From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D0001C5AC67 for ; Wed, 12 Aug 2026 03:04:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=N+xHSquL2/4ODUQ8HhhlIxF9ikxeo/686ecQQFNl2fU=; b=YfK+WL7ZnkgpNZ q06Xmn7P9fh7z4tFg82iuRGpY4B5c2JA2Y64ySutkBaeQ/ztXRY5ZIA6FqL75NWqFE4e2rQoSlyuk QUo92ucXr8Wwy3Cs4E0m3SFTzabYfU2w4xM4/p0+clCPAQoKsMpHf4m8qt4mkrmSrPJjw6vPhxer+ aU4Nnt1416hlyU6aU6sx1WWfbPCEMHG5MqASY99szNYJvF+gBje6HujU/w1Mk4vYOiHg84EKop/B7 TwscdsHlKmeZXhyaK57tkzn+F6GM1P/Sux1Aqz2ee2JNklBM6Y10KAOu0TSei/opa3hwH9JuieOBm CDUnWYXGtGV1KpFCie1A==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wtzGD-0000000FKLF-0Fs2; Wed, 12 Aug 2026 03:04:09 +0000 Received: from sea.source.kernel.org ([172.234.252.31]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wtzGA-0000000FKL4-3bLH for linux-amlogic@lists.infradead.org; Wed, 12 Aug 2026 03:04:08 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 71C5042E6C; Wed, 12 Aug 2026 03:04:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFAFD1F000E9; Wed, 12 Aug 2026 03:04:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786503846; bh=pycxU543XN7qwtxxsAjU6N59CasYVXqBRsX4jrr615Y=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=PtxRbljhJzDF/4PZv3P59HEPJEqjV0KFih8R+RzTAu/F2nZ85lvLpZwxiIPU06Hgt wNQC6FbXv906dSct/3L/AEoB1MEk2epDis8O1ZufMggDezDwPAq/+qIJmoKSFGkH1I 5Q25SCZQMQPe/zj6feB96gvXMBM86f+VesQJj+1euAmrLPWtZ8fbDYTxn0QcWboIla FQDoZ1kdgMdUooJHyijkfGt3QH+hE3EtDGA9w+hAHSLJ6PdNZ69O6S94GXW3QWW4qc bVEwuF5F0jfyx5WBymvSnZ4TGFBlpoKdZK+LK4YbwfXOrZ5I2UTmOiw/vvLRKxGpwK DMzCEYK1S7l8A== From: sashiko-bot@kernel.org Subject: Re: [PATCH v7 4/6] decoder: Add V4L2 stateless H.264 decoder driver To: "Zhentao Guo" Cc: devicetree@vger.kernel.org, robh@kernel.org, neil.armstrong@linaro.org, conor+dt@kernel.org, linux-amlogic@lists.infradead.org, media-ci@linuxtv.org In-Reply-To: <20260812-b4-s4-vdec-upstream-v7-4-3fae085861bd@amlogic.com> References: <20260812-b4-s4-vdec-upstream-v7-0-3fae085861bd@amlogic.com> <20260812-b4-s4-vdec-upstream-v7-4-3fae085861bd@amlogic.com> Date: Wed, 12 Aug 2026 03:04:05 +0000 Message-Id: <20260812030405.EFAFD1F000E9@smtp.kernel.org> X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MjIgcG90ZW50aWFsIGlzc3VlKHMpIHRvIGNvbnNpZGVyOgotIFtDcml0aWNhbF0gVW52YWxpZGF0 ZWQgU1BTIGRpbWVuc2lvbnMgY2F1c2UgYSAzMi1iaXQgaW50ZWdlciBvdmVyZmxvdywgcmVzdWx0 aW5nIGluIGFuIHVuZGVyc2l6ZWQgQ01BIGJ1ZmZlciBhbmQgbWFzc2l2ZSBvdXQtb2YtYm91bmRz IERNQSB3cml0ZXMuCi0gW0NyaXRpY2FsXSBBcnJheSBib3VuZHMgd3JpdGVzIGR1cmluZyByZWZl cmVuY2UgbGlzdCByZW9yZGVyaW5nIGFsbG93cyBtYXNzaXZlIGhlYXAgY29ycnVwdGlvbi4KLSBb Q3JpdGljYWxdIFRydXN0aW5nIFY0TDIgUFBTIGNvbnRyb2wgZmllbGRzIGFsbG93cyBhIGhlYXAg b3ZlcmZsb3cgdmlhIGBjbGVhcl91bnVzZWRfY29sX2J1ZmAuCi0gW0NyaXRpY2FsXSBEeW5hbWlj IHJlc29sdXRpb24gY2hhbmdlcyBieXBhc3MgRE1BIGJ1ZmZlciByZWFsbG9jYXRpb24sIGNhdXNp bmcgdGhlIGhhcmR3YXJlIHRvIG92ZXJmbG93IHRoZSBjb2xvY2F0ZWQgQ01BIGJ1ZmZlci4KLSBb SGlnaF0gVXNlLWFmdGVyLWZyZWUgb2YgVjRMMiBNMk0gY29udGV4dCBhbmQgZHJpdmVyIHJlc291 cmNlcyBkdWUgdG8gaW5jb3JyZWN0IHRlYXJkb3duIG9yZGVyIGFuZCBkZXZyZXMgdXNhZ2UgaW4g YGFtbF92ZGVjX2Rydl9yZW1vdmVgLgotIFtIaWdoXSBUT0NUT1UgcmFjZSBpbiBgdmRlY190aHJl YWRlZF9pc3JfaGFuZGxlcmAgbGVhZHMgdG8gTlVMTCBwb2ludGVyIGRlcmVmZXJlbmNlIG9mIGBj dXJyX2N0eGAgYW5kIGB2NGwyX20ybV9uZXh0X2RzdF9idWZgLgotIFtIaWdoXSBFcnJvciBwYXRo IGluIGBnZXRfZmlybXdhcmVgIGluY29ycmVjdGx5IHJldHVybnMgMCBvbiB1bmRlcnNpemVkIGZp cm13YXJlLCBwYXNzaW5nIHVuaW5pdGlhbGl6ZWQgc3RhY2sgbWVtb3J5IHRvIHRoZSBURUUgQVBJ LgotIFtIaWdoXSBIYXJkd2FyZSBWSUZJRk8gV3JpdGUgUG9pbnRlciBpcyBwcm9ncmFtbWVkIHdp dGggYSBwaHlzaWNhbCBvZmZzZXQgYmV5b25kIHRoZSBhbGxvY2F0ZWQgVjRMMiBidWZmZXIgYm91 bmRzLCBjYXVzaW5nIG91dC1vZi1ib3VuZHMgRE1BIHJlYWRzLgotIFtIaWdoXSBJbXByb3BlciBl cnJvciBoYW5kbGluZyBvZiBgb2ZfcGFyc2VfcGhhbmRsZWAgYWxsb3dzIGBzZWNfZndgIHRvIHJl bWFpbiBOVUxMLCBjYXVzaW5nIGEga2VybmVsIHBhbmljLgotIFtIaWdoXSBTbGVlcGluZyBpbiBg ZGV2aWNlX3J1bmAgc3RhbGxzIHRoZSBzaGFyZWQgVjRMMiBNMk0gd29ya2VyIHRocmVhZC4KLSBb SGlnaF0gRG91YmxlIGZyZWUgb2YgdGhlIHZpZGVvIGRldmljZSBvYmplY3QgYHZmZF9kZWNgIG9u IGVycm9yIHBhdGhzIGluIGBhbWxfdmRlY19kcnZfcHJvYmVgLgotIFtIaWdoXSBNaXNzaW5nIHJl c2V0IG9mIGBjdHgtPmludF9jb25kYCBjYXVzZXMgc3Vic2VxdWVudCBoYXJkd2FyZSBkZWNvZGUg d2FpdHMgdG8gY29tcGxldGUgcHJlbWF0dXJlbHkuCi0gW0hpZ2hdIGBmb3BzX3Zjb2RlY19yZWxl YXNlYCBmcmVlcyB0aGUgY29udHJvbCBoYW5kbGVyIGJlZm9yZSByZWxlYXNpbmcgdGhlIE0yTSBj b250ZXh0LCBjYXVzaW5nIGFjdGl2ZSBqb2JzIHRvIGFjY2VzcyBmcmVlZCBjb250cm9scy4KLSBb SGlnaF0gRmFpbGluZyB0byB2YWxpZGF0ZSBhbiB1bmFsbG9jYXRlZCBDYW52YXMgUE9DIGFsbG93 cyBhbiBvdXQtb2YtYm91bmRzIE1NSU8gcmVnaXN0ZXIgd3JpdGUsIGxldHRpbmcgYW4gYXR0YWNr ZXIgdGFtcGVyIHdpdGggYWRqYWNlbnQgZGV2aWNlIHJlZ2lzdGVycy4KLSBbSGlnaF0gRGF0YSBy YWNlIGJldHdlZW4gaGFyZHdhcmUgd2FpdCB0aW1lb3V0L3NpZ25hbCBoYW5kbGluZyBhbmQgdGhl IHRocmVhZGVkIElSUSBoYW5kbGVyLgotIFtIaWdoXSBUaGUgaGFyZCBJUlEgaGFuZGxlciBhY2Nl c3NlcyByZWdtYXAgb3ZlciBNTUlPIHdpdGhvdXQgYC51c2VfcmF3X3NwaW5sb2NrID0gdHJ1ZWAs IHRyaWdnZXJpbmcgYSAnc2xlZXBpbmcgaW4gYXRvbWljIGNvbnRleHQnIEJVRyBvbiBQUkVFTVBU X1JUIGtlcm5lbHMuCi0gW01lZGl1bV0gT3ZlcndyaXRpbmcgYG1lc29uX2NhbnZhc19hbGxvY2Ag cmV0dXJuIHZhbHVlcyBieXBhc3NlcyBlcnJvciBjaGVja2luZywgbGVhZGluZyB0byBjYW52YXMg Y29ycnVwdGlvbiBhbmQgZG91YmxlLWZyZWVzLgotIFtNZWRpdW1dIFRoZSBkcml2ZXIgaWdub3Jl cyBgbnVtX3JlZl9pZHhfbDFfYWN0aXZlX21pbnVzMWAgb3ZlcnJpZGVzIGluIEItc2xpY2VzLCB2 aW9sYXRpbmcgdGhlIEguMjY0IHNwZWNpZmljYXRpb24uCi0gW01lZGl1bV0gSGFyZHdhcmUgcG93 ZXIgZG9tYWlucyBhbmQgY2xvY2tzIGFyZSB1bmNvbmRpdGlvbmFsbHkgZW5hYmxlZCBwZXJtYW5l bnRseSBkdXJpbmcgcHJvYmUuCi0gW01lZGl1bV0gUG93ZXIgZG9tYWlucyBhbmQgZGV2aWNlIGxp bmtzIGFyZSBsZWFrZWQgaWYgaGFyZHdhcmUgcmVzb3VyY2UgaW5pdGlhbGl6YXRpb24gZmFpbHMu Ci0gW01lZGl1bV0gVGhlIGB2NGwyX2N0cmxfaGFuZGxlcmAgbWVtb3J5IGlzIGxlYWtlZCBpZiBg djRsMl9jdHJsX2hhbmRsZXJfc2V0dXBgIGZhaWxzLgotIFtMb3ddIEtjb25maWcgdW5jb25kaXRp b25hbGx5IHNlbGVjdHMgYE1FU09OX0NBTlZBU2AsIHJpc2tpbmcgdW5tZXQgZGlyZWN0IGRlcGVu ZGVuY3kgd2FybmluZ3MgdW5kZXIgYENPTVBJTEVfVEVTVGAuCi0tCgotLS0gUGF0Y2ggWzRdOiBb UEFUQ0ggdjcgNC82XSBkZWNvZGVyOiBBZGQgVjRMMiBzdGF0ZWxlc3MgSC4yNjQgZGVjb2RlciBk cml2ZXIgLS0tCmNvbW1pdCBiMTFmMmI3MzY5YTJiZDhiODU2YmQ3N2NhMzA4MmI3N2ZlZmE2NmZl CkF1dGhvcjogWmhlbnRhbyBHdW8gPHpoZW50YW8uZ3VvQGFtbG9naWMuY29tPgpTdWJqZWN0OiBk ZWNvZGVyOiBBZGQgVjRMMiBzdGF0ZWxlc3MgSC4yNjQgZGVjb2RlciBkcml2ZXIKClRoaXMgY29t bWl0IGFkZHMgdGhlIGluaXRpYWwgc3VwcG9ydCBmb3IgdGhlIFY0TDIgc3RhdGVsZXNzIHZpZGVv IGRlY29kZXIKZHJpdmVyIG9uIHRoZSBBbWxvZ2ljIFM0IHBsYXRmb3JtLiBJdCBjdXJyZW50bHkg c3VwcG9ydHMgOC1iaXQgcHJvZ3Jlc3NpdmUKSC4yNjQgYml0c3RyZWFtIGRlY29kaW5nLgoKPiBk aWZmIC0tZ2l0IGEvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvS2NvbmZpZyBi L2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL0tjb25maWcKPiAtLS0gL2Rldi9u dWxsCj4gKysrIGIvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvS2NvbmZpZwo+ IEBAIC0wLDAgKzEsMTggQEAKPiArIyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogKEdQTC0yLjAt b25seSBPUiBNSVQpCj4gKwo+ICtjb25maWcgVklERU9fQU1MT0dJQ19WREVDCj4gKyAgICB0cmlz dGF0ZSAiQW1sb2dpYyBWaWRlbyBEZWNvZGVyIERyaXZlciIKPiArICAgIGRlcGVuZHMgb24gQVJD