From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7C825CA9ED5 for ; Mon, 12 Oct 2026 07:20:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Date:References: In-Reply-To:Cc:To:Subject:From:Message-ID:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=I3/jdVVVsgu8twHkYjXpc9Mjt85qjuvUkZchZ5Ec+9I=; b=SzXYoMt/Nszp1N XQjqS56cHr1SK2fEP8fPTuF7Xszl46xFVagUJ3MjmxE434D50XOkxAaIhxqt0TyLkaoUuQcb9S4Fz liZ0R/i5RAtUB4BHd4OEEW3l3nVR/WIg2OBZI2w3JhHkY5LRIRbsq3SBD5FuVuOyxXGy56Lcxg4zn cXc5GJn3S1O3JxnPF6/wfeLzYRuoKla/f7UviBsepwq6kvnEv/Clb41j/kwJgA/aoEr2LdQMmNCD1 DBRP1c50dY8/j6y+9K8c3OcKFjVB1nrXbw2b9Wi4Xu/oL3hlYqCGL0rhc1UcrF+v2VZAz8hVKyNgy GxVbbBRJszEAHcg5eukA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1xGAL4-00000009pWo-0OXY; Mon, 12 Oct 2026 07:20:50 +0000 Received: from sea.source.kernel.org ([172.234.252.31]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1xGAL2-00000009pWY-44nw for linux-amlogic@lists.infradead.org; Mon, 12 Oct 2026 07:20:49 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id 74C7F42AED; Mon, 12 Oct 2026 07:20:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F03501F0089B; Mon, 12 Oct 2026 07:20:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1791789648; bh=/J8A8LCaAA3CsQhAHUEsS6ViRpTCjWN6mIioaoOUMy8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=Un0d5S0X3zvht+neaoYId0lqPGrupk9sCmTsd3b5UyCdyZhM7mQE8NwPE8Si7yxsJ rYzoom0+tu2nf0/NZLWIsza+di30s2dZ4Cweuupryuyx7HQt9BsNIeA2gwO+EFzP+z KM1pIyZU3lUekFp0H+iTyiXpW6EFtouHJXU9MNV6R2tY89wCgvvk63odZozsU8KDxL 1ryr2YNXR33mBjOMhNPzZEc9nZyyyqWQ+P0eqgB00OmYjSu1N303MCrxdKye1fWJUH Xiz89TgDSHTwM5LTBsF+ubadsQMdeBDEh5COFSdIKDjdDhPjLtTykTOh+nh4+Bl6rp GKKfR/IlhBJfg== Message-ID: From: sashiko-bot@kernel.org Subject: Re: [PATCH v11 4/6] decoder: Add V4L2 stateless H.264 decoder driver To: "Zhentao Guo" Cc: neil.armstrong@linaro.org, linux-amlogic@lists.infradead.org, media-ci@linuxtv.org, robh@kernel.org, devicetree@vger.kernel.org, conor+dt@kernel.org In-Reply-To: <20261012-b4-s4-vdec-upstream-v11-4-25939f85ada5@amlogic.com> References: <20261012-b4-s4-vdec-upstream-v11-0-25939f85ada5@amlogic.com> <20261012-b4-s4-vdec-upstream-v11-4-25939f85ada5@amlogic.com> Date: Mon, 12 Oct 2026 07:20:47 +0000 X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MTkgcG90ZW50aWFsIGlzc3VlKHMpIHRvIGNvbnNpZGVyOgotIFtDcml0aWNhbF0gbWVkaWE6IGFt bG9naWM6IG91dC1vZi1ib3VuZHMgYXJyYXkgYWNjZXNzIGluIGFtbF92ZGVjX2luaXRfZGVjX2lu c3QgYWxsb3dzIGNvbnRyb2wgZmxvdyBoaWphY2sKLSBbQ3JpdGljYWxdIG1lZGlhOiBhbWxvZ2lj OiBjb25jdXJyZW50IFNUUkVBTU9GRiBmcmVlcyBjb2RlYyBjb250ZXh0IHdoaWxlIHdvcmtlciB0 aHJlYWQgaXMgd2FpdGluZwotIFtIaWdoXSBtZWRpYTogYW1sb2dpYzogdWFmIG9uIGRldmljZSBy ZW1vdmFsIGR1ZSB0byBkZXZtX2t6YWxsb2MgYW5kIHY0bDJfbTJtX3JlbGVhc2UKLSBbSGlnaF0g bWVkaWE6IGFtbG9naWM6IGdldF9jYW52YXNfaW5kZXggbWFwcyBzdGFsZSBkYW5nbGluZyBETUEg YWRkcmVzc2VzIHRvIGhhcmR3YXJlCi0gW0hpZ2hdIG1lZGlhOiBhbWxvZ2ljOiBzdGFsZSBvbmVf Y29sX2J1Zl9zaXplIGNhdXNlcyBETUEgYnVmZmVyIG92ZXJmbG93IG9uIHJlc29sdXRpb24gY2hh bmdlCi0gW0hpZ2hdIG1lZGlhOiBhbWxvZ2ljOiBtaXNzaW5nIGVycm9yIGhhbmRsaW5nIGluIHBt X3ZkZWNfcG93ZXJfZG9tYWluX3Bvd2VyX29uIGNhdXNlcyBsZWFrcyBhbmQgTU1JTyBhYm9ydHMK LSBbSGlnaF0gbWVkaWE6IGFtbG9naWM6IGFtbF9zdG9wX3ZkZWNfaHcgcmVzZXRzIGhhcmR3YXJl IGNvbmN1cnJlbnRseSB3aXRoIHRocmVhZGVkIElTUgotIFtIaWdoXSBtZWRpYTogYW1sb2dpYzog dW5wcm90ZWN0ZWQgZG9zX2VuYWJsZSBpbiBkZXZpY2VfcnVuIHJhY2VzIHdpdGggYW1sX2gyNjRf ZXhpdAotIFtIaWdoXSBtZWRpYTogYW1sb2dpYzogdmIyX2ZpbmRfYnVmZmVyIGNhbGxlZCBmcm9t IHRocmVhZGVkIElTUiB3aXRob3V0IGhvbGRpbmcgcXVldWUgbG9jawotIFtIaWdoXSBtZWRpYTog YW1sb2dpYzogdmlkZW8gZGV2aWNlIHJlZ2lzdGVyZWQgYmVmb3JlIGhhcmR3YXJlIHBvd2VyIGRv bWFpbiBpcyBlbmFibGVkCi0gW01lZGl1bV0gbWVkaWE6IGFtbG9naWM6IGlycSByZWdpc3RlcmVk IGJlZm9yZSBoYXJkd2FyZSByZXNldCBhbmQgd2l0aG91dCBoYW5kbGVyCi0gW01lZGl1bV0gbWVk aWE6IGFtbG9naWM6IGZhaWxlZCBjYW52YXMgY29uZmlnIHNpbGVudGx5IGNvbXByZXNzZXMgaGFy ZHdhcmUgcmVmZXJlbmNlIGxpc3QKLSBbTWVkaXVtXSBtZWRpYTogYW1sb2dpYzogcGVyLWluc3Rh bmNlIHBvd2VyIGRvbWFpbiBkZXZpY2Ugc3RhdGUgY29ycnVwdHMgc3RhdGljIGdsb2JhbCBhcnJh eQotIFtNZWRpdW1dIG1lZGlhOiBhbWxvZ2ljOiByZWZfbGlzdDEgaW5jb3JyZWN0bHkgY2hlY2tl ZCBhZ2FpbnN0IHJlZl9saXN0MCB2YWxpZCBmbGFnCi0gW01lZGl1bV0gbWVkaWE6IGFtbG9naWM6 IHBvY19pc19pbl9kcGIgaWdub3JlcyBWNEwyX0gyNjRfRFBCX0VOVFJZX0ZMQUdfVkFMSUQgbGVh a2luZyByZXNvdXJjZXMKLSBbTG93XSBtZWRpYTogYW1sb2dpYzogZG91YmxlIGNvbXBsZXRpb24g b2YgbWVkaWEgcmVxdWVzdCB0cmlnZ2VycyBXQVJOX09OCi0gW0xvd10gbWVkaWE6IGFtbG9naWM6 IHZkZWNfc19mbXRfb3V0cHV0IGZhbHNlbHkgcmVqZWN0cyBpZGVudGljYWwgZm9ybWF0IGNoYW5n ZXMgd2l0aCAtRUJVU1kKLSBbTG93XSBtZWRpYTogYW1sb2dpYzogaGFyZHdhcmUgc3RyaWRlIGNv bmZpZ3VyZWQgdXNpbmcgU1BTIHdpZHRoIGluc3RlYWQgb2YgdjRsMiBieXRlc3BlcmxpbmUKLSBb TG93XSBtZWRpYTogYW1sb2dpYzogaW1wbGljaXQgZGVjbGFyYXRpb24gb2Yga3phbGxvY19vYmog Y2F1c2VzIGJ1aWxkIGZhaWx1cmUKLS0KCmNvbW1pdCBkYTI3NDEyNWMxNGQyZGE5MGJiODNhN2Zm YzMwYjU3ZDk2ZGE5MzIzCkF1dGhvcjogWmhlbnRhbyBHdW8gPHpoZW50YW8uZ3VvQGFtbG9naWMu Y29tPgpTdWJqZWN0OiBkZWNvZGVyOiBBZGQgVjRMMiBzdGF0ZWxlc3MgSC4yNjQgZGVjb2RlciBk cml2ZXIKClRoaXMgY29tbWl0IGFkZHMgaW5pdGlhbCBzdXBwb3J0IGZvciBhIFY0TDIgc3RhdGVs ZXNzIHZpZGVvIGRlY29kZXIgZHJpdmVyIG9uCnRoZSBBbWxvZ2ljIFM0IHBsYXRmb3JtLiBJdCBz dXBwb3J0cyA4LWJpdCBILjI2NCBwcm9ncmVzc2l2ZSBiaXRzdHJlYW1zIGluCnRoaXMgZmlyc3Qg cGhhc2UuCgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRl Yy9hbWxfdmRlYy5jIGIvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3Zk ZWMuYwo+IC0tLSBhL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92ZGVj LmMKPiArKysgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRlYy5j Cj4gQEAgLTEzMyw2ICsxMzMsOCBAQCBzdGF0aWMgdm9pZCBtMm1vcHNfdmRlY19kZXZpY2VfcnVu KHZvaWQgKm0ybV9wcml2KQo+ICAJCXY0bDJfY3RybF9yZXF1ZXN0X3NldHVwKHNyY19yZXEsICZj dHgtPmN0cmxfaGFuZGxlcik7Cj4gIAo+ICAJZG9zX2VuYWJsZShkZXYtPmRlY19odyk7Cj4gIAkv KiBpbmNhc2Ugb2YgYnVzIGhhbmcgaW4gc3RvcF9zdHJlYW1pbmcgKi8KPiAgCWN0eC0+ZG9zX2Ns a19lbiA9IDE7Cj4gIAljdHgtPmN1cnJfZnJtX2Vycl9mbGFnID0gMDsKPiAgCj4gIAlpZiAoY3R4 LT5jdXJyX2RlY190eXBlID09IENPREVDX1RZUEVfSDI2NCkKPiAgCQlhbWxfdmRlY19yZXNldF9j b3JlKGRldi0+ZGVjX2h3KTsKCltTZXZlcml0eTogSGlnaF0KRG9lcyB0aGlzIGV4ZWN1dGUgaGFy ZHdhcmUgc2V0dXAgYmVmb3JlIGN1cnJfY3R4IGlzIGFzc2lnbmVkIGFuZCB3aXRob3V0CmNyb3Nz LWluc3RhbmNlIGxvY2tpbmc/CgpJZiBhbm90aGVyIGRlY29kaW5nIGluc3RhbmNlIGlzIGNvbmN1 cnJlbnRseSBzdG9wcGVkIHZpYSBWSURJT0NfU1RSRUFNT0ZGLCBpdHMKYW1sX2gyNjRfZXhpdCgp IGNvdWxkIHNlZSAoIWRlY19ody0+Y3Vycl9jdHggfHwgZGVjX2h3LT5jdXJyX2N0eCA9PSBoMjY0 