From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 67310606A31A for ; Thu, 22 Oct 2026 06:01:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=LarxhVyA; dkim=fail reason="signature verification failed" (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=P5ukIY0p DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Date:References: In-Reply-To:Cc:To:Subject:From:Message-ID:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=mM2mfmop8bzfjNI8lrJKaPIk7lVrUc7zYr/8KO3OriE=; b=LarxhVyAwUKWSE vtQdMpZYKa7vcdYrifqA1SncWHzPV9T096jPWzm/+LxaR5HviPdy3XMYGWw/wkVHcUpjo8830qCYC KjP6gwptwOeDMXwqBxVgjtKeYjX22CiFfvEoCmAJhFjjWcNR1fSs4hu5xQDoDDcHQZJzbXHI+0VXL YwRw1P24pwfFhZQZSW+RFk9nxViyXTp86PbfuQpzVAyGBiVDhT1lBL6bCvp4uHXvwHuhX8IAcptU9 7WwReqIBBzH+MTIbPXfo9cJUuhxfVFJigDnB1pKgdxJAut+a2Clhazt3sHU8l8u8kyjfmwbiZMhvy WdX6eFdjpwsacxvx35rg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1xJlrd-0000000DRLl-3WME; Thu, 22 Oct 2026 06:01:21 +0000 Received: from sea.source.kernel.org ([2600:3c0a:e001:78e:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1xJlrc-0000000DRLX-16th for linux-amlogic@lists.infradead.org; Thu, 22 Oct 2026 06:01:20 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id B2B7140545; Thu, 22 Oct 2026 06:01:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A3541F000C1; Thu, 22 Oct 2026 06:01:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1792648879; bh=4UYII/jxqMf0Quc8mwHI4jTBZTgUQarKMX32yAjEysA=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=P5ukIY0pmciuJ3ESYXxuJNznGL7xRM+JIpLf9K9mdsPenrSQKjyE3WMkSv0DxwM7J LjVSNmcoBK8HSzI5CAbXmriLh/96UNe+JSKHwYYcv4zpx6zBsgxnRaC2AllYbVH2+J vLg8lJ+LnyChlUXWHkyXLiTGFJmYzCP6+qVo85Ao8hsqt7n6HR8DFyc2Hugm2djc2a RntP6YgLuGX2rkbxVDHcQDL/op4RN7AupXvyi86M4T6Kuowmk0jTy0ajmRxwrXkkgG yArE+JABw1PsmD/i0k3QjVuXTTu98bXWazooY4VFBc9TTSNrEuuaSe63KAjMJCOd8/ FXKx8st78VODw== Message-ID: From: sashiko-bot@kernel.org Subject: Re: [PATCH v12 5/6] arm64: dts: amlogic: Add video decoder driver support for S4 SOCs To: "Zhentao Guo" Cc: linux-amlogic@lists.infradead.org, devicetree@vger.kernel.org, robh@kernel.org, conor+dt@kernel.org, neil.armstrong@linaro.org, media-ci@linuxtv.org In-Reply-To: <20261022-b4-s4-vdec-upstream-v12-5-616240978792@amlogic.com> References: <20261022-b4-s4-vdec-upstream-v12-0-616240978792@amlogic.com> <20261022-b4-s4-vdec-upstream-v12-5-616240978792@amlogic.com> Date: Thu, 22 Oct 2026 06:01:18 +0000 X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev X-Archived-By: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" X-Spam-Status: No, score=-8.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MTMgcG90ZW50aWFsIGlzc3VlKHMpIHRvIGNvbnNpZGVyOgotIFtDcml0aWNhbF0gbWVkaWE6IGFt bG9naWM6IHZkZWM6IE9PQiByZWFkIGFuZCBjYW52YXMgbGVha3MgaW4gaDI2NCByZWZlcmVuY2Ug bGlzdCBoYW5kbGluZwotIFtDcml0aWNhbF0gbWVkaWE6IGFtbG9naWM6IHZkZWM6IGNvbG9jYXRl IGJ1ZmZlciBPT0IgRE1BIHdyaXRlIGluIGgyNjRfY29uZmlnX2RlY29kZV9idWYoKQotIFtIaWdo XSBtZWRpYTogYW1sb2dpYzogdmRlYzogYW1sX3ZkZWNfaW5pdF9kZWNfaW5zdCgpIHJldHVybnMg LTEgb24gcXVldWUgcmVzdGFydAotIFtIaWdoXSBtZWRpYTogYW1sb2dpYzogdmRlYzogaW52YWxp ZCBJU19FUlIoKSBjaGVjayBvbiBtZXNvbl9zbV9nZXQoKSBpbiBwcm9iZQotIFtIaWdoXSBtZWRp YTogYW1sb2dpYzogdmRlYzogcG9jX2lzX2luX2RwYigpIGFuZCBnZXRfZHBiX2J5X3BvYygpIGln bm9yZSBhY3RpdmUgZmxhZwotIFtIaWdoXSBtZWRpYTogYW1sb2dpYzogdmRlYzogZG9zIGNsb2Nr