SF9NRVNPTiB8fCBDT01QSUxFX1RFU1QKPiArICAgIGRlcGVuZHMgb24gVklERU9fREVWCj4gKyAg ICBkZXBlbmRzIG9uIFY0TF9NRU0yTUVNX0RSSVZFUlMKPiArICAgIGRlcGVuZHMgb24gVEVFCj4g KyAgICBkZXBlbmRzIG9uIE1FU09OX1NNCj4gKyAgICBzZWxlY3QgVklERU9CVUYyX0RNQV9DT05U SUcKPiArICAgIHNlbGVjdCBWNEwyX0gyNjQKPiArICAgIHNlbGVjdCBWNEwyX01FTTJNRU1fREVW Cj4gKyAgICBzZWxlY3QgTUVTT05fQ0FOVkFTCgpbU2V2ZXJpdHk6IExvd10KRG9lcyBzZWxlY3Rp bmcgTUVTT05fQ0FOVkFTIHVuY29uZGl0aW9uYWxseSBoZXJlIHJpc2sgdW5tZXQgZGlyZWN0CmRl cGVuZGVuY3kgd2FybmluZ3MgdW5kZXIgQ09NUElMRV9URVNUPyBTaW5jZSBWSURFT19BTUxPR0lD X1ZERUMgc3VwcG9ydHMKQ09NUElMRV9URVNULCBpdCBjb3VsZCBiZSBidWlsdCBvbiBhcmNoaXRl Y3R1cmVzIHdoZXJlIE1FU09OX0NBTlZBUwpkZXBlbmRlbmNpZXMgYXJlIG5vdCBtZXQuCgo+IGRp ZmYgLS1naXQgYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRlY19k cnYuYyBiL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92ZGVjX2Rydi5j Cj4gLS0tIC9kZXYvbnVsbAo+ICsrKyBiL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92 ZGVjL2FtbF92ZGVjX2Rydi5jCj4gQEAgLTAsMCArMSwyMzEgQEAKWyAuLi4gXQo+ICtzdGF0aWMg aW50IGZvcHNfdmNvZGVjX29wZW4oc3RydWN0IGZpbGUgKmZpbGUpCj4gK3sKWyAuLi4gXQo+ICsJ cmV0ID0gYW1sX3ZkZWNfY3RybHNfc2V0dXAoY3R4KTsKPiArCWlmIChyZXQpIHsKPiArCQl2NGwy X2VycigmZGVjX2Rldi0+djRsMl9kZXYsICJGYWlsZWQgdG8gaW5pdCBhbGwgY3RybHMgKCVkKSIs IHJldCk7Cj4gKwkJZ290byBlcnJfY3RybHNfc2V0dXA7Cj4gKwl9Cj4gKwo+ICsJYW1sX3ZkZWNf cmVzZXRfZm10cyhjdHgpOwo+ICsJbXV0ZXhfdW5sb2NrKCZkZWNfZGV2LT5kZXZfbXV0ZXgpOwo+ ICsKPiArCXJldHVybiByZXQ7Cj4gKwo+ICtlcnJfY3RybHNfc2V0dXA6Cj4gKwl2NGwyX20ybV9j dHhfcmVsZWFzZShjdHgtPm0ybV9jdHgpOwo+ICtlcnJfbTJtX2N0eF9pbml0Ogo+ICsJdjRsMl9m aF9kZWwoJmN0eC0+ZmgsIGZpbGUpOwo+ICsJdjRsMl9maF9leGl0KCZjdHgtPmZoKTsKPiArCWtm cmVlKGN0eCk7Cj4gKwltdXRleF91bmxvY2soJmRlY19kZXYtPmRldl9tdXRleCk7Cj4gKwo+ICsJ cmV0dXJuIHJldDsKPiArfQoKW1NldmVyaXR5OiBNZWRpdW1dCklzIHRoZXJlIGEgbWlzc2luZyBj YWxsIHRvIHY0bDJfY3RybF9oYW5kbGVyX2ZyZWUgaW4gdGhlIGVycl9jdHJsc19zZXR1cApwYXRo IGluIGZvcHNfdmNvZGVjX29wZW4/IElmIHY0bDJfY3RybF9oYW5kbGVyX3NldHVwIGZhaWxzIGR1 cmluZwphbWxfdmRlY19jdHJsc19zZXR1cCwgaXQgcmV0dXJucyBhbiBlcnJvciBidXQgZG9lcyBu b3QgZnJlZSB0aGUgaGFuZGxlci4KVGhpcyBlcnJvciBwYXRoIGFsc28gc2tpcHMgY2xlYW5pbmcg aXQgdXAsIHdoaWNoIGxvb2tzIGxpa2UgaXQgd291bGQKcGVybWFuZW50bHkgbGVhayB0aGUgaGFu ZGxlcidzIGludGVybmFsIGFsbG9jYXRpb25zLgoKWyAuLi4gXQo+ICtzdGF0aWMgaW50IGZvcHNf dmNvZGVjX3JlbGVhc2Uoc3RydWN0IGZpbGUgKmZpbGUpCj4gK3sKPiArCXN0cnVjdCBhbWxfdmRl Y19jdHggKmN0eCA9IGZoX3RvX2RlY19jdHgoZmlsZSk7Cj4gKwo+ICsJdjRsMl9jdHJsX2hhbmRs ZXJfZnJlZSgmY3R4LT5jdHJsX2hhbmRsZXIpOwo+ICsJdjRsMl9tMm1fY3R4X3JlbGVhc2UoY3R4 LT5tMm1fY3R4KTsKPiArCXY0bDJfZmhfZGVsKCZjdHgtPmZoLCBmaWxlKTsKPiArCXY0bDJfZmhf ZXhpdCgmY3R4LT5maCk7Cj4gKwlrZnJlZShjdHgpOwo+ICsKPiArCXJldHVybiAwOwo+ICt9Cgpb U2V2ZXJpdHk6IEhpZ2hdCkNvdWxkIGZyZWVpbmcgdGhlIGNvbnRyb2wgaGFuZGxlciBiZWZvcmUg cmVsZWFzaW5nIHRoZSBNMk0gY29udGV4dCBjYXVzZQphIHVzZS1hZnRlci1mcmVlIGluIGZvcHNf dmNvZGVjX3JlbGVhc2U/CgpUaGUgTTJNIGNvbnRleHQgcmVsZWFzZSBwZXJmb3JtcyBhIGJsb2Nr aW5nIHdhaXQgdG8gY2FuY2VsIGFjdGl2ZSBqb2JzLgpJZiB0aGUgd29ya2VyIHRocmVhZCBpcyBz dGlsbCBleGVjdXRpbmcgb3Igc2xlZXBpbmcgaW4gYW1sX2gyNjRfZGVjX3J1biwKaXQgd2lsbCBl dmVudHVhbGx5IGZpbmlzaCBhbmQgY2FsbCB2NGwyX2N0cmxfcmVxdWVzdF9jb21wbGV0ZS4gVGhp cwp3b3VsZCBhY2Nlc3MgdGhlIHBvaXNvbmVkIGNvbnRyb2wgbGlzdHMgc2luY2UgdjRsMl9jdHJs X2hhbmRsZXJfZnJlZQpoYXMgYWxyZWFkeSBkZXN0cm95ZWQgdGhlbS4KClsgLi4uIF0KPiArc3Rh dGljIGludCBhbWxfdmRlY19kcnZfcHJvYmUoc3RydWN0IHBsYXRmb3JtX2RldmljZSAqcGRldikK PiArewo+ICsJc3RydWN0IGFtbF92ZGVjX2RldiAqZGV2Owo+ICsJc3RydWN0IHZpZGVvX2Rldmlj ZSAqdmZkX2RlYzsKPiArCXN0cnVjdCBhbWxfdmRlY19odyAqaHc7Cj4gKwlpbnQgcmV0ID0gMDsK PiArCj4gKwlkZXYgPSBkZXZtX2t6YWxsb2MoJnBkZXYtPmRldiwgc2l6ZW9mKCpkZXYpLCBHRlBf S0VSTkVMKTsKCltTZXZlcml0eTogSGlnaF0KU2hvdWxkIHRoZSBhbWxfdmRlY19kZXYgc3RydWN0 dXJlJ3MgbGlmZXRpbWUgYmUgdGllZCB0byB0aGUgVjRMMiBvYmplY3QKaW5zdGVhZCBvZiB0aGUg ZGV2aWNlIGJpbmRpbmcgaW4gYW1sX3ZkZWNfZHJ2X3Byb2JlPwoKQnkgdXNpbmcgZGV2cmVzLCB0 aGUgc3RydWN0dXJlIGlzIGZyZWVkIHdoZW4gdGhlIGRldmljZSB1bmJpbmRzLiBIb3dldmVyLAp1 c2Vyc3BhY2UgY291bGQgc3RpbGwgaG9sZCBhbiBvcGVuIGZpbGUgZGVzY3JpcHRvciB0byB0aGUg dmlkZW8gZGV2aWNlLAphbGxvd2luZyBzdWJzZXF1ZW50IGlvY3RscyBvciBjbG9zZSBvcGVyYXRp b25zIHRvIGFjY2VzcyB0aGUgZnJlZWQKbTJtX2Rldl9kZWMgYW5kIGRldl9tdXRleCB2aWEgdGhl IGRhbmdsaW5nIGN0eC0+ZGV2IHBvaW50ZXIuCgpbIC4uLiBdCj4gKwlyZXQgPSBtZWRpYV9kZXZp Y2VfcmVnaXN0ZXIoJmRldi0+bWRldik7Cj4gKwlpZiAocmV0KSB7Cj4gKwkJdjRsMl9lcnIoJmRl di0+djRsMl9kZXYsICJGYWlsZWQgdG8gcmVnaXN0ZXIgbWVkaWEgZGV2aWNlIik7Cj4gKwkJZ290 byBlcnJfbWVkaWFfZGV2X3JlZ2lzdGVyOwo+ICsJfQo+ICsJdmRlY19lbmFibGUoZGV2LT5kZWNf aHcpOwo+ICsJcmV0dXJuIDA7CgpbU2V2ZXJpdHk6IE1lZGl1bV0KRG9lcyBhbWxfdmRlY19kcnZf cHJvYmUga2VlcCB0aGUgaGFyZHdhcmUgcG93ZXIgZG9tYWluIGFuZCBjbG9ja3MKcGVybWFuZW50 bHkgZW5hYmxlZCB3aGlsZSB0aGUgZHJpdmVyIGlzIGxvYWRlZD8KCkNhbGxpbmcgdmRlY19lbmFi bGUgaGVyZSBzeW5jaHJvbm91c2x5IHBvd2VycyBvbiB0aGUgZG9tYWluIGFuZCBlbmFibGVzCnRo ZSBjbG9ja3MgaW5kZWZpbml0ZWx5LiBJdCBtaWdodCBiZSBiZXR0ZXIgdG8gaW50ZWdyYXRlIHRo aXMgd2l0aApSdW50aW1lIFBNIHNvIHRoZSBoYXJkd2FyZSBjYW4gcG93ZXIgZG93biB3aGVuIG5v dCBhY3RpdmVseSBkZWNvZGluZy4KClsgLi4uIF0KPiArZXJyX21lZGlhX2Rldl9yZWdpc3RlcjoK PiArCXY0bDJfbTJtX3VucmVnaXN0ZXJfbWVkaWFfY29udHJvbGxlcihkZXYtPm0ybV9kZXZfZGVj KTsKPiArZXJyb3JfbTJtX21jX3JlZ2lzdGVyOgo+ICsJbWVkaWFfZGV2aWNlX2NsZWFudXAoJmRl di0+bWRldik7Cj4gKwl2aWRlb191bnJlZ2lzdGVyX2RldmljZShkZXYtPnZmZCk7Cj4gK2Vycl92 aWRfZGV2X3JlZ2lzdGVyOgo+ICsJdjRsMl9tMm1fcmVsZWFzZShkZXYtPm0ybV9kZXZfZGVjKTsK PiArZXJyX20ybV9kZXZfaW5pdDoKPiArCWRldi0+cHZkZWNfZGF0YS0+ZGVzdHJveV9od19yZXNv dXJjZShkZXYpOwo+ICtlcnJfaHdfaW5pdDoKPiArCWRldi0+ZGVjX2h3ID0gTlVMTDsKPiArZXJy X2RlY19tZW1faW5pdDoKPiArCXZpZGVvX2RldmljZV9yZWxlYXNlKHZmZF9kZWMpOwo+ICtlcnJf ZGV2aWNlX2FsbG9jOgo+ICsJdjRsMl9kZXZpY2VfdW5yZWdpc3RlcigmZGV2LT52NGwyX2Rldik7 Cj4gKwlyZXR1cm4gcmV0Owo+ICt9CgpbU2V2ZXJpdHk6IEhpZ2hdCkNhbiB0aGUgZXJyX2RlY19t ZW1faW5pdCBwYXRoIGluIGFtbF92ZGVjX2Rydl9wcm9iZSBjYXVzZSBhIGRvdWJsZSBmcmVlCm9m IHRoZSB2aWRlbyBkZXZpY2Ugb2JqZWN0PwoKSWYgYW4gZXJyb3Igb2NjdXJzIGFmdGVyIHN1Y2Nl c3NmdWwgdmlkZW8gZGV2aWNlIHJlZ2lzdHJhdGlvbiwgdGhlIGNvZGUKZmFsbHMgdGhyb3VnaCBl cnJvcl9tMm1fbWNfcmVnaXN0ZXIgYW5kIGNhbGxzIHZpZGVvX3VucmVnaXN0ZXJfZGV2aWNlLAp3 aGljaCBkcm9wcyB0aGUgcmVmY291bnQgYW5kIGludm9rZXMgdGhlIHJlbGVhc2UgY2FsbGJhY2sg dG8ga2ZyZWUgdmZkX2RlYy4KQ29udGludWluZyB0byBmYWxsIHRocm91Z2ggdG8gZXJyX2RlY19t ZW1faW5pdCB0aGVuIGNhbGxzCnZpZGVvX2RldmljZV9yZWxlYXNlKHZmZF9kZWMpLCB3aGljaCB3 b3VsZCBrZnJlZSB0aGUgZXhhY3Qgc2FtZSBwb2ludGVyLgoKWyAuLi4gXQo+ICtzdGF0aWMgdm9p ZCBhbWxfdmRlY19kcnZfcmVtb3ZlKHN0cnVjdCBwbGF0Zm9ybV9kZXZpY2UgKnBkZXYpCj4gK3sK PiArCXN0cnVjdCBhbWxfdmRlY19kZXYgKmRldiA9IHBsYXRmb3JtX2dldF9kcnZkYXRhKHBkZXYp Owo+ICsKPiArCXZkZWNfZGlzYWJsZShkZXYtPmRlY19odyk7Cj4gKwo+ICsJbWVkaWFfZGV2aWNl X3VucmVnaXN0ZXIoJmRldi0+bWRldik7Cj4gKwl2NGwyX20ybV91bnJlZ2lzdGVyX21lZGlhX2Nv bnRyb2xsZXIoZGV2LT5tMm1fZGV2X2RlYyk7Cj4gKwltZWRpYV9kZXZpY2VfY2xlYW51cCgmZGV2 LT5tZGV2KTsKPiArCj4gKwl2NGwyX20ybV9yZWxlYXNlKGRldi0+bTJtX2Rldl9kZWMpOwo+ICsJ dmlkZW9fdW5yZWdpc3Rlcl9kZXZpY2UoZGV2LT52ZmQpOwo+ICsJZGV2LT5wdmRlY19kYXRhLT5k