5lLT5zdGF0ZSk7Cj4gIAlzdHJ1Y3Qgc3BhY2VtaXRfZHJtX3ByaXZhdGUgKnByaXYg PSBwbGFuZS0+ZGV2LT5kZXZfcHJpdmF0ZTsKPiAgCXN0cnVjdCBzcGFjZW1pdF9od19kZXZpY2Ug Kmh3ZGV2ID0gcHJpdi0+aHdkZXY7Cj4gIAl1MzIgcmRtYV9pZCA9IHNwYWNlbWl0X3BzdGF0ZS0+ cmRtYV9pZDsKPiAgCXN0cnVjdCBjbWRsaXN0ICpjbCA9IE5VTEw7Cj4gIAlpbnQgaWR4Owo+ICAK PiAgCWlmICghZHJtX2Rldl9lbnRlcihwbGFuZS0+ZGV2LCAmaWR4KSkKPiAgCQlyZXR1cm47Cj4g IAo+ICAJdHJhY2Vfc3BhY2VtaXRfcGxhbmVfYXRvbWljX3VwZGF0ZShhX2NydGMtPmRldl9pZCk7 Cj4gIAo+ICAJaHdkZXYtPmdldF9jbF9yZG1hX2J1ZihhX2NydGMpOwoKW1NldmVyaXR5OiBIaWdo XQpJcyBpdCBzYWZlIHRvIHBlcmZvcm0gZHluYW1pYyBtZW1vcnkgYWxsb2NhdGlvbiBpbiB0aGUg YXRvbWljX3VwZGF0ZSBmYXN0IHBhdGg/ClRoZSBEUk0gYXRvbWljIHVwZGF0ZSBwaGFzZSBpcyBm b3JiaWRkZW4gdG8gZmFpbCBvciBzbGVlcC4gQW55IHRlbXBvcmFyeSBtZW1vcnkKc2hvdWxkIGJl IHByZS1hbGxvY2F0ZWQgaW4gYXRvbWljX2NoZWNrKCkgb3IgcHJlcGFyZV9mYigpLgoKW1NldmVy aXR5OiBDcml0aWNhbF0KRG9lcyBpZ25vcmluZyB0aGUgcmV0dXJuIHZhbHVlIG9mIGdldF9jbF9y ZG1hX2J1ZigpIGxlYWQgdG8gYSBVc2UtQWZ0ZXItRnJlZQpvciBEb3VibGUtRnJlZT8gSWYgaXQg ZmFpbHMsIGFfY3J0Yy0+Y2xfcmRtYSByZXRhaW5zIGl0cyBwcmV2aW91cyB2YWx1ZS4gV2hlbgpm cmVlX2NtZGxpc3RfcmVncyhhX2NydGMtPmNsX3JkbWEpIGlzIGNhbGxlZCBsYXRlciwgaXQgZnJl ZXMgdGhlIG1lbW9yeSBidXQKZG9lcyBub3Qgc2V0IHRoZSBwb2ludGVyIHRvIE5VTEwsIG1ha2lu ZyBhX2NydGMtPmNsX3JkbWEgYSBkYW5nbGluZyBwb2ludGVyIG9uCnN1YnNlcXVlbnQgZmFpbHVy ZXMuCgo+ICAKPiAgCWh3ZGV2LT5wbGFuZV91cGRhdGVfaHdfY2hhbm5lbChwbGFuZSk7Cj4gIAo+ ICAJLyogU29saWQtZmlsbCBsYXllcnMgaGF2ZSBubyBSRE1BIGFuZCBubyBwYWdlIHRhYmxlICov Cj4gIAlpZiAocmRtYV9pZCA8IGh3ZGV2LT5yZG1hX251bXMgJiYgc3BhY2VtaXRfcHN0YXRlLT5t bXVfdGJsLnZhKSB7Cj4gIAkJdTggdGJ1X2lkID0gcmRtYV9pZCAqIDI7Cj4gIAo+ICAJCXJldCA9 IHNwYWNlbWl0X2RtbXVfbWFwKHBsYW5lLT5zdGF0ZS0+ZmIsCj4gIAkJCQkJJnNwYWNlbWl0X3Bz dGF0ZS0+bW11X3RibCwgdGJ1X2lkLAo+ICAJCQkJCWFfY3J0Yy0+Y2xfcmRtYSwgcGxhbmUpOwo+ ICAJCWlmICghcmV0KQo+ICAJCQljbWRsaXN0X3JlZ3NfcGFja2luZyhwbGFuZV90b19jbChwbGFu ZSksCj4gIAkJCQkJICAgICBDTURMSVNUX01PRF9SRE1BLCBhX2NydGMtPmNsX3JkbWEpOwo+ICAJ CWVsc2UKPiAgCQkJZHJtX2VycihwbGFuZS0+ZGV2LCAiZmFpbGVkIHRvIG1hcCBwbGFuZTogJWRc biIsIHJldCk7Cj4gIAl9Cj4gIAo+ICAJY2wgPSAmc3BhY2VtaXRfcHN0YXRlLT5jbDsKPiAgCWNs LT5yY2hfc3RhcnRfY21wc195ID0gQ01ETElTVF9TRU5USU5FTF9QT0lTT047Cj4gIAljbC0+Y21k bGlzdF9jaF95X290aGVyID0gQ01ETElTVF9TRU5USU5FTF9QT0lTT047Cj4gIAlmcmVlX2NtZGxp c3RfcmVncyhhX2NydGMtPmNsX3JkbWEpOwoKW1NldmVyaXR5OiBDcml0aWNhbF0KRG9lcyB0aGlz IGZyZWVfY21kbGlzdF9yZWdzKCkgY2FsbCBsZWF2ZSBhX2NydGMtPmNsX3JkbWEgYXMgYSBkYW5n bGluZyBwb2ludGVyPwpBcyBtZW50aW9uZWQgYWJvdmUsIHNpbmNlIHRoZSBwb2ludGVyIGlzIG5v dCBjbGVhcmVkIGFmdGVyIGJlaW5nIGZyZWVkLCBhCnN1YnNlcXVlbnQgYWxsb2NhdGlvbiBmYWls dXJlIHdpbGwgbGVhdmUgdGhlIHBvaW50ZXIgcG9pbnRpbmcgdG8gZnJlZWQgbWVtb3J5LgoKPiAg Cj4gIAlkcm1fZGV2X2V4aXQoaWR4KTsKPiAgfQo+ICAKWyAuLi4gXQo+IEBAIC0yMDEsMTUgKzE5 MCwxNCBAQAo+ICBzdGF0aWMgdm9pZCBzcGFjZW1pdF9wbGFuZV9yZXNldChzdHJ1Y3QgZHJtX3Bs YW5lICpwbGFuZSkKPiAgewo+ICAJc3RydWN0IHNwYWNlbWl0X3BsYW5lX3N0YXRlICpzOwo+ICAK PiAgCWlmIChwbGFuZS0+c3RhdGUpIHsKPiAgCQlzID0gdG9fc3BhY2VtaXRfcGxhbmVfc3RhdGUo cGxhbmUtPnN0YXRlKTsKPiAgCQlfX2RybV9hdG9taWNfaGVscGVyX3BsYW5lX2Rlc3Ryb3lfc3Rh dGUocGxhbmUtPnN0YXRlKTsKPiAgCQlrZnJlZShzKTsKPiAgCQlwbGFuZS0+c3RhdGUgPSBOVUxM Owo+ICAJfQoKW1NldmVyaXR5OiBIaWdoXQpTaG91bGQgdGhpcyBjbGVhbnVwIGxvZ2ljIHV0aWxp emUgdGhlIGRyaXZlci1zcGVjaWZpYyBjdXN0b20gY2xlYW51cCBob29rPyBCeQpvcGVuLWNvZGlu ZyB0aGUgc3RhdGUgZGVzdHJ1Y3Rpb24gYW5kIGNhbGxpbmcga2ZyZWUocykgZGlyZWN0bHksIGl0 IGJ5cGFzc2VzCnNwYWNlbWl0X3BsYW5lX2F0b21pY19kZXN0cm95X3N0YXRlKCkuIFRoaXMgcGVy bWFuZW50bHkgbGVha3MgdGhlIHBsYW5lJ3MgRE1BCmFsbG9jYXRpb25zIChtbXVfdGJsLnZhIGFu