IGluIHZkZWNfY2xvY2tfZ2F0ZV9pbml0KCkgaXMgbmV2ZXIgZW5hYmxlZAotIFtIaWdoXSBtZWRp YTogYW1sb2dpYzogdmRlYzogaWdub3JlZCBwb3dlciBhbmQgY2xvY2sgZXJyb3JzIGluIGFtbF92 ZGVjX2h3LmMKLSBbSGlnaF0gbWVkaWE6IGFtbG9naWM6IHZkZWM6IGFtbF92ZGVjX2Rydl9yZW1v dmUoKSBwb3dlcnMgb2ZmIGh3IGJlZm9yZSB1bnJlZ2lzdGVyaW5nCi0gW0hpZ2hdIG1lZGlhOiBh bWxvZ2ljOiB2ZGVjOiBicm9rZW4gVEVFIGRlZmVycmFsIGFuZCBlcnJvciBjb2RlcyBpbiBhbWxf dmRlY190ZWVfZncuYwotIFtIaWdoXSBtZWRpYTogYW1sb2dpYzogdmRlYzogaW5maW5pdGUgcG9s bCB1bmRlciBjdHhfbXV0ZXggaW4gaDI2NF9jb25maWdfZGVjb2RlX2J1ZigpCi0gW01lZGl1bV0g bWVkaWE6IGFtbG9naWM6IHZkZWM6IG1pc3NpbmcgUkVHTUFQX01NSU8gYW5kIE1FRElBX0NPTlRS T0xMRVIgc2VsZWN0cwotIFtNZWRpdW1dIG1lZGlhOiBhbWxvZ2ljOiB2ZGVjOiBhbWxfdmRlY19k cnZfcHJvYmUoKSByZWdpc3RlcnMgdmlkZW9fZGV2aWNlIHRvbyBlYXJseQotIFtNZWRpdW1dIG1l ZGlhOiBhbWxvZ2ljOiB2ZGVjOiBtaXNzaW5nIHNldF9waWNfaW5mbygpIGluIHJlc2V0X291dHB1 dF9mbXRzKCkKLS0KCmNvbW1pdCA3ZDc3YjBlNTU2MGRkNmY3YzlmZGQ0NjVjMDBmZmZkZmY5MWM3 ZTU1CkF1dGhvcjogWmhlbnRhbyBHdW8gPHpoZW50YW8uZ3VvQGFtbG9naWMuY29tPgoKYXJtNjQ6 IGR0czogYW1sb2dpYzogQWRkIHZpZGVvIGRlY29kZXIgZHJpdmVyIHN1cHBvcnQgZm9yIFM0IFNP Q3MKClRoaXMgc2VyaWVzIGFkZHMgdGhlIEFtbG9naWMgUzQgVjRMMiBzdGF0ZWxlc3MgSC4yNjQg dmlkZW8gZGVjb2RlciBkcml2ZXIgaW4KY29tbWl0IDE4YTExYjJjNzBhN2VmNTVjNDJlZDg5N2Jj MTYyNDM5N2VjMzQzMGMgKCJkZWNvZGVyOiBBZGQgVjRMMiBzdGF0ZWxlc3MKSC4yNjQgZGVjb2Rl ciBkcml2ZXIiKSBhbmQgZW5hYmxlcyB0aGUgY29ycmVzcG9uZGluZyB2ZGVjLCBjYW52YXMsIGFu ZCBvcHRlZQpkZXZpY2UgdHJlZSBub2RlcyBpbiBtZXNvbi1zNC5kdHNpLgoKPiBkaWZmIC0tZ2l0 IGEvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvS2NvbmZpZyBiL2RyaXZlcnMv bWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL0tjb25maWcKPiBuZXcgZmlsZSBtb2RlIDEwMDY0 NAo+IGluZGV4IDAwMDAwMDAwMDAwMDAuLjJjNWRkODQ1Mjk2MjEKPiAtLS0gL2Rldi9udWxsCj4g KysrIGIvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvS2NvbmZpZwo+IEBAIC0w LDAgKzEsMTggQEAKPiArIyBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogKEdQTC0yLjAtb25seSBP UiBNSVQpCj4gKwo+ICtjb25maWcgVklERU9fQU1MT0dJQ19WREVDCj4gKyAgICB0cmlzdGF0ZSAi QW1sb2dpYyBWaWRlbyBEZWNvZGVyIERyaXZlciIKPiArICAgIGRlcGVuZHMgb24gQVJDSF9NRVNP TiB8fCBDT01QSUxFX1RFU1QKPiArICAgIGRlcGVuZHMgb24gVklERU9fREVWCj4gKyAgICBkZXBl bmRzIG9uIFY0TF9NRU0yTUVNX0RSSVZFUlMKPiArICAgIGRlcGVuZHMgb24gVEVFCj4gKyAgICBk ZXBlbmRzIG9uIE1FU09OX1NNCj4gKyAgICBzZWxlY3QgVklERU9CVUYyX0RNQV9DT05USUcKPiAr ICAgIHNlbGVjdCBWNEwyX0gyNjQKPiArICAgIHNlbGVjdCBWNEwyX01FTTJNRU1fREVWCj4gKyAg ICBzZWxlY3QgTUVTT05fQ0FOVkFTCgpbU2V2ZXJpdHk6IE1lZGl1bV0KU2hvdWxkIFZJREVPX0FN TE9HSUNfVkRFQyBhbHNvIHNlbGVjdCBSRUdNQVBfTU1JTyBhbmQgTUVESUFfQ09OVFJPTExFUiBo ZXJlPwoKSW4gZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3ZkZWNfaHcu YywKZGV2X3JlcXVlc3RfaHdfcmVzb3VyY2VzKCkgY2FsbHMgZGV2bV9yZWdtYXBfaW5pdF9tbWlv KCksIHdoaWNoIGZhaWxzIHRvIGxpbmsKd2hlbiBDT05GSUdfUkVHTUFQX01NSU8gaXMgZGlzYWJs ZWQuCgpJbiBhZGRpdGlvbiwgYW1sX3ZkZWNfZHJ2X3Byb2JlKCkgaW4KZHJpdmVycy9tZWRpYS9w bGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3ZkZWNfZHJ2LmMgcmVnaXN0ZXJzIGEgbWVkaWEgZGV2 aWNlCndpdGggYW1sX20ybV9tZWRpYV9vcHMgKHZiMl9yZXF1ZXN0X3ZhbGlkYXRlIGFuZCB2NGwy X20ybV9yZXF1ZXN0X3F1ZXVlKSBmb3IKc3RhdGVsZXNzIEguMjY0IGRlY29kaW5nLCB3aGljaCBj b21waWxlcyB0byBuby1vcCBzdHVicyBpZgpDT05GSUdfTUVESUFfQ09OVFJPTExFUiBpcyBkaXNh YmxlZC4gSW4KZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3ZkZWMuYywg c2hvdWxkIGFtbF92ZGVjX3F1ZXVlX2luaXQoKQphbHNvIHNldCBzcmNfdnEtPnJlcXVpcmVzX3Jl