X2N0eCkKZXZhbHVhdGUgdG8gdHJ1ZSwgbG9ja2luZyBjdHhfbXV0ZXggYW5kIHNodXR0aW5nIGRv d24gdGhlIGhhcmR3YXJlIHdoaWxlIHRoaXMKaW5zdGFuY2UgaXMgc2ltdWx0YW5lb3VzbHkgdHJ5 aW5nIHRvIGluaXRpYWxpemUgaXQuCgo+IEBAIC0xNDgsNiArMTQ4LDggQEAgc3RhdGljIHZvaWQg bTJtb3BzX3ZkZWNfZGV2aWNlX3J1bih2b2lkICptMm1fcHJpdikKPiAgCXY0bDJfbTJtX2J1Zl9j b3B5X21ldGFkYXRhKHNyY19idWYsIGRzdF9idWYpOwo+ICAJaWYgKHNyY19yZXEpCj4gIAkJdjRs Ml9jdHJsX3JlcXVlc3RfY29tcGxldGUoc3JjX3JlcSwgJmN0eC0+Y3RybF9oYW5kbGVyKTsKCltT ZXZlcml0eTogTG93XQpJcyB0aGlzIGV4cGxpY2l0IGNhbGwgdG8gdjRsMl9jdHJsX3JlcXVlc3Rf Y29tcGxldGUoKSB0cmlnZ2VyaW5nIGEgZG91YmxlCmNvbXBsZXRpb24gd2FybmluZz8KCkxhdGVy IGluIHRoaXMgZnVuY3Rpb24sIHY0bDJfbTJtX2J1Zl9kb25lX2FuZF9qb2JfZmluaXNoKCkgd2ls bCBjYWxsCnZiMl9idWZmZXJfZG9uZSgpLCB3aGljaCBpbnZva2VzIHRoZSBidWZfcmVxdWVzdF9j b21wbGV0ZSBjYWxsYmFjayBkZWZpbmVkIGluCmFtbF92ZGVjX3ZiMl9vcHMuIFRoYXQgY2FsbGJh Y2sgYWxzbyBjYWxscyB2NGwyX2N0cmxfcmVxdWVzdF9jb21wbGV0ZSgpIG9uIHRoZQpzYW1lIHJl cXVlc3QuCgpbIC4uLiBdCj4gQEAgLTIzMSw2ICsyMzEsMTAgQEAgc3RhdGljIGludCBhbWxfdmRl Y19pbml0X2RlY19pbnN0KHN0cnVjdCBhbWxfdmRlY19jdHggKmN0eCkKPiAgCXN0cnVjdCBhbWxf dmlkZW9fZm10ICpmbXRfb3V0ID0gJmN0eC0+ZGVjX2ZtdFtBTUxfRk1UX1NSQ107Cj4gIAlpbnQg cmV0ID0gLTE7Cj4gIAo+ICAJY3R4LT5jb2RlY19vcHMgPSAmZGV2LT5wdmRlY19kYXRhLT5jb2Rl Y19vcHNbZm10X291dC0+Y29kZWNfdHlwZV07Cj4gIAkvKgo+ICAJICogVGhlIGNvZGVjIGluc3Rh bmNlIGlzIG9ubHkgcmVsZWFzZWQgd2hlbiBib3RoIHF1ZXVlcyBhcmUKPiAgCSAqIHN0cmVhbWVk IG9mZjogZG8gbm90IGFsbG9jYXRlIGEgbmV3IG9uZSAobGVha2luZyB0aGUgcHJldmlvdXMKPiAg CSAqIGluc3RhbmNlKSB3aGVuIHRoZSBvdXRwdXQgcXVldWUgaXMgcmVzdGFydGVkIHdoaWxlIHRo ZQo+ICAJICogY2FwdHVyZSBxdWV1ZSBpcyBzdGlsbCBzdHJlYW1pbmcuCj4gIAkgKi8KPiAgCWlm IChjdHgtPmNvZGVjX29wcy0+aW5pdCAmJiAhY3R4LT5jb2RlY19wcml2KSB7Cj4gIAkJcmV0ID0g Y3R4LT5jb2RlY19vcHMtPmluaXQoY3R4KTsKCltTZXZlcml0eTogQ3JpdGljYWxdCkRvZXMgdGhp cyBwZXJtaXQgYW4gb3V0LW9mLWJvdW5kcyBhcnJheSBhY2Nlc3MgaWYgZm10X291dC0+Y29kZWNf dHlwZSBpcwp1bnRydXN0ZWQ/CgpJZiB1bnByaXZpbGVnZWQgdXNlcnNwYWNlIGNhbGxzIFZJRElP Q19TX0ZNVCBvbiB0aGUgb3V0cHV0IHF1ZXVlIHdpdGggYQpjYXB0dXJlLW9ubHkgZm9ybWF0IChl LmcuIFY0TDJfUElYX0ZNVF9OVjEyKSwgYW1sX3ZkZWNfZ2V0X3ZpZGVvX2ZtdCgpIGNvdWxkCnJl dHVybiB0aGF0IGZvcm1hdCBhbmQgcmVjb3JkIGl0cyBjb2RlY190eXBlIGFzIENPREVDX1RZUEVf RlJBTUUgKDEpLiBXaGVuClNUUkVBTU9OIHJlc29sdmVzIHRoZSBjb2RlYyBvcGVyYXRpb25zIGhl cmUsIGluZGV4IDEgcmVhZHMgcGFzdCB0aGUgZW5kIG9mIHRoZQphbWxfUzRfZGVjX29wcyBhcnJh eSBhbmQgZGVyZWZlcmVuY2VzIGEgd2lsZCBmdW5jdGlvbiBwb2ludGVyLgoKWyAuLi4gXQo+IEBA IC0zMTEsNiArMzExLDEwIEBAIHN0YXRpYyBpbnQgdmRlY19zX2ZtdF9vdXRwdXQoc3RydWN0IGFt bF92ZGVjX2N0eCAqY3R4LCBzdHJ1Y3QgdjRsMl9mb3JtYXQgKmYpCj4gIAlwZWVyX3ZxID0gdjRs Ml9tMm1fZ2V0X3ZxKGN0eC0+bTJtX2N0eCwgVjRMMl9CVUZfVFlQRV9WSURFT19DQVBUVVJFX01Q TEFORSk7Cj4gIAlpZiAodmIyX2lzX2J1c3kocGVlcl92cSkgJiYKPiAgCSAgICAocGl4X21wLT53 aWR0aCAhPSBjYXBfZm10LT53aWR0aCB8fAo+ICAJICAgIHBpeF9tcC0+aGVpZ2h0ICE9IGNhcF9m bXQtPmhlaWdodCkpCj4gIAkJcmV0dXJuIC1FQlVTWTsKCltTZXZlcml0eTogTG93XQpDb3VsZCB0 aGlzIGZhbHNlbHkgcmVqZWN0IGlkZW50aWNhbCBmb3JtYXQgY2hhbmdlcyB3aXRoIC1FQlVTWT8K ClRoZSBjYXBfZm10IHN0cnVjdHVyZSBjb250YWlucyB0aGUgYWN0aXZlIGNhcHR1cmUgZm9ybWF0 LCB3aGljaCBoYXMgYWxyZWFkeQpiZWVuIGFsaWduZWQgdG8gaGFyZHdhcmUgY29uc3RyYWludHMu IFRoZSBwaXhfbXAgc3RydWN0dXJlIGNvbnRhaW5zIHRoZQp1bmFsaWduZWQgdXNlci1yZXF1ZXN0 ZWQgZGltZW5zaW9ucy4gSWYgdXNlcnNwYWNlIHJlcXVlc3RzIHRoZSBleGFjdCBzYW1lCnVuYWxp Z25lZCBmb3JtYXQgd2hpbGUgdGhlIHF1ZXVlIGlzIGJ1c3ksIHRoaXMgY2hlY2sgZmFpbHMgYW5k IGZhbHNlbHkgcmVqZWN0cwphIGxlZ2l0aW1hdGUgbm8tb3AgZm9ybWF0IHNldHRpbmcuCgo+ICAK PiAgCW91dF9mbXQgPSBhbWxfdmRlY19nZXRfdmlkZW9fZm10KGN0eC0+ZGV2LCBwaXhfbXAtPnBp eGVsZm9ybWF0KTsKPiAgCWlmIChvdXRfZm10KSB7Cj4gIAkJY3R4LT5kZWNfZm10W0FNTF9GTVRf U1JDXSA9ICpvdXRfZm10OwoKW1NldmVyaXR5OiBDcml0aWNhbF0KQ2FuIHRoaXMgYmluZCBhIGNh cHR1cmUtb25seSBmb3JtYXQgdG8gdGhlIG91dHB1dCBxdWV1ZT8KClRoZSBhbWxfdmRlY19nZXRf dmlkZW9fZm10KCkgZnVuY3Rpb24gaWdub3JlcyBmbXQtPnR5cGUgZHVyaW5nIGxvb2t1cC4gVGhp cwptZWFucyBhIGZvcm1hdCBsaWtlIFY0TDJfUElYX0ZNVF9OVjEyIGNhbiBiZSBhcHBsaWVkIHRv IHRoZSBvdXRwdXQgcXVldWUsCndoaWNoIGV2ZW50dWFsbHkgbGVhZHMgdG8gdGhlIG91dC1vZi1i b3VuZHMgYWNjZXNzIGluIGFtbF92ZGVjX2luaXRfZGVjX2luc3QoKS4KClsgLi4uIF0KPiBAQCAt NTIyLDYgKzUyMiw4IEBAIHN0YXRpYyB2b2lkIHZiMm9wc192ZGVjX3N0b3Bfc3RyZWFtaW5nKHN0 cnVjdCB2YjJfcXVldWUgKnEpCj4gIAl9Cj4gIAo+ICAJaWYgKCFjdHgtPmlzX291dHB1dF9zdHJl YW1vbiAmJiAhY3R4LT5pc19jYXBfc3RyZWFtb24pCj4gIAkJYW1sX3ZkZWNfcmVsZWFzZV9pbnN0 YW5jZShjdHgpOwo+ICB9CgpbU2V2ZXJpdHk6IENyaXRpY2FsXQpEb2VzIHRoaXMgZnJlZSB0aGUg Y29kZWMgY29udGV4dCB3aXRob3V0IHN5bmNocm9uaXppbmcgYWdhaW5zdCB0aGUgYWN0aXZlCndv cmtlciB0aHJlYWQ/CgpJZiBTVFJFQU1PRkYgcnVucyB3aGlsZSB0aGUgZGV2aWNlX3J1biB3b3Jr ZXIgdGhyZWFkIGlzIGJsb2NrZWQgaW4Kd2FpdF9ldmVudF9pbnRlcnJ1cHRpYmxlX3RpbWVvdXQo KSwgYW1sX2gyNjRfZXhpdCgpIHdpbGwgZnJlZSBjdHgtPmNvZGVjX3ByaXYuCldoZW4gdGhlIHdv cmtlciB0aHJlYWQgd2FrZXMgdXAsIGl0IHdpbGwgd3JpdGUgdG8gdGhlIGZyZWVkIG1lbW9yeS4K Cj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92 ZGVjX2Rydi5jIGIvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3ZkZWNf ZHJ2LmMKPiAtLS0gYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRl Y19kcnYuYwo+ICsrKyBiL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92 ZGVjX2Rydi5jCj4gQEAgLTIzLDYgKzIzLDcgQEAgc3RhdGljIGludCBmb3BzX3Zjb2RlY19vcGVu KHN0cnVjdCBmaWxlICpmaWxlKQo+ICAJc3RydWN0IGFtbF92ZGVjX2N0eCAqY3R4ID0gTlVMTDsK PiAgCWludCByZXQgPSAwOwo+ICAKPiAgCWN0eCA9IGt6YWxsb2Nfb2JqKCpjdHgsIEdGUF9LRVJO RUwpOwoKW1NldmVyaXR5OiBMb3ddCklzIGt6YWxsb2Nfb2JqKCkgYW4gdW5kZWZpbmVkIG1hY3Jv L2Z1bmN0aW9uIGhlcmU/CgpJdCBsb29rcyBsaWtlIHRoaXMgbWlnaHQgaGF2ZSBtZWFudCB0byBi ZSBremFsbG9jKHNpemVvZigqY3R4KSwgR0ZQX0tFUk5FTCksCmFuZCB3aWxsIGNhdXNlIGEgYnVp bGQgZmFpbHVyZSBhcyB3cml0dGVuLgoKWyAuLi4gXQo+IEBAIC02OCw2ICs2OSw3IEBAIHN0YXRp YyBpbnQgZm9wc192Y29kZWNfcmVsZWFzZShzdHJ1Y3QgZmlsZSAqZmlsZSkKPiAgewo+ICAJc3Ry dWN0IGFtbF92ZGVjX2N0eCAqY3R4ID0gZmhfdG9fZGVjX2N0eChmaWxlKTsKPiAgCj4gIAl2NGwy X20ybV9jdHhfcmVsZWFzZShjdHgtPm0ybV9jdHgpOwoKW1NldmVyaXR5OiBIaWdoXQpEb2VzIHRo aXMgYWNjZXNzIHRoZSBNMk0gZGV2aWNlIGFmdGVyIGl0IGhhcyBiZWVuIGZyZWVkPwoKSWYgdGhl IGRldmljZSBpcyB1bmJvdW5kIHZpYSBzeXNmcyB3aGlsZSBhIHVzZXJzcGFjZSBwcm9jZXNzIGhv bGRzIHRoZSBmaWxlCmRlc2NyaXB0b3Igb3BlbiwgYW1sX3ZkZWNfZHJ2X3JlbW92ZSgpIHJ1bnMg YW5kIGNhbGxzIHY0bDJfbTJtX3JlbGVhc2UoKS4KU2luY2UgdGhlIGRyaXZlciBzdHJ1Y3R1cmVz IHdlcmUgYWxsb2NhdGVkIHdpdGggZGV2bV9remFsbG9jLCB0aGV5IGFyZSBmcmVlZAppbW1lZGlh dGVseS4gV2hlbiB1c2Vyc3BhY2UgZXZlbnR1YWxseSBjbG9zZXMgdGhlIGZpbGUgZGVzY3JpcHRv