From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CBC723D3492 for ; Mon, 31 Aug 2026 08:56:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788166604; cv=none; b=qC9zR/CjFdpqcjfs07sfbx8u3+retkDf5T5e8SRynOBls7vz9PBY5JRMg5jdZ0edKJIWaKqoT18aGyLb2mn7htIZfI7LsPPlCRMXLhe+It/Fn2Te7WvyzmNQO1HW3ErWbn01+rgiAte2EoTsnGwIvh/rYYcB7uZnT+DpqI1Arls= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788166604; c=relaxed/simple; bh=GERvTYEAdY+XxE/Yt01Sj7ICmgcjFXI9KyXJm9aPRgI=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=dHqMq9Fz/q+R48X4M9siOpML+oDmtFifuC9lwr6MQ5S/SS4QkOOTOvr6aR8sXKF2nzex5S4Ssjze5cQao5FSl2cbi2UZca3zG5jM3VpSsubl+EjbsbpRZrYWU70js7tj+h0Smypy8LgmZFwWwK1SEnohkg5SIu8rwwGUGK17Z3I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=LDHXxWH+; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="LDHXxWH+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 170E61F000E9; Mon, 31 Aug 2026 08:56:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788166602; bh=dp6BXRBBLZqV92tRn+YcHe6My4dK5IzTayWn+yi2Ams=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=LDHXxWH+Xnizq4UPNDgTrNKij39PW6UxruVyzX3NFXivtIIC8OKLnXzpmpPiNoPA1 fvcQ199lk0SW3A+9OsDN4X2ZLEtol7z++46PzYFoSknQ6L9mXGiV8oHO5QSytVlLx1 28fxk9Po/mFxy2b69jvcqVSwIi/D4p7xrbLxlJuTePx3JO7INPPfCNcylzss0y97kL SpJH/fuO/sMhQdvuXRePUpR4C8xa6J7vVmKGM7YltjSuaMvW7Rh9uZKFB3Y2iHch6/ gtZvwjaI8cL+H48r4rWieXrc7j+xPGCM0sjwXrZI17Bh5b5s/6QgbT26FSQ0OjkZpQ jZKSSb+RyD7jA== From: sashiko-bot@kernel.org Subject: Re: [PATCH v8 4/6] decoder: Add V4L2 stateless H.264 decoder driver Reply-To: sashiko-reviews@lists.linux.dev To: "Zhentao Guo" Cc: media-ci@linuxtv.org, conor+dt@kernel.org, neil.armstrong@linaro.org, robh@kernel.org, devicetree@vger.kernel.org, linux-amlogic@lists.infradead.org In-Reply-To: <20260831-b4-s4-vdec-upstream-v8-4-830195b9bd91@amlogic.com> References: <20260831-b4-s4-vdec-upstream-v8-0-830195b9bd91@amlogic.com> <20260831-b4-s4-vdec-upstream-v8-4-830195b9bd91@amlogic.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 31 Aug 2026 08:56:41 +0000 Message-Id: <20260831085642.170E61F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 15 potential issue= (s) to consider: - [Critical] Missing validation of dynamic SPS dimensions against queue for= mat leads to massive out-of-bounds DMA buffer writes. - [High] Unbinding the driver while a file descriptor is open leads to Use-= After-Free of the `dev` and `m2m_dev` structures. - [High] Stale DMA addresses are used for reference frames if the same DPB = entry appears multiple times in a reference list. - [High] The VIFIFO hardware read/write pointers are programmed to access p= ast the end of the userspace-provided DMA buffer, causing out-of-bounds DMA= reads. - [High] Failure to allocate a canvas silently aborts configuration, leadin= g the hardware to decode into a stale or uninitialized canvas index. - [High] Missing locking in `aml_h264_dec_run`'s timeout path allows concur= rent hardware access with the threaded ISR, corrupting hardware state. - [High] Dangling `dec_hw->curr_ctx` on early error returns in `aml_h264_de= c_run` causes Use-After-Free in the threaded ISR. - [High] Unhandled failure in `vb2_find_buffer()` causes hardware DMA to us= e uninitialized or stale addresses. - [High] The driver allocates video buffers without restricting them to 32-= bit DMA addresses, but writes them to 32-bit hardware registers. - [High] The 'dos' clock is requested but never enabled, which will hang th= e system when DOS_BUS registers are accessed. - [Medium] The V4L2 request reference is leaked on the load_firmware error = path. - [Medium] Returning IRQ_HANDLED for an unhandled interrupt causes an IRQ s= torm. - [Medium] `request_firmware()` is called with a NULL device pointer, break= ing firmware caching and sysfs fallbacks. - [Medium] vdec_try_fmt_mp fetches alignment from the first supported forma= t instead of the requested format. - [Medium] The output queue is erroneously marked as streaming if initializ= ation fails, causing state mismatch. -- commit ab3cf88bf6f6c60b14702ce65b846740e397629f Author: Zhentao Guo decoder: Add V4L2 stateless H.264 decoder driver =20 Add initial support for V4L2 stateless video decoder driver on Amlogic S4(S805X2) platform. In phase 1, it supports 8bit H.264 bitstreams decoding= .=20 Currently only progressive streams are supported. > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec.c b/drivers/med= ia/platform/amlogic/vdec/aml_vdec.c > --- a/drivers/media/platform/amlogic/vdec/aml_vdec.c > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec.c [ ... ] > @@ -135,16 +135,18 @@ static void m2mops_vdec_device_run(void *m2m_priv) > if (ctx->curr_dec_type =3D=3D CODEC_TYPE_H264) > aml_vdec_reset_core(dev->dec_hw); > =20 > if (load_firmware(dev->dec_hw, ctx->curr_dec_type) < 0) > goto err_cancel_job; > =20 > ret =3D ctx->codec_ops->run(ctx); > =20 > v4l2_m2m_buf_copy_metadata(src_buf, dst_buf); > if (src_req) > v4l2_ctrl_request_complete(src_req, &ctx->ctrl_handler); > if (ret < 0 || ctx->curr_frm_err_flag) > goto err_cancel_job; > v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev_dec, ctx->m2m_ctx, > VB2_BUF_STATE_DONE); > =20 > return; > =20 > err_cancel_job: > v4l2_m2m_buf_done_and_job_finish(dev->m2m_dev_dec, ctx->m2m_ctx, > VB2_BUF_STATE_ERROR); > } [Severity: Medium] Does this error path leak the V4L2 request reference? If load_firmware() fails, the code jumps to err_cancel_job and completes the buffers, but bypa= sses the v4l2_ctrl_request_complete() call, leaving userspace waiting indefinite= ly. [ ... ] > @@ -203,17 +205,18 @@ static int vidioc_vdec_enum_framesizes(struct file = *file, void *priv, > static int vdec_try_fmt_mp(struct aml_vdec_ctx *ctx, enum v4l2_buf_type = type, > struct v4l2_pix_format_mplane *pix_mp, > const struct aml_video_fmt *dec_fmt) > { > int i, align; > =20 > pix_mp->field =3D V4L2_FIELD_NONE; > align =3D ctx->dev->pvdec_data->dec_fmt->align; [Severity: Medium] Is it intentional to fetch the alignment from the first element of the supported format array here? This ignores the alignment requirement of the actual dec_fmt passed into