ZCBjbC52YSkgd2hlbiBzcGFjZW1pdF9wbGFuZV9yZXNldCgpIGV4ZWN1dGVzIG9uIGEKcGxhbmUg dGhhdCBhbHJlYWR5IGhhcyBhIHN0YXRlLgoKPiAgCj4gIAlzID0ga3phbGxvYyhzaXplb2YoKnMp LCBHRlBfS0VSTkVMKTsKPiAgCWlmIChzKSB7Cj4gIAkJX19kcm1fYXRvbWljX2hlbHBlcl9wbGFu ZV9yZXNldChwbGFuZSwgJnMtPnN0YXRlKTsKPiAgCQlzLT5yZG1hX2lkID0gUkRNQV9JTlZBTElE X0lEOwo+ICAJfQo+ICB9Cj4KCi0tIApTYXNoaWtvIEFJIHJldmlldyDCtyBodHRwczovL3Nhc2hp a28uZGV2LyMvcGF0Y2hzZXQvMjAyNjA3MjQtazMtZGlzcGxheS12MS0wLWYyMmExMGE1Mjg2N0Bn bWFpbC5jb20/cGFydD0xMAoKLS0gCmxpbnV4LXBoeSBtYWlsaW5nIGxpc3QKbGludXgtcGh5QGxp c3RzLmluZnJhZGVhZC5vcmcKaHR0cHM6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlz dGluZm8vbGludXgtcGh5Cg== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 525ACC531C9 for ; Sat, 25 Jul 2026 05:18:12 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id AA51810F510; Sat, 25 Jul 2026 05:18:11 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.b="cpQGxhpK"; dkim-atps=neutral Received: from sea.source.kernel.org (sea.source.kernel.org [172.234.252.31]) by gabe.freedesktop.org (Postfix) with ESMTPS id 7AC5110F50F for ; Sat, 25 Jul 2026 05:18:10 +0000 (UTC) Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 3460A44098; Sat, 25 Jul 2026 05:18:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6C041F000E9; Sat, 25 Jul 2026 05:18:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784956690; bh=FGTOwC9l0p3K39rI4nwYUnhRdmfc8VuDMzntBdqs1BA=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=cpQGxhpKZsAKU/iPBxxJS3gqNQU6LnkiR3SQklpgZm1crcAMJoop2FHYgzVGWLNHn l6/RoeZ0r/EuSS4WvVURetDv68dsBlTKz0MFihslUqQB0POWr0W+rZ0I3QE1ZpVLdY j2sc5J9yymoVjlksSdsfYsKAP89DKnt4xbNcDBImbE6CnjuFdyqFxxTahmL1e6Cs13 nukD2ZxyvM52VIaTQMZo54iytqcWBc1glXwt/ft1F8/c9sbFUXSZMLXoDABHxv+mCb HhrNVLsQJRxCo6zwOGJFGX/4yZi+Vo2lgOP1K9HW0RzsuYdnElHecXOHw1La5oGZ8r FnbuSkYRvwHlA== From: sashiko-bot@kernel.org Subject: Re: [PATCH 10/17] drm/spacemit: add Saturn DPU KMS pipeline To: "Cody Kang" Cc: olteanv@gmail.com, neil.armstrong@linaro.org, conor+dt@kernel.org, dri-devel@lists.freedesktop.org, robh@kernel.org, vkoul@kernel.org, linux-phy@lists.infradead.org, devicetree@vger.kernel.org In-Reply-To: <20260724-k3-display-v1-10-f22a10a52867@gmail.com> References: <20260724-k3-display-v1-0-f22a10a52867@gmail.com> <20260724-k3-display-v1-10-f22a10a52867@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Sat, 25 Jul 2026 05:18:09 +0000 Message-Id: <20260725051809.B6C041F000E9@smtp.kernel.org> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Thank you for your contribution! Sashiko AI review found 13 potential issue= (s) to consider: - [Critical] Ignored return value of `get_cl_rdma_buf()` in `spacemit_plane= _atomic_update` leads to Use-After-Free and Double-Free. - [High] Sleeping functions called from CRTC atomic commit callbacks (`atom= ic_enable` / `atomic_disable`), violating atomic context requirements. - [High] `spacemit_plane_reset` open-codes state destruction, permanently l= eaking the plane's DMA allocations. - [High] Dynamic memory allocation occurs in the `atomic_update` fast path. - [High] Enabling the DPU IRQ before hardware reset causes an interrupt sto= rm. - [High] TOCTOU race condition in `spacemit_crtc_atomic_disable` allows MMI= O access while clocks are gated. - [High] Unbounded DMA allocations in `atomic_check` lead to memory leaks o= n retries and unprivileged Denial of Service. - [High] Incorrect teardown order in `spacemit_drm_master_unbind` causes