ciwgdGhpcyBkZWxheWVkCmNhbGwgYWNjZXNzZXMgdGhlIGZyZWVkIG0ybV9kZXZfZGVjLgoKWyAu Li4gXQo+IEBAIC0xNjgsNiArMTcwLDggQEAgc3RhdGljIGludCBhbWxfdmRlY19kcnZfcHJvYmUo c3RydWN0IHBsYXRmb3JtX2RldmljZSAqcGRldikKPiAgCQlnb3RvIGVycl9tMm1fZGV2X2luaXQ7 Cj4gIAl9Cj4gIAo+ICAJcmV0ID0gdmlkZW9fcmVnaXN0ZXJfZGV2aWNlKHZmZF9kZWMsIFZGTF9U WVBFX1ZJREVPLCAtMSk7Cj4gIAlpZiAocmV0KSB7Cj4gIAkJdjRsMl9lcnIoJmRldi0+djRsMl9k ZXYsICJGYWlsZWQgdG8gcmVnaXN0ZXIgdmlkZW8gZGV2aWNlIik7Cj4gQEAgLTE4OSw2ICsxOTMs NyBAQCBzdGF0aWMgaW50IGFtbF92ZGVjX2Rydl9wcm9iZShzdHJ1Y3QgcGxhdGZvcm1fZGV2aWNl ICpwZGV2KQo+ICAJCXY0bDJfZXJyKCZkZXYtPnY0bDJfZGV2LCAiRmFpbGVkIHRvIHJlZ2lzdGVy IG1lZGlhIGRldmljZSIpOwo+ICAJCWdvdG8gZXJyX21lZGlhX2Rldl9yZWdpc3RlcjsKPiAgCX0K PiAgCXZkZWNfZW5hYmxlKGRldi0+ZGVjX2h3KTsKCltTZXZlcml0eTogSGlnaF0KSXMgdGhlIHZp ZGVvIGRldmljZSByZWdpc3RlcmVkIGFuZCBleHBvc2VkIHRvIHVzZXJzcGFjZSBiZWZvcmUgdGhl IGhhcmR3YXJlCnBvd2VyIGRvbWFpbiBpcyBlbmFibGVkPwoKQSBmYXN0IHVzZXJzcGFjZSBwcm9j ZXNzIGNhbiBpbW1lZGlhdGVseSBvcGVuIHRoZSBkZXZpY2UgYW5kIHN0YXJ0IHN0cmVhbWluZywK Y2F1c2luZyB0aGUgZHJpdmVyIHRvIGV4ZWN1dGUgTU1JTyByZWFkcy93cml0ZXMgb24gdW5wb3dl cmVkIHJlZ2lzdGVycywKcmVzdWx0aW5nIGluIHN5bmNocm9ub3VzIGV4dGVybmFsIGFib3J0cy4K ClsgLi4uIF0KPiBAQCAtMjMzLDYgKzIzOCw4IEBAIHN0YXRpYyB2b2lkIGFtbF92ZGVjX2Rydl9y ZW1vdmUoc3RydWN0IHBsYXRmb3JtX2RldmljZSAqcGRldikKPiAgCXZpZGVvX3VucmVnaXN0ZXJf ZGV2aWNlKGRldi0+dmZkKTsKPiAgCW1lZGlhX2RldmljZV9jbGVhbnVwKCZkZXYtPm1kZXYpOwo+ ICAKPiAgCXY0bDJfbTJtX3JlbGVhc2UoZGV2LT5tMm1fZGV2X2RlYyk7Cj4gIAlkZXYtPnB2ZGVj X2RhdGEtPmRlc3Ryb3lfaHdfcmVzb3VyY2UoZGV2KTsKCltTZXZlcml0eTogSGlnaF0KRG9lcyBy ZWxlYXNpbmcgdGhlIE0yTSBkZXZpY2UgaGVyZSBjcmVhdGUgYSB1c2UtYWZ0ZXItZnJlZSByaXNr IGZvciBvcGVuIGZpbGUKZGVzY3JpcHRvcnM/CgpTaW5jZSBkZXYgYW5kIGRlY19odyB1c2UgZGV2 bV9remFsbG9jLCByZWxlYXNpbmcgdGhlbSBoZXJlIGJlZm9yZSBhbGwgZmRzIGFyZQpjbG9zZWQg bWVhbnMgdGhhdCBmb3BzX3Zjb2RlY19yZWxlYXNlKCkgd2lsbCBsYXRlciBkZXJlZmVyZW5jZSBm cmVlZCBtZW1vcnkuCgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9n aWMvdmRlYy9hbWxfdmRlY19ody5jIGIvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3Zk ZWMvYW1sX3ZkZWNfaHcuYwo+IC0tLSBhL2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92 ZGVjL2FtbF92ZGVjX2h3LmMKPiArKysgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMv dmRlYy9hbWxfdmRlY19ody5jCj4gQEAgLTE3OSw2ICsxNzksOCBAQCBzdGF0aWMgaW50IHBtX3Zk ZWNfcG93ZXJfZG9tYWluX2luaXQoc3RydWN0IGFtbF92ZGVjX2h3ICpodykKPiAgCj4gIAlmb3Ig KGkgPSAwOyBpIDwgVkRFQ19NQVg7IGkrKykgewo+ICAJCXBkW2ldLmRldiA9IGRldl9wbV9kb21h aW5fYXR0YWNoX2J5X25hbWUoaHctPmRldiwgcGRbaV0ubmFtZSk7Cj4gIAkJaWYgKElTX0VSUl9P Ul9OVUxMKHBkW2ldLmRldikpIHsKPiAgCQkJZXJyID0gUFRSX0VSUihwZFtpXS5kZXYpOwo+ICAJ CQlkZXZfZGJnKGh3LT5kZXYsICJHZXQgJXMgZmFpbGVkLCBwbS1kb21haW46ICVkXG4iLAo+ICAJ CQkJcGRbaV0ubmFtZSwgZXJyKTsKPiAgCQkJcGRbaV0uZGV2ID0gTlVMTDsKPiAgCQkJY29udGlu dWU7Cj4gIAkJfQo+ICAKPiAgCQlwZFtpXS5saW5rID0gZGV2aWNlX2xpbmtfYWRkKGh3LT5kZXYs IHBkW2ldLmRldiwKCltTZXZlcml0eTogTWVkaXVtXQpEb2VzIHN0b3JpbmcgcGVyLWRldmljZSBw b2ludGVycyBpbnRvIHRoZSBzdGF0aWMgZ2xvYmFsICd2ZGVjX2RvbWFpbl9kYXRhJwphcnJheSBj b3JydXB0IHN0YXRlIGZvciBtdWx0aXBsZSBpbnN0YW5jZXM/CgpJZiB0aGUgZHJpdmVyIHVuYmlu ZHMgYW5kIHJlYmluZHMsIG9yIGlmIG11bHRpcGxlIGluc3RhbmNlcyBwcm9iZSwgdGhlIGdsb2Jh bAphcnJheSB3aWxsIGJlIG92ZXJ3cml0dGVuLCBjYXVzaW5nIHRlYXJkb3duIHJvdXRpbmVzIHRv IG9wZXJhdGUgb24gY29ycnVwdGVkCnBvaW50ZXJzLgoKWyAuLi4gXQo+IEBAIC0yODMsNiArMjg1 LDggQEAgc3RhdGljIHZvaWQgcG1fdmRlY19wb3dlcl9kb21haW5fcG93ZXJfb24oc3RydWN0IGFt bF92ZGVjX2h3ICpodywgaW50IGlkKQo+ICAKPiAgCWlmICghcmV0ICYmIGRldikgewo+ICAJCXJl dCA9IHBtX3J1bnRpbWVfcmVzdW1lX2FuZF9nZXQoZGV2KTsKPiAgCQlpZiAocmV0IDwgMCkKPiAg CQkJZGV2X2Vycihody0+ZGV2LCAiZmFpbGVkIHRvIHBvd2VyIG9uICVzIGRvbWFpbjogJWRcbiIs Cj4gIAkJCQlwbS0+cGRfZGF0YVtpZF0ubmFtZSwgcmV0KTsKPiAgCQllbHNlCj4gIAkJCWRldl9k YmcoZGV2LCAiZGV2OiAlcCBsaW5rICVwIHRoZSAlLTE1cyBwb3dlciBvblxuIiwKPiAgCQkJCWRl diwgcG0tPnBkX2RhdGFbaWRdLmxpbmssIHBtLT5wZF9kYXRhW2lkXS5uYW1lKTsKPiAgCX0KPiAg Cj4gIAkvKgo+ICAJICogRG8gbm90IHRvdWNoIHRoZSBET1MgcmVnaXN0ZXJzIHdoZW4gdGhlIGNs b2NrIG9yIHRoZSBwb3dlcgo+ICAJICogZG9tYWluIGNvdWxkIG5vdCBiZSBlbmFibGVkLCB0aGUg TU1JTyBhY2Nlc3Mgd291bGQgYWJvcnQuCj4gIAkgKi8KPiAgCWlmICghcmV0KQo+ICAJCWRvc19s b2NhbF9jb25maWcoaHcsIDEsIGlkKTsKCltTZXZlcml0eTogSGlnaF0KSWYgcG1fcnVudGltZV9y ZXN1bWVfYW5kX2dldCgpIGZhaWxzLCBkb2VzIHRoaXMgbGVhdmUgdGhlIGNsb2NrIGVuYWJsZWQ/ CgpCZWNhdXNlIGl0IGRvZXNuJ3QgY2xlYW4gdXAgdGhlIGNsa19wcmVwYXJlX2VuYWJsZSgpIGNh bGwsIHRoZSBjbG9jayBsZWFrcy4KQWxzbywgaWYgZWl0aGVyIGdhdGVfbm9kZSBvciBkZXYgaXMg TlVMTCwgcmV0IHJlbWFpbnMgMCwgd2hpY2ggYnlwYXNzZXMgdGhlCmVuYWJsZW1lbnQgYnV0IGFs bG93cyBkb3NfbG9jYWxfY29uZmlnKCkgdG8gZXhlY3V0ZSB1bnBvd2VyZWQgTU1JTyB3cml0ZXMs CmNhdXNpbmcgYSBidXMgY3Jhc2guCgpbIC4uLiBdCj4gQEAgLTM0Myw2ICszNDcsOCBAQCBzdGF0 aWMgaXJxcmV0dXJuX3QgdmRlY190aHJlYWRlZF9pc3JfaGFuZGxlcihpbnQgaXJxLCB2b2lkICpw cml2KQo+ICAKPiAgCW11dGV4X2xvY2soJmh3LT5jdHhfbXV0ZXgpOwo+ICAJaWYgKGh3LT5od19v cHMuaXJxX3RocmVhZGVkX2Z1bmMgJiYgaHctPmN1cnJfY3R4KQo+ICAJCXJldCA9IGh3LT5od19v cHMuaXJxX3RocmVhZGVkX2Z1bmMoaXJxLCBwcml2KTsKPiAgCW11dGV4X3VubG9jaygmaHctPmN0 eF9tdXRleCk7CgpbU2V2ZXJpdHk6IEhpZ2hdCkRvZXMgdGhpcyB0aHJlYWRlZCBJU1IgcHJvZ3Jh bSBoYXJkd2FyZSByZWdpc3RlcnMgd2hpbGUgcmVseWluZyBzb2xlbHkgb24KY3R4X211dGV4PwoK RHVyaW5nIGEgZGVjb2RlciB0aW1lb3V0LCBhbWxfaDI2NF9kZWNfcnVuKCkgY2FsbHMgYW1sX3N0 b3BfdmRlY19odygpIHdpdGhvdXQKYWNxdWlyaW5nIGN0eF9tdXRleC4gVGhpcyBjYXVzZXMgdGhl IGhhcmR3YXJlIHRvIGJlIHJlc2V0IGNvbmN1cnJlbnRseSB3aGlsZQp0aGUgSVNSIG1pZ2h0IHN0 aWxsIGJlIGFjdGl2ZWx5IHByb2dyYW1taW5nIGl0cyBtZW1vcnkgYW5kIHJlZ2lzdGVycy4KClsg Li4uIF0KPiBAQCAtNDI4LDYgKzQzNCw4IEBAIHN0YXRpYyBpcnFyZXR1cm5fdCB2ZGVjX2lycV9o YW5kbGVyKGludCBpcnEsIHZvaWQgKnByaXYpCj4gIAlpcnFyZXR1cm5fdCByZXQgPSBJUlFfTk9O RTsKPiAgCj4gIAlpZiAoaHctPmh3X29wcy5pcnFfaGFuZGxlcikKPiAgCQlyZXQgPSBody0+aHdf b3BzLmlycV9oYW5kbGVyKGlycSwgcHJpdik7Cj4gIAo+ICAJcmV0dXJuIHJldDsKPiAgfQpbIC4u LiBdCj4gQEAgLTQ3OSw2ICs0ODcsOCBAQCBpbnQgZGV2X3JlcXVlc3RfaHdfcmVzb3VyY2VzKHZv aWQgKnByaXYpCj4gIAkJZGV2X2VycigmcGRldi0+ZGV2LCAiZ2V0IGlycSBmYWlsZWRcbiIpOwo+ ICAJCXJldHVybiBody0+ZGVjX2lycTsKPiAgCX0KPiAgCXJldCA9IGRldm1fcmVxdWVzdF90aHJl YWRlZF9pcnEoJnBkZXYtPmRldiwgaHctPmRlY19pcnEsIHZkZWNfaXJxX2hhbmRsZXIsCgpbU2V2 ZXJpdHk6IE1lZGl1bV0KQ291bGQgYSBwZW5kaW5nIGludGVycnVwdCBjYXVzZSB0aGUgSVJRIGxp bmUgdG8gYmUgcGVybWFuZW50bHkgZGlzYWJsZWQ/CgpUaGUgSVJRIGlzIHJlZ2lzdGVyZWQgYmVm b3JlIHRoZSBoYXJkd2FyZSBoYXMgYmVlbiBleHBsaWNpdGx5IHJlc2V0LCBhbmQKaHctPmh3X29w cy5pcnFfaGFuZGxlciBpcyBOVUxMIGF0IHRoaXMgcG9pbnQuIElmIGFuIGludGVycnVwdCBmaXJl