vdec_try_fmt_mp(), which could cause formats req= uiring different alignments to be validated incorrectly. > =20 > if (V4L2_TYPE_IS_OUTPUT(type)) { > pix_mp->num_planes =3D dec_fmt->num_planes; > pix_mp->pixelformat =3D dec_fmt->fourcc; [ ... ] > @@ -396,16 +399,16 @@ static int vb2ops_vdec_start_streaming(struct vb2_q= ueue *q, unsigned int count) > { > struct aml_vdec_ctx *ctx =3D vb2_get_drv_priv(q); > =20 > if (V4L2_TYPE_IS_OUTPUT(q->type)) { > struct vb2_v4l2_buffer *src_buf; > =20 > ctx->is_output_streamon =3D 1; > if (aml_vdec_init_dec_inst(ctx) < 0) { > while ((src_buf =3D v4l2_m2m_src_buf_remove(ctx->m2m_ctx))) > v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_QUEUED); > return -EINVAL; > } [Severity: Medium] If aml_vdec_init_dec_inst() fails, is the output queue left erroneously marked as streaming? It appears ctx->is_output_streamon is never rolled back to 0 on this error path. > } else { > ctx->is_cap_streamon =3D 1; > } > =20 > return 0; > } > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec_drv.c b/drivers= /media/platform/amlogic/vdec/aml_vdec_drv.c > --- a/drivers/media/platform/amlogic/vdec/aml_vdec_drv.c > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec_drv.c [ ... ] > @@ -66,13 +66,13 @@ static int fops_vcodec_open(struct file *file) > static int fops_vcodec_release(struct file *file) > { > struct aml_vdec_ctx *ctx =3D fh_to_dec_ctx(file); > =20 > v4l2_m2m_ctx_release(ctx->m2m_ctx); [Severity: High] Could unbinding the driver while a file descriptor is open lead to a use-after-free here? When aml_vdec_drv_remove() runs, it unconditionally frees dev->m2m_dev_dec. However, the V4L2 core keeps the video_device alive until the file descriptor is closed, at which point this function will dereference the freed m2m_ctx. > v4l2_ctrl_handler_free(&ctx->ctrl_handler); > v4l2_fh_del(&ctx->fh, file); > v4l2_fh_exit(&ctx->fh); > kfree(ctx); > =20 > return 0; > } [ ... ] > @@ -136,17 +136,17 @@ static int aml_vdec_drv_probe(struct platform_devic= e *pdev) > dev->pvdec_data =3D of_device_get_match_data(&pdev->dev); > ret =3D dev->pvdec_data->req_hw_resource(dev); > if (ret < 0) > goto err_hw_init; > =20 > dev->m2m_dev_dec =3D v4l2_m2m_init(&aml_vdec_m2m_ops); [Severity: High] Is a call to dma_set_mask_and_coherent() missing before initializing the V4L2 M2M framework? Without restricting allocations to 32 bits, 64-bit DMA addresses allocated on platforms with >4GB memory could be silently truncated when the driver writes them to 32-bit hardware registers. > if (IS_ERR(dev->m2m_dev_dec)) { > v4l2_err(&dev->v4l2_dev, "Failed to init mem2mem dec device\n"); > ret =3D PTR_ERR((__force void *)dev->m2m_dev_dec); > goto err_m2m_dev_init; > } [ ... ] > @@ -201,16 +201,16 @@ static void aml_vdec_drv_remove(struct platform_dev= ice *pdev) > { > struct aml_vdec_dev *dev =3D platform_get_drvdata(pdev); > =20 > vdec_disable(dev->dec_hw); > media_device_unregister(&dev->mdev); > v4l2_m2m_unregister_media_controller(dev->m2m_dev_dec); > video_unregister_device(dev->vfd); > media_device_cleanup(&dev->mdev); > =20 > v4l2_m2m_release(dev->m2m_dev_dec); > dev->pvdec_data->destroy_hw_resource(dev); > v4l2_device_unregister(&dev->v4l2_dev); > } > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec_hw.c b/drivers/= media/platform/amlogic/vdec/aml_vdec_hw.c > --- a/drivers/media/platform/amlogic/vdec/aml_vdec_hw.c > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec_hw.c [ ... ] > @@ -264,15 +264,16 @@ static void pm_vdec_power_domain_power_on(struct am= l_vdec_hw *hw, int id) > const struct power_manager_s *pm =3D hw->pm; > struct device *dev =3D pm->pd_data[id].dev; > struct clk_bulk_data *gate_node =3D NULL; > =20 > if (id =3D=3D VDEC) > gate_node =3D vdec_get_clk_by_name(hw, "core_vdec"); > else if (id =3D=3D HVDEC) > gate_node =3D vdec_get_clk_by_name(hw, "core_hvdec"); > =20 > if (gate_node) { > clk_prepare_enable(gate_node->clk); [Severity: High] Is the dos clock requested during vdec_clock_gate_init() but never enabled here? Skipping the dos clock enable before accessing DOS bus registers in dos_local_config() below could cause the system bus to hang. > if (id =3D=3D VDEC) { > clk_set_rate(gate_node->clk, 499999992); > dev_dbg(hw->dev, "after set, vdec clock is %lu Hz\n", > clk_get_rate(gate_node->clk)); > } [ ... ] > @@ -308,16 +309,16 @@ static const struct power_manager_s pm[] =3D { > .power_off =3D pm_vdec_power_domain_power_off, > }, > }; > =20 > static irqreturn_t vdec_irq_handler(int irq, void *priv) > { > struct aml_vdec_dev *dev =3D (struct aml_vdec_dev *)priv; > struct aml_vdec_hw *hw =3D dev->dec_hw; > irqreturn_t ret =3D IRQ_HANDLED; > =20 > if (hw->hw_ops.irq_handler) > ret =3D hw->hw_ops.irq_handler(irq, priv); > =20 > return ret; > } [Severity: Medium] If hw->hw_ops.irq_handler is NULL, does returning IRQ_HANDLED trick the spurious interrupt detector? It appears this could lead to an interrupt sto= rm if no work was actually performed to clear the hardware interrupt. > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec_tee_fw.c b/driv= ers/media/platform/amlogic/vdec/aml_vdec_tee_fw.c > --- a/drivers/media/platform/amlogic/vdec/aml_vdec_tee_fw.c > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec_tee_fw.c [ ... ] > @@ -156,16 +156,16 @@ int load_firmware(struct aml_vdec_hw *hw, u32 type) > meson_sm_call(hw->sec_fw, SM_LOAD_VIDEO_FW, &ret, > video_fw->fw_format, video_fw->core, > video_fw->is_swap, 0, 0); > if (ret < 0) > dev_err(hw->dev, "loading fw type %d core %d, ret %x\n", > video_fw->fw_format, video_fw->core, ret); > =20 > return ret; > } > =20 > static int get_firmware(const char *path, void **data, size_t *size) > { > const struct firmware *fw =3D NULL; > int ret; > void *buf; > =20 > ret =3D request_firmware(&fw, FIRMWARE_PATH, NULL); [Severity: Medium] Does passing a NULL device pointer to request_firmware() break firmware caching and sysfs fallbacks? The firmware loader typically needs the correct device hierarchy to bind the request properly. > if (ret) > return ret; > =20 > if (fw->size <=3D UCODE_HEADER_SIZE) { > release_firmware(fw); > return -EINVAL; > } > diff --git a/drivers/media/platform/amlogic/vdec/h264.c b/drivers/media/p= latform/amlogic/vdec/h264.c > --- a/drivers/media/platform/amlogic/vdec/h264.c > +++ b/drivers/media/platform/amlogic/vdec/h264.c [ ... ] > @@ -163,16 +163,16 @@ static inline uint32_t spec2canvas(struct h264_deco= de_buf_spec *buf_spec) > static struct h264_decode_buf_spec *find_spec_by_dpb_index(struct aml_h2= 64_ctx > *h264_ctx, int index, int list) > { > int i; > int size; > struct h264_decode_buf_spec *ref_list; > =20 > size =3D h264_ctx->list_size[list]; > if (list =3D=3D 0) > ref_list =3D &h264_ctx->ref_list0[0]; > else > ref_list =3D &h264_ctx->ref_list1[0]; > =20 > for (i =3D 0; i < size; i++) { > if (index =3D=3D ref_list[i].dpb_index) > return &ref_list[i]; > } [Severity: High] Will multiple identical DPB entries in the reference list result in stale D= MA addresses? Because this search stops at the first match, any subsequent duplicate entries in the list will be skipped when h264_config_decode_spec() initializes the DMA addresses, potentially leaving hardware programmed with stale or uninitialized addresses. > =20 > return NULL; > } > =20 > static int h264_prepare_input(struct aml_vdec_ctx *ctx) > { > struct aml_vdec_hw *hw =3D vdec_get_hw(ctx->dev); > struct vb2_v4l2_buffer *src; > struct vb2_buffer *vb; > dma_addr_t src_dma; > u32 payload_size; > int dummy; > =20 > src =3D v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); > if (!src) { > dev_info(hw->dev, "no input buffer available!\n"); > return -1; > } > vb =3D &src->vb2_buf; > payload_size =3D vb2_get_plane_payload(vb, 0); > src_dma =3D vb2_dma_contig_plane_dma_addr(vb, 0); > =20 > regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_CONTROL, 0); > /* reset VLD fifo for all vdec */ > regmap_write(hw->map[DOS_BUS], DOS_SW_RESET0, > (1 << 5) | (1 << 4) | (1 << 3)); > regmap_write(hw->map[DOS_BUS], DOS_SW_RESET0, 0); > regmap_write(hw->map[DOS_BUS], POWER_CTL_VLD, 1 << 4); > =20 > regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_START_PTR, src_dma); > regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_END_PTR, > (src_dma + payload_size)); > regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_CURR_PTR, > round_down(src_dma, VDEC_FIFO_ALIGN)); > =20 > regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_CONTROL, 1); > regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_CONTROL, 0); > regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_BUF_CNTL, 2); > =20 > regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_RP, > round_down(src_dma, VDEC_FIFO_ALIGN)); > dummy =3D payload_size + VLD_PADDING_SIZE; > regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_WP, > round_down((src_dma + dummy), VDEC_FIFO_ALIGN)); [Severity: High] Can programming the write pointer past the mapped payload size cause out-of-bounds DMA reads? If userspace provides a tight buffer where the mapped plane size exactly matches the payload size, the hardware might attempt to read the VLD_PADDING_SIZE bytes from unmapped physical memory. > =20 > regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_BUF_CNTL, 3); > regmap_write(hw->map[DOS_BUS], VLD_MEM_VIFIFO_BUF_CNTL, 2); [ ... ] > @@ -345,16 +346,16 @@ static int config_sps_params(struct aml_h264_ctx *h= 264_ctx, > { > struct aml_vdec_ctx *ctx =3D h264_ctx->v4l2_ctx; > struct aml_vdec_hw *hw =3D vdec_get_hw(ctx->dev); > const struct v4l2_frmsize_stepwise *stepwise =3D > &ctx->dec_fmt[AML_FMT_SRC].stepwise; > u32 cfg_tmp =3D 0; > u32 frame_size; > u32 offset =3D 0; > unsigned short data_tmp[0x100]; > int i, ii; > =20 > memset(sps_base, 0, 0x100); > =20 > h264_ctx->frame_width =3D (sps->pic_width_in_mbs_minus1 + 1) << 4; > h264_ctx->frame_height =3D (sps->pic_height_in_map_units_minus1 + 1) <<= 4; [Severity: Critical] Is there a missing check to verify that these SPS dimensions actually fit within the allocated V4L2 capture queue resolution? Blindly accepting these could lead to massive out-of-bounds DMA writes when the hardware is later programmed with these sizes. > =20 > if (!frame_size_in_range(stepwise, h264_ctx->frame_width, > h264_ctx->frame_height)) { > dev_info(&ctx->dev->plat_dev->dev, [ ... ] > @@ -396,16 +397,16 @@ static int h264_config_params(struct aml_vdec_ctx *= ctx) > =20 > return 0; > } > =20 > static void config_decode_canvas(struct aml_vdec_hw *hw, > struct h264_decode_buf_spec *buf_spec, > u32 mb_width, u32 mb_height) > { > int blkmode =3D 0x0; > int ret; > =20 > ret =3D meson_canvas_alloc(hw->canvas, &buf_spec->y_canvas_index); > if (ret) { > dev_err(hw->dev, "failed to alloc y canvas (%d)\n", ret); > return; > } [Severity: High] If canvas allocation fails, does the hardware end up writing to an uninitialized or stale canvas index? The failure is logged and returns early, but the caller doesn't abort the decode job. > =20 > ret =3D meson_canvas_alloc(hw->canvas, &buf_spec->u_canvas_index); [ ... ] > @@ -585,16 +586,16 @@ static int h264_config_decode_spec(struct aml_vdec_= hw *hw, struct aml_vdec_ctx * > if (buf_spec_l0) { > buf_spec_l0->canvas_pos =3D > get_canvas_pos_by_poc(h264_ctx, > dpb->top_field_order_cnt); > if (buf_spec_l0->canvas_pos < 0) { > dev_dbg(&ctx->dev->plat_dev->dev, > "l0 canvas_pos %d error\n", > buf_spec_l0->canvas_pos); > continue; > } > vb =3D vb2_find_buffer(vq, dpb->reference_ts); > if (!vb) { > dev_dbg(&ctx->dev->plat_dev->dev, > "ref pic for ts %llu lost\n", dpb->reference_ts); > continue; > } [Severity: High] If the reference picture is lost and vb2_find_buffer() returns NULL, does this skip initializing the DMA address while leaving the reference picture active for canvas programming? This could cause the hardware to read from a stale physical address. > =20 > buf_spec_l0->y_dma_addr =3D > vb2_dma_contig_plane_dma_addr(vb, 0); [ ... ] > @@ -2095,16 +2096,16 @@ void aml_h264_exit(void *priv) > static void config_decode_mode(struct aml_vdec_ctx *ctx) > { > struct aml_h264_ctx *h264_ctx =3D (struct aml_h264_ctx *)ctx->codec_pri= v; > struct aml_vdec_hw *hw =3D vdec_get_hw(ctx->dev); > =20 > regmap_write(hw->map[DOS_BUS], H264_DECODE_MODE, 