VB= LANK timeouts. - [High] DRM ioctls can access freed `priv` and `hwdev` after driver unbind= due to missing unplug state. - [Medium] TOCTOU race setting `a_crtc->clocks_on =3D true` before the hard= ware clocks are actually resumed. - [Medium] Unbounded accumulation of `use_cnt` in `saturn_count_rdma_use`. - [Medium] `spacemit_crtc_duplicate_state` leaks DRM property blobs on erro= r path. - [Medium] Hardware resets are deasserted before clocks are enabled during = PM resume. -- --- Patch [10]: [PATCH 10/17] drm/spacemit: add Saturn DPU KMS pipeline --- commit f6c949f848ca8fa43777ef224d0be429d2966ff6 Author: Cody Kang drm/spacemit: add Saturn DPU KMS pipeline Add the atomic KMS implementation on top of the hardware backend: one CRTC and one primary plane per DPU instance. atomic_check validates the plane rectangle 1:1 against the mode and sizes the per-channel FBC line buffer; atomic commit builds the cmdlist batches, maps the framebuffer through the DMMU and arms the cfg-ready handshake, with vblank events driven from the DPU interrupt. > diff --git a/drivers/gpu/drm/spacemit/spacemit_crtc.c b/drivers/gpu/drm/s= pacemit/spacemit_crtc.c > --- a/drivers/gpu/drm/spacemit/spacemit_crtc.c > +++ b/drivers/gpu/drm/spacemit/spacemit_crtc.c > @@ -43,18 +43,15 @@ > static void saturn_count_rdma_use(struct drm_crtc_state *crtc_state) > { > struct drm_plane *plane; > struct spacemit_crtc_state *spacemit_state =3D > to_spacemit_crtc_state(crtc_state); > struct spacemit_crtc_rdma *rdmas =3D spacemit_state->rdmas; > u32 rdma_id =3D 0; > const struct drm_plane_state *pstate; > =20 > drm_atomic_crtc_state_for_each_plane_state(plane, pstate, crtc_state) { > rdma_id =3D to_spacemit_plane_state(pstate)->rdma_id; > if (rdma_id !=3D RDMA_INVALID_ID) > rdmas[rdma_id].use_cnt++; [Severity: Medium] Will this counter accumulate values incorrectly if atomic_check is called multiple times on the same CRTC state? If the DRM core retries the commit d= ue to -EDEADLK backoff, it seems the counter might increment repeatedly since = it is not cleared first. > } > } > =20 [ ... ] > @@ -95,21 +92,20 @@ > static void spacemit_crtc_atomic_enable(struct drm_crtc *crtc, > struct drm_atomic_commit *old_state) > { > struct spacemit_crtc *a_crtc =3D to_spacemit_crtc(crtc); > int idx; > =20 > if (!drm_dev_enter(crtc->dev, &idx)) > return; > =20 > trace_spacemit_crtc_atomic_enable(a_crtc->dev_id); > =20 > /* > * U-Boot leaves its boot-logo pipeline running. Hard-stop it with the > * resets alone; the clocks are not ours to gate until we have enabled > * them. > */ > if (unlikely(a_crtc->first_modeset)) { > dpu_reset_assert(a_crtc->dev, "lcd", a_crtc->lcd_reset); > dpu_reset_assert(a_crtc->dev, "esc", a_crtc->esc_reset); > dpu_reset_assert(a_crtc->dev, "mclk", a_crtc->mclk_reset); > dpu_reset_assert(a_crtc->dev, "aclk", a_crtc->aclk_reset); > dpu_reset_assert(a_crtc->dev, "dsc", a_crtc->dsc_reset); > usleep_range(10000, 20000); [Severity: High] Is it safe to call usleep_range() here? CRTC atomic enable callbacks are invoked in atomic context during non-blocking commits, where sleeping funct= ions are strictly forbidden and can cause kernel panics or system instability. > a_crtc->first_modeset =3D false; > } > =20 > if (!a_crtc->clocks_on) { > a_crtc->clocks_on =3D true; > dpu_pm_resume(a_crtc->dev); [Severity: Medium] Does setting a_crtc->clocks_on to true before the hardware clocks are actua= lly resumed in dpu_pm_resume() introduce