ZXN0cm95X2h3X3Jlc291cmNlKGRldik7Cj4gKwl2NGwyX2RldmljZV91bnJlZ2lzdGVyKCZkZXYt PnY0bDJfZGV2KTsKPiArfQoKW1NldmVyaXR5OiBIaWdoXQpEb2VzIHJlbGVhc2luZyB0aGUgTTJN IGNvbnRleHQgYmVmb3JlIHVucmVnaXN0ZXJpbmcgdGhlIHZpZGVvIGRldmljZQppbiBhbWxfdmRl Y19kcnZfcmVtb3ZlIGNyZWF0ZSBhIHJhY2UgY29uZGl0aW9uPwoKSWYgYSB1c2Vyc3BhY2UgYXBw bGljYXRpb24gaXMgY29uY3VycmVudGx5IGNhbGxpbmcgaW9jdGxzIHdoaWxlIHRoZSBkcml2ZXIK aXMgYmVpbmcgcmVtb3ZlZCwgdGhleSBtaWdodCBhY2Nlc3MgdGhlIGZyZWVkIE0yTSBjb250ZXh0 IGJlZm9yZSB0aGUKdmlkZW8gZGV2aWNlIGlzIGZ1bGx5IHRvcm4gZG93biBieSB2aWRlb191bnJl Z2lzdGVyX2RldmljZS4KCj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1s b2dpYy92ZGVjL2FtbF92ZGVjX2h3LmMgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMv dmRlYy9hbWxfdmRlY19ody5jCj4gLS0tIC9kZXYvbnVsbAo+ICsrKyBiL2RyaXZlcnMvbWVkaWEv cGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92ZGVjX2h3LmMKWyAuLi4gXQo+ICtzdGF0aWMgaXJx cmV0dXJuX3QgdmRlY190aHJlYWRlZF9pc3JfaGFuZGxlcihpbnQgaXJxLCB2b2lkICpwcml2KQo+ ICt7Cj4gKwlzdHJ1Y3QgYW1sX3ZkZWNfZGV2ICpkZXYgPSAoc3RydWN0IGFtbF92ZGVjX2RldiAq KXByaXY7Cj4gKwlzdHJ1Y3QgYW1sX3ZkZWNfaHcgKmh3ID0gZGV2LT5kZWNfaHc7Cj4gKwlpcnFy ZXR1cm5fdCByZXQgPSBJUlFfSEFORExFRDsKPiArCj4gKwlpZiAoaHctPmh3X29wcy5pcnFfdGhy ZWFkZWRfZnVuYyAmJiBody0+Y3Vycl9jdHgpCj4gKwkJcmV0ID0gaHctPmh3X29wcy5pcnFfdGhy ZWFkZWRfZnVuYyhpcnEsIHByaXYpOwo+ICsKPiArCXJldHVybiByZXQ7Cj4gK30KCltTZXZlcml0 eTogSGlnaF0KSXMgaXQgc2FmZSB0byBjaGVjayBody0+Y3Vycl9jdHggaW4gdmRlY190aHJlYWRl ZF9pc3JfaGFuZGxlciB3aXRob3V0CmhvbGRpbmcgYW55IGxvY2tzPwoKQ29uY3VycmVudGx5LCBh bWxfaDI2NF9kZWNfcnVuIGNhbiBzZXQgaHctPmN1cnJfY3R4IHRvIE5VTEwgdXBvbiBhIHRpbWVv dXQKb3Igc2lnbmFsLiBJZiB0aGUgY29udGV4dCBpcyBjbGVhcmVkIGltbWVkaWF0ZWx5IGFmdGVy IHRoaXMgY2hlY2sgcGFzc2VzLAp0aGUgdGhyZWFkZWQgSVNSIHdvdWxkIGRlcmVmZXJlbmNlIGEg TlVMTCBwb2ludGVyLgoKWyAuLi4gXQo+ICtzdGF0aWMgY29uc3Qgc3RydWN0IHJlZ21hcF9jb25m aWcgZG9zX3JlZ21hcF9jb25mID0gewo+ICsJLnJlZ19iaXRzID0gMzIsCj4gKwkudmFsX2JpdHMg PSAzMiwKPiArCS5yZWdfc3RyaWRlID0gNCwKPiArCS5tYXhfcmVnaXN0ZXIgPSAweDEwMDAwLAo+ ICt9OwoKW1NldmVyaXR5OiBIaWdoXQpTaG91bGQgdGhlIGRvc19yZWdtYXBfY29uZiBjb25maWd1 cmF0aW9uIGluY2x1ZGUgLnVzZV9yYXdfc3BpbmxvY2sgPSB0cnVlPwoKV2l0aG91dCBpdCwgdGhl IHJlZ21hcCB1c2VzIGEgc3RhbmRhcmQgc3BpbmxvY2ssIHdoaWNoIGJlY29tZXMgYQpzbGVlcGFi bGUgbXV0ZXggb24gUFJFRU1QVF9SVCBrZXJuZWxzLiBTaW5jZSBoMjY0X2lzciBjYWxscyByZWdt YXBfd3JpdGUKZnJvbSB0aGUgcHJpbWFyeSBoYXJkIElSUSBoYW5kbGVyIGNvbnRleHQsIHRha2lu ZyBhIHNsZWVwYWJsZSBsb2NrIGhlcmUKd2lsbCBjYXVzZSBhIHNsZWVwaW5nIGluIGF0b21pYyBj b250ZXh0IEJVRyBvbiBSVC4KClsgLi4uIF0KPiAraW50IGRldl9yZXF1ZXN0X2h3X3Jlc291cmNl cyh2b2lkICpwcml2KQo+ICt7ClsgLi4uIF0KPiArCWlmIChody0+cG0tPmluaXQpIHsKPiArCQly ZXQgPSBody0+cG0tPmluaXQoaHcpOwo+ICsJCWlmIChyZXQgPCAwKSB7Cj4gKwkJCWRldl9lcnIo JnBkZXYtPmRldiwgInBvd2VyIG1nciBpbml0IGZhaWxlZCFcbiIpOwo+ICsJCQlyZXR1cm4gcmV0 Owo+ICsJCX0KPiArCX0KPiArCj4gKwlyZXQgPSB2ZGVjX2Nsb2NrX2dhdGVfaW5pdChodyk7Cj4g KwlpZiAocmV0KSB7Cj4gKwkJZGV2X2VycigmcGRldi0+ZGV2LCAiY2xrIGJ1bGsgaW5pdCBmYWls ZWQhXG4iKTsKPiArCQlyZXR1cm4gcmV0Owo+ICsJfQoKW1NldmVyaXR5OiBNZWRpdW1dCklmIHZk ZWNfY2xvY2tfZ2F0ZV9pbml0IG9yIGFtbF90ZWVfZndfcHJlbG9hZCBmYWlscyBpbgpkZXZfcmVx dWVzdF9od19yZXNvdXJjZXMsIHdlIHJldHVybiBlYXJseS4gU2hvdWxkIHdlIGNhbGwKaHctPnBt LT5yZWxlYXNlKGh3KSBpbiB0aGUgZXJyb3IgcGF0aCB0byB0ZWFyIGRvd24gdGhlIFBNIGRvbWFp biB3ZSBqdXN0CnN1Y2Nlc3NmdWxseSBhdHRhY2hlZCwgdG8gYXZvaWQgcGVybWFuZW50bHkgbGVh a2luZyBpdD8KClsgLi4uIF0KPiArCXNtX25wID0gb2ZfcGFyc2VfcGhhbmRsZShwZGV2LT5kZXYu b2Zfbm9kZSwgInNlY3VyZS1tb25pdG9yIiwgMCk7Cj4gKwlpZiAoSVNfRVJSX09SX05VTEwoc21f bnApKQo+ICsJCXJldHVybiBQVFJfRVJSKHNtX25wKTsKCltTZXZlcml0eTogSGlnaF0KRG9lcyBJ U19FUlJfT1JfTlVMTCBtYXNrIHRoZSBlcnJvciB3aGVuIG9mX3BhcnNlX3BoYW5kbGUgZmFpbHMg aW4KZGV2X3JlcXVlc3RfaHdfcmVzb3VyY2VzPwoKb2ZfcGFyc2VfcGhhbmRsZSByZXR1cm5zIE5V TEwgb24gZmFpbHVyZS4gUFRSX0VSUihOVUxMKSBldmFsdWF0ZXMgdG8gMCwKc28gZGV2X3JlcXVl c3RfaHdfcmVzb3VyY2VzIHdvdWxkIHNpbGVudGx5IHN1Y2NlZWQgd2hpbGUgbGVhdmluZwpody0+ c2VjX2Z3IHVuaW5pdGlhbGl6ZWQuIExhdGVyLCBsb2FkX2Zpcm13YXJlIHdvdWxkIHBhc3MgdGhp cyBOVUxMCnBvaW50ZXIgdG8gbWVzb25fc21fY2FsbCwgY2F1c2luZyBhIGtlcm5lbCBwYW5pYy4K Cj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92 ZGVjX3RlZV9mdy5jIGIvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3Zk ZWNfdGVlX2Z3LmMKPiAtLS0gL2Rldi9udWxsCj4gKysrIGIvZHJpdmVycy9tZWRpYS9wbGF0Zm9y bS9hbWxvZ2ljL3ZkZWMvYW1sX3ZkZWNfdGVlX2Z3LmMKWyAuLi4gXQo+ICtzdGF0aWMgaW50IGdl dF9maXJtd2FyZShjb25zdCBjaGFyICpwYXRoLCB2b2lkICoqZGF0YSwgc2l6ZV90ICpzaXplKQo+ ICt7Cj4gKwljb25zdCBzdHJ1Y3QgZmlybXdhcmUgKmZ3ID0gTlVMTDsKPiArCWludCByZXQ7Cj4g Kwl2b2lkICpidWY7Cj4gKwo+ICsJcmV0ID0gcmVxdWVzdF9maXJtd2FyZSgmZncsIEZJUk1XQVJF X1BBVEgsIE5VTEwpOwo+ICsJaWYgKHJldCB8fCBmdy0+c2l6ZSA8PSBVQ09ERV9IRUFERVJfU0la RSkKPiArCQlyZXR1cm4gcmV0OwoKW1NldmVyaXR5OiBIaWdoXQpJZiB0aGUgZmlybXdhcmUgc2l6 ZSBpcyBsZXNzIHRoYW4gb3IgZXF1YWwgdG8gVUNPREVfSEVBREVSX1NJWkUgaW4KZ2V0X2Zpcm13 YXJlLCB0aGlzIHJldHVybnMgMCAoc2luY2UgcmV0IGlzIDAgaGVyZSkgYnV0IGRvZXNuJ3QgaW5p dGlhbGl6ZQp0aGUgZGF0YSBvciBzaXplIG91dHB1dCBwb2ludGVycy4KClRoaXMgY2F1c2VzIHRo ZSBjYWxsZXIsIHBhc3NfZmlybXdhcmVfdG9fdGVlLCB0byBiZWxpZXZlIGl0IHN1Y2NlZWRlZAph bmQgaW52b2tlIHRoZSBURUUgQVBJIHdpdGggdW5pbml0aWFsaXplZCBzdGFjayBtZW1vcnksIGV2 ZW50dWFsbHkKY2FsbGluZyBrZnJlZSBvbiBhbiB1bmluaXRpYWxpemVkIHBvaW50ZXIuCgo+IGRp ZmYgLS1naXQgYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9oMjY0LmMgYi9k cml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9oMjY0LmMKPiAtLS0gL2Rldi9udWxs Cj4gKysrIGIvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvaDI2NC5jClsgLi4u IF0KPiArc3RhdGljIGludCBoMjY0X3ByZXBhcmVfaW5wdXQoc3RydWN0IGFtbF92ZGVjX2N0eCAq Y3R4KQo+ICt7ClsgLi4uIF0KPiArCWR1bW15ID0gcGF5bG9hZF9zaXplICsgVkxEX1BBRERJTkdf U0laRTsKPiArCXJlZ21hcF93cml0ZShody0+bWFwW0RPU19CVVNdLCBWTERfTUVNX1ZJRklGT19X UCwKPiArCQkgICAgIHJvdW5kX2Rvd24oKHNyY19kbWEgKyBkdW1teSksIFZERUNfRklGT19BTElH TikpOwoKW1NldmVyaXR5OiBIaWdoXQpDb3VsZCB0aGUgZHVtbXkgY2FsY3VsYXRpb24gaW4gaDI2 NF9wcmVwYXJlX2lucHV0IGNhdXNlIG91dC1vZi1ib3VuZHMKRE1BIHJlYWRzPwoKV2UgcHJvZ3Jh bSB0aGUgaGFyZHdhcmUgd3JpdGUgcG9pbnRlciB0bwpzcmNfZG1hICsgcGF5bG9hZF9zaXplICsg VkxEX1BBRERJTkdfU0laRS4gSWYgdXNlcnNwYWNlIHNldHMgc2l6ZWltYWdlCmVxdWFsIHRvIHBh eWxvYWRfc2l6ZSwgdGhpcyBwaHlzaWNhbCBvZmZzZXQgcG9pbnRzIGJleW9uZCB0aGUgbWVtb3J5 CmFsbG9jYXRlZCBmb3IgdGhlIENNQSBidWZmZXIuCgpbIC4uLiBdCj4gK3N0YXRpYyB2b2lkIGNv bmZpZ19zcHNfcGFyYW1zKHN0cnVjdCBhbWxfaDI2NF9jdHggKmgyNjRfY3R4LAo+ICsJCQkgICAg ICB1bnNpZ25lZCBzaG9ydCAqc3BzX2Jhc2UsCj4gKwkJCSAgICAgIGNvbnN0IHN0cnVjdCB2NGwy X2N0cmxfaDI2NF9zcHMgKnNwcykKPiArewpbIC4uLiBdCj4gKwloMjY0X2N0eC0+bWJfd2lkdGgg PSAoc3BzLT5waWNfd2lkdGhfaW5fbWJzX21pbnVzMSArIDQpICYgMHhmZmZmZmZmYzsKPiArCWgy NjRfY3R4LT5tYl9oZWlnaHQgPSAoc3BzLT5waWNfaGVpZ2h0X2luX21hcF91bml0c19taW51czEg KyA0KSAmIDB4ZmZmZmZmZmM7Cj4gKwo+ICsJaDI2NF9jdHgtPm1iX3RvdGFsID0gaDI2NF9jdHgt Pm1iX3dpZHRoICogaDI2NF9jdHgtPm1iX2hlaWdodDsKCltTZXZlcml0eTogQ3JpdGljYWxdCkFy ZSB0aGUgbWJfd2lkdGggYW5kIG1iX2hlaWdodCBkaW1lbnNpb25zIHZhbGlkYXRlZCBhZ2FpbnN0 IG1heGltdW0KbGltaXRzIGluIGNvbmZpZ19zcHNfcGFyYW1zPwoKVXNlcnNwYWNlIGNhbiBwcm92 