cXVlc3RzID0gdHJ1ZSBhbG9uZ3NpZGUKc3JjX3ZxLT5zdXBwb3J0c19yZXF1ZXN0cyA9IHRydWUg c28gbm9uLXJlcXVlc3QgYnVmZmVycyBhcmUgcmVqZWN0ZWQ/CgpbIC4uLiBdCgo+IGRpZmYgLS1n aXQgYS9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRlYy5jIGIvZHJp dmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3ZkZWMuYwo+IG5ldyBmaWxlIG1v ZGUgMTAwNjQ0Cj4gaW5kZXggMDAwMDAwMDAwMDAwMC4uZTY1ZWJiMmNlMzExZgo+IC0tLSAvZGV2 L251bGwKPiArKysgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRl Yy5jCgpbIC4uLiBdCgo+ICtzdGF0aWMgaW50IGFtbF92ZGVjX2luaXRfZGVjX2luc3Qoc3RydWN0 IGFtbF92ZGVjX2N0eCAqY3R4KQo+ICt7Cj4gKwlzdHJ1Y3QgYW1sX3ZkZWNfZGV2ICpkZXYgPSBj dHgtPmRldjsKPiArCXN0cnVjdCBhbWxfdmlkZW9fZm10ICpmbXRfb3V0ID0gJmN0eC0+ZGVjX2Zt dFtBTUxfRk1UX1NSQ107Cj4gKwlpbnQgcmV0ID0gLTE7Cj4gKwo+ICsJY3R4LT5jb2RlY19vcHMg PSAmZGV2LT5wdmRlY19kYXRhLT5jb2RlY19vcHNbZm10X291dC0+Y29kZWNfdHlwZV07Cj4gKwkv Kgo+ICsJICogVGhlIGNvZGVjIGluc3RhbmNlIGlzIG9ubHkgcmVsZWFzZWQgd2hlbiBib3RoIHF1 ZXVlcyBhcmUKPiArCSAqIHN0cmVhbWVkIG9mZjogZG8gbm90IGFsbG9jYXRlIGEgbmV3IG9uZSAo bGVha2luZyB0aGUgcHJldmlvdXMKPiArCSAqIGluc3RhbmNlKSB3aGVuIHRoZSBvdXRwdXQgcXVl dWUgaXMgcmVzdGFydGVkIHdoaWxlIHRoZQo+ICsJICogY2FwdHVyZSBxdWV1ZSBpcyBzdGlsbCBz dHJlYW1pbmcuCj4gKwkgKi8KPiArCWlmIChjdHgtPmNvZGVjX29wcy0+aW5pdCAmJiAhY3R4LT5j b2RlY19wcml2KSB7Cj4gKwkJcmV0ID0gY3R4LT5jb2RlY19vcHMtPmluaXQoY3R4KTsKPiArCQlp ZiAocmV0IDwgMCkKPiArCQkJcmV0dXJuIHJldDsKPiArCX0KPiArCWN0eC0+Y3Vycl9kZWNfdHlw ZSA9IGZtdF9vdXQtPmNvZGVjX3R5cGU7Cj4gKwlkZXZfaW5mbygmZGV2LT5wbGF0X2Rldi0+ZGV2 LCAiJXMgc2V0IGN1cnJfZGVjX3R5cGUgJXNcbiIsCj4gKwkJIF9fZnVuY19fLCBkZWNfdHlwZV90 b19uYW1lKGN0eC0+Y3Vycl9kZWNfdHlwZSkpOwo+ICsKPiArCXJldHVybiByZXQ7Cj4gK30KCltT ZXZlcml0eTogSGlnaF0KV2hlbiB0aGUgb3V0cHV0IHF1ZXVlIGlzIHN0b3BwZWQgYW5kIHJlc3Rh cnRlZCB3aGlsZSB0aGUgY2FwdHVyZSBxdWV1ZSByZW1haW5zCnN0cmVhbWluZywgY3R4LT5jb2Rl Y19wcml2IGlzIGFscmVhZHkgbm9uLU5VTEwsIHNvIGFtbF92ZGVjX2luaXRfZGVjX2luc3QoKQpz a2lwcyBjdHgtPmNvZGVjX29wcy0+aW5pdChjdHgpIGFuZCByZXR1cm5zIHRoZSBpbml0aWFsIHJl dCA9IC0xLgoKSW4gdmIyb3BzX3ZkZWNfc3RhcnRfc3RyZWFtaW5nKCk6CgogICAgaWYgKGFtbF92 ZGVjX2luaXRfZGVjX2luc3QoY3R4KSA8IDApIHsKICAgICAgICB3aGlsZSAoKHNyY19idWYgPSB2 NGwyX20ybV9zcmNfYnVmX3JlbW92ZShjdHgtPm0ybV9jdHgpKSkKICAgICAgICAgICAgdjRsMl9t Mm1fYnVmX2RvbmUoc3JjX2J1ZiwgVkIyX0JVRl9TVEFURV9RVUVVRUQpOwogICAgICAgIHJldHVy biAtRUlOVkFMOwogICAgfQoKV29uJ3QgdGhpcyBjYXVzZSB2YjJvcHNfdmRlY19zdGFydF9zdHJl YW1pbmcoKSB0byBhbHdheXMgZmFpbCB3aXRoIC1FSU5WQUwgb24Kb3V0cHV0IHF1ZXVlIHJlc3Rh cnQgdW5sZXNzIHJldCBpcyBpbml0aWFsaXplZCB0byAwIGluCmFtbF92ZGVjX2luaXRfZGVjX2lu c3QoKT8KClsgLi4uIF0KCj4gK3N0YXRpYyBpbnQgdmRlY190cnlfZm10X21wKHN0cnVjdCBhbWxf dmRlY19jdHggKmN0eCwgZW51bSB2NGwyX2J1Zl90eXBlIHR5cGUsCj4gKwkJCSAgIHN0cnVjdCB2 NGwyX3BpeF9mb3JtYXRfbXBsYW5lICpwaXhfbXAsCj4gKwkJCSAgIGNvbnN0IHN0cnVjdCBhbWxf dmlkZW9fZm10ICpkZWNfZm10KQo+ICt7Cj4gKwlpbnQgaSwgYWxpZ247Cj4gKwo+ICsJcGl4X21w LT5maWVsZCA9IFY0TDJfRklFTERfTk9ORTsKPiArCWFsaWduID0gZGVjX2ZtdC0+YWxpZ247Cj4g Kwo+ICsJaWYgKFY0TDJfVFlQRV9JU19PVVRQVVQodHlwZSkpIHsKPiArCQlwaXhfbXAtPm51bV9w bGFuZXMgPSBkZWNfZm10LT5udW1fcGxhbmVzOwo+ICsJCXBpeF9tcC0+cGl4ZWxmb3JtYXQgPSBk ZWNfZm10LT5mb3VyY2M7Cj4gKwkJaWYgKCFwaXhfbXAtPnBsYW5lX2ZtdFswXS5zaXplaW1hZ2Up Cj4gKwkJCXBpeF9tcC0+cGxhbmVfZm10WzBdLnNpemVpbWFnZSA9Cj4gKwkJCSAgICAocGl4X21w LT5oZWlnaHQgKiBwaXhfbXAtPndpZHRoICogMykgLyAyOwo+ICsJCXBpeF9tcC0+aGVpZ2h0ID0g QUxJR04ocGl4X21wLT5oZWlnaHQsIGFsaWduKTsKPiArCQlwaXhfbXAtPndpZHRoID0gQUxJR04o cGl4X21wLT53aWR0aCwgYWxpZ24pOwo+ICsJfSBlbHNlIHsKPiArCQlwaXhfbXAtPmhlaWdodCA9 