a TOCTOU race? If a spurious or pending interrupt fires in this window, the ISR might read MMIO registers before the clocks are fully resumed, which could lead to a bus stall. > =20 > /* > * The DPU must settle after reset deassert or CFG_RDY races > * the flush. > */ > usleep_range(10000, 20000); > } > =20 [ ... ] > @@ -124,31 +120,29 @@ > static void spacemit_crtc_atomic_disable(struct drm_crtc *crtc, > struct drm_atomic_commit *old_state) > { > struct spacemit_crtc *a_crtc =3D to_spacemit_crtc(crtc); > struct drm_device *drm =3D a_crtc->crtc.dev; > int idx; > =20 > if (!drm_dev_enter(drm, &idx)) > return; > =20 > trace_spacemit_crtc_atomic_disable(a_crtc->dev_id); > =20 > spacemit_crtc_uninit(a_crtc); > =20 > drm_crtc_vblank_off(&a_crtc->crtc); > =20 > /* > * MMIO on a clock-gated DPU stalls the bus, so an in-flight handler > * must finish its status reads before dpu_pm_suspend() gates the > * clocks. > */ > if (a_crtc->irq_online > 0) > synchronize_irq(a_crtc->irq_online); > =20 > /* > * Nothing else cancels the watchdog; it would fire against freed state. > */ > timer_delete_sync(&a_crtc->cfg_rdy_timer); > =20 > /* Close the ISR's MMIO gate before the clocks actually stop. */ > a_crtc->clocks_on =3D false; > dpu_pm_suspend(a_crtc->dev); [Severity: High] Are there calls to multiple blocking and sleeping functions within this ato= mic disable path? Functions like synchronize_irq(), timer_delete_sync(), and any potential sleeping inside dpu_pm_suspend() violate atomic context requireme= nts. [Severity: High] Could setting a_crtc->clocks_on =3D false after calling synchronize_irq() c= reate a TOCTOU race window? A new interrupt could fire immediately after synchronize_irq() returns, and the new ISR instance would see clocks_on as true and access MMIO concurrently while dpu_pm_suspend() gates the clocks, potentially hanging the bus. > =20 > spin_lock_irq(&drm->event_lock); > if (crtc->state->event) { > drm_crtc_send_vblank_event(crtc, crtc->state->event); > crtc->state->event =3D NULL; [ ... ] > @@ -171,15 +165,14 @@ > static int spacemit_crtc_atomic_check(struct drm_crtc *crtc, > struct drm_atomic_commit *atomic_state) > { > struct drm_crtc_state *state =3D > drm_atomic_get_new_crtc_state(atomic_state, crtc); > struct spacemit_crtc_state *cstate =3D to_spacemit_crtc_state(state); > struct spacemit_crtc *a_crtc =3D to_spacemit_crtc(crtc); > int ret =3D 0; > =20 > trace_spacemit_crtc_atomic_check(a_crtc->dev_id); > =20 > ret =3D spacemit_crtc_atomic_check_fbmem(crtc, state); > if (ret) { > drm_dbg_kms(crtc->dev, > "failed to satisfy fbcmem size for all rdmas\n"); > return ret; > } > =20 > saturn_count_rdma_use(state); > =20 > ret =3D spacemit_cmdlist_alloc(a_crtc->dev, &cstate->cl); > if (ret) > return ret; [Severity: High] Is it possible for this DMA allocation in atomic_check() to cause memory le= aks? If the DRM core retries the commit (for example, due to -EDEADLK backoff), atomic_check() is called again on the same state. This would overwrite the pointer and permanently leak the previous allocation, allowing unprivileged userspace to trigger a denial of service via TEST_ONLY commits. > =20 > return 0; > } > =20 [ ... ] > @@ -211,21 +204,18 @@ > static struct drm_crtc_state * > spacemit_crtc_duplicate_state(struct drm_crtc *crtc) > { > struct spacemit_crtc_state *state; > struct spacemit_drm_private *priv =3D crtc->dev->dev_private; > struct spacemit_hw_device *hwdev =3D priv->hwdev; > u8 n_rdma; > =20 > if (WARN_ON(!crtc->state)) > return NULL; > =20 > state =3D kzalloc_obj(*state); > if (!state) > return NULL; > =20 > __drm_atomic_helper_crtc_duplicate_state(crtc, &state->base); > =20 > n_rdma =3D hwdev->rdma_nums; > state->rdmas =3D kzalloc_objs(*state->rdmas, n_rdma); > if (!state->rdmas) { > kfree(state); > return NULL; > } [Severity: Medium] Will this error path leak DRM property blob references? The call to __drm_atomic_helper_crtc_duplicate_state() increments blob refcounts, but if kzalloc_objs() fails, kfree(state) is called without dropping those blob references via __drm_atomic_helper_crtc_destroy_state(). > =20 > state->cl.type =3D CMDLIST_CRTC; > =20 > return &state->base; > } [ ... ] > @@ -481,26 +471,21 @@ > static int spacemit_drm_master_bind(struct device *dev) > { > struct spacemit_drm_private *priv =3D dev_get_drvdata(dev); > struct device_node *np =3D dev->of_node; > struct device_node *ports =3D NULL, *port =3D NULL; > struct spacemit_crtc *a_crtc; > struct drm_plane *plane; > struct spacemit_kms *kms; > struct drm_device *drm; > int ret; > =20 > ret =3D aperture_remove_all_conflicting_devices(spacemit_drm_drv.name); > if (ret) { > dev_err(dev, "failed to remove existing framebuffers: %d\n", > ret); > return ret; > } > =20 > kms =3D devm_drm_dev_alloc(dev, &spacemit_drm_drv, > struct spacemit_kms, drm); > if (IS_ERR(kms)) > return PTR_ERR(kms); > drm =3D &kms->drm; > priv->ddev =3D drm; > drm->dev_private =3D priv; > =20 > ret =3D spacemit_drm_mode_config_init(drm); > if (ret) > return ret; > =20 > a_crtc =3D drmm_kzalloc(drm, sizeof(*a_crtc), GFP_KERNEL); > if (!a_crtc) { > ret =3D -ENOMEM; > goto err_dc; > } > a_crtc->dev =3D dev; > a_crtc->first_modeset =3D true; > priv->a_crtc =3D a_crtc; > =20 > a_crtc->clk_ctx =3D priv->clk_ctx; > a_crtc->aclk =3D DPU_AXICLK_DEFAULT; > a_crtc->mclk_reset =3D priv->mclk_reset; > a_crtc->esc_reset =3D priv->esc_reset; > a_crtc->lcd_reset =3D priv->lcd_reset; > a_crtc->aclk_reset =3D priv->aclk_reset; > a_crtc->dsc_reset =3D priv->dsc_reset; > a_crtc->irq_online =3D priv->irq_online; > =20 > /* Both K3 DPU instances are COMPOSER1 in the Saturn IRQ tables. */ > a_crtc->dev_id =3D COMPOSER1; > =20 > /* The K3 pipeline always hands RGB888 to the DP/eDP encoder. */ > a_crtc->out_format =3D OUTFMT_RGB888; > =20 > a_crtc->core =3D &dpu_saturn_ops; > =20 > timer_setup(&a_crtc->cfg_rdy_timer, spacemit_cfg_rdy_timer_handler, 0); > =20 > plane =3D spacemit_plane_init(drm, a_crtc); > if (IS_ERR(plane)) { > ret =3D PTR_ERR(plane); > goto err_dc; > } > =20 > ports =3D of_get_child_by_name(np, "ports"); > if (!ports) { > dev_err(dev, "CRTC %pOF has no ports node\n", np); > ret =3D -EINVAL; > goto err_dc; > } > =20 > port =3D of_get_child_by_name(ports, "port"); > if (!port) { > dev_err(dev, "CRTC %pOF has no port@X node\n", np); > ret =3D -EINVAL; > goto err_ports_put; > } > =20 > ret =3D spacemit_crtc_bind_init(drm, &a_crtc->crtc, plane, port); > of_node_put(port); > of_node_put(ports); > port =3D NULL; > ports =3D NULL; > if (ret) > goto err_dc; > =20 > /* > * component_bind_all() unbinds what it bound before returning an error. > */ > ret =3D component_bind_all(dev, drm); > if (ret) { > dev_err(dev, "failed to bind all components\n"); > goto err_dc; > } > =20 > ret =3D drm_vblank_init(drm, drm->mode_config.num_crtc); > if (ret) { > dev_err(dev, "failed to initialize vblank\n"); > goto