aWRlIGFyYml0cmFyeSB2YWx1ZXMgZm9yIHRoZSB3aWR0aCBhbmQgaGVpZ2h0LgpFeHRyZW1lbHkg bGFyZ2UgdmFsdWVzIGNhdXNlIG1iX3RvdGFsICogOTYgaW4gYWxsb2NfY29sb2NhdGVfY21hIHRv CmV4Y2VlZCAzMiBiaXRzLCB0cnVuY2F0aW5nIHRvIGEgc21hbGwgYWxsb2NhdGlvbiBzaXplLiBU aGUgaGFyZHdhcmUKd291bGQgdGhlbiB3cml0ZSBjb2xvY2F0ZWQgbW90aW9uIHZlY3RvcnMgd2Vs bCBwYXN0IHRoZSBhbGxvY2F0ZWQgYnVmZmVyCmJvdW5kcy4KClsgLi4uIF0KPiArc3RhdGljIHZv aWQgY29uZmlnX2RlY29kZV9jYW52YXMoc3RydWN0IGFtbF92ZGVjX2h3ICpodywKPiArCQkJCSBz dHJ1Y3QgaDI2NF9kZWNvZGVfYnVmX3NwZWMgKmJ1Zl9zcGVjLAo+ICsJCQkJIHUzMiBtYl93aWR0 aCwgdTMyIG1iX2hlaWdodCkKPiArewo+ICsJaW50IGNhbnZhc19hbGxvY19yZXN1bHQgPSAwOwo+ ICsJaW50IGJsa21vZGUgPSAweDA7Cj4gKwo+ICsJY2FudmFzX2FsbG9jX3Jlc3VsdCA9IG1lc29u X2NhbnZhc19hbGxvYyhody0+Y2FudmFzLCAmYnVmX3NwZWMtPnlfY2FudmFzX2luZGV4KTsKPiAr CWNhbnZhc19hbGxvY19yZXN1bHQgPSBtZXNvbl9jYW52YXNfYWxsb2MoaHctPmNhbnZhcywgJmJ1 Zl9zcGVjLT51X2NhbnZhc19pbmRleCk7CgpbU2V2ZXJpdHk6IE1lZGl1bV0KRG9lcyBjb25maWdf ZGVjb2RlX2NhbnZhcyBjbG9iYmVyIHRoZSBmaXJzdCBjYW52YXNfYWxsb2NfcmVzdWx0IHdpdGhv dXQKY2hlY2tpbmcgaXQ/CgpJZiB0aGUgWSBjYW52YXMgYWxsb2NhdGlvbiBmYWlscyBidXQgdGhl IFUgY2FudmFzIGFsbG9jYXRpb24gc3VjY2VlZHMsCnRoZSBlcnJvciBpcyBtYXNrZWQuIFRoZSB1 bmluaXRpYWxpemVkIFkgY2FudmFzIGluZGV4IHdpbGwgYmUgcHJvZ3JhbW1lZAppbnRvIGhhcmR3 YXJlIGFuZCBldmVudHVhbGx5IHBhc3NlZCB0byBtZXNvbl9jYW52YXNfZnJlZSwgcG90ZW50aWFs bHkKY2F1c2luZyBhIGRvdWJsZS1mcmVlLgoKWyAuLi4gXQo+ICtzdGF0aWMgaW50IGFsbG9jX2Nv bG9jYXRlX2NtYShzdHJ1Y3QgYW1sX2gyNjRfY3R4ICpoMjY0X2N0eCwKPiArCQkJICAgICAgc3Ry dWN0IGFtbF92ZGVjX2N0eCAqY3R4KQo+ICt7Cj4gKwlpbnQgYWxsb2Nfc2l6ZSA9IDA7Cj4gKwlp bnQgaTsKPiArCXN0cnVjdCBhbWxfdmRlY19odyAqaHc7Cj4gKwlnZnBfdCBnZnAgPSBHRlBfS0VS TkVMIHwgR0ZQX0RNQTMyOwo+ICsKPiArCWlmIChoMjY0X2N0eC0+Y29sbGF0ZWRfY21hX3ZhZGRy KQo+ICsJCXJldHVybiAwOwoKW1NldmVyaXR5OiBDcml0aWNhbF0KSWYgdXNlcnNwYWNlIHByb3Zp ZGVzIGEgbmV3IFNQUyBtaWQtc3RyZWFtIHRoYXQgaW5jcmVhc2VzIHRoZSByZXNvbHV0aW9uLApk b2VzIGFsbG9jX2NvbG9jYXRlX2NtYSBieXBhc3MgcmVhbGxvY2F0aW5nIHRoZSBDTUEgYnVmZmVy PwoKSWYgd2UgcmV0dXJuIGVhcmx5IGhlcmUsIG9uZV9jb2xfYnVmX3NpemUgaXMgbm90IHVwZGF0 ZWQgZm9yIHRoZSBuZXcKZGltZW5zaW9ucy4gVGhpcyBjYXVzZXMgdGhlIGhhcmR3YXJlIHRvIHNp bGVudGx5IG92ZXJmbG93IHRoZSBleGlzdGluZwpzbWFsbGVyIGJ1ZmZlciB3aGVuIHdyaXRpbmcg bW90aW9uIHZlY3RvcnMuCgpbIC4uLiBdCj4gK3N0YXRpYyB2b2lkIHJlbGVhc2VfY29sb2NhdGVf YnVmKHN0cnVjdCBhbWxfaDI2NF9jdHggKmgyNjRfY3R4LCBpbnQgaW5kZXgpCj4gK3sKWyAuLi4g XQo+ICsJCX0gZWxzZSB7Cj4gKwkJCWlmIChoMjY0X2N0eC0+Y29sb2NhdGVkX2J1Zl9wb2NbaW5k ZXhdICE9IElOVkFMSURfUE9DICYmCj4gKwkJCSAgICAoKGgyNjRfY3R4LT5jb2xvY2F0ZWRfYnVm X21hcCA+PiBpbmRleCkgJiAweDEpID09IDB4MSkgewo+ICsJCQkJaDI2NF9jdHgtPmNvbG9jYXRl ZF9idWZfbWFwICY9ICh+KDEgPDwgaW5kZXgpKTsKPiArCQkJCWRldl9kYmcKPiArCQkJCSAgICAo JmN0eC0+ZGV2LT5wbGF0X2Rldi0+ZGV2LAo+ICsJCQkJICAgICAiJXMgY29sb2NhdGVkX2J1Zl9p bmRleCAlZCByZWxlYXNlZCBwb2MgJWRcbiIsCj4gKwkJCQkgICAgIF9fZnVuY19fLCBpbmRleCwK PiArCQkJCSAgICAgaDI2NF9jdHgtPmNvbG9jYXRlZF9idWZfcG9jW2luZGV4XSk7Cj4gKwkJCX0K PiArCQkJaDI2NF9jdHgtPmNvbG9jYXRlZF9idWZfcG9jW2luZGV4XSA9IElOVkFMSURfUE9DOwo+ ICsJCX0KPiArCX0KPiArfQpbIC4uLiBdCj4gK3N0YXRpYyB2b2lkIGNsZWFyX3VudXNlZF9jb2xf YnVmKHN0cnVjdCBhbWxfaDI2NF9jdHggKmgyNjRfY3R4LAo+ICsJCQkJIHN0cnVjdCB2NGwyX2N0 cmxfaDI2NF9kZWNvZGVfcGFyYW1zICpkZWNvZGUpCj4gK3sKWyAuLi4gXQo+ICsJZm9yIChpID0g MDsgaSA8IGgyNjRfY3R4LT5jb2xvY2F0ZWRfYnVmX251bTsgaSsrKSB7Cj4gKwkJY29sX3BvYyA9 IGgyNjRfY3R4LT5jb2xvY2F0ZWRfYnVmX3BvY1tpXTsKPiArCQlpZiAoY29sX3BvYyAhPSBJTlZB TElEX1BPQyAmJgo+ICsJCSAgICAocG9jX2lzX2luX2RwYihjb2xfcG9jLCBkZWNvZGUtPmRwYikg IT0gMSkpCj4gKwkJCXJlbGVhc2VfY29sb2NhdGVfYnVmKGgyNjRfY3R4LCBpKTsKPiArCX0KCltT ZXZlcml0eTogQ3JpdGljYWxdCklzIGNvbG9jYXRlZF9idWZfbnVtIGZ1bGx5IGNvbnRyb2xsZWQg YnkgdGhlIFBQUyBkZWZhdWx0IGFjdGl2ZSBtaW51czEKaW4gY2xlYXJfdW51c2VkX2NvbF9idWY/ CgpJZiB1c2Vyc3BhY2UgaW5mbGF0ZXMgdGhpcyB2YWx1ZSBiZXlvbmQgSDI2NF9NQVhfQ09MX0JV RiAoMzIpLCB0aGlzIGxvb3AKd2lsbCBpdGVyYXRlIG91dCBvZiBib3VuZHMsIGFuZCByZWxlYXNl X2NvbG9jYXRlX2J1ZiB3aWxsIHdyaXRlCklOVkFMSURfUE9DICgweEZGRkZGRkZGKSBiZXlvbmQg dGhlIGVuZCBvZiB0aGUgY29sb2NhdGVkX2J1Zl9wb2MgYXJyYXksCmNhdXNpbmcgbWVtb3J5IGNv cnJ1cHRpb24gaW4gdGhlIGFtbF9oMjY0X2N0eCBzdHJ1Y3QuCgpbIC4uLiBdCj4gK3N0YXRpYyB2 b2lkIGgyNjRfY29uZmlnX2RlY29kZV9zcGVjKHN0cnVjdCBhbWxfdmRlY19odyAqaHcsIHN0cnVj dCBhbWxfdmRlY19jdHggKmN0eCkKPiArewpbIC4uLiBdCj4gKwkJYnVmX3NwZWNfbDAgPSBmaW5k X3NwZWNfYnlfZHBiX2luZGV4KGgyNjRfY3R4LCBpLCAwKTsKPiArCQlpZiAoYnVmX3NwZWNfbDAp IHsKPiArCQkJYnVmX3NwZWNfbDAtPmNhbnZhc19wb3MgPQo+ICsJCQkgICAgZ2V0X2NhbnZhc19w b3NfYnlfcG9jKGgyNjRfY3R4LAo+ICsJCQkJCQkgIGRwYi0+dG9wX2ZpZWxkX29yZGVyX2NudCk7 Cj4gKwkJCWlmIChidWZfc3BlY19sMC0+Y2FudmFzX3BvcyA8IDApIHsKPiArCQkJCWRldl9lcnIo JmN0eC0+ZGV2LT5wbGF0X2Rldi0+ZGV2LAoKW1NldmVyaXR5OiBIaWdoXQpJcyBjYW52YXNfcG9z IGFuIHVuc2lnbmVkIGludGVnZXIgaW4gaDI2NF9jb25maWdfZGVjb2RlX3NwZWM/CgpJZiBnZXRf Y2FudmFzX3Bvc19ieV9wb2MgcmV0dXJucyAtMSBmb3IgYW4gdW5hbGxvY2F0ZWQgY2FudmFzLCB0 aGUgPCAwCmNoZWNrIHdpbGwgZmFpbCBiZWNhdXNlIG9mIGludGVnZXIgcHJvbW90aW9uLiBUaGUg MHhGRkZGRkZGRiB2YWx1ZSB3aWxsCnRoZW4gYmUgdXNlZCBpbiBjb25maWdfZGVjb2RlX2NhbnZh cyB0byBjYWxjdWxhdGUgYW4gb3V0LW9mLWJvdW5kcyBNTUlPCm9mZnNldCAoQU5DMF9DQU5WQVNf QUREUiAtIDQpIGFuZCBvdmVyd3JpdGUgYWRqYWNlbnQgaGFyZHdhcmUgcmVnaXN0ZXJzLgoKWyAu Li4gXQo+ICtzdGF0aWMgdm9pZCByZW9yZGVyX3Nob3J0X3Rlcm0oc3RydWN0IHNsaWNlICpjdXJy X3NsaWNlLCBpbnQgY3VyX2xpc3QsCj4gKwkJCSAgICAgICBpbnQgcGljX251bV9seCwgaW50ICpy ZWZfaWR4X2x4KQo+ICt7ClsgLi4uIF0KPiArCW51bV9yZWZfaWR4X2x4X2FjdGl2ZSA9IGdldF9y ZWZfbGlzdF9zaXplKGgyNjRfY3R4LCBjdXJfbGlzdCk7Cj4gKwlpZiAobnVtX3JlZl9pZHhfbHhf YWN0aXZlID4gKFY0TDJfSDI2NF9OVU1fRFBCX0VOVFJJRVMgKyAxKSkgewo+ICsJCWRldl9kYmco JmN0eC0+ZGV2LT5wbGF0X2Rldi0+ZGV2LCAiaW5jb3JyZWN0IHZhbHVlIHN0IG51bV9yZWZfaWR4 X2x4X2FjdGl2ZSAlZFxuIiwKPiArCQkJbnVtX3JlZl9pZHhfbHhfYWN0aXZlKTsKPiArCQlyZXR1 cm47Cj4gKwl9CgpbU2V2ZXJpdHk6IENyaXRpY2FsXQpEb2VzIHRoZSBvZmYtYnktb25lIGNoZWNr IGluIHJlb3JkZXJfc2hvcnRfdGVybSBhbGxvdyBhbiBhcnJheSBib3VuZHMgd3JpdGU/CgpWNEwy X0gyNjRfTlVNX0RQQl9FTlRSSUVTIGlzIDE2LCBzbyB0aGUgY2hlY2sgYWxsb3dzIG51bV9yZWZf aWR4X2x4X2FjdGl2ZQp0byBiZSAxNy4gVGhlIGxvb3AgYmVsb3cgd2lsbCB0aGVuIGFjY2VzcyBh bmQgd3JpdGUgdG8gaW5kZXggMTcgb2YgdGhlCnJlZl9saXN0IGFycmF5LCB3aGljaCBvbmx5IGhv bGRzIDE3IGl0ZW1zICgwIHRvIDE2KS4gQWRkaXRpb25hbGx5LApyZW9yZGVyX2xvbmdfdGVybSBh cHBlYXJzIHRvIGNvbXBsZXRlbHkgbGFjayB0aGlzIGJvdW5kcyBjaGVjaywgYWxsb3dpbmcKdW5i b3VuZGVkIHdyaXRlcyBwYXN0IHRoZSBhcnJheSBiYXNlZCBvbiBQUFMgdmFsdWVzLgoKWyAuLi4g XQo+ICtzdGF0aWMgaW50IGdldF9yZWZfbGlzdF9zaXplKHN0cnVjdCBhbWxfaDI2NF9jdHggKmgy NjRfY3R4LCBpbnQgY3VyX2xpc3QpCj4gK3sKWyAuLi4gXQo+ICsJaWYgKGN1cl9saXN0ID09IDAp IHsKPiArCQludW1fcmVmX2lkeF9seF9hY3RpdmVfbWludXMxID0KPiArCQkJaDI2NF9jdHgtPmN0 cmxfcmVmLnBwcy0+bnVtX3JlZl9pZHhfbDBfZGVmYXVsdF9hY3RpdmVfbWludXMxOwo+ICsJCWlm IChvdmVycmlkZV9mbGFnKQo+ICsJCQludW1fcmVmX2lkeF9seF9hY3RpdmVfbWludXMxID0KPiAr CQkJCWgyNjRfY3R4LT5kcGJfcGFyYW0uZHBiLm51bV9yZWZfaWR4X2wwX2FjdGl2ZV9taW51czE7 Cj4gKwl9IGVsc2Ugewo+ICsJCW51bV9yZWZfaWR4X2x4X2FjdGl2ZV9taW51czEgPQo+ICsJCQlo MjY0X2N0eC0+Y3RybF9yZWYucHBzLT5udW1fcmVmX2lkeF9sMV9kZWZhdWx0X2FjdGl2ZV9taW51 