0x1); /*decode mode fr= amebase */ > regmap_write(hw->map[DOS_BUS], HEAD_PADDING_REG, 0); > regmap_write(hw->map[DOS_BUS], H264_DECODE_SEQINFO, h264_ctx->seq_info); > regmap_write(hw->map[DOS_BUS], INIT_FLAG_REG, 1); > } > =20 > int aml_h264_dec_run(void *priv) > { > struct aml_vdec_ctx *ctx =3D (struct aml_vdec_ctx *)priv; > struct aml_h264_ctx *h264_ctx =3D (struct aml_h264_ctx *)ctx->codec_pri= v; > struct aml_vdec_hw *dec_hw =3D vdec_get_hw(ctx->dev); > int ret =3D -1; > int i; > =20 > aml_vdec_set_curr_ctx(dec_hw, h264_ctx); > =20 > ret =3D aml_h264_get_stateless_ctrl_ref(h264_ctx); > if (ret < 0) { > dev_err(&ctx->dev->plat_dev->dev, "not ctrl ref for h264 decoder\n"); > return ret; > } [Severity: High] If an initialization step like aml_h264_get_stateless_ctrl_ref() fails and returns early, is dec_hw->curr_ctx left as a dangling pointer? A subsequent interrupt might dereference this freed memory in the threaded ISR. > =20 > h264_ctx->new_pic_flag =3D 1; > ret =3D h264_config_params(ctx); [ ... ] > @@ -2127,16 +2128,16 @@ int aml_h264_dec_run(void *priv) > =20 > ctx->int_cond =3D 0; > aml_start_vdec_hw(dec_hw); > h264_ctx->init_flag =3D 1; > =20 > regmap_write(dec_hw->map[DOS_BUS], DPB_STATUS_REG, H264_ACTION_SEARCH_H= EAD); > =20 > ret =3D wait_event_interruptible_timeout(ctx->queue, ctx->int_cond, > msecs_to_jiffies(DECODER_TIMEOUT_MS)); > =20 > if (!ret) { > ret =3D -1; > dev_err(&ctx->dev->plat_dev->dev, "dec timeout=3D%u\n", DECODER_TIMEOU= T_MS); > for (i =3D 0; i < 16; i++) { /* 16 : show ucode PC 16 times when timeo= ut */ > dev_dbg(&ctx->dev->plat_dev->dev, "decoder timeout, pc 0x%x\n", > read_dos_reg(dec_hw, MPC_E)); > usleep_range(10, 20); > } > /* > * Halt the hardware and wait out any in-flight threaded IRQ > * handler before cleaning up, otherwise both contexts may run > * h264_release_decode_spec() concurrently. > */ > aml_stop_vdec_hw(dec_hw); > synchronize_irq(dec_hw->dec_irq); > h264_release_decode_spec(dec_hw, ctx); [Severity: High] Does aml_stop_vdec_hw() race with vdec_threaded_isr_handler() here? The timeout path accesses hardware registers without acquiring hw->ctx_mutex or disabling the IRQ, which could corrupt hardware state if an interrupt fires concurrently. > } else if (-ERESTARTSYS =3D=3D ret) { > ret =3D -1; > aml_stop_vdec_hw(dec_hw); --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260831-b4-s4-vdec= -upstream-v8-0-830195b9bd91@amlogic.com?part=3D4 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 90480C61DD3 for ; Mon, 31 Aug 2026 08:56:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=KGdOeQXdkbeEhwNRp1X4Me4vLabbQZI3ypM0NpevRHw=; b=169A35s0tX5+cB CQZxtwFlPI9hLY0BmJUgf3IXtSJoPzX1lOKHh4wAYR/Ui5W+NwCLb7JiY+4WwJIni9v5CBrKqGq7o 172UX44rx5kDB5jAJSeeXb2l8MeQUKn1aH90BVt4pQs2UPNyqdimHqLs6Uw2IvFnbYXv6jPtrEsbr JdecaF6CBxEbjEL7ef3rFVp5dVQ738hxnduClEEkXeNnsvCqEnt3mMGNLzb+0x2DbNt4mARN/hhKb 5jKOlzEMENf48LmzL7MqWZkYP8pJY63duwphQ79ILxMaCTJxLeBlgFeTFjGsztUNI2+kFCBGpU6Z8 as75coDkc63G7jGsWPBg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x0xoq-00000008xWE-0qzC; Mon, 31 Aug 2026 08:56:44 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1x0xop-00000008xVv-0Sl5 for linux-amlogic@lists.infradead.org; Mon, 31 Aug 2026 08:56:43 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 76B7E439C8; Mon, 31 Aug 2026 08:56:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 170E61F000E9; Mon, 31 Aug 2026 08:56:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788166602; bh=dp6BXRBBLZqV92tRn+YcHe6My4dK5IzTayWn+yi2Ams=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=LDHXxWH+Xnizq4UPNDgTrNKij39PW6UxruVyzX3NFXivtIIC8OKLnXzpmpPiNoPA1 fvcQ199lk0SW3A+9OsDN4X2ZLEtol7z++46PzYFoSknQ6L9mXGiV8oHO5QSytVlLx1 28fxk9Po/mFxy2b69jvcqVSwIi/D4p7xrbLxlJuTePx3JO7INPPfCNcylzss0y97kL SpJH/fuO/sMhQdvuXRePUpR4C8xa6J7vVmKGM7YltjSuaMvW7Rh9uZKFB3Y2iHch6/ gtZvwjaI8cL+H48r4rWieXrc7j+xPGCM0sjwXrZI17Bh5b5s/6QgbT26FSQ0OjkZpQ jZKSSb+RyD7jA== From: sashiko-bot@kernel.org Subject: Re: [PATCH v8 4/6] decoder: Add V4L2 stateless H.264 decoder driver To: "Zhentao Guo" Cc: media-ci@linuxtv.org, conor+dt@kernel.org, neil.armstrong@linaro.org, robh@kernel.org, devicetree@vger.kernel.org, linux-amlogic@lists.infradead.org In-Reply-To: <20260831-b4-s4-vdec-upstream-v8-4-830195b9bd91@amlogic.com> References: <20260831-b4-s4-vdec-upstream-v8-0-830195b9bd91@amlogic.com> <20260831-b4-s4-vdec-upstream-v8-4-830195b9bd91@amlogic.com> Date: Mon, 31 Aug 2026 08:56:41 +0000 Message-Id: <20260831085642.170E61F000E9@smtp.kernel.org> X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MTUgcG90ZW50aWFsIGlzc3VlKHMpIHRvIGNvbnNpZGVyOgotIFtDcml0aWNhbF0gTWlzc2luZyB2 YWxpZGF0aW9uIG9mIGR5bmFtaWMgU1BTIGRpbWVuc2lvbnMgYWdhaW5zdCBxdWV1ZSBmb3JtYXQg bGVhZHMgdG8gbWFzc2l2ZSBvdXQtb2YtYm91bmRzIERNQSBidWZmZXIgd3JpdGVzLgotIFtIaWdo XSBVbmJpbmRpbmcgdGhlIGRyaXZlciB3aGlsZSBhIGZpbGUgZGVzY3JpcHRvciBpcyBvcGVuIGxl YWRzIHRvIFVzZS1BZnRlci1GcmVlIG9mIHRoZSBgZGV2YCBhbmQgYG0ybV9kZXZgIHN0cnVjdHVy ZXMuCi0gW0hpZ2hdIFN0YWxlIERNQSBhZGRyZXNzZXMgYXJlIHVzZWQgZm9yIHJlZmVyZW5jZSBm cmFtZXMgaWYgdGhlIHNhbWUgRFBCIGVudHJ5IGFwcGVhcnMgbXVsdGlwbGUgdGltZXMgaW4gYSBy ZWZlcmVuY2UgbGlzdC4KLSBbSGlnaF0gVGhlIFZJRklGTyBoYXJkd2FyZSByZWFkL3dyaXRlIHBv aW50ZXJzIGFyZSBwcm9ncmFtbWVkIHRvIGFjY2VzcyBwYXN0IHRoZSBlbmQgb2YgdGhlIHVzZXJz cGFjZS1wcm92aWRlZCBETUEgYnVmZmVyLCBjYXVzaW5nIG91dC1vZi1ib3VuZHMgRE1BIHJlYWRz LgotIFtIaWdoXSBGYWlsdXJlIHRvIGFsbG9jYXRlIGEgY2FudmFzIHNpbGVudGx5IGFib3J0cyBj b25maWd1cmF0aW9uLCBsZWFkaW5nIHRoZSBoYXJkd2FyZSB0byBkZWNvZGUgaW50byBhIHN0YWxl IG9yIHVuaW5pdGlhbGl6ZWQgY2FudmFzIGluZGV4LgotIFtIaWdoXSBNaXNzaW5nIGxvY2tpbmcg aW4gYGFtbF9oMjY0X2RlY19ydW5gJ3MgdGltZW91dCBwYXRoIGFsbG93cyBjb25jdXJyZW50IGhh cmR3YXJlIGFjY2VzcyB3aXRoIHRoZSB0aHJlYWRlZCBJU1IsIGNvcnJ1cHRpbmcgaGFyZHdhcmUg c3RhdGUuCi0gW0hpZ2hdIERhbmdsaW5nIGBkZWNfaHctPmN1cnJfY3R4YCBvbiBlYXJseSBlcnJv ciByZXR1cm5zIGluIGBhbWxfaDI2NF9kZWNfcnVuYCBjYXVzZXMgVXNlLUFmdGVyLUZyZWUgaW4g dGhlIHRocmVhZGVkIElTUi4KLSBbSGlnaF0gVW5oYW5kbGVkIGZhaWx1cmUgaW4gYHZiMl9maW5k X2J1ZmZlcigpYCBjYXVzZXMgaGFyZHdhcmUgRE1BIHRvIHVzZSB1bmluaXRpYWxpemVkIG9yIHN0 YWxlIGFkZHJlc3Nlcy4KLSBbSGlnaF0gVGhlIGRyaXZlciBhbGxvY2F0ZXMgdmlkZW8gYnVmZmVy