IGN0eC0+cGl4X2ZtdFtBTUxfRk1UX1NSQ10uaGVpZ2h0Owo+ICsJCXBpeF9tcC0+d2lkdGggPSBj dHgtPnBpeF9mbXRbQU1MX0ZNVF9TUkNdLndpZHRoOwo+ICsJfQo+ICsKPiArCXY0bDJfYXBwbHlf ZnJtc2l6ZV9jb25zdHJhaW50cygmcGl4X21wLT53aWR0aCwgJnBpeF9tcC0+aGVpZ2h0LAo+ICsJ CQkJICAgICAgICZkZWNfZm10LT5zdGVwd2lzZSk7CgpbIC4uLiBdCgo+ICtzdGF0aWMgaW50IHZk ZWNfc19mbXRfb3V0cHV0KHN0cnVjdCBhbWxfdmRlY19jdHggKmN0eCwgc3RydWN0IHY0bDJfZm9y bWF0ICpmKQo+ICt7Cj4gKwlzdHJ1Y3QgdjRsMl9waXhfZm9ybWF0X21wbGFuZSAqcGl4X21wID0g JmYtPmZtdC5waXhfbXA7Cj4gKwlzdHJ1Y3QgdjRsMl9waXhfZm9ybWF0X21wbGFuZSAqY2FwX2Zt dCA9ICZjdHgtPnBpeF9mbXRbQU1MX0ZNVF9EU1RdOwo+ICsJY29uc3Qgc3RydWN0IGFtbF92aWRl b19mbXQgKm91dF9mbXQ7Cj4gKwlzdHJ1Y3QgdmIyX3F1ZXVlICp2cSwgKnBlZXJfdnE7Cj4gKwlp bnQgcmV0Owo+ICsKPiArCXZxID0gdjRsMl9tMm1fZ2V0X3ZxKGN0eC0+bTJtX2N0eCwgVjRMMl9C VUZfVFlQRV9WSURFT19PVVRQVVRfTVBMQU5FKTsKPiArCWlmICh2YjJfaXNfYnVzeSh2cSkgJiYK PiArCSAgICBwaXhfbXAtPnBpeGVsZm9ybWF0ICE9IGN0eC0+cGl4X2ZtdFtBTUxfRk1UX1NSQ10u cGl4ZWxmb3JtYXQpCj4gKwkJcmV0dXJuIC1FQlVTWTsKPiArCj4gKwkvKgo+ICsJICogU2luY2Ug c19mbXQgb3V0cHV0IHdpbGwgcmVzZXQgdGhlIHdpZHRoIGFuZCBoZWlnaHQgaW4gdGhlIGNhcHR1 cmUgcXVldWUsCj4gKwkgKiBzX2ZtdF9vdXRwdXQgd2l0aCByZXNvbHV0aW9uIGNoYW5nZSBzaG91 bGQgbm90IHRha2UgZWZmZWN0IHdoZW4gY2FwdHVyZQo+ICsJICogcXVldWUgaXMgYnVzeS4KPiAr CSAqLwo+ICsJcGVlcl92cSA9IHY0bDJfbTJtX2dldF92cShjdHgtPm0ybV9jdHgsIFY0TDJfQlVG X1RZUEVfVklERU9fQ0FQVFVSRV9NUExBTkUpOwo+ICsJaWYgKHZiMl9pc19idXN5KHBlZXJfdnEp ICYmCj4gKwkgICAgKHBpeF9tcC0+d2lkdGggIT0gY2FwX2ZtdC0+d2lkdGggfHwKPiArCSAgICBw aXhfbXAtPmhlaWdodCAhPSBjYXBfZm10LT5oZWlnaHQpKQo+ICsJCXJldHVybiAtRUJVU1k7Cgpb IC4uLiBdCgo+ICtzdGF0aWMgdm9pZCByZXNldF9vdXRwdXRfZm10cyhzdHJ1Y3QgYW1sX3ZkZWNf Y3R4ICpjdHgpCj4gK3sKPiArCXN0cnVjdCBhbWxfdmRlY19kZXYgKmRldiA9IGN0eC0+ZGV2Owo+ ICsJY29uc3Qgc3RydWN0IGFtbF92aWRlb19mbXQgKm91dF9mbXQ7Cj4gKwlzdHJ1Y3QgdjRsMl9w aXhfZm9ybWF0X21wbGFuZSBmbXQ7Cj4gKwo+ICsJLyogcmVzZXQgZGVmYXVsdCBvdXRwdXQgZm10 IHRvIFY0TDJfUElYX0ZNVF9IMjY0X1NMSUNFICovCj4gKwlvdXRfZm10ID0gYW1sX3ZkZWNfZ2V0 X3ZpZGVvX2ZtdChkZXYsIFY0TDJfUElYX0ZNVF9IMjY0X1NMSUNFKTsKPiArCWlmICghb3V0X2Zt dCkKPiArCQlyZXR1cm47Cj4gKwo+ICsJY3R4LT5kZWNfZm10W0FNTF9GTVRfU1JDXSA9ICpvdXRf Zm10Owo+ICsKPiArCW1lbXNldCgmZm10LCAwLCBzaXplb2Yoc3RydWN0IHY0bDJfcGl4X2Zvcm1h dF9tcGxhbmUpKTsKPiArCj4gKwlmbXQuaGVpZ2h0ID0gb3V0X2ZtdC0+c3RlcHdpc2UubWluX2hl aWdodDsKPiArCWZtdC53aWR0aCA9IG91dF9mbXQtPnN0ZXB3aXNlLm1pbl93aWR0aDsKPiArCS8q IHJlc2V0IGJ5dGVzcGVybGluZSB0byAwIGZvciBvdXRwdXQgZm10cyAqLwo+ICsJZm10LnBsYW5l X2ZtdFswXS5ieXRlc3BlcmxpbmUgPSAwOwo+ICsJZm10LmNvbG9yc3BhY2UgPSBWNEwyX0NPTE9S U1BBQ0VfREVGQVVMVDsKPiArCWZtdC55Y2Jjcl9lbmMgPSBWNEwyX1lDQkNSX0VOQ19ERUZBVUxU Owo+ICsJZm10LnF1YW50aXphdGlvbiA9IFY0TDJfUVVBTlRJWkFUSU9OX0RFRkFVTFQ7Cj4gKwlm bXQueGZlcl9mdW5jID0gVjRMMl9YRkVSX0ZVTkNfREVGQVVMVDsKPiArCXZkZWNfdHJ5X2ZtdF9t cChjdHgsIFY0TDJfQlVGX1RZUEVfVklERU9fT1VUUFVUX01QTEFORSwgJmZtdCwKPiArCQkJb3V0 X2ZtdCk7Cj4gKwo+ICsJY3R4LT5waXhfZm10W0FNTF9GTVRfU1JDXSA9IGZtdDsKPiArfQoKW1Nl dmVyaXR5OiBNZWRpdW1dCkluIGZvcHNfdmNvZGVjX29wZW4oKSAtPiBhbWxfdmRlY19yZXNldF9m bXRzKCkgLT4gcmVzZXRfb3V0cHV0X2ZtdHMoKSwKc2V0X3BpY19pbmZvKCkgaXMgbm90IGNhbGxl ZCBhZnRlciB2ZGVjX3RyeV9mbXRfbXAoKS4gSWYgdXNlcnNwYWNlIHN0YXJ0cwpzdHJlYW1pbmcg d2l0aG91dCBjYWxsaW5nIHZkZWNfc19mbXRfb3V0cHV0KCksIHdvbid0IGN0eC0+cGljX2luZm8u ZmJfc2l6ZVswXQpyZW1haW4gMCwgY2F1c2luZyBoMjY0X2NvbmZpZ19kZWNvZGVfc3BlYygpIGFu ZCBoMjY0X2NvbmZpZ19yZWZfc3BlYygpIGluCmRyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dp