czE7Cj4gKwl9CgpbU2V2ZXJpdHk6IE1lZGl1bV0KRG9lcyBnZXRfcmVmX2xpc3Rfc2l6ZSBpZ25v cmUgdGhlIG92ZXJyaWRlX2ZsYWcgZm9yIHRoZSBMMSByZWZlcmVuY2UgbGlzdD8KCkFjY29yZGlu ZyB0byB0aGUgSC4yNjQgc3BlY2lmaWNhdGlvbiwgbnVtX3JlZl9pZHhfYWN0aXZlX292ZXJyaWRl X2ZsYWcKYXBwbGllcyB0byBib3RoIEwwIGFuZCBMMSBsaXN0cyBpbiBCLXNsaWNlcy4gSWdub3Jp bmcgaXQgaGVyZSBjb3VsZCBjYXVzZQpkZWNvZGluZyBpc3N1ZXMgZm9yIHZhbGlkIHN0cmVhbXMg dGhhdCBvdmVycmlkZSBib3RoIHNpemVzLgoKWyAuLi4gXQo+ICtzdGF0aWMgaXJxcmV0dXJuX3Qg aDI2NF90aHJlYWRlZF9pc3JfZnVuYyhpbnQgaXJxLCB2b2lkICpwcml2KQo+ICt7Cj4gKwl1MzIg ZGVjX3N0YXR1czsKPiArCXN0cnVjdCBhbWxfdmRlY19kZXYgKmRldiA9IChzdHJ1Y3QgYW1sX3Zk ZWNfZGV2ICopcHJpdjsKPiArCXN0cnVjdCBhbWxfaDI2NF9jdHggKmgyNjRfY3R4ID0gKHN0cnVj dCBhbWxfaDI2NF9jdHggKilkZXYtPmRlY19ody0+Y3Vycl9jdHg7Cj4gKwlzdHJ1Y3QgYW1sX3Zk ZWNfY3R4ICpjdHggPSAoc3RydWN0IGFtbF92ZGVjX2N0eCAqKWgyNjRfY3R4LT52NGwyX2N0eDsK CltTZXZlcml0eTogSGlnaF0KSWYgaHctPmN1cnJfY3R4IGlzIGNsZWFyZWQgY29uY3VycmVudGx5 IGFzIG5vdGljZWQgZWFybGllciBpbgp2ZGVjX3RocmVhZGVkX2lzcl9oYW5kbGVyLCBkb2Vzbid0 IGgyNjRfdGhyZWFkZWRfaXNyX2Z1bmMgZGVyZWZlcmVuY2UKdGhlIE5VTEwgY29udGV4dCB3aGVu IGNhc3RpbmcgYW5kIHJlYWRpbmcgaDI2NF9jdHgtPnY0bDJfY3R4PwoKQWRkaXRpb25hbGx5LCBp ZiB0aGUgY29udGV4dCBpcyB2YWxpZCBidXQgdGhlIHF1ZXVlIGlzIGVtcHR5IGR1cmluZyBhCnNw dXJpb3VzIGludGVycnVwdCwgdjRsMl9tMm1fbmV4dF9kc3RfYnVmIGZ1cnRoZXIgZG93biB3aWxs IHJldHVybiBOVUxMCmFuZCBjcmFzaC4KClsgLi4uIF0KPiAraW50IGFtbF9oMjY0X2RlY19ydW4o dm9pZCAqcHJpdikKPiArewpbIC4uLiBdCj4gKwlyZXQgPSB3YWl0X2V2ZW50X2ludGVycnVwdGli bGVfdGltZW91dChjdHgtPnF1ZXVlLCBjdHgtPmludF9jb25kLAo+ICsJCQkJCSAgICAgICBtc2Vj c190b19qaWZmaWVzKERFQ09ERVJfVElNRU9VVF9NUykpOwo+ICsJY3R4LT5pbnRfY29uZCA9IDA7 CgpbU2V2ZXJpdHk6IEhpZ2hdCklzIGl0IHNhZmUgdG8gcGVyZm9ybSBhIGJsb2NraW5nIHdhaXQg aW5zaWRlIHRoZSBub24tYmxvY2tpbmcgZGV2aWNlX3J1bgpjYWxsYmFjayBpbiBhbWxfaDI2NF9k ZWNfcnVuPwoKVGhlIFY0TDIgTTJNIGFyY2hpdGVjdHVyZSBleHBlY3RzIGRldmljZV9ydW4gdG8g aW5pdGlhdGUgaGFyZHdhcmUKcHJvY2Vzc2luZyBhbmQgcmV0dXJuIGltbWVkaWF0ZWx5LiBTbGVl cGluZyBoZXJlIGZvcmNlcyB0aGUgc2hhcmVkIE0yTQp3b3JrZXIgdGhyZWFkIHRvIGJsb2NrLCBz dGFsbGluZyBhbGwgY29uY3VycmVudCBkZWNvZGluZyBpbnN0YW5jZXMuCgpBbHNvLCBzaG91bGQg Y3R4LT5pbnRfY29uZCBiZSByZXNldCB0byAwIGJlZm9yZSBpbml0aWF0aW5nIHRoZSBqb2IsCnJh dGhlciB0aGFuIGFmdGVyIHRoZSB3YWl0PyBJZiBhIGRlbGF5ZWQgaGFyZHdhcmUgaW50ZXJydXB0 IGZpcmVzIGFmdGVyCnRoaXMgcmVzZXQsIHRoZSBuZXh0IGRlY29kZSBydW4gd2lsbCBvYnNlcnZl IGN0eC0+aW50X2NvbmQgPT0gMSBhbmQKcmV0dXJuIGluc3RhbnRseS4KClsgLi4uIF0KPiArCWlm ICghcmV0KSB7Cj4gKwkJcmV0ID0gLTE7Cj4gKwkJZGV2X2VycigmY3R4LT5kZXYtPnBsYXRfZGV2 LT5kZXYsICJkZWMgdGltZW91dD0ldVxuIiwgREVDT0RFUl9USU1FT1VUX01TKTsKPiArCQlmb3Ig KGkgPSAwOyBpIDwgMTY7IGkrKykgewkvKiAxNiA6IHNob3cgdWNvZGUgUEMgMTYgdGltZXMgd2hl biB0aW1lb3V0ICovCj4gKwkJCWRldl9kYmcoJmN0eC0+ZGV2LT5wbGF0X2Rldi0+ZGV2LCAiZGVj b2RlciB0aW1lb3V0LCBwYyAweCV4XG4iLAo+ICsJCQkJcmVhZF9kb3NfcmVnKGRlY19odywgTVBD X0UpKTsKPiArCQkJdXNsZWVwX3JhbmdlKDEwLCAyMCk7Cj4gKwkJfQo+ICsJCWgyNjRfcmVsZWFz ZV9kZWNvZGVfc3BlYyhkZWNfaHcsIGN0eCk7Cj4gKwl9IGVsc2UgaWYgKC1FUkVTVEFSVFNZUyA9 PSByZXQpIHsKPiArCQlyZXQgPSAtMTsKPiArCQloMjY0X3JlbGVhc2VfZGVjb2RlX3NwZWMoZGVj X2h3LCBjdHgpOwo+ICsJfQoKW1NldmVyaXR5OiBIaWdoXQpEb2VzIHRoZSB0aW1lb3V0IG9yIHNp Z25hbCBoYW5kbGluZyBpbiBhbWxfaDI2NF9kZWNfcnVuIHJhY2Ugd2l0aCB0aGUKdGhyZWFkZWQg SVJRIGhhbmRsZXI/CgpJZiB0aGUgd2FpdCBpcyBpbnRlcnJ1cHRlZCBvciB0aW1lcyBvdXQsIHRo aXMgZGlyZWN0bHkgZXhlY3V0ZXMKaDI2NF9yZWxlYXNlX2RlY29kZV9zcGVjLiBJZiB0aGUgZGVs YXllZCBoYXJkd2FyZSBpbnRlcnJ1cHQgZmlyZXMKY29uY3VycmVudGx5LCBoMjY0X3RocmVhZGVk X2lzcl9mdW5jIHdpbGwgYWxzbyB1bmNvbmRpdGlvbmFsbHkgY2FsbApoMjY0X3JlbGVhc2VfZGVj b2RlX3NwZWMuIFdpdGhvdXQgYSBsb2NrLCB0aGlzIHJpc2tzIGRvdWJsZS1mcmVlcyBvZgp0aGUg Y2FudmFzIElEcyBhbmQgc3RydWN0dXJhbCBjb3JydXB0aW9uLgoKLS0gClNhc2hpa28gQUkgcmV2 aWV3IMK3IGh0dHBzOi8vc2FzaGlrby5kZXYvIy9wYXRjaHNldC8yMDI2MDgxMi1iNC1zNC12ZGVj LXVwc3RyZWFtLXY3LTAtM2ZhZTA4NTg2MWJkQGFtbG9naWMuY29tP3BhcnQ9NAoKX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbGludXgtYW1sb2dpYyBtYWls aW5nIGxpc3QKbGludXgtYW1sb2dpY0BsaXN0cy5pbmZyYWRlYWQub3JnCmh0dHA6Ly9saXN0cy5p bmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8vbGludXgtYW1sb2dpYwo= From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C68163033F8 for ; Wed, 12 Aug 2026 03:04:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786503848; cv=none; b=mSOp6z9wFzFBhNEW0yi0C3luP1lB8pg7lA8lF6pq8wZO+9gCoPXD/m/FwIFneUADbgfWrVZ3iFyhUruOdGcE0ocNOwkwYcsVP7SOrePsVFNzTz/EhjTF8C906TM/CCRefhnjijpQ0L5ZWbooZtHIR0KD+vrXfqw34SZu3l2VPHk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786503848; c=relaxed/simple; bh=MQKK5JxaEoWuR9m1/+diZi3TNHlm7/0zv73VzjL6GOs=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=thuOBttyM3+5fd05nP8OF3KHOm3ziYGmTsuH9FWUsXz0LJOWoZRbn4nocKR9LA6vRVqsvWhzxHxx8h5eSzWaQrk3MT9+NhmddnXxDaReqdKOiXGkQ5AtH7uPu3lorAZdYcp3hdSnFMAgKGhNctbEHSCNi516Mb4gw73wjuLLK4g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=PtxRbljh; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="PtxRbljh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFAFD1F000E9; Wed, 12 Aug 2026 03:04:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786503846; bh=pycxU543XN7qwtxxsAjU6N59CasYVXqBRsX4jrr615Y=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=PtxRbljhJzDF/4PZv3P59HEPJEqjV0KFih8R+RzTAu/F2nZ85lvLpZwxiIPU06Hgt wNQC6FbXv906dSct/3L/AEoB1MEk2epDis8O1ZufMggDezDwPAq/+qIJmoKSFGkH1I 5Q25SCZQMQPe/zj6feB96gvXMBM86f+VesQJj+1euAmrLPWtZ8fbDYTxn0QcWboIla FQDoZ1kdgMdUooJHyijkfGt3QH+hE3EtDGA9w+hAHSLJ6PdNZ69O6S94GXW3QWW4qc bVEwuF5F0jfyx5WBymvSnZ4TGFBlpoKdZK+LK4YbwfXOrZ5I2UTmOiw/vvLRKxGpwK DMzCEYK1S7l8A== From: sashiko-bot@kernel.org Subject: Re: [PATCH v7 4/6] decoder: Add V4L2 stateless H.264 decoder driver Reply-To: sashiko-reviews@lists.linux.dev To: "Zhentao Guo" Cc: devicetree@vger.kernel.org, robh@kernel.org, neil.armstrong@linaro.org, conor+dt@kernel.org, linux-amlogic@lists.infradead.org, media-ci@linuxtv.org In-Reply-To: <20260812-b4-s4-vdec-upstream-v7-4-3fae085861bd@amlogic.com> References: <20260812-b4-s4-vdec-upstream-v7-0-3fae085861bd@amlogic.com> <20260812-b4-s4-vdec-upstream-v7-4-3fae085861bd@amlogic.