cywKdmRlY19pcnFfaGFuZGxlcigpIHdpbGwgcmVwZWF0ZWRseSByZXR1cm4gSVJRX05PTkUsIGNh dXNpbmcgdGhlIGtlcm5lbCB0bwpkZXRlY3QgYSBzcHVyaW91cyBJUlEgc3Rvcm0gYW5kIGRpc2Fi bGUgdGhlIGxpbmUuCgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9n aWMvdmRlYy9oMjY0LmMgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9oMjY0 LmMKPiAtLS0gYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9oMjY0LmMKPiAr KysgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9oMjY0LmMKPiBAQCAtNDIz LDYgKzQyMyw4IEBAIHN0YXRpYyBpbnQgcG9jX2lzX2luX2RwYihpbnQgcG9jLCBjb25zdCBzdHJ1 Y3QgdjRsMl9oMjY0X2RwYl9lbnRyeSAqZHBiKQo+ICAJaW50IHJldCA9IDA7Cj4gIAo+ICAJZm9y IChpID0gMDsgaSA8IFY0TDJfSDI2NF9OVU1fRFBCX0VOVFJJRVM7IGkrKykgewo+ICAJCWlmIChw b2MgPT0gZHBiW2ldLnRvcF9maWVsZF9vcmRlcl9jbnQpIHsKPiAgCQkJcmV0ID0gMTsKPiAgCQkJ YnJlYWs7CgpbU2V2ZXJpdHk6IE1lZGl1bV0KU2hvdWxkIHRoaXMgY2hlY2sgVjRMMl9IMjY0X0RQ Ql9FTlRSWV9GTEFHX1ZBTElEIGJlZm9yZSBjb21wYXJpbmcgdGhlIFBPQz8KCklmIGl0IGNvbXBh cmVzIGFnYWluc3QgaW5hY3RpdmUgb3Igc3RhbGUgZW50cmllcyB3aXRoIGxpbmdlcmluZyB6ZXJv cywgaXQgY2FuCmZhbHNlbHkgcmV0dXJuIDEsIHByZXZlbnRpbmcgY2xlYXJfdW51c2VkX2NvbF9i dWYoKSBmcm9tIHJlbGVhc2luZyB0aGUKYXNzb2NpYXRlZCBjYW52YXMgcG9zaXRpb25zIGFuZCBj b2xvY2F0ZSBidWZmZXJzLgoKWyAuLi4gXQo+IEBAIC00OTQsNiArNDk2LDggQEAgc3RhdGljIGlu dCBjb25maWdfZGVjb2RlX2NhbnZhcyhzdHJ1Y3QgYW1sX3ZkZWNfaHcgKmh3LAo+ICAJLyogY29u ZmlnIHkgY2FudmFzICovCj4gIAltZXNvbl9jYW52YXNfY29uZmlnKGh3LT5jYW52YXMsCj4gIAkJ CSAgICBidWZfc3BlYy0+eV9jYW52YXNfaW5kZXgsIGJ1Zl9zcGVjLT55X2RtYV9hZGRyLAo+ICAJ CQkgICAgbWJfd2lkdGggPDwgNCwgbWJfaGVpZ2h0IDw8IDQsCgpbU2V2ZXJpdHk6IExvd10KRG9l cyB0aGlzIGhhcmRjb2RlIHRoZSBoYXJkd2FyZSBzdHJpZGUgdG8gdGhlIGJpdHN0cmVhbS1kZXJp dmVkIHdpZHRoIGluc3RlYWQKb2YgdGhlIG5lZ290aWF0ZWQgYnl0ZXNwZXJsaW5lPwoKVjRMMiBz ZW1hbnRpY3MgcmVxdWlyZSB1c2luZyB0aGUgYnl0ZXNwZXJsaW5lIHNldCB2aWEgVklESU9DX1Nf Rk1ULiBJZiB0aGUKbmVnb3RpYXRlZCBzdHJpZGUgZGlmZmVycyBmcm9tIHRoZSB0aWdodGx5LXBh Y2tlZCBTUFMgd2lkdGgsIHRoZSByZXN1bHRpbmcKaW1hZ2Ugd2lsbCBzdWZmZXIgZnJvbSB2aXN1 YWwgY29ycnVwdGlvbi4KClsgLi4uIF0KPiBAQCAtNjA5LDYgKzYxMyw5IEBAIHN0YXRpYyBpbnQg YWxsb2NfY29sb2NhdGVfY21hKHN0cnVjdCBhbWxfaDI2NF9jdHggKmgyNjRfY3R4LAo+ICAJZ2Zw X3QgZ2ZwID0gR0ZQX0tFUk5FTCB8IEdGUF9ETUEzMjsKPiAgCj4gIAlpZiAoaDI2NF9jdHgtPmNv bGxhdGVkX2NtYV92YWRkcikKPiAgCQlyZXR1cm4gMDsKPiAgCj4gIAlodyA9IHZkZWNfZ2V0X2h3 KGN0eC0+ZGV2KTsKCltTZXZlcml0eTogSGlnaF0KRG9lcyB0aGlzIGJ5cGFzcyB1cGRhdGluZyBv bmVfY29sX2J1Zl9zaXplIGlmIHRoZSBidWZmZXIgd2FzIGFscmVhZHkgYWxsb2NhdGVkPwoKSWYg dGhlIHN0cmVhbSBkeW5hbWljYWxseSBpbmNyZWFzZXMgaW4gcmVzb2x1dGlvbiwgaDI2NF9jdHgt Pm9uZV9jb2xfYnVmX3NpemUKd2lsbCByZW1haW4gYXQgdGhlIHN0YWxlLCBzbWFsbGVyIHNpemUu CgpbIC4uLiBdCj4gQEAgLTgzOCw2ICs4NDUsOSBAQCBzdGF0aWMgaW50IGgyNjRfY29uZmlnX2Rl Y29kZV9idWYoc3RydWN0IGFtbF92ZGVjX2h3ICpodywKPiAgCWZvciAoaSA9IDA7IGkgPCBoMjY0 X2N0eC0+bGlzdF9zaXplWzBdOyBpKyspIHsKPiAgCQlpZiAoIWgyNjRfY3R4LT5yZWZfbGlzdDBb aV0udmFsaWQpCj4gIAkJCWNvbnRpbnVlOwo+ICAJCWNhbnZhc19wb3MgPSBoMjY0X2N0eC0+cmVm X2xpc3QwW2ldLmNhbnZhc19wb3M7Cj4gIAkJLyogYml0IDA6MyBjYW52YXNfcG9zIGJpdCA1OjYg ZnJhbWUgc3RydWN0IGNmZyAqLwo+ICAJCXJlZl9jZmdfb25jZSA9IChjYW52YXNfcG9zICYgMHgx ZikgfCAodHlwZV9jZmcgPDwgNSk7CgpbU2V2ZXJpdHk6IE1lZGl1bV0KSWYgYSByZWZlcmVuY2Ug cGljdHVyZSBpcyBpbnZhbGlkLCBkb2VzIHNraXBwaW5nIGl0IHdpdGhvdXQgaW5jcmVtZW50aW5n ICdqJwpzaGlmdCBhbGwgc3Vic2VxdWVudCB2YWxpZCBlbnRyaWVzIGludG8gdGhlIHdyb25nIGhh cmR3YXJlIHNsb3RzPwoKVGhpcyBgY29udGludWVgIHN0YXRlbWVudCBzaWxlbnRseSBieXBhc3Nl cyB0aGUgaGFyZHdhcmUgaW5kZXggcGFja2luZywKY29ycnVwdGluZyB0aGUgZGVjb2Rpbmcgb2Yg Qi1mcmFtZXMgb3IgUC1mcmFtZXMuCgpbIC4uLiBdCj4gQEAgLTg2NSw2ICs4NzUsOCBAQCBzdGF0 aWMgaW50IGgyNjRfY29uZmlnX2RlY29kZV9idWYoc3RydWN0IGFtbF92ZGVjX2h3ICpodywKPiAg CXJlZl9jZmcgPSAwOwo+ICAKPiAgCWZvciAoaSA9IDA7IGkgPCBoMjY0X2N0eC0+bGlzdF9zaXpl WzFdOyBpKyspIHsKPiAgCQlpZiAoIWgyNjRfY3R4LT5yZWZfbGlzdDBbaV0udmFsaWQpCj4gIAkJ CWNvbnRpbnVlOwo+ICAJCWNhbnZhc19wb3MgPSBoMjY0X2N0eC0+cmVmX2xpc3QxW2ldLmNhbnZh c19wb3M7CgpbU2V2ZXJpdHk6IE1lZGl1bV0KSXMgcmVmX2xpc3QxIGluY29ycmVjdGx5IGNoZWNr ZWQgYWdhaW5zdCByZWZfbGlzdDAncyB2YWxpZCBmbGFnIGhlcmU/CgpJZiByZWZfbGlzdDAgaGFz IGZld2VyIHZhbGlkIGVudHJpZXMgdGhhbiByZWZfbGlzdDEsIHRoZSBsb29wIHdpbGwgZXJyb25l b3VzbHkKc2tpcCB2YWxpZCByZWZfbGlzdDEgZW50cmllcy4KClsgLi4uIF0KPiBAQCAtODk2LDYg KzkwOCw5IEBAIHN0YXRpYyBpbnQgaDI2NF9jb25maWdfZGVjb2RlX2J1ZihzdHJ1Y3QgYW1sX3Zk ZWNfaHcgKmh3LAo+ICAJCWNvbG9jYXRlX3dyX2FkciA9ICh1bnNpZ25lZCBpbnQpaDI2NF9jdHgt PmNvbGxhdGVkX2NtYV9hZGRyICsKPiAgCQkgICAgKChoMjY0X2N0eC0+b25lX2NvbF9idWZfc2l6 ZSAqCj4gIAkJICAgICAgaDI2NF9jdHgtPmN1cnJfc3BlYy5jb2xfYnVmX2luZGV4KSA+PiAodXNl X21vZGVfOHg4X2ZsYWcgPyAyIDogMCkpOwo+ICAJCWlmIChjb2xvY2F0ZV9hZHJfb2Zmc2V0ID4g aDI2NF9jdHgtPm9uZV9jb2xfYnVmX3NpemUgfHwKPiAgCQkgICAgY29sb2NhdGVfd3JfYWRyICsg aDI2NF9jdHgtPm9uZV9jb2xfYnVmX3NpemUgPgo+ICAJCSAgICAodW5zaWduZWQgaW50KWgyNjRf Y3R4LT5jb2xsYXRlZF9jbWFfYWRkcl9lbmQpIHsKCltTZXZlcml0eTogSGlnaF0KRG9lcyB0aGlz IGJvdW5kcyBjaGVjayBwZXJtaXQgbWVtb3J5IGNvcnJ1cHRpb24gYmVjYXVzZSBpdCB2ZXJpZmll cyBhZ2FpbnN0CnRoZSBvbGQgc21hbGxlciBvbmVfY29sX2J1Zl9zaXplPwoKVGhlIGhhcmR3YXJl IGlzIHByb2dyYW1tZWQgd2l0aCB0aGUgbmV3IGxhcmdlciBkaW1lbnNpb25zLCB3cml0aW5nCm5l d19tYl90b3RhbCAqIDk2IGJ5dGVzIHN0YXJ0aW5nIGF0IGNvbG9jYXRlX3dyX2Fkciwgb3ZlcmZs b3dpbmcgdGhlIHNwYWNpbmcKZGVmaW5lZCBieSB0aGUgc3RhbGUgb25lX2NvbF9idWZfc2l6ZS4K ClsgLi4uIF0KPiBAQCAtMTU3MCw2ICsxNTg1LDggQEAgc3RhdGljIGludCBoMjY0X2NvbmZpZ19y ZWZfc3BlYyhzdHJ1Y3QgYW1sX2gyNjRfY3R4ICpoMjY0X2N0eCwKPiAgCQlyZXR1cm4gLTE7Cj4g IAl9Cj4gIAo+ICAJdmIgPSB2YjJfZmluZF9idWZmZXIodnEsIGRwYi0+cmVmZXJlbmNlX3RzKTsK CltTZXZlcml0eTogSGlnaF0KSXMgaXQgc2FmZSB0byBpdGVyYXRlIG92ZXIgdGhlIHZiMiBxdWV1 ZSBidWZmZXJzIGZyb20gdGhlIHRocmVhZGVkIElTUiB3aXRob3V0CmhvbGRpbmcgdGhlIHY0bDJf aW50Zl9sb2NrPwoKSWYgYSBjb25jdXJyZW50IFZJRElPQ19SRVFCVUZTIG9yIFZJRElPQ19TVFJF QU1PRkYgbW9kaWZpZXMgdGhlIHF1ZXVlIHdoaWxlCnRoaXMgaXMgZXhlY3V0aW5nLCBpdCBjb3Vs ZCBsZWFkIHRvIHVzZS1hZnRlci1mcmVlIG9yIG91dC1vZi1ib3VuZHMgYWNjZXNzZXMuCgo+ICAJ aWYgKCF2Yikgewo+ICAJCWRldl9kYmcoJmN0eC0+ZGV2LT5wbGF0X2Rldi0+ZGV2LAo+ICAJCQki cmVmIHBpYyBmb3IgdHMgJWxsdSBsb3N0XG4iLCBkcGItPnJlZmVyZW5jZV90cyk7Cj4gIAkJYnVm X3NwZWMtPnZhbGlkID0gMDsKPiAgCQlyZXR1cm4gLTE7CgpbU2V2ZXJpdHk6IEhpZ2hdCkRvZXMg dGhpcyBsZWF2ZSB0aGUgc3RhbGUgcGh5c2ljYWwgYWRkcmVzc2VzIGluIHRoZSBidWZmZXIgc3Bl Yz8KCldoZW4gY29tYmluZWQgd2l0aCB0aGUgbG9vcCBpbiBnZXRfY2FudmFzX2luZGV4KCksIHdo aWNoIGlnbm9yZXMgdGhlIHZhbGlkCmZsYWc6Cgpkcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9n aWMvdmRlYy9oMjY0LmM6Z2V0X2NhbnZhc19pbmRleCgpIHsKLi4uCgkJZm9yIChpID0gMDsgaSA8 