Yy92ZGVjL2gyNjQuYyB0byBzZXQgY19kbWFfYWRkciBlcXVhbCB0bwp5X2RtYV9hZGRyIGZvciBz aW5nbGUtcGxhbmFyIE5WMTIvTlYyMSBjYXB0dXJlIGJ1ZmZlcnM/CgpBbHNvIGluIHZkZWNfdHJ5 X2ZtdF9tcCgpLCBwaXhfbXAtPnBsYW5lX2ZtdFswXS5zaXplaW1hZ2UgaXMgY2FsY3VsYXRlZCBm cm9tCnBpeF9tcC0+aGVpZ2h0ICogcGl4X21wLT53aWR0aCBiZWZvcmUgQUxJR04oKSBhbmQKdjRs Ml9hcHBseV9mcm1zaXplX2NvbnN0cmFpbnRzKCkgY2xhbXAgdGhlIGRpbWVuc2lvbnMsIGFuZCBp bgp2ZGVjX3NfZm10X291dHB1dCgpLCBwaXhfbXAtPndpZHRoIGFuZCBwaXhfbXAtPmhlaWdodCBh cmUgY29tcGFyZWQgYWdhaW5zdCB0aGUKNjQtYWxpZ25lZCBjYXBfZm10IGRpbWVuc2lvbnMgYmVm b3JlIHZkZWNfdHJ5X2ZtdF9tcCgpIGFsaWducyB0aGVtLiBTaG91bGQKc2l6ZWltYWdlIGFuZCB0 aGUgYnVzeSByZXNvbHV0aW9uIGNoZWNrIHVzZSB0aGUgYWxpZ25lZCBhbmQgY2xhbXBlZCBkaW1l bnNpb25zCmluc3RlYWQ/CgpbIC4uLiBdCgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL21lZGlhL3Bs YXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRlY19kcnYuYyBiL2RyaXZlcnMvbWVkaWEvcGxhdGZv cm0vYW1sb2dpYy92ZGVjL2FtbF92ZGVjX2Rydi5jCj4gbmV3IGZpbGUgbW9kZSAxMDA2NDQKPiBp bmRleCAwMDAwMDAwMDAwMDAwLi4xODcwZDU2NjU5Y2Y0Cj4gLS0tIC9kZXYvbnVsbAo+ICsrKyBi L2RyaXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92ZGVjX2Rydi5jCgpbIC4u LiBdCgo+ICsJcmV0ID0gdmlkZW9fcmVnaXN0ZXJfZGV2aWNlKHZmZF9kZWMsIFZGTF9UWVBFX1ZJ REVPLCAtMSk7Cj4gKwlpZiAocmV0KSB7Cj4gKwkJdjRsMl9lcnIoJmRldi0+djRsMl9kZXYsICJG YWlsZWQgdG8gcmVnaXN0ZXIgdmlkZW8gZGV2aWNlIik7Cj4gKwkJZ290byBlcnJfdmlkX2Rldl9y ZWdpc3RlcjsKPiArCX0KPiArCj4gKwlkZXYtPm1kZXYuZGV2ID0gJnBkZXYtPmRldjsKPiArCXN0 cnNjcHkoZGV2LT5tZGV2Lm1vZGVsLCBBTUxfVkRFQ19EUlZfTkFNRSwgc2l6ZW9mKGRldi0+bWRl di5tb2RlbCkpOwo+ICsJbWVkaWFfZGV2aWNlX2luaXQoJmRldi0+bWRldik7Cj4gKwlkZXYtPm1k ZXYub3BzID0gJmFtbF9tMm1fbWVkaWFfb3BzOwo+ICsJZGV2LT52NGwyX2Rldi5tZGV2ID0gJmRl di0+bWRldjsKPiArCj4gKwlyZXQgPSB2NGwyX20ybV9yZWdpc3Rlcl9tZWRpYV9jb250cm9sbGVy KGRldi0+bTJtX2Rldl9kZWMsIHZmZF9kZWMsCj4gKwkJCQkJCSBNRURJQV9FTlRfRl9QUk9DX1ZJ REVPX0RFQ09ERVIpOwo+ICsJaWYgKHJldCkgewo+ICsJCXY0bDJfZXJyKCZkZXYtPnY0bDJfZGV2 LCAiRmFpbGVkIHRvIGluaXQgbWVtMm1lbSBtZWRpYSBjb250cm9sbGVyXG4iKTsKPiArCQlnb3Rv IGVycm9yX20ybV9tY19yZWdpc3RlcjsKPiArCX0KPiArCj4gKwlyZXQgPSBtZWRpYV9kZXZpY2Vf cmVnaXN0ZXIoJmRldi0+bWRldik7Cj4gKwlpZiAocmV0KSB7Cj4gKwkJdjRsMl9lcnIoJmRldi0+ djRsMl9kZXYsICJGYWlsZWQgdG8gcmVnaXN0ZXIgbWVkaWEgZGV2aWNlIik7Cj4gKwkJZ290byBl cnJfbWVkaWFfZGV2X3JlZ2lzdGVyOwo+ICsJfQo+ICsJdmRlY19lbmFibGUoZGV2LT5kZWNfaHcp Owo+ICsJcmV0dXJuIDA7CgpbU2V2ZXJpdHk6IE1lZGl1bV0KSW4gYW1sX3ZkZWNfZHJ2X3Byb2Jl KCksIHZpZGVvX3JlZ2lzdGVyX2RldmljZSgpIGV4cG9zZXMgdGhlIHZpZGVvIG5vZGUgdG8KdXNl cnNwYWNlIGJlZm9yZSBkZXYtPnY0bDJfZGV2Lm1kZXYgaXMgaW5pdGlhbGl6ZWQsIGJlZm9yZSB0 aGUgbWVkaWEKY29udHJvbGxlciBlbnRpdGllcyBhcmUgcmVnaXN0ZXJlZCwgYW5kIGJlZm9yZSB2 ZGVjX2VuYWJsZShkZXYtPmRlY19odykgcG93ZXJzCm9uIHRoZSBWREVDIGhhcmR3YXJlIGRvbWFp biBhbmQgY2xvY2suCgpDb3VsZCBhIHVzZXJzcGFjZSBwcm9jZXNzIG9wZW4gdGhlIHZpZGVvIGRl dmljZSBpbW1lZGlhdGVseSBhZnRlcgp2aWRlb19yZWdpc3Rlcl9kZXZpY2UoKSBhbmQgcmFjZSB3 aXRoIG1lZGlhIGNvbnRyb2xsZXIgc2V0dXAgb3IgdHJpZ2dlcgptMm1vcHNfdmRlY19kZXZpY2Vf cnVuKCkgYmVmb3JlIHZkZWNfZW5hYmxlKCkgaGFzIHJ1bj8KClsgLi4uIF0KCj4gK3N0YXRpYyB2 b2lkIGFtbF92ZGVjX2Rydl9yZW1vdmUoc3RydWN0IHBsYXRmb3JtX2RldmljZSAqcGRldikKPiAr ewo+ICsJc3RydWN0IGFtbF92ZGVjX2RldiAqZGV2ID0gcGxhdGZvcm1fZ2V0X2RydmRhdGEocGRl dik7Cj4gKwo+ICsJLyoKPiArCSAqIFRoZSBJUlEgaXMgZGV2bS1tYW5hZ2VkIGFuZCBvbmx5IHJl bGVhc2VkIGFmdGVyIHJlbW92ZSgpCj4gKwkgKiByZXR1cm5zOiBtYXNrIGl0IGFuZCB3YWl0IGZv