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Wed, 12 Aug 2026 03:04:05 +0000 Message-Id: <20260812030405.EFAFD1F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 22 potential issue= (s) to consider: - [Critical] Unvalidated SPS dimensions cause a 32-bit integer overflow, re= sulting in an undersized CMA buffer and massive out-of-bounds DMA writes. - [Critical] Array bounds writes during reference list reordering allows ma= ssive heap corruption. - [Critical] Trusting V4L2 PPS control fields allows a heap overflow via `c= lear_unused_col_buf`. - [Critical] Dynamic resolution changes bypass DMA buffer reallocation, cau= sing the hardware to overflow the colocated CMA buffer. - [High] Use-after-free of V4L2 M2M context and driver resources due to inc= orrect teardown order and devres usage in `aml_vdec_drv_remove`. - [High] TOCTOU race in `vdec_threaded_isr_handler` leads to NULL pointer d= ereference of `curr_ctx` and `v4l2_m2m_next_dst_buf`. - [High] Error path in `get_firmware` incorrectly returns 0 on undersized f= irmware, passing uninitialized stack memory to the TEE API. - [High] Hardware VIFIFO Write Pointer is programmed with a physical offset= beyond the allocated V4L2 buffer bounds, causing out-of-bounds DMA reads. - [High] Improper error handling of `of_parse_phandle` allows `sec_fw` to r= emain NULL, causing a kernel panic. - [High] Sleeping in `device_run` stalls the shared V4L2 M2M worker thread. - [High] Double free of the video device object `vfd_dec` on error paths in= `aml_vdec_drv_probe`. - [High] Missing reset of `ctx->int_cond` causes subsequent hardware decode= waits to complete prematurely. - [High] `fops_vcodec_release` frees the control handler before releasing t= he M2M context, causing active jobs to access freed controls. - [High] Failing to validate an unallocated Canvas POC allows an out-of-bou= nds MMIO register write, letting an attacker tamper with adjacent device re= gisters. - [High] Data race between hardware wait timeout/signal handling and the th= readed IRQ handler. - [High] The hard IRQ handler accesses regmap over MMIO without `.use_raw_s= pinlock =3D true`, triggering a 'sleeping in atomic context' BUG on PREEMPT= _RT kernels. - [Medium] Overwriting `meson_canvas_alloc` return values bypasses error ch= ecking, leading to canvas corruption and double-frees. - [Medium] The driver ignores `num_ref_idx_l1_active_minus1` overrides in B= -slices, violating the H.264 specification. - [Medium] Hardware power domains and clocks are unconditionally enabled pe= rmanently during probe. - [Medium] Power domains and device links are leaked if hardware resource i= nitialization fails. - [Medium] The `v4l2_ctrl_handler` memory is leaked if `v4l2_ctrl_handler_s= etup` fails. - [Low] Kconfig unconditionally selects `MESON_CANVAS`, risking unmet direc= t dependency warnings under `COMPILE_TEST`. -- --- Patch [4]: [PATCH v7 4/6] decoder: Add V4L2 stateless H.264 decoder dri= ver --- commit b11f2b7369a2bd8b856bd77ca3082b77fefa66fe Author: Zhentao Guo Subject: decoder: Add V4L2 stateless H.264 decoder driver This commit adds the initial support for the V4L2 stateless video decoder driver on the Amlogic S4 platform. It currently supports 8-bit progressive H.264 bitstream decoding. > diff --git a/drivers/media/platform/amlogic/vdec/Kconfig b/drivers/media/= platform/amlogic/vdec/Kconfig > --- /dev/null > +++ b/drivers/media/platform/amlogic/vdec/Kconfig > @@ -0,0 +1,18 @@ > +# SPDX-License-Identifier: (GPL-2.0-only OR MIT) > + > +config VIDEO_AMLOGIC_VDEC > + tristate "Amlogic Video Decoder Driver" > + depends on ARCH_MESON || COMPILE_TEST > + depends on VIDEO_DEV > + depends on V4L_MEM2MEM_DRIVERS > + depends on TEE > + depends on MESON_SM > + select VIDEOBUF2_DMA_CONTIG > + select V4L2_H264 > + select V4L2_MEM2MEM_DEV > + select MESON_CANVAS [Severity: Low] Does selecting MESON_CANVAS unconditionally here risk unmet direct dependency warnings under COMPILE_TEST? Since VIDEO_AMLOGIC_VDEC supports COMPILE_TEST, it could be built on architectures where MESON_CANVAS dependencies are not met. > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec_drv.c b/drivers= /media/platform/amlogic/vdec/aml_vdec_drv.c > --- /dev/null > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec_drv.c > @@ -0,0 +1,231 @@ [ ... ] > +static int fops_vcodec_open(struct file *file) > +{ [ ... ] > + ret =3D aml_vdec_ctrls_setup(ctx); > + if (ret) { > + v4l2_err(&dec_dev->v4l2_dev, "Failed to init all ctrls (%d)", ret); > + goto err_ctrls_setup; > + } > + > + aml_vdec_reset_fmts(ctx); > + mutex_unlock(&dec_dev->dev_mutex); > + > + return ret; > + > +err_ctrls_setup: > + v4l2_m2m_ctx_release(ctx->m2m_ctx); > +err_m2m_ctx_init: > + v4l2_fh_del(&ctx->fh, file); > + v4l2_fh_exit(&ctx->fh); > + kfree(ctx); > + mutex_unlock(&dec_dev->dev_mutex); > + > + return ret; > +} [Severity: Medium] Is there a missing call to v4l2_ctrl_handler_free in the err_ctrls_setup path in fops_vcodec_open? If v4l2_ctrl_handler_setup fails during aml_vdec_ctrls_setup, it returns an error but does not free the handler. This error path also skips cleaning it up, which looks like it would permanently leak the handler's internal allocations. [ ... ] > +static int fops_vcodec_release(struct file *file) > +{ > + struct aml_vdec_ctx *ctx =3D fh_to_dec_ctx(file); > + > + v4l2_ctrl_handler_free(&ctx->ctrl_handler); > + v4l2_m2m_ctx_release(ctx->m2m_ctx); > + v4l2_fh_del(&ctx->fh, file); > + v4l2_fh_exit(&ctx->fh); > + kfree(ctx); > + > + return 0; > +} [Severity: High] Could freeing the control handler before releasing the M2M context cause a use-after-free in fops_vcodec_release? The M2M context release performs a blocking wait to cancel active jobs. If the worker thread is still executing or sleeping in aml_h264_dec_run, it will eventually finish and call v4l2_ctrl_request_complete. This would access the poisoned control lists since v4l2_ctrl_handler_free has already destroyed them. [ ... ] > +static int aml_vdec_drv_probe(struct platform_device *pdev) > +{ > + struct aml_vdec_dev *dev; > + struct video_device *vfd_dec; > + struct aml_vdec_hw *hw; > + int ret =3D 0; > + > + dev =3D devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL); [Severity: High] Should the aml_vdec_dev structure's lifetime be tied to the V4L2 object instead of the device binding in aml_vdec_drv_probe? By using devres, the structure is freed when the device unbinds. However, userspace could still hold an open file descriptor to the video device, allowing subsequent ioctls or close operations to access the freed m2m_dev_dec and dev_mutex via the dangling ctx->dev pointer. [ ... ] > + ret =3D media_device_register(&dev->mdev); > + if (ret) { > + v4l2_err(&dev->v4l2_dev, "Failed to register media device"); > + goto err_media_dev_register; > + } > + vdec_enable(dev->dec_hw); > + return 0; [Severity: Medium] Does aml_vdec_drv_probe keep the hardware power domain and clocks permanently enabled while the driver is loaded? Calling vdec_enable here synchronously powers on the domain and enables the clocks indefinitely. It might be better to integrate this with Runtime PM so the hardware can power down when not actively decoding. [ ... ] > +err_media_dev_register: > + v4l2_m2m_unregister_media_controller(dev->m2m_dev_dec); > +error_m2m_mc_register: > + media_device_cleanup(&dev->mdev); > + video_unregister_device(dev->vfd); > +err_vid_dev_register: > + v4l2_m2m_release(dev->m2m_dev_dec); > +err_m2m_dev_init: > + dev->pvdec_data->destroy_hw_resource(dev); > +err_hw_init: > + dev->dec_hw =3D NULL; > +err_dec_mem_init: > + video_device_release(vfd_dec); > +err_device_alloc: > + v4l2_device_unregister(&dev->v4l2_dev); > + return