IGgyNjRfY3R4LT5saXN0X3NpemVbMF07IGkrKykgewoJCQlidWYgPSAmaDI2NF9jdHgtPnJlZl9s aXN0MFtpXTsKCQkJcmV0ID0gY29uZmlnX2RlY29kZV9jYW52YXMoaHcsIGJ1ZiwgaDI2NF9jdHgt Pm1iX3dpZHRoLAouLi4KfQoKdGhpcyB3aWxsIGNvbmZpZ3VyZSB0aGUgaGFyZHdhcmUgdG8gbWFw IGFuZCB1c2UgdGhlIHN0YWxlLCBkYW5nbGluZyB5X2RtYV9hZGRyCmZvciB0aGUgY3VycmVudCBm cmFtZSdzIGRlY29kaW5nIGlmIHJlZmVyZW5jZSBwaWN0dXJlIHZhbGlkYXRpb24gZmFpbHMuCgpb IC4uLiBdCj4gQEAgLTE2NjUsNiArMTY4Miw5IEBAIHN0YXRpYyBpbnQgZ2V0X2NhbnZhc19pbmRl eChzdHJ1Y3QgYW1sX3ZkZWNfaHcgKmh3LCBzdHJ1Y3QgYW1sX3ZkZWNfY3R4ICpjdHgpCj4gIAlp ZiAocmV0KQo+ICAJCXJldHVybiByZXQ7Cj4gIAo+ICAJaWYgKGgyNjRfY3R4LT5saXN0X3NpemVb MF0gPiAwKSB7Cj4gIAkJZm9yIChpID0gMDsgaSA8IGgyNjRfY3R4LT5saXN0X3NpemVbMF07IGkr Kykgewo+ICAJCQlidWYgPSAmaDI2NF9jdHgtPnJlZl9saXN0MFtpXTsKPiAgCQkJcmV0ID0gY29u ZmlnX2RlY29kZV9jYW52YXMoaHcsIGJ1ZiwgaDI2NF9jdHgtPm1iX3dpZHRoLAo+ICAJCQkJCQkg ICBoMjY0X2N0eC0+bWJfaGVpZ2h0KTsKCltTZXZlcml0eTogSGlnaF0KRG9lcyB0aGlzIGl0ZXJh dGUgb3ZlciBhbGwgcmVmZXJlbmNlIGVudHJpZXMgYW5kIGNvbmZpZ3VyZSBjYW52YXNlcyB3aXRo b3V0CmNoZWNraW5nIGlmIHRoZSBlbnRyeSBpcyB2YWxpZD8KClRoaXMgaWdub3JlcyBidWYtPnZh bGlkIGFuZCBwcm9ncmFtcyBwb3RlbnRpYWxseSBzdGFsZSBvciBmYWlsZWQgRE1BIGFkZHJlc3Nl cwppbnRvIHRoZSBoYXJkd2FyZS4KClsgLi4uIF0KPiBAQCAtMjAxNSw2ICsyMDM1LDggQEAgdm9p ZCBhbWxfaDI2NF9leGl0KHZvaWQgKnByaXYpCj4gIAo+ICAJc3luY2hyb25pemVfaXJxKGRlY19o dy0+ZGVjX2lycSk7Cj4gIAltdXRleF9sb2NrKCZkZWNfaHctPmN0eF9tdXRleCk7Cj4gIAlpZiAo Y3R4LT5kb3NfY2xrX2VuICYmCj4gIAkgICAgKCFkZWNfaHctPmN1cnJfY3R4IHx8IGRlY19ody0+ Y3Vycl9jdHggPT0gaDI2NF9jdHgpKQo+ICAJCWFtbF9zdG9wX3ZkZWNfaHcoZGVjX2h3KTsKCltT ZXZlcml0eTogSGlnaF0KQ2FuIHRoaXMgc2h1dCBkb3duIHRoZSBoYXJkd2FyZSBjb25jdXJyZW50 bHkgd2hpbGUgYW5vdGhlciBpbnN0YW5jZSBpcyBiZWluZwppbml0aWFsaXplZD8KCklmIG0ybW9w c192ZGVjX2RldmljZV9ydW4oKSBpcyBjdXJyZW50bHkgZXhlY3V0aW5nIGRvc19lbmFibGUoKSBm b3IgYSBuZXcKaW5zdGFuY2UsIGRlY19ody0+Y3Vycl9jdHggbWlnaHQgc3RpbGwgYmUgTlVMTC4g VGhpcyBjb25kaXRpb24gZXZhbHVhdGVzIHRvCnRydWUsIHJlc3VsdGluZyBpbiBhbWxfc3RvcF92 ZGVjX2h3KCkgcnVubmluZyBhbmQgcmVzZXR0aW5nIHRoZSBoYXJkd2FyZQpjbG9ja3MvcmVnaXN0 ZXJzIG91dCBmcm9tIHVuZGVyIHRoZSBvdGhlciBjb250ZXh0LgoKWyAuLi4gXQo+IEBAIC0yMDky LDYgKzIxMTQsOCBAQCBpbnQgYW1sX2gyNjRfZGVjX3J1bih2b2lkICpwcml2KQo+ICAJCWRldl9l cnIoJmN0eC0+ZGV2LT5wbGF0X2Rldi0+ZGV2LCAiZGVjIGludGVyIGZhaWxcbiIpOwo+ICAJfQo+ ICAKPiAgCWgyNjRfY3R4LT5pbml0X2ZsYWcgPSAwOwo+ICAJYW1sX3ZkZWNfc2V0X2N1cnJfY3R4 KGRlY19odywgTlVMTCk7CgpbU2V2ZXJpdHk6IENyaXRpY2FsXQpEb2VzIHRoaXMgd3JpdGUgdG8g dGhlIGZyZWVkIGNvbnRleHQgYWZ0ZXIgcmV0dXJuaW5nIGZyb20Kd2FpdF9ldmVudF9pbnRlcnJ1 cHRpYmxlX3RpbWVvdXQoKT8KCklmIGEgY29uY3VycmVudCBTVFJFQU1PRkYgaGFzIGFscmVhZHkg ZnJlZWQgaDI2NF9jdHgsIHNldHRpbmcgaW5pdF9mbGFnIGhlcmUKcmVzdWx0cyBpbiBhIHVzZS1h ZnRlci1mcmVlLgoKPiAgCj4gIAlyZXR1cm4gcmV0OwpbIC4uLiBdCj4gQEAgLTIxNjQsNiArMjE4 OCw4IEBAIGludCBhbWxfaDI2NF9kZWNfcnVuKHZvaWQgKnByaXYpCj4gIAkJICogaDI2NF9yZWxl YXNlX2RlY29kZV9zcGVjKCkgY29uY3VycmVudGx5Lgo+ICAJCSAqLwo+ICAJCWFtbF9zdG9wX3Zk ZWNfaHcoZGVjX2h3KTsKPiAgCQlzeW5jaHJvbml6ZV9pcnEoZGVjX2h3LT5kZWNfaXJxKTsKCltT ZXZlcml0eTogSGlnaF0KRG9lcyB0aGlzIGNhbGwgaGFyZHdhcmUgcmVzZXQgb3BlcmF0aW9ucyBj b25jdXJyZW50bHkgd2l0aG91dCB0aGUgY3R4X211dGV4IGFuZApiZWZvcmUgc3luY2hyb25pemlu ZyB0aGUgSVNSPwoKSWYgdGhlIHRocmVhZGVkIElTUiBpcyBhY3RpdmUsIGFtbF9zdG9wX3ZkZWNf aHcoKSB3aWxsIHJlc2V0IHRoZSBoYXJkd2FyZSB3aGlsZQp0aGUgSVNSIGlzIGFjdGl2ZWx5IHBy b2dyYW1taW5nIGl0cyBtZW1vcnkgYW5kIHJlZ2lzdGVycywgbGVhZGluZyB0byBidXMKbG9ja3Vw cy4KCi0tIApTYXNoaWtvIEFJIHJldmlldyDCtyBodHRwczovL3Nhc2hpa28uZGV2LyMvcGF0Y2hz ZXQvMjAyNjEwMTItYjQtczQtdmRlYy11cHN0cmVhbS12MTEtMC0yNTkzOWY4NWFkYTVAYW1sb2dp Yy5jb20/cGFydD00CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXwpsaW51eC1hbWxvZ2ljIG1haWxpbmcgbGlzdApsaW51eC1hbWxvZ2ljQGxpc3RzLmluZnJh ZGVhZC5vcmcKaHR0cDovL2xpc3RzLmluZnJhZGVhZC5vcmcvbWFpbG1hbi9saXN0aW5mby9saW51 eC1hbWxvZ2ljCg== From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE54A3AE6E5 for ; Mon, 12 Oct 2026 07:20:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791789650; cv=none; b=L7qb6lcI8qGkVtZTHGppacBDXxxZUORGiK6yfhFbfTxtPLgmhiUfZmRlUQrtH52ZdaBBWrhVXn6PcgH86MsOL7Dnpo/dkEaeaw83Rrc48TN9JcCSKVkcpytmAS3CFAt5dd7ScETsogIbpn+v6R1eeFO5RcI0zBkqyxCHexMoc/M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791789650; c=relaxed/simple; bh=zJArM2OixImZhfSHivx5jBwJhqsjU3ULBz2XIEegnmw=; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type: Date; b=BMdDaMNNt+AGBEmlnDu+j5RRVECrdlhFgDl5OH7RtnYN9Ze8nZYMb6NSxbtAGcjY2KhysJWbarypygxIXPB+r156vqKPhbcv+YFmV4pQKMu39LJkxw9hJVgOgwYZ2jyC/L7VaLWJzNvdpmCZobcjvfZRLv5IUj0QnZPvLq0SiQo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Un0d5S0X; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Un0d5S0X" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F03501F0089B; Mon, 12 Oct 2026 07:20:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1791789648; bh=/J8A8LCaAA3CsQhAHUEsS6ViRpTCjWN6mIioaoOUMy8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=Un0d5S0X3zvht+neaoYId0lqPGrupk9sCmTsd3b5UyCdyZhM7mQE8NwPE8Si7yxsJ rYzoom0+tu2nf0/NZLWIsza+di30s2dZ4Cweuupryuyx7HQt9BsNIeA2gwO+EFzP+z KM1pIyZU3lUekFp0H+iTyiXpW6EFtouHJXU9MNV6R2tY89wCgvvk63odZozsU8KDxL 1ryr2YNXR33mBjOMhNPzZEc9nZyyyqWQ+P0eqgB00OmYjSu1N303MCrxdKye1fWJUH Xiz89TgDSHTwM5LTBsF+ubadsQMdeBDEh5COFSdIKDjdDhPjLtTykTOh+nh4+Bl6rp GKKfR/IlhBJfg== Message-ID: From: sashiko-bot@kernel.org Subject: Re: [PATCH v11 4/6] decoder: Add V4L2 stateless H.264 decoder driver Reply-To: sashiko-reviews@lists.linux.dev To: "Zhentao Guo" Cc: neil.armstrong@linaro.org, linux-amlogic@lists.infradead.org, media-ci@linuxtv.org, robh@kernel.org, devicetree@vger.kernel.org, conor+dt@kernel.org In-Reply-To: <20261012-b4-s4-vdec-upstream-v11-4-25939f85ada5@amlogic.com> References: <20261012-b4-s4-vdec-upstream-v11-0-25939f85ada5@amlogic.com> <20261012-b4-s4-vdec-upstream-v11-4-25939f85ada5@amlogic.