cyB3aXRob3V0IHJlc3RyaWN0aW5nIHRoZW0gdG8gMzItYml0IERNQSBhZGRyZXNzZXMsIGJ1dCB3 cml0ZXMgdGhlbSB0byAzMi1iaXQgaGFyZHdhcmUgcmVnaXN0ZXJzLgotIFtIaWdoXSBUaGUgJ2Rv cycgY2xvY2sgaXMgcmVxdWVzdGVkIGJ1dCBuZXZlciBlbmFibGVkLCB3aGljaCB3aWxsIGhhbmcg dGhlIHN5c3RlbSB3aGVuIERPU19CVVMgcmVnaXN0ZXJzIGFyZSBhY2Nlc3NlZC4KLSBbTWVkaXVt XSBUaGUgVjRMMiByZXF1ZXN0IHJlZmVyZW5jZSBpcyBsZWFrZWQgb24gdGhlIGxvYWRfZmlybXdh cmUgZXJyb3IgcGF0aC4KLSBbTWVkaXVtXSBSZXR1cm5pbmcgSVJRX0hBTkRMRUQgZm9yIGFuIHVu aGFuZGxlZCBpbnRlcnJ1cHQgY2F1c2VzIGFuIElSUSBzdG9ybS4KLSBbTWVkaXVtXSBgcmVxdWVz dF9maXJtd2FyZSgpYCBpcyBjYWxsZWQgd2l0aCBhIE5VTEwgZGV2aWNlIHBvaW50ZXIsIGJyZWFr aW5nIGZpcm13YXJlIGNhY2hpbmcgYW5kIHN5c2ZzIGZhbGxiYWNrcy4KLSBbTWVkaXVtXSB2ZGVj X3RyeV9mbXRfbXAgZmV0Y2hlcyBhbGlnbm1lbnQgZnJvbSB0aGUgZmlyc3Qgc3VwcG9ydGVkIGZv cm1hdCBpbnN0ZWFkIG9mIHRoZSByZXF1ZXN0ZWQgZm9ybWF0LgotIFtNZWRpdW1dIFRoZSBvdXRw dXQgcXVldWUgaXMgZXJyb25lb3VzbHkgbWFya2VkIGFzIHN0cmVhbWluZyBpZiBpbml0aWFsaXph dGlvbiBmYWlscywgY2F1c2luZyBzdGF0ZSBtaXNtYXRjaC4KLS0KCmNvbW1pdCBhYjNjZjg4YmY2 ZjZjNjBiMTQ3MDJjZTY1Yjg0Njc0MGUzOTc2MjlmCkF1dGhvcjogWmhlbnRhbyBHdW8gPHpoZW50 YW8uZ3VvQGFtbG9naWMuY29tPgoKZGVjb2RlcjogQWRkIFY0TDIgc3RhdGVsZXNzIEguMjY0IGRl Y29kZXIgZHJpdmVyCiAgICAKQWRkIGluaXRpYWwgc3VwcG9ydCBmb3IgVjRMMiBzdGF0ZWxlc3Mg dmlkZW8gZGVjb2RlciBkcml2ZXIgb24gQW1sb2dpYwpTNChTODA1WDIpIHBsYXRmb3JtLiBJbiBw aGFzZSAxLCBpdCBzdXBwb3J0cyA4Yml0IEguMjY0IGJpdHN0cmVhbXMgZGVjb2RpbmcuIApDdXJy ZW50bHkgb25seSBwcm9ncmVzc2l2ZSBzdHJlYW1zIGFyZSBzdXBwb3J0ZWQuCgo+IGRpZmYgLS1n aXQgYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRlYy5jIGIvZHJp dmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3ZkZWMuYwo+IC0tLSBhL2RyaXZl cnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92ZGVjLmMKPiArKysgYi9kcml2ZXJz L21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRlYy5jClsgLi4uIF0KPiBAQCAtMTM1 LDE2ICsxMzUsMTggQEAgc3RhdGljIHZvaWQgbTJtb3BzX3ZkZWNfZGV2aWNlX3J1bih2b2lkICpt Mm1fcHJpdikKPiAgCWlmIChjdHgtPmN1cnJfZGVjX3R5cGUgPT0gQ09ERUNfVFlQRV9IMjY0KQo+ ICAJCWFtbF92ZGVjX3Jlc2V0X2NvcmUoZGV2LT5kZWNfaHcpOwo+ICAKPiAgCWlmIChsb2FkX2Zp cm13YXJlKGRldi0+ZGVjX2h3LCBjdHgtPmN1cnJfZGVjX3R5cGUpIDwgMCkKPiAgCQlnb3RvIGVy cl9jYW5jZWxfam9iOwo+ICAKPiAgCXJldCA9IGN0eC0+Y29kZWNfb3BzLT5ydW4oY3R4KTsKPiAg Cj4gIAl2NGwyX20ybV9idWZfY29weV9tZXRhZGF0YShzcmNfYnVmLCBkc3RfYnVmKTsKPiAgCWlm IChzcmNfcmVxKQo+ICAJCXY0bDJfY3RybF9yZXF1ZXN0X2NvbXBsZXRlKHNyY19yZXEsICZjdHgt PmN0cmxfaGFuZGxlcik7Cj4gIAlpZiAocmV0IDwgMCB8fCBjdHgtPmN1cnJfZnJtX2Vycl9mbGFn KQo+ICAJCWdvdG8gZXJyX2NhbmNlbF9qb2I7Cj4gIAl2NGwyX20ybV9idWZfZG9uZV9hbmRfam9i X2ZpbmlzaChkZXYtPm0ybV9kZXZfZGVjLCBjdHgtPm0ybV9jdHgsCj4gIAkJCQkJIFZCMl9CVUZf U1RBVEVfRE9ORSk7Cj4gIAo+ICAJcmV0dXJuOwo+ICAKPiAgZXJyX2NhbmNlbF9qb2I6Cj4gIAl2 NGwyX20ybV9idWZfZG9uZV9hbmRfam9iX2ZpbmlzaChkZXYtPm0ybV9kZXZfZGVjLCBjdHgtPm0y bV9jdHgsCj4gIAkJCQkJIFZCMl9CVUZfU1RBVEVfRVJST1IpOwo+ICB9CgpbU2V2ZXJpdHk6IE1l ZGl1bV0KRG9lcyB0aGlzIGVycm9yIHBhdGggbGVhayB0aGUgVjRMMiByZXF1ZXN0IHJlZmVyZW5j ZT8gSWYgbG9hZF9maXJtd2FyZSgpCmZhaWxzLCB0aGUgY29kZSBqdW1wcyB0byBlcnJfY2FuY2Vs X2pvYiBhbmQgY29tcGxldGVzIHRoZSBidWZmZXJzLCBidXQgYnlwYXNzZXMKdGhlIHY0bDJfY3Ry bF9yZXF1ZXN0X2NvbXBsZXRlKCkgY2FsbCwgbGVhdmluZyB1c2Vyc3BhY2Ugd2FpdGluZyBpbmRl ZmluaXRlbHkuCgpbIC4uLiBdCj4gQEAgLTIwMywxNyArMjA1LDE4IEBAIHN0YXRpYyBpbnQgdmlk aW9jX3ZkZWNfZW51bV9mcmFtZXNpemVzKHN0cnVjdCBmaWxlICpmaWxlLCB2b2lkICpwcml2LAo+ ICBzdGF0aWMgaW50IHZkZWNfdHJ5X2ZtdF9tcChzdHJ1Y3QgYW1sX3ZkZWNfY3R4ICpjdHgsIGVu dW0gdjRsMl9idWZfdHlwZSB0eXBlLAo+ICAJCQkgICBzdHJ1Y3QgdjRsMl9waXhfZm9ybWF0X21w bGFuZSAqcGl4X21wLAo+ICAJCQkgICBjb25zdCBzdHJ1Y3QgYW1sX3ZpZGVvX2ZtdCAqZGVjX2Zt dCkKPiAgewo+ICAJaW50IGksIGFsaWduOwo+ICAKPiAgCXBpeF9tcC0+ZmllbGQgPSBWNEwyX0ZJ RUxEX05PTkU7Cj4gIAlhbGlnbiA9IGN0eC0+ZGV2LT5wdmRlY19kYXRhLT5kZWNfZm10LT5hbGln bjsKCltTZXZlcml0eTogTWVkaXVtXQpJcyBpdCBpbnRlbnRpb25hbCB0byBmZXRjaCB0aGUgYWxp Z25tZW50IGZyb20gdGhlIGZpcnN0IGVsZW1lbnQgb2YgdGhlCnN1cHBvcnRlZCBmb3JtYXQgYXJy YXkgaGVyZT8gVGhpcyBpZ25vcmVzIHRoZSBhbGlnbm1lbnQgcmVxdWlyZW1lbnQgb2YgdGhlCmFj dHVhbCBkZWNfZm10IHBhc3NlZCBpbnRvIHZkZWNfdHJ5X2ZtdF9tcCgpLCB3aGljaCBjb3VsZCBj YXVzZSBmb3JtYXRzIHJlcXVpcmluZwpkaWZmZXJlbnQgYWxpZ25tZW50cyB0byBiZSB2YWxpZGF0 ZWQgaW5jb3JyZWN0bHkuCgo+ICAKPiAgCWlmIChWNEwyX1RZUEVfSVNfT1VUUFVUKHR5cGUpKSB7 Cj4gIAkJcGl4X21wLT5udW1fcGxhbmVzID0gZGVjX2ZtdC0+bnVtX3BsYW5lczsKPiAgCQlwaXhf bXAtPnBpeGVsZm9ybWF0ID0gZGVjX2ZtdC0+Zm91cmNjOwpbIC4uLiBdCj4gQEAgLTM5NiwxNiAr Mzk5LDE2IEBAIHN0YXRpYyBpbnQgdmIyb3BzX3ZkZWNfc3RhcnRfc3RyZWFtaW5nKHN0cnVjdCB2 YjJfcXVldWUgKnEsIHVuc2lnbmVkIGludCBjb3VudCkKPiAgewo+ICAJc3RydWN0IGFtbF92ZGVj X2N0eCAqY3R4ID0gdmIyX2dldF9kcnZfcHJpdihxKTsKPiAgCj4gIAlpZiAoVjRMMl9UWVBFX0lT X09VVFBVVChxLT50eXBlKSkgewo+ICAJCXN0cnVjdCB2YjJfdjRsMl9idWZmZXIgKnNyY19idWY7 Cj4gIAo+ICAJCWN0eC0+aXNfb3V0cHV0X3N0cmVhbW9uID0gMTsKPiAgCQlpZiAoYW1sX3ZkZWNf aW5pdF9kZWNfaW5zdChjdHgpIDwgMCkgewo+ICAJCQl3aGlsZSAoKHNyY19idWYgPSB2NGwyX20y bV9zcmNfYnVmX3JlbW92ZShjdHgtPm0ybV9jdHgpKSkKPiAgCQkJCXY0bDJfbTJtX2J1Zl9kb25l KHNyY19idWYsIFZCMl9CVUZfU1RBVEVfUVVFVUVEKTsKPiAgCQkJcmV0dXJuIC1FSU5WQUw7Cj4g IAkJfQoKW1NldmVyaXR5OiBNZWRpdW1dCklmIGFtbF92ZGVjX2luaXRfZGVjX2luc3QoKSBmYWls cywgaXMgdGhlIG91dHB1dCBxdWV1ZSBsZWZ0IGVycm9uZW91c2x5Cm1hcmtlZCBhcyBzdHJlYW1p bmc/IEl0IGFwcGVhcnMgY3R4LT5pc19vdXRwdXRfc3RyZWFtb24gaXMgbmV2ZXIgcm9sbGVkCmJh Y2sgdG8gMCBvbiB0aGlzIGVycm9yIHBhdGguCgo+ICAJfSBlbHNlIHsKPiAgCQljdHgtPmlzX2Nh cF9zdHJlYW1vbiA9IDE7Cj4gIAl9Cj4gIAo+ICAJcmV0dXJuIDA7Cj4gIH0KCj4gZGlmZiAtLWdp dCBhL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92ZGVjX2Rydi5jIGIv ZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3ZkZWNfZHJ2LmMKPiAtLS0g YS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRlY19kcnYuYwo+ICsr KyBiL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92ZGVjX2Rydi5jClsg Li4uIF0KPiBAQCAtNjYsMTMgKzY2LDEzIEBAIHN0YXRpYyBpbnQgZm9wc192Y29kZWNfb3Blbihz dHJ1Y3QgZmlsZSAqZmlsZSkKPiAgc3RhdGljIGludCBmb3BzX3Zjb2RlY19yZWxlYXNlKHN0cnVj dCBmaWxlICpmaWxlKQo+ICB7Cj4gIAlzdHJ1Y3QgYW1sX3ZkZWNfY3R4ICpjdHggPSBmaF90b19k ZWNfY3R4KGZpbGUpOwo+ICAKPiAgCXY0bDJfbTJtX2N0eF9yZWxlYXNlKGN0eC0+bTJtX2N0eCk7 CgpbU2V2ZXJpdHk6IEhpZ2hdCkNvdWxkIHVuYmluZGluZyB0aGUgZHJpdmVyIHdoaWxlIGEgZmls ZSBkZXNjcmlwdG9yIGlzIG9wZW4gbGVhZCB0byBhCnVzZS1hZnRlci1mcmVlIGhlcmU/IFdoZW4g YW1sX3ZkZWNfZHJ2X3JlbW92ZSgpIHJ1bnMsIGl0IHVuY29uZGl0aW9uYWxseQpmcmVlcyBkZXYt