ret; > +} [Severity: High] Can the err_dec_mem_init path in aml_vdec_drv_probe cause a double free of the video device object? If an error occurs after successful video device registration, the code falls through error_m2m_mc_register and calls video_unregister_device, which drops the refcount and invokes the release callback to kfree vfd_dec. Continuing to fall through to err_dec_mem_init then calls video_device_release(vfd_dec), which would kfree the exact same pointer. [ ... ] > +static void aml_vdec_drv_remove(struct platform_device *pdev) > +{ > + struct aml_vdec_dev *dev =3D platform_get_drvdata(pdev); > + > + vdec_disable(dev->dec_hw); > + > + media_device_unregister(&dev->mdev); > + v4l2_m2m_unregister_media_controller(dev->m2m_dev_dec); > + media_device_cleanup(&dev->mdev); > + > + v4l2_m2m_release(dev->m2m_dev_dec); > + video_unregister_device(dev->vfd); > + dev->pvdec_data->destroy_hw_resource(dev); > + v4l2_device_unregister(&dev->v4l2_dev); > +} [Severity: High] Does releasing the M2M context before unregistering the video device in aml_vdec_drv_remove create a race condition? If a userspace application is concurrently calling ioctls while the driver is being removed, they might access the freed M2M context before the video device is fully torn down by video_unregister_device. > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec_hw.c b/drivers/= media/platform/amlogic/vdec/aml_vdec_hw.c > --- /dev/null > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec_hw.c [ ... ] > +static irqreturn_t vdec_threaded_isr_handler(int irq, void *priv) > +{ > + struct aml_vdec_dev *dev =3D (struct aml_vdec_dev *)priv; > + struct aml_vdec_hw *hw =3D dev->dec_hw; > + irqreturn_t ret =3D IRQ_HANDLED; > + > + if (hw->hw_ops.irq_threaded_func && hw->curr_ctx) > + ret =3D hw->hw_ops.irq_threaded_func(irq, priv); > + > + return ret; > +} [Severity: High] Is it safe to check hw->curr_ctx in vdec_threaded_isr_handler without holding any locks? Concurrently, aml_h264_dec_run can set hw->curr_ctx to NULL upon a timeout or signal. If the context is cleared immediately after this check passes, the threaded ISR would dereference a NULL pointer. [ ... ] > +static const struct regmap_config dos_regmap_conf =3D { > + .reg_bits =3D 32, > + .val_bits =3D 32, > + .reg_stride =3D 4, > + .max_register =3D 0x10000, > +}; [Severity: High] Should the dos_regmap_conf configuration include .use_raw_spinlock =3D true? Without it, the regmap uses a standard spinlock, which becomes a sleepable mutex on PREEMPT_RT kernels. Since h264_isr calls regmap_write from the primary hard IRQ handler context, taking a sleepable lock here will cause a sleeping in atomic context BUG on RT. [ ... ] > +int dev_request_hw_resources(void *priv) > +{ [ ... ] > + if (hw->pm->init) { > + ret =3D hw->pm->init(hw); > + if (ret < 0) { > + dev_err(&pdev->dev, "power mgr init failed!\n"); > + return ret; > + } > + } > + > + ret =3D vdec_clock_gate_init(hw); > + if (ret) { > + dev_err(&pdev->dev, "clk bulk init failed!\n"); > + return ret; > + } [Severity: Medium] If vdec_clock_gate_init or aml_tee_fw_preload fails in dev_request_hw_resources, we return early. Should we call hw->pm->release(hw) in the error path to tear down the PM domain we just successfully attached, to avoid permanently leaking it? [ ... ] > + sm_np =3D of_parse_phandle(pdev->dev.of_node, "secure-monitor", 0); > + if (IS_ERR_OR_NULL(sm_np)) > + return PTR_ERR(sm_np); [Severity: High] Does IS_ERR_OR_NULL mask the error when of_parse_phandle fails in dev_request_hw_resources? of_parse_phandle returns NULL on failure. PTR_ERR(NULL) evaluates to 0, so dev_request_hw_resources would silently succeed while leaving hw->sec_fw uninitialized. Later, load_firmware would pass this NULL pointer to meson_sm_call, causing a kernel panic. > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec_tee_fw.c b/driv= ers/media/platform/amlogic/vdec/aml_vdec_tee_fw.c > --- /dev/null > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec_tee_fw.c [ ... ] > +static int get_firmware(const char *path, void **data, size_t *size) > +{ > + const struct firmware *fw =3D NULL; > + int ret; > + void *buf; > + > + ret =3D request_firmware(&fw, FIRMWARE_PATH, NULL); > + if (ret || fw->size <=3D UCODE_HEADER_SIZE) > + return ret; [Severity: High] If the firmware size is less than or equal to UCODE_HEADER_SIZE in get_firmware, this returns 0 (since ret is 0 here) but doesn't initialize the data or size output pointers. This causes the caller, pass_firmware_to_tee, to believe it succeeded and invoke the TEE API with uninitialized stack memory, eventually calling kfree on an uninitialized pointer. > diff --git a/drivers/media/platform/amlogic/vdec/h264.c b/drivers/media/p= latform/amlogic/vdec/h264.c > --- /dev/null > +++ b/drivers/media/platform/amlogic/vdec/h264.c [ ... ] > +static int h264_prepare_input(struct aml_vdec_ctx *ctx) > +{ [ ... ] > + dummy =3D payload_size + VLD_PADDING_SIZE; > + regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_WP, > + round_down((src_dma + dummy), VDEC_FIFO_ALIGN)); [Severity: High] Could the dummy calculation in h264_prepare_input cause out-of-bounds DMA reads? We program the hardware write pointer to src_dma + payload_size + VLD_PADDING_SIZE. If userspace sets sizeimage equal to payload_size, this physical offset points beyond the memory allocated for the CMA buffer. [ ... ] > +static void config_sps_params(struct aml_h264_ctx *h264_ctx, > + unsigned short *sps_base, > + const struct v4l2_ctrl_h264_sps *sps) > +{ [ ... ] > + h264_ctx->mb_width =3D (sps->pic_width_in_mbs_minus1 + 4) & 0xfffffffc; > + h264_ctx->mb_height =3D (sps->pic_height_in_map_units_minus1 + 4) & 0xf= ffffffc; > + > + h264_ctx->mb_total =3D h264_ctx->mb_width * h264_ctx->mb_height; [Severity: Critical] Are the mb_width and mb_height dimensions validated against maximum limits in config_sps_params? Userspace can provide arbitrary values for the width and height. Extremely large values cause mb_total * 96 in alloc_colocate_cma to exceed 32 bits, truncating to a small allocation size. The hardware would then write colocated motion vectors well past the allocated buffer bounds. [ ... ] > +static void config_decode_canvas(struct aml_vdec_hw *hw, > + struct h264_decode_buf_spec *buf_spec, > + u32 mb_width, u32 mb_height) > +{ > + int canvas_alloc_result =3D 0; > + int blkmode =3D 0x0; > + > + canvas_alloc_result =3D meson_canvas_alloc(hw->canvas, &buf_spec->y_can= vas_index); > + canvas_alloc_result =3D meson_canvas_alloc(hw->canvas, &buf_spec->u_can= vas_index); [Severity: Medium] Does config_decode_canvas clobber the first canvas_alloc_result without checking it? If the Y canvas allocation fails but the U canvas allocation succeeds, the error is masked. The uninitialized Y canvas index will be programmed into hardware and eventually passed to meson_canvas_free, potentially causing a double-free. [ ... ] > +static int alloc_colocate_cma(struct aml_h264_ctx *h264_ctx, > + struct aml_vdec_ctx *ctx) > +{ > + int alloc_size =3D 0; > + int i; > + struct aml_vdec_hw *hw; > + gfp_t gfp =3D GFP_KERNEL | GFP_DMA32; > + > + if (h264_ctx->collated_cma_vaddr) > + return 0; [Severity: Critical] If userspace provides a new SPS mid-stream that increases the resolution, does alloc_colocate_cma bypass reallocating the CMA buffer? If we return early here, one_col_buf_size is not updated for the new dimensions. This causes the hardware to silently overflow the existing smaller buffer when writing motion vectors. [ ... ] > +static void release_colocate_buf(struct aml_h264_ctx *h264_ctx, int inde= x) > +{ [ ... ] > + } else { > + if (h264_ctx->colocated_buf_poc[index] !