err_unbind_all; > } > =20 > drm_mode_config_reset(drm); > drmm_kms_helper_poll_init(drm); > drm_helper_hpd_irq_event(drm); > =20 > enable_irq(priv->irq_online); [Severity: High] Does unmasking the OS IRQ here before the hardware state is prepared cause = an interrupt storm? If the bootloader left the display pipeline active, an interrupt fires immediately. The ISR in spacemit_dpu_isr() will see clocks_on =3D=3D false and bail out with IRQ_NONE without acknowledging the interrupt, forcing the kernel to permanently disable the IRQ line. > =20 > ret =3D drm_dev_register(drm, 0); > if (ret < 0) > goto err_disable_irq; > drm_client_setup(drm, NULL); > =20 > return 0; [ ... ] > @@ -591,16 +576,14 @@ > static void spacemit_drm_master_unbind(struct device *dev) > { > struct spacemit_drm_private *priv =3D dev_get_drvdata(dev); > struct drm_device *drm =3D priv->ddev; > =20 > disable_irq(priv->irq_online); > =20 > drm_dev_unregister(drm); > drm_atomic_helper_shutdown(drm); [Severity: High] Is the teardown order correct here? Calling disable_irq() before drm_atomic_helper_shutdown() can cause multi-second stalls, as the shutdown process issues a full modeset to disable CRTCs and waits for vblank interru= pts that will never arrive since the IRQ is disabled. [Severity: High] Could calling drm_dev_unregister() without setting the unplugged state via drm_dev_unplug() leave ioctl entry paths open while devm resources are free= d? If userspace holds an open DRM file descriptor, ioctls can still execute because drm_dev_enter() will succeed, leading to a Use-After-Free when they dereference the freed priv pointer. > component_unbind_all(dev, drm); > =20 > /* .shutdown and a later re-bind must not touch the stale instance. */ > priv->ddev =3D NULL; > priv->a_crtc =3D NULL; > } [ ... ] > @@ -747,21 +730,17 @@ > static int dpu_pm_resume(struct device *dev) > { > struct spacemit_drm_private *priv =3D dev_get_drvdata(dev); > struct spacemit_crtc *a_crtc =3D priv->a_crtc; > =20 > dpu_reset_deassert(dev, "mclk", a_crtc->mclk_reset); > dpu_reset_deassert(dev, "esc", a_crtc->esc_reset); > dpu_reset_deassert(dev, "lcd", a_crtc->lcd_reset); > dpu_reset_deassert(dev, "aclk", a_crtc->aclk_reset); > dpu_reset_deassert(dev, "dsc", a_crtc->dsc_reset); > =20 > if (a_crtc->core && a_crtc->core->enable_clk) > a_crtc->core->enable_clk(a_crtc); [Severity: Medium] Are hardware resets being deasserted before clocks are enabled? Reset edges cannot propagate through gated hardware blocks, so the clocks should likely= be enabled before deasserting resets to ensure a clean initialization and avoid hardware state machine violations. > =20 > return 0; > } > =20 > static const struct of_device_id dpu_match_table[] =3D { > { > .compatible =3D "spacemit,k3-saturn-dpu", > .data =3D &k3_saturn_dpu, > }, > {}, > }; > MODULE_DEVICE_TABLE(of, dpu_match_table); > =20 > static struct platform_driver spacemit_dpu_driver =3D { > .probe =3D spacemit_dpu_probe, > .remove =3D spacemit_dpu_remove, > .shutdown =3D spacemit_dpu_shutdown, > .driver =3D { > .name =3D "spacemit-dpu-drv", > .of_match_table =3D dpu_match_table, > .suppress_bind_attrs =3D true, > }, > }; > module_platform_driver(spacemit_dpu_driver); > =20 > MODULE_DESCRIPTION("SpacemiT DRM KMS master driver"); > MODULE_LICENSE("GPL"); > diff --git a/drivers/gpu/drm/spacemit/spacemit_planes.c b/drivers/gpu/drm= /spacemit/spacemit_planes.c > --- a/drivers/gpu/drm/spacemit/spacemit_planes.c > +++ b/drivers/gpu/drm/spacemit/spacemit_planes.c > @@ -107,31 +104,27 @@ > static int spacemit_plane_atomic_check(struct drm_plane *plane, > struct drm_atomic_commit *atomic_state) > { > struct drm_plane_state *state =3D > drm_atomic_get_new_plane_state(atomic_state, plane); > struct drm_framebuffer *fb =3D state->fb; > u32 src_w, src_h, src_x, src_y; > u32 crtc_w, crtc_h; > struct spacemit_plane_state *cur_state =3D to_spacemit_plane_state(stat= e); > u32 cur_rdma_id =3D cur_state->rdma_id; > struct spacemit_drm_private *priv =3D plane->dev->dev_private; > struct spacemit_hw_device *hwdev =3D priv->hwdev; > struct spacemit_crtc *a_crtc =3D NULL; > =20 > struct drm_crtc_state *crtc_state =3D NULL; > int ret; > =20 > if (state->crtc) > crtc_state =3D drm_atomic_get_new_crtc_state(atomic_state, > state->crtc); > =20 > ret =3D drm_atomic_helper_check_plane_state(state, crtc_state, > DRM_PLANE_NO_SCALING, > DRM_PLANE_NO_SCALING, > true, false); > if (ret) > return ret; > =20 > if (!state->visible) > return 0; > =20 > a_crtc =3D to_spacemit_crtc(state->crtc); > trace_spacemit_plane_atomic_check(a_crtc->dev_id); > =20 > src_x =3D state->src_x >> 16; > src_y =3D state->src_y >> 16; > src_w =3D state->src_w >> 16; > src_h =3D state->src_h >> 16; > crtc_w =3D state->crtc_w; > crtc_h =3D state->crtc_h; > =20 > /* The programming paths use the raw rectangles, so refuse to clip. */ > if ((state->src.x1 >> 16) !=3D src_x || (state->src.y1 >> 16) !=3D src_= y || > (drm_rect_width(&state->src) >> 16) !=3D src_w || > (drm_rect_height(&state->src) >> 16) !=3D src_h || > state->dst.x1 !=3D state->crtc_x || state->dst.y1 !=3D state->crtc_= y || > drm_rect_width(&state->dst) !=3D crtc_w || > drm_rect_height(&state->dst) !=3D crtc_h) { > drm_dbg_kms(plane->dev, > "clipped plane rectangles not supported\n"); > return -EINVAL; > } > =20 > /* One-dimensional sources are invalid (only 0x0 =3D constant fill) */ > if ((src_w =3D=3D 0) !=3D (src_h =3D=3D 0)) { > drm_dbg_kms(plane->dev, "unsupported src_w %d src_h %d\n", > src_w, src_h); > return -EINVAL; > } > =20 > if (src_w =3D=3D 0 && src_h =3D=3D 0) > cur_rdma_id =3D RDMA_INVALID_ID; /* constant-fill layer, no RDMA */ > else if (cur_rdma_id =3D=3D RDMA_INVALID_ID) > cur_rdma_id =3D state->zpos; /* first commit: bind channel by zpos */ > cur_state->rdma_id =3D cur_rdma_id; > =20 > if (cur_rdma_id !=3D RDMA_INVALID_ID) { > if (cur_rdma_id >=3D hwdev->rdma_nums) { > drm_dbg_kms(plane->dev, "invalid rdma id %d\n", > cur_rdma_id); > return -EINVAL; > } > =20 > if (a_crtc->core->cal_layer_fbcmem_size(plane, state)) { > drm_dbg_kms(plane->dev, > "plane %d: invalid fbcmem size\n", > state->zpos); > return -EINVAL; > } > =20 > cur_state->mmu_tbl.size =3D > ((PAGE_ALIGN(fb->obj[0]->size) >> PAGE_SHIFT) + > HW_ALIGN_TTB_NUM) * 4; > cur_state->mmu_tbl.va =3D > dma_alloc_coherent(a_crtc->dev, cur_state->mmu_tbl.size, > &cur_state->mmu_tbl.pa, > GFP_KERNEL | __GFP_ZERO); > if (!cur_state->mmu_tbl.va) > return -ENOMEM; [Severity: High] Does allocating DMA memory directly into the state here in atomic_check() cause memory leaks on retries? Just like with spacemit_cmdlist_alloc(), if = the commit is retried due to -EDEADLK backoff, this will overwrite the pointer = and permanently leak the previous allocation. > } > =20 > /* > * The commit cannot fail, so take the DMA buffer while -ENOMEM is an > * answer. > */ > ret =3D spacemit_cmdlist_alloc(a_crtc->dev, &cur_state->cl); > if (ret) > return ret; > =20 > cur_state->format =3D spacemit_plane_hw_get_format_id(fb->format->forma= t); > if (cur_state->format =3D=3D SPACEMIT_DPU_INVALID_FORMAT_ID) { > drm_dbg_kms(plane->dev, "unsupported format %p4cc\n", > &fb->format->format); > return -EINVAL; > } > =20 > return 0; > } > =20 > static void spacemit_plane_atomic_update(struct drm_plane *plane, > struct drm_atomic_commit *state) > { > int ret =3D 0; > struct spacemit_crtc *a_crtc =3D to_spacemit_crtc(plane->state->crtc); > struct spacemit_plane_state *spacemit_pstate =3D > to_spacemit_plane_state(plane->state); > struct spacemit_drm_private *priv =3D plane->dev->dev_private; > struct spacemit_hw_device *hwdev =3D priv->hwdev; > u32 rdma_id =3D spacemit_pstate->rdma_id; > struct cmdlist *cl =3D NULL; > int idx; > =20 > if (!drm_dev_enter(plane->dev, &idx)) > return; > =20 > trace_spacemit_plane_atomic_update(a_crtc->dev_id); > =20 > hwdev->get_cl_rdma_buf(a_crtc); [Severity: High] Is it safe to perform dynamic memory allocation in the atomic_update fast p= ath? The DRM atomic update phase is forbidden to fail or sleep. Any temporary me= mory should be pre-allocated in atomic_check() or prepare_fb(). [Severity: Critical] Does ignoring the return value of get_cl_rdma_buf() lead to a Use-After-Free or Double-Free? If it fails, a_crtc->cl_rdma retains its previous value. Wh= en free_cmdlist_regs(a_crtc->cl_rdma) is called later, it frees the memory but does not set the pointer to NULL, making a_crtc->cl_rdma a dangling pointer= on subsequent failures. > =20 > hwdev->plane_update_hw_channel(plane); > =20 > /* Solid-fill layers have no RDMA and no page table */ > if (rdma_id < hwdev->rdma_nums && spacemit_pstate->mmu_tbl.va) { > u8 tbu_id =3D rdma_id * 2; > =20 > ret =3D spacemit_dmmu_map(plane->state->fb, > &spacemit_pstate->mmu_tbl, tbu_id, > a_crtc->cl_rdma, plane); > if (!ret) > cmdlist_regs_packing(plane_to_cl(plane), > CMDLIST_MOD_RDMA, a_crtc->cl_rdma); > else > drm_err(plane->dev, "failed to map plane: %d\n", ret); > } > =20 > cl =3D &spacemit_pstate->cl; > cl->rch_start_cmps_y =3D CMDLIST_SENTINEL_POISON; > cl->cmdlist_ch_y_other =3D CMDLIST_SENTINEL_POISON; > free_cmdlist_regs(a_crtc->cl_rdma); [Severity: Critical] Does this free_cmdlist_regs() call leave a_crtc->cl_rdma as a dangling poin= ter? As mentioned above, since the pointer is not cleared after being freed, a subsequent allocation failure will leave the pointer pointing to freed memo= ry. > =20 > drm_dev_exit(idx); > } > =20 [ ... ] > @@ -201,15 +190,14 @@ > static void spacemit_plane_reset(struct drm_plane *plane) > { > struct spacemit_plane_state *s; > =20 > if (plane->state) { > s =3D to_spacemit_plane_state(plane->state); > __drm_atomic_helper_plane_destroy_state(plane->state); > kfree(s); > plane->state =3D NULL; > } [Severity: High] Should this cleanup logic utilize the driver-specific custom cleanup hook? = By open-coding the state destruction and calling kfree(s) directly, it bypasses spacemit_plane_atomic_destroy_state(). This permanently leaks the plane's D= MA allocations (mmu_tbl.va and cl.va) when spacemit_plane_reset() executes on a plane that already has a state. > =20 > s =3D kzalloc(sizeof(*s), GFP_KERNEL); > if (s) { > __drm_atomic_helper_plane_reset(plane, &s->state); > s->rdma_id =3D RDMA_INVALID_ID; > } > } > --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260724-k3-display= -v1-0-f22a10a52867@gmail.com?part=3D10