Pm0ybV9kZXZfZGVjLiBIb3dldmVyLCB0aGUgVjRMMiBjb3JlIGtlZXBzIHRoZSB2aWRlb19kZXZp Y2UKYWxpdmUgdW50aWwgdGhlIGZpbGUgZGVzY3JpcHRvciBpcyBjbG9zZWQsIGF0IHdoaWNoIHBv aW50IHRoaXMgZnVuY3Rpb24Kd2lsbCBkZXJlZmVyZW5jZSB0aGUgZnJlZWQgbTJtX2N0eC4KCj4g IAl2NGwyX2N0cmxfaGFuZGxlcl9mcmVlKCZjdHgtPmN0cmxfaGFuZGxlcik7Cj4gIAl2NGwyX2Zo X2RlbCgmY3R4LT5maCwgZmlsZSk7Cj4gIAl2NGwyX2ZoX2V4aXQoJmN0eC0+ZmgpOwo+ICAJa2Zy ZWUoY3R4KTsKPiAgCj4gIAlyZXR1cm4gMDsKPiAgfQpbIC4uLiBdCj4gQEAgLTEzNiwxNyArMTM2 LDE3IEBAIHN0YXRpYyBpbnQgYW1sX3ZkZWNfZHJ2X3Byb2JlKHN0cnVjdCBwbGF0Zm9ybV9kZXZp Y2UgKnBkZXYpCj4gIAlkZXYtPnB2ZGVjX2RhdGEgPSBvZl9kZXZpY2VfZ2V0X21hdGNoX2RhdGEo JnBkZXYtPmRldik7Cj4gIAlyZXQgPSBkZXYtPnB2ZGVjX2RhdGEtPnJlcV9od19yZXNvdXJjZShk ZXYpOwo+ICAJaWYgKHJldCA8IDApCj4gIAkJZ290byBlcnJfaHdfaW5pdDsKPiAgCj4gIAlkZXYt Pm0ybV9kZXZfZGVjID0gdjRsMl9tMm1faW5pdCgmYW1sX3ZkZWNfbTJtX29wcyk7CgpbU2V2ZXJp dHk6IEhpZ2hdCklzIGEgY2FsbCB0byBkbWFfc2V0X21hc2tfYW5kX2NvaGVyZW50KCkgbWlzc2lu ZyBiZWZvcmUgaW5pdGlhbGl6aW5nIHRoZQpWNEwyIE0yTSBmcmFtZXdvcms/IFdpdGhvdXQgcmVz dHJpY3RpbmcgYWxsb2NhdGlvbnMgdG8gMzIgYml0cywgNjQtYml0IERNQQphZGRyZXNzZXMgYWxs b2NhdGVkIG9uIHBsYXRmb3JtcyB3aXRoID40R0IgbWVtb3J5IGNvdWxkIGJlIHNpbGVudGx5CnRy dW5jYXRlZCB3aGVuIHRoZSBkcml2ZXIgd3JpdGVzIHRoZW0gdG8gMzItYml0IGhhcmR3YXJlIHJl Z2lzdGVycy4KCj4gIAlpZiAoSVNfRVJSKGRldi0+bTJtX2Rldl9kZWMpKSB7Cj4gIAkJdjRsMl9l cnIoJmRldi0+djRsMl9kZXYsICJGYWlsZWQgdG8gaW5pdCBtZW0ybWVtIGRlYyBkZXZpY2VcbiIp Owo+ICAJCXJldCA9IFBUUl9FUlIoKF9fZm9yY2Ugdm9pZCAqKWRldi0+bTJtX2Rldl9kZWMpOwo+ ICAJCWdvdG8gZXJyX20ybV9kZXZfaW5pdDsKPiAgCX0KWyAuLi4gXQo+IEBAIC0yMDEsMTYgKzIw MSwxNiBAQCBzdGF0aWMgdm9pZCBhbWxfdmRlY19kcnZfcmVtb3ZlKHN0cnVjdCBwbGF0Zm9ybV9k ZXZpY2UgKnBkZXYpCj4gIHsKPiAgCXN0cnVjdCBhbWxfdmRlY19kZXYgKmRldiA9IHBsYXRmb3Jt X2dldF9kcnZkYXRhKHBkZXYpOwo+ICAKPiAgCXZkZWNfZGlzYWJsZShkZXYtPmRlY19odyk7Cj4g IAltZWRpYV9kZXZpY2VfdW5yZWdpc3RlcigmZGV2LT5tZGV2KTsKPiAgCXY0bDJfbTJtX3VucmVn aXN0ZXJfbWVkaWFfY29udHJvbGxlcihkZXYtPm0ybV9kZXZfZGVjKTsKPiAgCXZpZGVvX3VucmVn aXN0ZXJfZGV2aWNlKGRldi0+dmZkKTsKPiAgCW1lZGlhX2RldmljZV9jbGVhbnVwKCZkZXYtPm1k ZXYpOwo+ICAKPiAgCXY0bDJfbTJtX3JlbGVhc2UoZGV2LT5tMm1fZGV2X2RlYyk7Cj4gIAlkZXYt PnB2ZGVjX2RhdGEtPmRlc3Ryb3lfaHdfcmVzb3VyY2UoZGV2KTsKPiAgCXY0bDJfZGV2aWNlX3Vu cmVnaXN0ZXIoJmRldi0+djRsMl9kZXYpOwo+ICB9Cgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL21l ZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRlY19ody5jIGIvZHJpdmVycy9tZWRpYS9w bGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3ZkZWNfaHcuYwo+IC0tLSBhL2RyaXZlcnMvbWVkaWEv cGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92ZGVjX2h3LmMKPiArKysgYi9kcml2ZXJzL21lZGlh L3BsYXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRlY19ody5jClsgLi4uIF0KPiBAQCAtMjY0LDE1 ICsyNjQsMTYgQEAgc3RhdGljIHZvaWQgcG1fdmRlY19wb3dlcl9kb21haW5fcG93ZXJfb24oc3Ry dWN0IGFtbF92ZGVjX2h3ICpodywgaW50IGlkKQo+ICAJY29uc3Qgc3RydWN0IHBvd2VyX21hbmFn ZXJfcyAqcG0gPSBody0+cG07Cj4gIAlzdHJ1Y3QgZGV2aWNlICpkZXYgPSBwbS0+cGRfZGF0YVtp ZF0uZGV2Owo+ICAJc3RydWN0IGNsa19idWxrX2RhdGEgKmdhdGVfbm9kZSA9IE5VTEw7Cj4gIAo+ ICAJaWYgKGlkID09IFZERUMpCj4gIAkJZ2F0ZV9ub2RlID0gdmRlY19nZXRfY2xrX2J5X25hbWUo aHcsICJjb3JlX3ZkZWMiKTsKPiAgCWVsc2UgaWYgKGlkID09IEhWREVDKQo+ICAJCWdhdGVfbm9k ZSA9IHZkZWNfZ2V0X2Nsa19ieV9uYW1lKGh3LCAiY29yZV9odmRlYyIpOwo+ICAKPiAgCWlmIChn YXRlX25vZGUpIHsKPiAgCQljbGtfcHJlcGFyZV9lbmFibGUoZ2F0ZV9ub2RlLT5jbGspOwoKW1Nl dmVyaXR5OiBIaWdoXQpJcyB0aGUgZG9zIGNsb2NrIHJlcXVlc3RlZCBkdXJpbmcgdmRlY19jbG9j a19nYXRlX2luaXQoKSBidXQgbmV2ZXIgZW5hYmxlZApoZXJlPyBTa2lwcGluZyB0aGUgZG9zIGNs b2NrIGVuYWJsZSBiZWZvcmUgYWNjZXNzaW5nIERPUyBidXMgcmVnaXN0ZXJzIGluCmRvc19sb2Nh bF9jb25maWcoKSBiZWxvdyBjb3VsZCBjYXVzZSB0aGUgc3lzdGVtIGJ1cyB0byBoYW5nLgoKPiAg CQlpZiAoaWQgPT0gVkRFQykgewo+ICAJCQljbGtfc2V0X3JhdGUoZ2F0ZV9ub2RlLT5jbGssIDQ5 OTk5OTk5Mik7Cj4gIAkJCWRldl9kYmcoaHctPmRldiwgImFmdGVyIHNldCwgdmRlYyBjbG9jayBp cyAlbHUgSHpcbiIsCj4gIAkJCQljbGtfZ2V0X3JhdGUoZ2F0ZV9ub2RlLT5jbGspKTsKPiAgCQl9 ClsgLi4uIF0KPiBAQCAtMzA4LDE2ICszMDksMTYgQEAgc3RhdGljIGNvbnN0IHN0cnVjdCBwb3dl cl9tYW5hZ2VyX3MgcG1bXSA9IHsKPiAgCQkucG93ZXJfb2ZmICAgID0gcG1fdmRlY19wb3dlcl9k b21haW5fcG93ZXJfb2ZmLAo+ICAJfSwKPiAgfTsKPiAgCj4gIHN0YXRpYyBpcnFyZXR1cm5fdCB2 ZGVjX2lycV9oYW5kbGVyKGludCBpcnEsIHZvaWQgKnByaXYpCj4gIHsKPiAgCXN0cnVjdCBhbWxf dmRlY19kZXYgKmRldiA9IChzdHJ1Y3QgYW1sX3ZkZWNfZGV2ICopcHJpdjsKPiAgCXN0cnVjdCBh bWxfdmRlY19odyAqaHcgPSBkZXYtPmRlY19odzsKPiAgCWlycXJldHVybl90IHJldCA9IElSUV9I QU5ETEVEOwo+ICAKPiAgCWlmIChody0+aHdfb3BzLmlycV9oYW5kbGVyKQo+ICAJCXJldCA9IGh3 LT5od19vcHMuaXJxX2hhbmRsZXIoaXJxLCBwcml2KTsKPiAgCj4gIAlyZXR1cm4gcmV0Owo+ICB9 CgpbU2V2ZXJpdHk6IE1lZGl1bV0KSWYgaHctPmh3X29wcy5pcnFfaGFuZGxlciBpcyBOVUxMLCBk b2VzIHJldHVybmluZyBJUlFfSEFORExFRCB0cmljayB0aGUKc3B1cmlvdXMgaW50ZXJydXB0IGRl dGVjdG9yPyBJdCBhcHBlYXJzIHRoaXMgY291bGQgbGVhZCB0byBhbiBpbnRlcnJ1cHQgc3Rvcm0K aWYgbm8gd29yayB3YXMgYWN0dWFsbHkgcGVyZm9ybWVkIHRvIGNsZWFyIHRoZSBoYXJkd2FyZSBp bnRlcnJ1cHQuCgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMv dmRlYy9hbWxfdmRlY190ZWVfZncuYyBiL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92 ZGVjL2FtbF92ZGVjX3RlZV9mdy5jCj4gLS0tIGEvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxv Z2ljL3ZkZWMvYW1sX3ZkZWNfdGVlX2Z3LmMKPiArKysgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3Jt L2FtbG9naWMvdmRlYy9hbWxfdmRlY190ZWVfZncuYwpbIC4uLiBdCj4gQEAgLTE1NiwxNiArMTU2 LDE2IEBAIGludCBsb2FkX2Zpcm13YXJlKHN0cnVjdCBhbWxfdmRlY19odyAqaHcsIHUzMiB0eXBl KQo+ICAJbWVzb25fc21fY2FsbChody0+c2VjX2Z3LCBTTV9MT0FEX1ZJREVPX0ZXLCAmcmV0LAo+ ICAJCSAgICAgIHZpZGVvX2Z3LT5md19mb3JtYXQsIHZpZGVvX2Z3LT5jb3JlLAo+ICAJCSAgICAg IHZpZGVvX2Z3LT5pc19zd2FwLCAwLCAwKTsKPiAgCWlmIChyZXQgPCAwKQo+ICAJCWRldl9lcnIo aHctPmRldiwgImxvYWRpbmcgZncgdHlwZSAlZCBjb3JlICVkLCByZXQgJXhcbiIsCj4gIAkJCXZp ZGVvX2Z3LT5md19mb3JtYXQsIHZpZGVvX2Z3LT5jb3JlLCByZXQpOwo+ICAKPiAgCXJldHVybiBy ZXQ7Cj4gIH0KPiAgCj4gIHN0YXRpYyBpbnQgZ2V0X2Zpcm13YXJlKGNvbnN0IGNoYXIgKnBhdGgs IHZvaWQgKipkYXRhLCBzaXplX3QgKnNpemUpCj4gIHsKPiAgCWNvbnN0IHN0cnVjdCBmaXJtd2Fy ZSAqZncgPSBOVUxMOwo+ICAJaW50IHJldDsKPiAgCXZvaWQgKmJ1ZjsKPiAgCj4gIAlyZXQgPSBy ZXF1ZXN0X2Zpcm13YXJlKCZmdywgRklSTVdBUkVfUEFUSCwgTlVMTCk7CgpbU2V2ZXJpdHk6IE1l ZGl1bV0KRG9lcyBwYXNzaW5nIGEgTlVMTCBkZXZpY2UgcG9pbnRlciB0byByZXF1ZXN0X2Zpcm13 YXJlKCkgYnJlYWsgZmlybXdhcmUKY2FjaGluZyBhbmQgc3lzZnMgZmFsbGJhY2tzPyBUaGUgZmly bXdhcmUgbG9hZGVyIHR5cGljYWxseSBuZWVkcyB0aGUgY29ycmVjdApkZXZpY2UgaGllcmFyY2h5 