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 12 Oct 2026 07:20:47 +0000 Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 19 potential issue= (s) to consider: - [Critical] media: amlogic: out-of-bounds array access in aml_vdec_init_de= c_inst allows control flow hijack - [Critical] media: amlogic: concurrent STREAMOFF frees codec context while= worker thread is waiting - [High] media: amlogic: uaf on device removal due to devm_kzalloc and v4l2= _m2m_release - [High] media: amlogic: get_canvas_index maps stale dangling DMA addresses= to hardware - [High] media: amlogic: stale one_col_buf_size causes DMA buffer overflow = on resolution change - [High] media: amlogic: missing error handling in pm_vdec_power_domain_pow= er_on causes leaks and MMIO aborts - [High] media: amlogic: aml_stop_vdec_hw resets hardware concurrently with= threaded ISR - [High] media: amlogic: unprotected dos_enable in device_run races with am= l_h264_exit - [High] media: amlogic: vb2_find_buffer called from threaded ISR without h= olding queue lock - [High] media: amlogic: video device registered before hardware power doma= in is enabled - [Medium] media: amlogic: irq registered before hardware reset and without= handler - [Medium] media: amlogic: failed canvas config silently compresses hardwar= e reference list - [Medium] media: amlogic: per-instance power domain device state corrupts = static global array - [Medium] media: amlogic: ref_list1 incorrectly checked against ref_list0 = valid flag - [Medium] media: amlogic: poc_is_in_dpb ignores V4L2_H264_DPB_ENTRY_FLAG_V= ALID leaking resources - [Low] media: amlogic: double completion of media request triggers WARN_ON - [Low] media: amlogic: vdec_s_fmt_output falsely rejects identical format = changes with -EBUSY - [Low] media: amlogic: hardware stride configured using SPS width instead = of v4l2 bytesperline - [Low] media: amlogic: implicit declaration of kzalloc_obj causes build fa= ilure -- commit da274125c14d2da90bb83a7ffc30b57d96da9323 Author: Zhentao Guo Subject: decoder: Add V4L2 stateless H.264 decoder driver This commit adds initial support for a V4L2 stateless video decoder driver = on the Amlogic S4 platform. It supports 8-bit H.264 progressive bitstreams in this first phase. > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec.c b/drivers/med= ia/platform/amlogic/vdec/aml_vdec.c > --- a/drivers/media/platform/amlogic/vdec/aml_vdec.c > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec.c > @@ -133,6 +133,8 @@ static void m2mops_vdec_device_run(void *m2m_priv) > v4l2_ctrl_request_setup(src_req, &ctx->ctrl_handler); > =20 > dos_enable(dev->dec_hw); > /* incase of bus hang in stop_streaming */ > ctx->dos_clk_en =3D 1; > ctx->curr_frm_err_flag =3D 0; > =20 > if (ctx->curr_dec_type =3D=3D CODEC_TYPE_H264) > aml_vdec_reset_core(dev->dec_hw); [Severity: High] Does this execute hardware setup before curr_ctx is assigned and without cross-instance locking? If another decoding instance is concurrently stopped via VIDIOC_STREAMOFF, = its aml_h264_exit() could see (!dec_hw->curr_ctx || dec_hw->curr_ctx =3D=3D h26= 4_ctx) evaluate to true, locking ctx_mutex and shutting down the hardware while th= is instance is simultaneously trying to initialize it. > @@ -148,6 +148,8 @@ static void m2mops_vdec_device_run(void *m2m_priv) > v4l2_m2m_buf_copy_metadata(src_buf, dst_buf); > if (src_req) > v4l2_ctrl_request_complete(src_req, &ctx->ctrl_handler); [Severity: Low] Is this explicit call to v4l2_ctrl_request_complete() triggering a double completion warning? Later in this function, v4l2_m2m_buf_done_and_job_finish() will call vb2_buffer_done(), which invokes the buf_request_complete callback defined = in aml_vdec_vb2_ops. That callback also calls v4l2_ctrl_request_complete() on = the same request. [ ... ] > @@ -231,6 +231,10 @@ static int aml_vdec_init_dec_inst(struct aml_vdec_ct= x *ctx) > struct aml_video_fmt *fmt_out =3D &ctx->dec_fmt[AML_FMT_SRC]; > int ret =3D -1; > =20 > ctx->codec_ops =3D &dev->pvdec_data->codec_ops[fmt_out->codec_type]; > /* > * The codec instance is only released when both queues are > * streamed off: do not allocate a new one (leaking the previous > * instance) when the output queue is restarted while the > * capture queue is still streaming. > */ > if (ctx->codec_ops->init && !ctx->codec_priv) { > ret =3D ctx->codec_ops->init(ctx); [Severity: Critical] Does this permit an out-of-bounds array access if fmt_out->codec_type is untrusted? If unprivileged userspace calls VIDIOC_S_FMT on the output queue with a capture-only format (e.g. V4L2_PIX_FMT_NV12), aml_vdec_get_video_fmt() could return that format and record its codec_type as CODEC_TYPE_FRAME (1). When STREAMON resolves the codec operations here, index 1 reads past the end of = the aml_S4_dec_ops array and dereferences a wild function pointer. [ ... ] > @@ -311,6 +311,10 @@ static int vdec_s_fmt_output(struct aml_vdec_ctx *ct= x, struct v4l2_format *f) > peer_vq =3D v4l2_m2m_get_vq(ctx->m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE_M= PLANE); > if (vb2_is_busy(peer_vq) && > (pix_mp->width !=3D cap_fmt->width || > pix_mp->height !=3D cap_fmt->height)) > return -EBUSY; [Severity: Low] Could this falsely reject identical format changes with -EBUSY? The cap_fmt structure contains the active capture format, which has already been aligned to hardware constraints. The pix_mp structure contains the unaligned user-requested dimensions. If userspace requests the exact same unaligned format while the queue is busy, this check fails and falsely reje= cts a legitimate no-op format setting. > =20 > out_fmt =3D aml_vdec_get_video_fmt(ctx->dev, pix_mp->pixelformat); > if (out_fmt) { > ctx->dec_fmt[AML_FMT_SRC] =3D *out_fmt; [Severity: Critical] Can this bind a capture-only format to the output queue? The aml_vdec_get_video_fmt() function ignores fmt->type during lookup. This means a format like V4L2_PIX_FMT_NV12 can be applied to the output queue, which eventually leads to the out-of-bounds access in aml_vdec_init_dec_ins= t(). [ ... ] > @@ -522,6 +522,8 @@ static void vb2ops_vdec_stop_streaming(struct vb2_que= ue *q) > } > =20 > if (!ctx->is_output_streamon && !ctx->is_cap_streamon) > aml_vdec_release_instance(ctx); > } [Severity: Critical] Does this free the codec context without synchronizing against the active worker thread? If STREAMOFF runs while the device_run worker thread is blocked in wait_event_interruptible_timeout(), aml_h264_exit() will free ctx->codec_pr= iv. When the worker thread wakes up, it will write to the freed memory. > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec_drv.c b/drivers= /media/platform/amlogic/vdec/aml_vdec_drv.c > --- a/drivers/media/platform/amlogic/vdec/aml_vdec_drv.c > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec_drv.c > @@ -23,6 +23,7 @@ static int fops_vcodec_open(struct file *file) > struct aml_vdec_ctx *ctx =3D NULL; > int ret =3D 0; > =20 > ctx =3D kzalloc_obj(*ctx, GFP_KERNEL); [Severity: Low] Is kzalloc_obj() an undefined macro/function here? It looks like this might have meant to be kzalloc(sizeof(*ctx), GFP_KERNEL), and will cause a build failure as written. [ ... ] > @@ -68,6 +69,7 @@ static int fops_vcodec_release(struct file *file) > { > struct aml_vdec_ctx *ctx =3D fh_to_dec_ctx(file); > =20 > v4l2_m2m_ctx_release(ctx->m2m_ctx); [Severity: High] Does this access the M2M device after it has been freed? If the device is unbound via sysfs while a userspace process holds the file descriptor open, aml_vdec_drv_remove() runs and calls v4l2_m2m_release(). Since the driver structures were allocated with devm_kzalloc, they are freed immediately. When userspace eventually closes the file descriptor, this del= ayed call accesses the freed m2m_dev_dec. [ ... ] > @@ -168,6 +170,8 @@ static int aml_vdec_drv_probe(struct platform_device = *pdev) > goto err_m2m_dev_init; > } > =20 > ret =3D video_register_device(vfd_dec, VFL_TYPE_VIDEO, -1); > if (ret) { > v4l2_err(&dev->v4l2_dev, "Failed to register video device"); > @@ -189,6 +193,7 @@ static int aml_vdec_drv_probe(struct platform_device = *pdev) > v4l2_err(&dev->v4l2_dev, "Failed to register media device"); > goto err_media_dev_register; > } > vdec_enable(dev->dec_hw); [Severity: High] Is the video device registered and exposed to userspace before the hardware power domain is enabled? A fast userspace process can immediately open the device and start streamin= g, causing the driver to execute MMIO reads/writes on unpowered registers, resulting in synchronous external aborts. [ ... ] > @@ -233,6 +238,8 @@ static void aml_vdec_drv_remove(struct platform_devic= e *pdev) > video_unregister_device(dev->vfd); > media_device_cleanup(&dev->mdev); > =20 > v4l2_m2m_release(dev->m2m_dev_dec); > dev->pvdec_data->destroy_hw_resource(dev); [Severity: High] Does releasing the M2M device here create a use-after-free risk for open fi= le descriptors? Since dev and dec_hw use devm_kzalloc, releasing them here before all fds a= re closed means that fops_vcodec_release() will later dereference freed memory. > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec_hw.c b/drivers/= media/platform/amlogic/vdec/aml_vdec_hw.c > --- a/drivers/media/platform/amlogic/vdec/aml_vdec_hw.c > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec_hw.c > @@ -179,6 +179,8 @@ static int pm_vdec_power_domain_init(struct aml_vdec_= hw *hw) > =20 > for (i =3D 0; i < VDEC_MAX; i++) { > pd[i].dev =3D dev_pm_domain_attach_by_name(hw->dev, pd[i].name); > if (IS_ERR_OR_NULL(pd[i].dev)) { > err =3D PTR_ERR(pd[i].dev); > dev_dbg(hw->dev, "Get %s failed, pm-domain: %d\n", > pd[i].name, err); > pd[i].dev =3D NULL; > continue; > } > =20 > pd[i].link =3D device_link_add(hw->dev, pd[i].dev, [Severity: Medium] Does storing per-device pointers into the static global 'vdec_domain_data' array corrupt state for multiple instances? If the driver unbinds and rebinds, or if multiple instances probe, the glob= al array will be overwritten, causing teardown routines to operate on corrupted pointers. [ ... ] > @@ -283,6 +285,8 @@ static void pm_vdec_power_domain_power_on(struct aml_= vdec_hw *hw, int id) > =20 > if (!ret && dev) { > ret =3D pm_runtime_resume_and_get(dev); > if (ret < 0) > dev_err(hw->dev, "failed to power on %s domain: %d\n", > pm->pd_data[id].name, ret); > else > dev_dbg(dev, "dev: %p link %p the %-15s power on\n", > dev, pm->pd_data[id].link, pm->pd_data[id].name); > } > =20 > /* > * Do not touch the DOS registers when the clock or the power > * domain could not be enabled, the MMIO access would abort. > */ > if (!ret) > dos_local_config(hw, 1, id); [Severity: High] If pm_runtime_resume_and_get() fails, does this leave the clock enabled? Because it doesn't clean up the clk_prepare_enable() call, the clock leaks. Also, if either gate_node or dev is NULL, ret remains 0, which bypasses the enablement but allows dos_local_config() to execute unpowered MMIO writes, causing a bus crash. [ ... ] > @@ -343,6 +347,8 @@ static irqreturn_t vdec_threaded_isr_handler(int irq,= void *priv) > =20 > mutex_lock(&hw->ctx_mutex); > if (hw->hw_ops.irq_threaded_func && hw->curr_ctx) > ret =3D hw->hw_ops.irq_threaded_func(irq, priv); > mutex_unlock(&hw->ctx_mutex); [Severity: High] Does this threaded ISR program hardware registers while relying solely on ctx_mutex? During a decoder timeout, aml_h264_dec_run() calls aml_stop_vdec_hw() witho= ut acquiring ctx_mutex. This causes the hardware to be reset concurrently while the ISR might still be actively programming its memory and registers. [ ... ] > @@ -428,6 +434,8 @@ static irqreturn_t vdec_irq_handler(int irq, void *pr= iv) > irqreturn_t ret =3D IRQ_NONE; > =20 > if (hw->hw_ops.irq_handler) > ret =3D hw->hw_ops.irq_handler(irq, priv); > =20 > return ret; > } [ ... ] > @@ -479,6 +487,8 @@ int dev_request_hw_resources(void *priv) > dev_err(&pdev->dev, "get irq failed\n"); > return hw->dec_irq; > } > ret =3D devm_request_threaded_irq(&pdev->dev, hw->dec_irq, vdec_irq_han= dler, [Severity: Medium] Could a pending interrupt cause the IRQ line to be permanently disabled? The IRQ is registered before the hardware has been explicitly reset, and hw->hw_ops.irq_handler is NULL at this point. If an interrupt fires, vdec_irq_handler() will repeatedly return IRQ_NONE, causing the kernel to detect a spurious IRQ storm and disable the line. > diff --git a/drivers/media/platform/amlogic/vdec/h264.c b/drivers/media/p= latform/amlogic/vdec/h264.c > --- a/drivers/media/platform/amlogic/vdec/h264.c > +++ b/drivers/media/platform/amlogic/vdec/h264.c > @@ -423,6 +423,8 @@ static int poc_is_in_dpb(int poc, const struct v4l2_h= 264_dpb_entry *dpb) > int ret =3D 0; > =20 > for (i =3D 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) { > if (poc =3D=3D dpb[i].top_field_order_cnt) { > ret =3D 1; > break; [Severity: Medium] Should this check V4L2_H264_DPB_ENTRY_FLAG_VALID before comparing the POC? If it compares against inactive or stale entries with lingering zeros, it c= an falsely return 1, preventing clear_unused_col_buf() from