ciBhbnkgaW4tZmxpZ2h0IHRocmVhZGVkIGhhbmRsZXIKPiArCSAqIGJlZm9yZSBwb3dlcmluZyBv ZmYgdGhlIFZERUMgZG9tYWluLCBvdGhlcndpc2UgdGhlIGhhbmRsZXIKPiArCSAqIGNvdWxkIGFj Y2VzcyBwb3dlcmVkLWRvd24gcmVnaXN0ZXJzLgo+ICsJICovCj4gKwlkaXNhYmxlX2lycShkZXYt PmRlY19ody0+ZGVjX2lycSk7Cj4gKwl2ZGVjX2Rpc2FibGUoZGV2LT5kZWNfaHcpOwo+ICsJbWVk aWFfZGV2aWNlX3VucmVnaXN0ZXIoJmRldi0+bWRldik7Cj4gKwl2NGwyX20ybV91bnJlZ2lzdGVy X21lZGlhX2NvbnRyb2xsZXIoZGV2LT5tMm1fZGV2X2RlYyk7Cj4gKwl2aWRlb191bnJlZ2lzdGVy X2RldmljZShkZXYtPnZmZCk7Cj4gKwltZWRpYV9kZXZpY2VfY2xlYW51cCgmZGV2LT5tZGV2KTsK PiArCj4gKwl2NGwyX20ybV9yZWxlYXNlKGRldi0+bTJtX2Rldl9kZWMpOwo+ICsJZGV2LT5wdmRl Y19kYXRhLT5kZXN0cm95X2h3X3Jlc291cmNlKGRldik7Cj4gKwl2NGwyX2RldmljZV91bnJlZ2lz dGVyKCZkZXYtPnY0bDJfZGV2KTsKPiArfQoKW1NldmVyaXR5OiBIaWdoXQpJbiBhbWxfdmRlY19k cnZfcmVtb3ZlKCksIGRpc2FibGVfaXJxKCkgYW5kIHZkZWNfZGlzYWJsZShkZXYtPmRlY19odykg cG93ZXIKb2ZmIHRoZSBWREVDIGRvbWFpbiBhbmQgZGlzYWJsZSB0aGUgVkRFQyBjbG9jayBiZWZv cmUgdW5yZWdpc3RlcmluZyB0aGUgbWVkaWEKYW5kIHZpZGVvIGRldmljZXMgb3IgcmVsZWFzaW5n IE0yTSBjb250ZXh0cy4KCklmIGEgZGVjb2RlIGpvYiBpcyBpbiBmbGlnaHQgaW4gYW1sX2gyNjRf ZGVjX3J1bigpIG9yIGFuIG9wZW4gZmlsZSBoYW5kbGUgaXMKc3Vic2VxdWVudGx5IGNsb3NlZCB2 aWEgZm9wc192Y29kZWNfcmVsZWFzZSgpIC0+IHZiMm9wc192ZGVjX3N0b3Bfc3RyZWFtaW5nKCkK LT4gYW1sX2gyNjRfZXhpdCgpLCB3b24ndCByZWFkX2Rvc19yZWcoKSBhbmQgYW1sX3N0b3BfdmRl Y19odygpIHBlcmZvcm0gTU1JTwphY2Nlc3NlcyB0byBET1NfQlVTIHJlZ2lzdGVycyB0aGF0IGhh dmUgYWxyZWFkeSBiZWVuIHBvd2VyZWQgZG93biBhbmQKdW5jbG9ja2VkPwoKPiBkaWZmIC0tZ2l0 IGEvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3ZkZWNfaHcuYyBiL2Ry aXZlcnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL2FtbF92ZGVjX2h3LmMKPiBuZXcgZmls ZSBtb2RlIDEwMDY0NAo+IGluZGV4IDAwMDAwMDAwMDAwMDAuLjA0M2YwYmJmMzI1MTYKPiAtLS0g L2Rldi9udWxsCj4gKysrIGIvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1s X3ZkZWNfaHcuYwoKWyAuLi4gXQoKPiArdm9pZCBkb3NfZW5hYmxlKHN0cnVjdCBhbWxfdmRlY19o dyAqaHcpCj4gK3sKPiArCWRvc19yZWdfd3JpdGVfYml0cyhodywgRE9TX0dDTEtfRU4wLCAweDNm ZiwgMCwgMTApOwo+ICsKPiArCXJlZ21hcF93cml0ZShody0+bWFwW0RPU19CVVNdLCBHQ0xLX0VO LCAweDNmZik7Cj4gKwo+ICsJcmVnbWFwX3VwZGF0ZV9iaXRzKGh3LT5tYXBbRE9TX0JVU10sIE1E RUNfUElDX0RDX0NUUkwsICgxIDw8IDMxKSwgMCk7Cj4gK30KClsgLi4uIF0KCj4gK3N0YXRpYyBp bnQgdmRlY19jbG9ja19nYXRlX2luaXQoc3RydWN0IGFtbF92ZGVjX2h3ICpodykKPiArewo+ICsJ aHctPmdhdGVzW0NMS19ET1NdLmlkID0gImRvcyI7Cj4gKwlody0+Z2F0ZXNbQ0xLX1ZERUNdLmlk ID0gInZkZWMiOwo+ICsJaHctPmdhdGVzW0NMS19IVkRFQ10uaWQgPSAiaHZkZWMiOwo+ICsKPiAr CXJldHVybiBkZXZtX2Nsa19idWxrX2dldChody0+ZGV2LCBDTEtfTUFYLCBody0+Z2F0ZXMpOwo+ ICt9CgpbU2V2ZXJpdHk6IEhpZ2hdCnZkZWNfY2xvY2tfZ2F0ZV9pbml0KCkgYWNxdWlyZXMgaHct PmdhdGVzW0NMS19ET1NdICgiZG9zIiksIGJ1dApwbV92ZGVjX3Bvd2VyX2RvbWFpbl9wb3dlcl9v bigpIGFuZCBwbV92ZGVjX3Bvd2VyX2RvbWFpbl9wb3dlcl9vZmYoKSBvbmx5CmVuYWJsZSBhbmQg ZGlzYWJsZSB0aGUgInZkZWMiIGFuZCAiaHZkZWMiIGNsb2NrcywgYW5kIGRvc19lbmFibGUoKSBv bmx5IHdyaXRlcwppbnRlcm5hbCBET1MgcmVnaXN0ZXJzLgoKV2hlcmUgaXMgaHctPmdhdGVzW0NM S19ET1NdLmNsayBwcmVwYXJlZCBhbmQgZW5hYmxlZCBiZWZvcmUgZG9zX2xvY2FsX2NvbmZpZygp CmFuZCBkb3NfZW5hYmxlKCkgYWNjZXNzIERPU19CVVMgcmVnaXN0ZXJzPyBJZiBDTEtJRF9ET1Mg aXMgZ2F0ZWQgYnkgdGhlCmJvb3Rsb2FkZXIgb3IgY2xrX2Rpc2FibGVfdW51c2VkLCB3b24ndCB0 aGVzZSBNTUlPIGFjY2Vzc2VzIGhhbmcgb3IgYWJvcnQ/CgpbIC4uLiBdCgo+ICtzdGF0aWMgaW50 IHBtX3ZkZWNfcG93ZXJfZG9tYWluX2luaXQoc3RydWN0IGFtbF92ZGVjX2h3ICpodykKPiArewo+ ICsJaW50IGksIGVycjsKPiArCWNvbnN0IHN0cnVjdCBwb3dlcl9tYW5hZ2VyX3MgKnBtID0gaHct