IHRvIGJpbmQgdGhlIHJlcXVlc3QgcHJvcGVybHkuCgo+ICAJaWYgKHJldCkKPiAgCQlyZXR1cm4g cmV0Owo+ICAKPiAgCWlmIChmdy0+c2l6ZSA8PSBVQ09ERV9IRUFERVJfU0laRSkgewo+ICAJCXJl bGVhc2VfZmlybXdhcmUoZncpOwo+ICAJCXJldHVybiAtRUlOVkFMOwo+ICAJfQoKPiBkaWZmIC0t Z2l0IGEvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvaDI2NC5jIGIvZHJpdmVy cy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvaDI2NC5jCj4gLS0tIGEvZHJpdmVycy9tZWRp YS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvaDI2NC5jCj4gKysrIGIvZHJpdmVycy9tZWRpYS9wbGF0 Zm9ybS9hbWxvZ2ljL3ZkZWMvaDI2NC5jClsgLi4uIF0KPiBAQCAtMTYzLDE2ICsxNjMsMTYgQEAg c3RhdGljIGlubGluZSB1aW50MzJfdCBzcGVjMmNhbnZhcyhzdHJ1Y3QgaDI2NF9kZWNvZGVfYnVm X3NwZWMgKmJ1Zl9zcGVjKQo+ICBzdGF0aWMgc3RydWN0IGgyNjRfZGVjb2RlX2J1Zl9zcGVjICpm aW5kX3NwZWNfYnlfZHBiX2luZGV4KHN0cnVjdCBhbWxfaDI2NF9jdHgKPiAgCQkJCQkJCSAgICpo MjY0X2N0eCwgaW50IGluZGV4LCBpbnQgbGlzdCkKPiAgewo+ICAJaW50IGk7Cj4gIAlpbnQgc2l6 ZTsKPiAgCXN0cnVjdCBoMjY0X2RlY29kZV9idWZfc3BlYyAqcmVmX2xpc3Q7Cj4gIAo+ICAJc2l6 ZSA9IGgyNjRfY3R4LT5saXN0X3NpemVbbGlzdF07Cj4gIAlpZiAobGlzdCA9PSAwKQo+ICAJCXJl Zl9saXN0ID0gJmgyNjRfY3R4LT5yZWZfbGlzdDBbMF07Cj4gIAllbHNlCj4gIAkJcmVmX2xpc3Qg PSAmaDI2NF9jdHgtPnJlZl9saXN0MVswXTsKPiAgCj4gIAlmb3IgKGkgPSAwOyBpIDwgc2l6ZTsg aSsrKSB7Cj4gIAkJaWYgKGluZGV4ID09IHJlZl9saXN0W2ldLmRwYl9pbmRleCkKPiAgCQkJcmV0 dXJuICZyZWZfbGlzdFtpXTsKPiAgCX0KCltTZXZlcml0eTogSGlnaF0KV2lsbCBtdWx0aXBsZSBp ZGVudGljYWwgRFBCIGVudHJpZXMgaW4gdGhlIHJlZmVyZW5jZSBsaXN0IHJlc3VsdCBpbiBzdGFs ZSBETUEKYWRkcmVzc2VzPyBCZWNhdXNlIHRoaXMgc2VhcmNoIHN0b3BzIGF0IHRoZSBmaXJzdCBt YXRjaCwgYW55IHN1YnNlcXVlbnQKZHVwbGljYXRlIGVudHJpZXMgaW4gdGhlIGxpc3Qgd2lsbCBi ZSBza2lwcGVkIHdoZW4gaDI2NF9jb25maWdfZGVjb2RlX3NwZWMoKQppbml0aWFsaXplcyB0aGUg RE1BIGFkZHJlc3NlcywgcG90ZW50aWFsbHkgbGVhdmluZyBoYXJkd2FyZSBwcm9ncmFtbWVkIHdp dGgKc3RhbGUgb3IgdW5pbml0aWFsaXplZCBhZGRyZXNzZXMuCgo+ICAKPiAgCXJldHVybiBOVUxM Owo+ICB9Cj4gIAo+ICBzdGF0aWMgaW50IGgyNjRfcHJlcGFyZV9pbnB1dChzdHJ1Y3QgYW1sX3Zk ZWNfY3R4ICpjdHgpCj4gIHsKPiAgCXN0cnVjdCBhbWxfdmRlY19odyAqaHcgPSB2ZGVjX2dldF9o dyhjdHgtPmRldik7Cj4gIAlzdHJ1Y3QgdmIyX3Y0bDJfYnVmZmVyICpzcmM7Cj4gIAlzdHJ1Y3Qg dmIyX2J1ZmZlciAqdmI7Cj4gIAlkbWFfYWRkcl90IHNyY19kbWE7Cj4gIAl1MzIgcGF5bG9hZF9z aXplOwo+ICAJaW50IGR1bW15Owo+ICAKPiAgCXNyYyA9IHY0bDJfbTJtX25leHRfc3JjX2J1Zihj dHgtPmZoLm0ybV9jdHgpOwo+ICAJaWYgKCFzcmMpIHsKPiAgCQlkZXZfaW5mbyhody0+ZGV2LCAi bm8gaW5wdXQgYnVmZmVyIGF2YWlsYWJsZSFcbiIpOwo+ICAJCXJldHVybiAtMTsKPiAgCX0KPiAg CXZiID0gJnNyYy0+dmIyX2J1ZjsKPiAgCXBheWxvYWRfc2l6ZSA9IHZiMl9nZXRfcGxhbmVfcGF5 bG9hZCh2YiwgMCk7Cj4gIAlzcmNfZG1hID0gdmIyX2RtYV9jb250aWdfcGxhbmVfZG1hX2FkZHIo dmIsIDApOwo+ICAKPiAgCXJlZ21hcF93cml0ZShody0+bWFwW0RPU19CVVNdLCBWTERfTUVNX1ZJ RklGT19DT05UUk9MLCAwKTsKPiAgCS8qIHJlc2V0IFZMRCBmaWZvIGZvciBhbGwgdmRlYyAqLwo+ ICAJcmVnbWFwX3dyaXRlKGh3LT5tYXBbRE9TX0JVU10sIERPU19TV19SRVNFVDAsCj4gIAkJICAg ICAoMSA8PCA1KSB8ICgxIDw8IDQpIHwgKDEgPDwgMykpOwo+ICAJcmVnbWFwX3dyaXRlKGh3LT5t YXBbRE9TX0JVU10sIERPU19TV19SRVNFVDAsIDApOwo+ICAJcmVnbWFwX3dyaXRlKGh3LT5tYXBb RE9TX0JVU10sIFBPV0VSX0NUTF9WTEQsIDEgPDwgNCk7Cj4gIAo+ICAJcmVnbWFwX3dyaXRlKGh3 LT5tYXBbRE9TX0JVU10sIFZMRF9NRU1fVklGSUZPX1NUQVJUX1BUUiwgc3JjX2RtYSk7Cj4gIAly ZWdtYXBfd3JpdGUoaHctPm1hcFtET1NfQlVTXSwgVkxEX01FTV9WSUZJRk9fRU5EX1BUUiwKPiAg CQkgICAgIChzcmNfZG1hICsgcGF5bG9hZF9zaXplKSk7Cj4gIAlyZWdtYXBfd3JpdGUoaHctPm1h cFtET1NfQlVTXSwgVkxEX01FTV9WSUZJRk9fQ1VSUl9QVFIsCj4gIAkJICAgICByb3VuZF9kb3du KHNyY19kbWEsIFZERUNfRklGT19BTElHTikpOwo+ICAKPiAgCXJlZ21hcF93cml0ZShody0+bWFw W0RPU19CVVNdLCBWTERfTUVNX1ZJRklGT19DT05UUk9MLCAxKTsKPiAgCXJlZ21hcF93cml0ZSho dy0+bWFwW0RPU19CVVNdLCBWTERfTUVNX1ZJRklGT19DT05UUk9MLCAwKTsKPiAgCXJlZ21hcF93 cml0ZShody0+bWFwW0RPU19CVVNdLCBWTERfTUVNX1ZJRklGT19CVUZfQ05UTCwgMik7Cj4gIAo+ ICAJcmVnbWFwX3dyaXRlKGh3LT5tYXBbRE9TX0JVU10sIFZMRF9NRU1fVklGSUZPX1JQLAo+ICAJ CSAgICAgcm91bmRfZG93bihzcmNfZG1hLCBWREVDX0ZJRk9fQUxJR04pKTsKPiAgCWR1bW15ID0g cGF5bG9hZF9zaXplICsgVkxEX1BBRERJTkdfU0laRTsKPiAgCXJlZ21hcF93cml0ZShody0+bWFw W0RPU19CVVNdLCBWTERfTUVNX1ZJRklGT19XUCwKPiAgCQkgICAgIHJvdW5kX2Rvd24oKHNyY19k bWEgKyBkdW1teSksIFZERUNfRklGT19BTElHTikpOwoKW1NldmVyaXR5OiBIaWdoXQpDYW4gcHJv Z3JhbW1pbmcgdGhlIHdyaXRlIHBvaW50ZXIgcGFzdCB0aGUgbWFwcGVkIHBheWxvYWQgc2l6ZSBj YXVzZQpvdXQtb2YtYm91bmRzIERNQSByZWFkcz8gSWYgdXNlcnNwYWNlIHByb3ZpZGVzIGEgdGln aHQgYnVmZmVyIHdoZXJlIHRoZQptYXBwZWQgcGxhbmUgc2l6ZSBleGFjdGx5IG1hdGNoZXMgdGhl IHBheWxvYWQgc2l6ZSwgdGhlIGhhcmR3YXJlIG1pZ2h0CmF0dGVtcHQgdG8gcmVhZCB0aGUgVkxE X1BBRERJTkdfU0laRSBieXRlcyBmcm9tIHVubWFwcGVkIHBoeXNpY2FsIG1lbW9yeS4KCj4gIAo+ ICAJcmVnbWFwX3dyaXRlKGh3LT5tYXBbRE9TX0JVU10sIFZMRF9NRU1fVklGSUZPX0JVRl9DTlRM LCAzKTsKPiAgCXJlZ21hcF93cml0ZShody0+bWFwW0RPU19CVVNdLCBWTERfTUVNX1ZJRklGT19C VUZfQ05UTCwgMik7ClsgLi4uIF0KPiBAQCAtMzQ1LDE2ICszNDYsMTYgQEAgc3RhdGljIGludCBj b25maWdfc3BzX3BhcmFtcyhzdHJ1Y3QgYW1sX2gyNjRfY3R4ICpoMjY0X2N0eCwKPiAgewo+ICAJ c3RydWN0IGFtbF92ZGVjX2N0eCAqY3R4ID0gaDI2NF9jdHgtPnY0bDJfY3R4Owo+ICAJc3RydWN0 IGFtbF92ZGVjX2h3ICpodyA9IHZkZWNfZ2V0X2h3KGN0eC0+ZGV2KTsKPiAgCWNvbnN0IHN0cnVj dCB2NGwyX2ZybXNpemVfc3RlcHdpc2UgKnN0ZXB3aXNlID0KPiAgCQkmY3R4LT5kZWNfZm10W0FN TF9GTVRfU1JDXS5zdGVwd2lzZTsKPiAgCXUzMiBjZmdfdG1wID0gMDsKPiAgCXUzMiBmcmFtZV9z aXplOwo+ICAJdTMyIG9mZnNldCA9IDA7Cj4gIAl1bnNpZ25lZCBzaG9ydCBkYXRhX3RtcFsweDEw MF07Cj4gIAlpbnQgaSwgaWk7Cj4gIAo+ICAJbWVtc2V0KHNwc19iYXNlLCAwLCAweDEwMCk7Cj4g IAo+ICAJaDI2NF9jdHgtPmZyYW1lX3dpZHRoID0gKHNwcy0+cGljX3dpZHRoX2luX21ic19taW51 czEgKyAxKSA8PCA0Owo+ICAJaDI2NF9jdHgtPmZyYW1lX2hlaWdodCA9IChzcHMtPnBpY19oZWln aHRfaW5fbWFwX3VuaXRzX21pbnVzMSArIDEpIDw8IDQ7CgpbU2V2ZXJpdHk6IENyaXRpY2FsXQpJ cyB0aGVyZSBhIG1pc3NpbmcgY2hlY2sgdG8gdmVyaWZ5IHRoYXQgdGhlc2UgU1BTIGRpbWVuc2lv bnMgYWN0dWFsbHkgZml0CndpdGhpbiB0aGUgYWxsb2NhdGVkIFY0TDIgY2FwdHVyZSBxdWV1ZSBy ZXNvbHV0aW9uPyBCbGluZGx5IGFjY2VwdGluZyB0aGVzZQpjb3VsZCBsZWFkIHRvIG1hc3NpdmUg b3V0LW9mLWJvdW5kcyBETUEgd3JpdGVzIHdoZW4gdGhlIGhhcmR3YXJlIGlzIGxhdGVyCnByb2dy YW1tZWQgd2l0aCB0aGVzZSBzaXplcy4KCj4gIAo+ICAJaWYgKCFmcmFtZV9zaXplX2luX3Jhbmdl KHN0ZXB3aXNlLCBoMjY0X2N0eC0+ZnJhbWVfd2lkdGgsCj4gIAkJCQkgaDI2NF9jdHgtPmZyYW1l X2hlaWdodCkpIHsKPiAgCQlkZXZfaW5mbygmY3R4LT5kZXYtPnBsYXRfZGV2LT5kZXYsClsgLi4u IF0KPiBAQCAtMzk2LDE2ICszOTcsMTYgQEAgc3RhdGljIGludCBoMjY0X2NvbmZpZ19wYXJhbXMo c3RydWN0IGFtbF92ZGVjX2N0eCAqY3R4KQo+ICAKPiAgCXJldHVybiAwOwo+ICB9Cj4gIAo+ICBz dGF0aWMgdm9pZCBjb25maWdfZGVjb2RlX2NhbnZhcyhzdHJ1Y3QgYW1sX3ZkZWNfaHcgKmh3LAo+ ICAJCQkJIHN0cnVjdCBoMjY0X2RlY29kZV9idWZfc3BlYyAqYnVmX3NwZWMsCj4gIAkJCQkgdTMy IG1iX3dpZHRoLCB1MzIgbWJfaGVpZ2h0KQo+ICB7Cj4gIAlpbnQgYmxrbW9kZSA9IDB4MDsKPiAg CWludCByZXQ7Cj4gIAo+ICAJcmV0ID0gbWVzb25fY2FudmFzX2FsbG9jKGh3LT5jYW52YXMsICZi dWZfc3BlYy0+eV9jYW52YXNfaW5kZXgpOwo+ICAJaWYgKHJldCkgewo+ICAJCWRldl9lcnIoaHct PmRldiwgImZhaWxlZCB0byBhbGxvYyB5IGNhbnZhcyAoJWQpXG4iLCByZXQpOwo+ICAJCXJldHVy bjsKPiAgCX0KCltTZXZlcml0eTogSGlnaF0KSWYgY2FudmFzIGFsbG9jYXRpb24gZmFpbHMsIGRv ZXMgdGhlIGhhcmR3YXJlIGVuZCB1cCB3cml0aW5nIHRvIGFuCnVuaW5pdGlhbGl6ZWQgb3Igc3Rh bGUgY2FudmFzIGluZGV4PyBUaGUgZmFpbHVyZSBpcyBsb2dnZWQgYW5kIHJldHVybnMKZWFybHks IGJ1dCB0aGUgY2FsbGVyIGRvZXNuJ3QgYWJvcnQgdGhlIGRlY29kZSBqb2IuCgo+ICAKPiAgCXJl dCA9IG1lc29uX2NhbnZhc19hbGxvYyhody0+Y2FudmFzLCAmYnVmX3NwZWMtPnVfY2FudmFzX2lu ZGV4KTsKWyAuLi4gXQo+IEBAIC01ODUsMTYgKzU4NiwxNiBAQCBzdGF0aWMgaW50IGgyNjRfY29u ZmlnX2RlY29kZV9zcGVjKHN0cnVjdCBhbWxfdmRlY19odyAqaHcsIHN0cnVjdCBhbWxfdmRlY19j dHggKgo+ICAJCWlmIChidWZfc3BlY19sMCkgewo+ICAJCQlidWZfc3BlY19sMC0+Y2FudmFzX3Bv cyA9Cj4gIAkJCSAgICBnZXRfY2FudmFzX3Bvc19ieV9wb2MoaDI2NF9jdHgsCj4gIAkJCQkJCSAg ZHBiLT50b3BfZmllbGRfb3JkZXJfY250KTsKPiAgCQkJaWYgKGJ1Zl9zcGVjX2wwLT5jYW52YXNf cG9zIDwgMCkgewo+ICAJCQkJZGV2X2RiZygmY3R4LT5kZXYtPnBsYXRfZGV2LT5kZXYsCj4gIAkJ CQkJImwwIGNhbnZhc19wb3MgJWQgZXJyb3JcbiIsCj4gIAkJCQkJYnVmX3NwZWNfbDAtPmNhbnZh c19wb3MpOwo+ICAJCQkJY29udGludWU7Cj4gIAkJCX0KPiAgCQkJdmIgPSB2YjJfZmluZF9idWZm ZXIodnEsIGRwYi0+cmVmZXJlbmNlX3RzKTsKPiAgCQkJaWYgKCF2Yikgewo+ICAJCQkJZGV2X2Ri ZygmY3R4LT5kZXYtPnBsYXRfZGV2LT5kZXYsCj4gIAkJCQkJInJlZiBwaWMgZm9yIHRzICVsbHUg bG9zdFxuIiwgZHBiLT5yZWZlcmVuY2VfdHMpOwo+ICAJCQkJY29udGludWU7Cj4gIAkJCX0KCltT ZXZlcml0eTogSGlnaF0KSWYgdGhlIHJlZmVyZW5jZSBwaWN0dXJlIGlzIGxvc3QgYW5kIHZiMl9m aW5kX2J1ZmZlcigpIHJldHVybnMgTlVMTCwgZG9lcwp0aGlzIHNraXAgaW5pdGlhbGl6aW5nIHRo ZSBETUEgYWRkcmVzcyB3aGlsZSBsZWF2aW5nIHRoZSByZWZlcmVuY2UgcGljdHVyZQphY3RpdmUg Zm9yIGNhbnZhcyBwcm9ncmFtbWluZz8gVGhpcyBjb3VsZCBjYXVzZSB0aGUgaGFyZHdhcmUgdG8g cmVhZCBmcm9tIGEKc3RhbGUgcGh5c2ljYWwgYWRkcmVzcy4KCj4gIAo+ICAJCQlidWZfc3BlY19s MC0+eV9kbWFfYWRkciA9Cj4gIAkJCSAgICB2YjJfZG1hX2NvbnRpZ19wbGFuZV9kbWFfYWRkcih2 YiwgMCk7ClsgLi4uIF0KPiBAQCAtMjA5NSwxNiArMjA5NiwxNiBAQCB2b2lkIGFtbF9oMjY0X2V4 aXQodm9pZCAqcHJpdikKPiAgc3RhdGljIHZvaWQgY29uZmlnX2RlY29kZV9tb2RlKHN0cnVjdCBh bWxfdmRlY19jdHggKmN0eCkKPiAgewo+ICAJc3RydWN0IGFtbF9oMjY0X2N0eCAqaDI2NF9jdHgg PSAoc3RydWN0IGFtbF9oMjY0X2N0eCAqKWN0eC0+Y29kZWNfcHJpdjsKPiAgCXN0cnVjdCBhbWxf dmRlY19odyAqaHcgPSB2ZGVjX2dldF9odyhjdHgtPmRldik7Cj4gIAo+ICAJcmVnbWFwX3dyaXRl KGh3LT5tYXBbRE9TX0JVU10sIEgyNjRfREVDT0RFX01PREUsIDB4MSk7CS8qZGVjb2RlIG1vZGUg ZnJhbWViYXNlICovCj4gIAlyZWdtYXBfd3JpdGUoaHctPm1hcFtET1NfQlVTXSwgSEVBRF9QQURE SU5HX1JFRywgMCk7Cj4gIAlyZWdtYXBfd3JpdGUoaHctPm1hcFtET1NfQlVTXSwgSDI2NF9ERUNP REVfU0VRSU5GTywgaDI2NF9jdHgtPnNlcV9pbmZvKTsKPiAgCXJlZ21hcF93cml0ZShody0+bWFw W0RPU19CVVNdLCBJTklUX0ZMQUdfUkVHLCAxKTsKPiAgfQo+ICAKPiAgaW50IGFtbF9oMjY0X2Rl Y19ydW4odm9pZCAqcHJpdikKPiAgewo+ICAJc3RydWN0IGFtbF92ZGVjX2N0eCAqY3R4ID0gKHN0 cnVjdCBhbWxfdmRlY19jdHggKilwcml2Owo+ICAJc3RydWN0IGFtbF9oMjY0X2N0eCAqaDI2NF9j dHggPSAoc3RydWN0IGFtbF9oMjY0X2N0eCAqKWN0eC0+Y29kZWNfcHJpdjsKPiAgCXN0cnVjdCBh bWxfdmRlY19odyAqZGVjX2h3ID0gdmRlY19nZXRfaHcoY3R4LT5kZXYpOwo+ICAJaW50IHJldCA9 IC0xOwo+ICAJaW50IGk7Cj4gIAo+ICAJYW1sX3ZkZWNfc2V0X2N1cnJfY3R4KGRlY19odywgaDI2 NF9jdHgpOwo+ICAKPiAgCXJldCA9IGFtbF9oMjY0X2dldF9zdGF0ZWxlc3NfY3RybF9yZWYoaDI2 NF9jdHgpOwo+ICAJaWYgKHJldCA8IDApIHsKPiAgCQlkZXZfZXJyKCZjdHgtPmRldi0+cGxhdF9k ZXYtPmRldiwgIm5vdCBjdHJsIHJlZiBmb3IgaDI2NCBkZWNvZGVyXG4iKTsKPiAgCQlyZXR1cm4g cmV0Owo+ICAJfQoKW1NldmVyaXR5OiBIaWdoXQpJZiBhbiBpbml0aWFsaXphdGlvbiBzdGVwIGxp a2UgYW1sX2gyNjRfZ2V0X3N0YXRlbGVzc19jdHJsX3JlZigpIGZhaWxzIGFuZApyZXR1cm5zIGVh cmx5LCBpcyBkZWNfaHctPmN1cnJfY3R4IGxlZnQgYXMgYSBkYW5nbGluZyBwb2ludGVyPyBBIHN1 YnNlcXVlbnQKaW50ZXJydXB0IG1pZ2h0IGRlcmVmZXJlbmNlIHRoaXMgZnJlZWQgbWVtb3J5IGlu IHRoZSB0aHJlYWRlZCBJU1IuCgo+ICAKPiAgCWgyNjRfY3R4LT5uZXdfcGljX2ZsYWcgPSAxOwo+ ICAJcmV0ID0gaDI2NF9jb25maWdfcGFyYW1zKGN0eCk7ClsgLi4uIF0KPiBAQCAtMjEyNywxNiAr MjEyOCwxNiBAQCBpbnQgYW1sX2gyNjRfZGVjX3J1bih2b2lkICpwcml2KQo+ICAKPiAgCWN0eC0+ aW50X2NvbmQgPSAwOwo+ICAJYW1sX3N0YXJ0X3ZkZWNfaHcoZGVjX2h3KTsKPiAgCWgyNjRfY3R4 LT5pbml0X2ZsYWcgPSAxOwo+ICAKPiAgCXJlZ21hcF93cml0ZShkZWNfaHctPm1hcFtET1NfQlVT XSwgRFBCX1NUQVRVU19SRUcsIEgyNjRfQUNUSU9OX1NFQVJDSF9IRUFEKTsKPiAgCj4gIAlyZXQg PSB3YWl0X2V2ZW50X2ludGVycnVwdGlibGVfdGltZW91dChjdHgtPnF1ZXVlLCBjdHgtPmludF9j b25kLAo+ICAJCQkJCSAgICAgICBtc2Vjc190b19qaWZmaWVzKERFQ09ERVJfVElNRU9VVF9NUykp Owo+ICAKPiAgCWlmICghcmV0KSB7Cj4gIAkJcmV0ID0gLTE7Cj4gIAkJZGV2X2VycigmY3R4LT5k ZXYtPnBsYXRfZGV2LT5kZXYsICJkZWMgdGltZW91dD0ldVxuIiwgREVDT0RFUl9USU1FT1VUX01T KTsKPiAgCQlmb3IgKGkgPSAwOyBpIDwgMTY7IGkrKykgewkvKiAxNiA6IHNob3cgdWNvZGUgUEMg MTYgdGltZXMgd2hlbiB0aW1lb3V0ICovCj4gIAkJCWRldl9kYmcoJmN0eC0+ZGV2LT5wbGF0X2Rl di0+ZGV2LCAiZGVjb2RlciB0aW1lb3V0LCBwYyAweCV4XG4iLAo+ICAJCQkJcmVhZF9kb3NfcmVn KGRlY19odywgTVBDX0UpKTsKPiAgCQkJdXNsZWVwX3JhbmdlKDEwLCAyMCk7Cj4gIAkJfQo+ICAJ CS8qCj4gIAkJICogSGFsdCB0aGUgaGFyZHdhcmUgYW5kIHdhaXQgb3V0IGFueSBpbi1mbGlnaHQg dGhyZWFkZWQgSVJRCj4gIAkJICogaGFuZGxlciBiZWZvcmUgY2xlYW5pbmcgdXAsIG90aGVyd2lz ZSBib3RoIGNvbnRleHRzIG1heSBydW4KPiAgCQkgKiBoMjY0X3JlbGVhc2VfZGVjb2RlX3NwZWMo KSBjb25jdXJyZW50bHkuCj4gIAkJICovCj4gIAkJYW1sX3N0b3BfdmRlY19odyhkZWNfaHcpOwo+ ICAJCXN5bmNocm9uaXplX2lycShkZWNfaHctPmRlY19pcnEpOwo+ICAJCWgyNjRfcmVsZWFzZV9k ZWNvZGVfc3BlYyhkZWNfaHcsIGN0eCk7CgpbU2V2ZXJpdHk6IEhpZ2hdCkRvZXMgYW1sX3N0b3Bf dmRlY19odygpIHJhY2Ugd2l0aCB2ZGVjX3RocmVhZGVkX2lzcl9oYW5kbGVyKCkgaGVyZT8gVGhl CnRpbWVvdXQgcGF0aCBhY2Nlc3NlcyBoYXJkd2FyZSByZWdpc3RlcnMgd2l0aG91dCBhY3F1aXJp bmcgaHctPmN0eF9tdXRleCBvcgpkaXNhYmxpbmcgdGhlIElSUSwgd2hpY2ggY291bGQgY29ycnVw dCBoYXJkd2FyZSBzdGF0ZSBpZiBhbiBpbnRlcnJ1cHQKZmlyZXMgY29uY3VycmVudGx5LgoKPiAg CX0gZWxzZSBpZiAoLUVSRVNUQVJUU1lTID09IHJldCkgewo+ICAJCXJldCA9IC0xOwo+ICAJCWFt bF9zdG9wX3ZkZWNfaHcoZGVjX2h3KTsKCi0tIApTYXNoaWtvIEFJIHJldmlldyDCtyBodHRwczov L3Nhc2hpa28uZGV2LyMvcGF0Y2hzZXQvMjAyNjA4MzEtYjQtczQtdmRlYy11cHN0cmVhbS12OC0w LTgzMDE5NWI5YmQ5MUBhbWxvZ2ljLmNvbT9wYXJ0PTQKCl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fCmxpbnV4LWFtbG9naWMgbWFpbGluZyBsaXN0CmxpbnV4 LWFtbG9naWNAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9t YWlsbWFuL2xpc3RpbmZvL2xpbnV4LWFtbG9naWMK