releasing the associated canvas positions and colocate buffers. [ ... ] > @@ -494,6 +496,8 @@ static int config_decode_canvas(struct aml_vdec_hw *h= w, > /* config y canvas */ > meson_canvas_config(hw->canvas, > buf_spec->y_canvas_index, buf_spec->y_dma_addr, > mb_width << 4, mb_height << 4, [Severity: Low] Does this hardcode the hardware stride to the bitstream-derived width inste= ad of the negotiated bytesperline? V4L2 semantics require using the bytesperline set via VIDIOC_S_FMT. If the negotiated stride differs from the tightly-packed SPS width, the resulting image will suffer from visual corruption. [ ... ] > @@ -609,6 +613,9 @@ static int alloc_colocate_cma(struct aml_h264_ctx *h2= 64_ctx, > gfp_t gfp =3D GFP_KERNEL | GFP_DMA32; > =20 > if (h264_ctx->collated_cma_vaddr) > return 0; > =20 > hw =3D vdec_get_hw(ctx->dev); [Severity: High] Does this bypass updating one_col_buf_size if the buffer was already alloca= ted? If the stream dynamically increases in resolution, h264_ctx->one_col_buf_si= ze will remain at the stale, smaller size. [ ... ] > @@ -838,6 +845,9 @@ static int h264_config_decode_buf(struct aml_vdec_hw = *hw, > for (i =3D 0; i < h264_ctx->list_size[0]; i++) { > if (!h264_ctx->ref_list0[i].valid) > continue; > canvas_pos =3D h264_ctx->ref_list0[i].canvas_pos; > /* bit 0:3 canvas_pos bit 5:6 frame struct cfg */ > ref_cfg_once =3D (canvas_pos & 0x1f) | (type_cfg << 5); [Severity: Medium] If a reference picture is invalid, does skipping it without incrementing 'j' shift all subsequent valid entries into the wrong hardware slots? This `continue` statement silently bypasses the hardware index packing, corrupting the decoding of B-frames or P-frames. [ ... ] > @@ -865,6 +875,8 @@ static int h264_config_decode_buf(struct aml_vdec_hw = *hw, > ref_cfg =3D 0; > =20 > for (i =3D 0; i < h264_ctx->list_size[1]; i++) { > if (!h264_ctx->ref_list0[i].valid) > continue; > canvas_pos =3D h264_ctx->ref_list1[i].canvas_pos; [Severity: Medium] Is ref_list1 incorrectly checked against ref_list0's valid flag here? If ref_list0 has fewer valid entries than ref_list1, the loop will erroneou= sly skip valid ref_list1 entries. [ ... ] > @@ -896,6 +908,9 @@ static int h264_config_decode_buf(struct aml_vdec_hw = *hw, > colocate_wr_adr =3D (unsigned int)h264_ctx->collated_cma_addr + > ((h264_ctx->one_col_buf_size * > h264_ctx->curr_spec.col_buf_index) >> (use_mode_8x8_flag ? 2 : 0= )); > if (colocate_adr_offset > h264_ctx->one_col_buf_size || > colocate_wr_adr + h264_ctx->one_col_buf_size > > (unsigned int)h264_ctx->collated_cma_addr_end) { [Severity: High] Does this bounds check permit memory corruption because it verifies against the old smaller one_col_buf_size? The hardware is programmed with the new larger dimensions, writing new_mb_total * 96 bytes starting at colocate_wr_adr, overflowing the spacing defined by the stale one_col_buf_size. [ ... ] > @@ -1570,6 +1585,8 @@ static int h264_config_ref_spec(struct aml_h264_ctx= *h264_ctx, > return -1; > } > =20 > vb =3D vb2_find_buffer(vq, dpb->reference_ts); [Severity: High] Is it safe to iterate over the vb2 queue buffers from the threaded ISR with= out holding the v4l2_intf_lock? If a concurrent VIDIOC_REQBUFS or VIDIOC_STREAMOFF modifies the queue while this is executing, it could lead to use-after-free or out-of-bounds accesse= s. > if (!vb) { > dev_dbg(&ctx->dev->plat_dev->dev, > "ref pic for ts %llu lost\n", dpb->reference_ts); > buf_spec->valid =3D 0; > return -1; [Severity: High] Does this leave the stale physical addresses in the buffer spec? When combined with the loop in get_canvas_index(), which ignores the valid flag: drivers/media/platform/amlogic/vdec/h264.c:get_canvas_index() { ... for (i =3D 0; i < h264_ctx->list_size[0]; i++) { buf =3D &h264_ctx->ref_list0[i]; ret =3D config_decode_canvas(hw, buf, h264_ctx->mb_width, ... } this will configure the hardware to map and use the stale, dangling y_dma_a= ddr for the current frame's decoding if reference picture validation fails. [ ... ] > @@ -1665,6 +1682,9 @@ static int get_canvas_index(struct aml_vdec_hw *hw,= struct aml_vdec_ctx *ctx) > if (ret) > return ret; > =20 > if (h264_ctx->list_size[0] > 0) { > for (i =3D 0; i < h264_ctx->list_size[0]; i++) { > buf =3D &h264_ctx->ref_list0[i]; > ret =3D config_decode_canvas(hw, buf, h264_ctx->mb_width, > h264_ctx->mb_height); [Severity: High] Does this iterate over all reference entries and configure canvases without checking if the entry is valid? This ignores buf->valid and programs potentially stale or failed DMA addres= ses into the hardware. [ ... ] > @@ -2015,6 +2035,8 @@ void aml_h264_exit(void *priv) > =20 > synchronize_irq(dec_hw->dec_irq); > mutex_lock(&dec_hw->ctx_mutex); > if (ctx->dos_clk_en && > (!dec_hw->curr_ctx || dec_hw->curr_ctx =3D=3D h264_ctx)) > aml_stop_vdec_hw(dec_hw); [Severity: High] Can this shut down the hardware concurrently while another instance is being initialized? If m2mops_vdec_device_run() is currently executing dos_enable() for a new instance, dec_hw->curr_ctx might still be NULL. This condition evaluates to true, resulting in aml_stop_vdec_hw() running and resetting the hardware clocks/registers out from under the other context. [ ... ] > @@ -2092,6 +2114,8 @@ int aml_h264_dec_run(void *priv) > dev_err(&ctx->dev->plat_dev->dev, "dec inter fail\n"); > } > =20 > h264_ctx->init_flag =3D 0; > aml_vdec_set_curr_ctx(dec_hw, NULL); [Severity: Critical] Does this write to the freed context after returning from wait_event_interruptible_timeout()? If a concurrent STREAMOFF has already freed h264_ctx, setting init_flag here results in a use-after-free. > =20 > return ret; [ ... ] > @@ -2164,6 +2188,8 @@ int aml_h264_dec_run(void *priv) > * h264_release_decode_spec() concurrently. > */ > aml_stop_vdec_hw(dec_hw); > synchronize_irq(dec_hw->dec_irq); [Severity: High] Does this call hardware reset operations concurrently without the ctx_mutex= and before synchronizing the ISR? If the threaded ISR is active, aml_stop_vdec_hw() will reset the hardware w= hile the ISR is actively programming its memory and registers, leading to bus lockups. --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261012-b4-s4-vdec= -upstream-v11-0-25939f85ada5@amlogic.com?part=3D4