PnBtOwo+ICsJc3RydWN0IHBtX3BkX3MgKnBkID0gcG0tPnBkX2RhdGE7Cj4gKwo+ICsJbXV0ZXhf aW5pdCgmaHctPnBtX211dGV4KTsKPiArCj4gKwlmb3IgKGkgPSAwOyBpIDwgVkRFQ19NQVg7IGkr Kykgewo+ICsJCXBkW2ldLmRldiA9IGRldl9wbV9kb21haW5fYXR0YWNoX2J5X25hbWUoaHctPmRl diwgcGRbaV0ubmFtZSk7Cj4gKwkJaWYgKElTX0VSUl9PUl9OVUxMKHBkW2ldLmRldikpIHsKPiAr CQkJZXJyID0gUFRSX0VSUihwZFtpXS5kZXYpOwo+ICsJCQlkZXZfZGJnKGh3LT5kZXYsICJHZXQg JXMgZmFpbGVkLCBwbS1kb21haW46ICVkXG4iLAo+ICsJCQkJcGRbaV0ubmFtZSwgZXJyKTsKPiAr CQkJcGRbaV0uZGV2ID0gTlVMTDsKPiArCQkJY29udGludWU7Cj4gKwkJfQoKWyAuLi4gXQoKPiAr c3RhdGljIHZvaWQgcG1fdmRlY19wb3dlcl9kb21haW5fcG93ZXJfb24oc3RydWN0IGFtbF92ZGVj X2h3ICpodywgaW50IGlkKQo+ICt7Cj4gKwljb25zdCBzdHJ1Y3QgcG93ZXJfbWFuYWdlcl9zICpw bSA9IGh3LT5wbTsKPiArCXN0cnVjdCBkZXZpY2UgKmRldiA9IHBtLT5wZF9kYXRhW2lkXS5kZXY7 Cj4gKwlzdHJ1Y3QgY2xrX2J1bGtfZGF0YSAqZ2F0ZV9ub2RlID0gTlVMTDsKPiArCWludCByZXQg PSAwOwo+ICsKPiArCWlmIChpZCA9PSBWREVDKQo+ICsJCWdhdGVfbm9kZSA9IHZkZWNfZ2V0X2Ns a19ieV9uYW1lKGh3LCAidmRlYyIpOwo+ICsJZWxzZSBpZiAoaWQgPT0gSFZERUMpCj4gKwkJZ2F0 ZV9ub2RlID0gdmRlY19nZXRfY2xrX2J5X25hbWUoaHcsICJodmRlYyIpOwo+ICsKPiArCWlmIChn YXRlX25vZGUpIHsKPiArCQlyZXQgPSBjbGtfcHJlcGFyZV9lbmFibGUoZ2F0ZV9ub2RlLT5jbGsp Owo+ICsJCWlmIChyZXQpIHsKPiArCQkJZGV2X2Vycihody0+ZGV2LCAiZmFpbGVkIHRvIGVuYWJs ZSAlcyBjbG9jazogJWRcbiIsCj4gKwkJCQlnYXRlX25vZGUtPmlkLCByZXQpOwo+ICsJCX0gZWxz ZSB7Cj4gKwkJCWlmIChpZCA9PSBWREVDKSB7Cj4gKwkJCQljbGtfc2V0X3JhdGUoZ2F0ZV9ub2Rl LT5jbGssIDQ5OTk5OTk5Mik7Cj4gKwkJCQlkZXZfZGJnKGh3LT5kZXYsICJhZnRlciBzZXQsIHZk ZWMgY2xvY2sgaXMgJWx1IEh6XG4iLAo+ICsJCQkJCWNsa19nZXRfcmF0ZShnYXRlX25vZGUtPmNs aykpOwo+ICsJCQl9Cj4gKwkJCWRldl9kYmcoaHctPmRldiwgInRoZSAlLTE1cyBjbG9jayBvblxu IiwgZ2F0ZV9ub2RlLT5pZCk7Cj4gKwkJfQo+ICsJfSBlbHNlIHsKPiArCQlkZXZfaW5mbyhody0+ ZGV2LCAiY2xrICVkLCB1bnJlYWNoYWJsZVxuIiwgaWQpOwo+ICsJCXJldCA9IC1FTk9ERVY7Cj4g Kwl9Cj4gKwo+ICsJaWYgKCFyZXQgJiYgZGV2KSB7Cj4gKwkJcmV0ID0gcG1fcnVudGltZV9yZXN1 bWVfYW5kX2dldChkZXYpOwo+ICsJCWlmIChyZXQgPCAwKQo+ICsJCQlkZXZfZXJyKGh3LT5kZXYs ICJmYWlsZWQgdG8gcG93ZXIgb24gJXMgZG9tYWluOiAlZFxuIiwKPiArCQkJCXBtLT5wZF9kYXRh W2lkXS5uYW1lLCByZXQpOwo+ICsJCWVsc2UKPiArCQkJZGV2X2RiZyhkZXYsICJkZXY6ICVwIGxp bmsgJXAgdGhlICUtMTVzIHBvd2VyIG9uXG4iLAo+ICsJCQkJZGV2LCBwbS0+cGRfZGF0YVtpZF0u bGluaywgcG0tPnBkX2RhdGFbaWRdLm5hbWUpOwo+ICsJfQo+ICsKPiArCS8qCj4gKwkgKiBEbyBu b3QgdG91Y2ggdGhlIERPUyByZWdpc3RlcnMgd2hlbiB0aGUgY2xvY2sgb3IgdGhlIHBvd2VyCj4g KwkgKiBkb21haW4gY291bGQgbm90IGJlIGVuYWJsZWQsIHRoZSBNTUlPIGFjY2VzcyB3b3VsZCBh Ym9ydC4KPiArCSAqLwo+ICsJaWYgKCFyZXQpCj4gKwkJZG9zX2xvY2FsX2NvbmZpZyhodywgMSwg aWQpOwo+ICt9Cj4gKwo+ICtzdGF0aWMgdm9pZCBwbV92ZGVjX3Bvd2VyX2RvbWFpbl9wb3dlcl9v ZmYoc3RydWN0IGFtbF92ZGVjX2h3ICpodywgaW50IGlkKQo+ICt7Cj4gKwljb25zdCBzdHJ1Y3Qg cG93ZXJfbWFuYWdlcl9zICpwbSA9IGh3LT5wbTsKPiArCXN0cnVjdCBkZXZpY2UgKmRldiA9IHBt LT5wZF9kYXRhW2lkXS5kZXY7Cj4gKwlzdHJ1Y3QgY2xrX2J1bGtfZGF0YSAqZ2F0ZV9ub2RlID0g TlVMTDsKPiArCj4gKwlkb3NfbG9jYWxfY29uZmlnKGh3LCAwLCBpZCk7Cj4gKwo+ICsJaWYgKGRl dikgewo+ICsJCXBtX3J1bnRpbWVfcHV0X3N5bmMoZGV2KTsKPiArCQlkZXZfZGJnKGRldiwgImRl djogJXAgbGluayAlcCB0aGUgJS0xNXMgcG93ZXIgb2ZmXG4iLAo+ICsJCQlkZXYsIHBtLT5wZF9k YXRhW2lkXS5saW5rLCBwbS0+cGRfZGF0YVtpZF0ubmFtZSk7Cj4gKwl9Cj4gKwo+ICsJaWYgKGlk ID09IFZERUMpCj4gKwkJZ2F0ZV9ub2RlID0gdmRlY19nZXRfY2xrX2J5X25hbWUoaHcsICJ2ZGVj Iik7Cj4gKwllbHNlIGlmIChpZCA9PSBIVkRFQykKPiArCQlnYXRlX25vZGUgPSB2ZGVjX2dldF9j bGtfYnlfbmFtZShodywgImh2ZGVjIik7Cj4gKwo+ICsJaWYgKGdhdGVfbm9kZSkgewo+ICsJCWNs