=3D INVALID_POC && > + ((h264_ctx->colocated_buf_map >> index) & 0x1) =3D=3D 0x1) { > + h264_ctx->colocated_buf_map &=3D (~(1 << index)); > + dev_dbg > + (&ctx->dev->plat_dev->dev, > + "%s colocated_buf_index %d released poc %d\n", > + __func__, index, > + h264_ctx->colocated_buf_poc[index]); > + } > + h264_ctx->colocated_buf_poc[index] =3D INVALID_POC; > + } > + } > +} [ ... ] > +static void clear_unused_col_buf(struct aml_h264_ctx *h264_ctx, > + struct v4l2_ctrl_h264_decode_params *decode) > +{ [ ... ] > + for (i =3D 0; i < h264_ctx->colocated_buf_num; i++) { > + col_poc =3D h264_ctx->colocated_buf_poc[i]; > + if (col_poc !=3D INVALID_POC && > + (poc_is_in_dpb(col_poc, decode->dpb) !=3D 1)) > + release_colocate_buf(h264_ctx, i); > + } [Severity: Critical] Is colocated_buf_num fully controlled by the PPS default active minus1 in clear_unused_col_buf? If userspace inflates this value beyond H264_MAX_COL_BUF (32), this loop will iterate out of bounds, and release_colocate_buf will write INVALID_POC (0xFFFFFFFF) beyond the end of the colocated_buf_poc array, causing memory corruption in the aml_h264_ctx struct. [ ... ] > +static void h264_config_decode_spec(struct aml_vdec_hw *hw, struct aml_v= dec_ctx *ctx) > +{ [ ... ] > + buf_spec_l0 =3D find_spec_by_dpb_index(h264_ctx, i, 0); > + if (buf_spec_l0) { > + buf_spec_l0->canvas_pos =3D > + get_canvas_pos_by_poc(h264_ctx, > + dpb->top_field_order_cnt); > + if (buf_spec_l0->canvas_pos < 0) { > + dev_err(&ctx->dev->plat_dev->dev, [Severity: High] Is canvas_pos an unsigned integer in h264_config_decode_spec? If get_canvas_pos_by_poc returns -1 for an unallocated canvas, the < 0 check will fail because of integer promotion. The 0xFFFFFFFF value will then be used in config_decode_canvas to calculate an out-of-bounds MMIO offset (ANC0_CANVAS_ADDR - 4) and overwrite adjacent hardware registers. [ ... ] > +static void reorder_short_term(struct slice *curr_slice, int cur_list, > + int pic_num_lx, int *ref_idx_lx) > +{ [ ... ] > + num_ref_idx_lx_active =3D get_ref_list_size(h264_ctx, cur_list); > + if (num_ref_idx_lx_active > (V4L2_H264_NUM_DPB_ENTRIES + 1)) { > + dev_dbg(&ctx->dev->plat_dev->dev, "incorrect value st num_ref_idx_lx_a= ctive %d\n", > + num_ref_idx_lx_active); > + return; > + } [Severity: Critical] Does the off-by-one check in reorder_short_term allow an array bounds write? V4L2_H264_NUM_DPB_ENTRIES is 16, so the check allows num_ref_idx_lx_active to be 17. The loop below will then access and write to index 17 of the ref_list array, which only holds 17 items (0 to 16). Additionally, reorder_long_term appears to completely lack this bounds check, allowing unbounded writes past the array based on PPS values. [ ... ] > +static int get_ref_list_size(struct aml_h264_ctx *h264_ctx, int cur_list) > +{ [ ... ] > + if (cur_list =3D=3D 0) { > + num_ref_idx_lx_active_minus1 =3D > + h264_ctx->ctrl_ref.pps->num_ref_idx_l0_default_active_minus1; > + if (override_flag) > + num_ref_idx_lx_active_minus1 =3D > + h264_ctx->dpb_param.dpb.num_ref_idx_l0_active_minus1; > + } else { > + num_ref_idx_lx_active_minus1 =3D > + h264_ctx->ctrl_ref.pps->num_ref_idx_l1_default_active_minus1; > + } [Severity: Medium] Does get_ref_list_size ignore the override_flag for the L1 reference list? According to the H.264 specification, num_ref_idx_active_override_flag applies to both L0 and L1 lists in B-slices. Ignoring it here could cause decoding issues for valid streams that override both sizes. [ ... ] > +static irqreturn_t h264_threaded_isr_func(int irq, void *priv) > +{ > + u32 dec_status; > + struct aml_vdec_dev *dev =3D (struct aml_vdec_dev *)priv; > + struct aml_h264_ctx *h264_ctx =3D (struct aml_h264_ctx *)dev->dec_hw->c= urr_ctx; > + struct aml_vdec_ctx *ctx =3D (struct aml_vdec_ctx *)h264_ctx->v4l2_ctx; [Severity: High] If hw->curr_ctx is cleared concurrently as noticed earlier in vdec_threaded_isr_handler, doesn't h264_threaded_isr_func dereference the NULL context when casting and reading h264_ctx->v4l2_ctx? Additionally, if the context is valid but the queue is empty during a spurious interrupt, v4l2_m2m_next_dst_buf further down will return NULL and crash. [ ... ] > +int aml_h264_dec_run(void *priv) > +{ [ ... ] > + ret =3D wait_event_interruptible_timeout(ctx->queue, ctx->int_cond, > + msecs_to_jiffies(DECODER_TIMEOUT_MS)); > + ctx->int_cond =3D 0; [Severity: High] Is it safe to perform a blocking wait inside the non-blocking device_run callback in aml_h264_dec_run? The V4L2 M2M architecture expects device_run to initiate hardware processing and return immediately. Sleeping here forces the shared M2M worker thread to block, stalling all concurrent decoding instances. Also, should ctx->int_cond be reset to 0 before initiating the job, rather than after the wait? If a delayed hardware interrupt fires after this reset, the next decode run will observe ctx->int_cond =3D=3D 1 and return instantly. [ ... ] > + if (!ret) { > + ret =3D -1; > + dev_err(&ctx->dev->plat_dev->dev, "dec timeout=3D%u\n", DECODER_TIMEOU= T_MS); > + for (i =3D 0; i < 16; i++) { /* 16 : show ucode PC 16 times when timeo= ut */ > + dev_dbg(&ctx->dev->plat_dev->dev, "decoder timeout, pc 0x%x\n", > + read_dos_reg(dec_hw, MPC_E)); > + usleep_range(10, 20); > + } > + h264_release_decode_spec(dec_hw, ctx); > + } else if (-ERESTARTSYS =3D=3D ret) { > + ret =3D -1; > + h264_release_decode_spec(dec_hw, ctx); > + } [Severity: High] Does the timeout or signal handling in aml_h264_dec_run race with the threaded IRQ handler? If the wait is interrupted or times out, this directly executes h264_release_decode_spec. If the delayed hardware interrupt fires concurrently, h264_threaded_isr_func will also unconditionally call h264_release_decode_spec. Without a lock, this risks double-frees of the canvas IDs and structural corruption. --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260812-b4-s4-vdec= -upstream-v7-0-3fae085861bd@amlogic.com?part=3D4