a19kaXNhYmxlX3VucHJlcGFyZShnYXRlX25vZGUtPmNsayk7Cj4gKwkJZGV2X2RiZyhody0+ZGV2 LCAidGhlICUtMTVzIGNsb2NrIG9mZlxuIiwgZ2F0ZV9ub2RlLT5pZCk7Cj4gKwl9IGVsc2Ugewo+ ICsJCWRldl9pbmZvKGh3LT5kZXYsICJjbGsgJWQsIHVucmVhY2hhYmxlXG4iLCBpZCk7Cj4gKwl9 Cj4gK30KPiArCj4gK3N0YXRpYyB2b2lkIHZkZWNfcG93ZXJvbihzdHJ1Y3QgYW1sX3ZkZWNfaHcg Kmh3LCBlbnVtIHZkZWNfdHlwZV9lIGNvcmUpCj4gK3sKPiArCWlmIChjb3JlID49IFZERUNfTUFY KQo+ICsJCXJldHVybjsKPiArCj4gKwltdXRleF9sb2NrKCZody0+cG1fbXV0ZXgpOwo+ICsJaWYg KCFody0+cG0tPnBkX2RhdGFbY29yZV0uZGV2KQo+ICsJCWdvdG8gb3V0Owo+ICsKPiArCWh3LT5w bS0+cGRfZGF0YVtjb3JlXS5yZWZfY291bnQrKzsKPiArCWlmIChody0+cG0tPnBkX2RhdGFbY29y ZV0ucmVmX2NvdW50ID4gMSkKPiArCQlnb3RvIG91dDsKPiArCj4gKwlody0+cG0tPnBvd2VyX29u KGh3LCBjb3JlKTsKPiArCj4gK291dDoKPiArCW11dGV4X3VubG9jaygmaHctPnBtX211dGV4KTsK PiArfQoKW1NldmVyaXR5OiBIaWdoXQpUaGVyZSBhcHBlYXIgdG8gYmUgdHdvIGVycm9yLWhhbmRs aW5nIGlzc3VlcyBpbiB0aGUgcG93ZXIgZG9tYWluIGFuZCBjbG9jawpoZWxwZXJzIGhlcmU6Cgox LiBJbiBwbV92ZGVjX3Bvd2VyX2RvbWFpbl9pbml0KCksIGlmIGRldl9wbV9kb21haW5fYXR0YWNo X2J5X25hbWUoKSByZXR1cm5zCmFuIGVycm9yIHBvaW50ZXIgKHN1Y2ggYXMgLUVQUk9CRV9ERUZF Uikgb3IgTlVMTCwgcGRbaV0uZGV2IGlzIHNldCB0byBOVUxMIGFuZAp0aGUgbG9vcCBjb250aW51 ZXMgd2hpbGUgcmV0dXJuaW5nIDAuIFRoZW4gdmRlY19wb3dlcm9uKCkgc2VlcwohaHctPnBtLT5w ZF9kYXRhW2NvcmVdLmRldiBhbmQgZXhpdHMgd2l0aG91dCBlbmFibGluZyB0aGUgY2xvY2sgb3Ig cG93ZXIKZG9tYWluLCB3aGlsZSB2ZGVjX2VuYWJsZSgpIHN0aWxsIHJldHVybnMgMC4gV29uJ3Qg c3Vic2VxdWVudCBNTUlPIHdyaXRlcyBpbgptMm1vcHNfdmRlY19kZXZpY2VfcnVuKCkgLT4gZG9z X2VuYWJsZSgpIGFjY2VzcyB1bnBvd2VyZWQgYW5kIHVuY2xvY2tlZCBET1MKcmVnaXN0ZXJzPwoK Mi4gSW4gcG1fdmRlY19wb3dlcl9kb21haW5fcG93ZXJfb24oKSwgaWYgY2xrX3ByZXBhcmVfZW5h YmxlKGdhdGVfbm9kZS0+Y2xrKQpzdWNjZWVkcyBhbmQgcG1fcnVudGltZV9yZXN1bWVfYW5kX2dl dChkZXYpIGZhaWxzLCBnYXRlX25vZGUtPmNsayBpcyBsZWZ0CmVuYWJsZWQgYW5kIHRoZSBmYWls dXJlIGlzIG5vdCBwcm9wYWdhdGVkIHRvIHZkZWNfcG93ZXJvbigpIG9yIHZkZWNfZW5hYmxlKCks CmxlYXZpbmcgcmVmX2NvdW50IGF0IDEuIFdoZW4gdmRlY19kaXNhYmxlKCkgLT4gdmRlY19wb3dl cm9mZigpIC0+CnBtX3ZkZWNfcG93ZXJfZG9tYWluX3Bvd2VyX29mZigpIGxhdGVyIHJ1bnMsIHdv bid0IGl0IGNhbGwKZG9zX2xvY2FsX2NvbmZpZyhodywgMCwgaWQpIG9uIHRoZSB1bnBvd2VyZWQg ZG9tYWluIGFuZCBjYWxsCnBtX3J1bnRpbWVfcHV0X3N5bmMoZGV2KSBkZXNwaXRlIHBtX3J1bnRp bWVfcmVzdW1lX2FuZF9nZXQoZGV2KSBoYXZpbmcgZmFpbGVkPwoKWyAuLi4gXQoKPiArCWh3LT5j YW52YXMgPSBtZXNvbl9jYW52YXNfZ2V0KCZwZGV2LT5kZXYpOwo+ICsJaWYgKElTX0VSUl9PUl9O VUxMKGh3LT5jYW52YXMpKQo+ICsJCXJldHVybiBQVFJfRVJSKGh3LT5jYW52YXMpOwo+ICsKPiAr CXNtX25wID0gb2ZfcGFyc2VfcGhhbmRsZShwZGV2LT5kZXYub2Zfbm9kZSwgImFtbG9naWMsc2Vj dXJlLW1vbml0b3IiLCAwKTsKPiArCWlmICghc21fbnApCj4gKwkJcmV0dXJuIC1FTk9ERVY7Cj4g Kwo+ICsJaHctPnNlY19mdyA9IG1lc29uX3NtX2dldChzbV9ucCk7Cj4gKwlvZl9ub2RlX3B1dChz bV9ucCk7Cj4gKwlpZiAoSVNfRVJSKGh3LT5zZWNfZncpKQo+ICsJCXJldHVybiBQVFJfRVJSKGh3 LT5zZWNfZncpOwoKW1NldmVyaXR5OiBIaWdoXQpJbiBkcml2ZXJzL2Zpcm13YXJlL21lc29uL21l c29uX3NtLmMsIG1lc29uX3NtX2dldCgpIHJldHVybnMgTlVMTCAobm90IGFuCkVSUl9QVFIpIHdo ZW4gdGhlIHNlY3VyZS1tb25pdG9yIHBsYXRmb3JtIGRldmljZSBoYXMgbm90IHByb2JlZCB5ZXQu CgpCZWNhdXNlIElTX0VSUihOVUxMKSBpcyBmYWxzZSwgZGV2X3JlcXVlc3RfaHdfcmVzb3VyY2Vz KCkgc3VjY2VlZHMgd2l0aApody0+c2VjX2Z3ID09IE5VTEwgaW5zdGVhZCBvZiByZXR1cm5pbmcg LUVQUk9CRV9ERUZFUi4gV2hlbiBkZWNvZGluZyBzdGFydHMgaW4KbTJtb3BzX3ZkZWNfZGV2aWNl X3J1bigpIC0+IGxvYWRfZmlybXdhcmUoKSAtPiBtZXNvbl9zbV9jYWxsKGh3LT5zZWNfZncsIC4u LiksCndvbid0IG1lc29uX3NtX2NhbGwoKSBkZXJlZmVyZW5jZSBhIE5VTEwgaHctPnNlY19mdyBw b2ludGVyIG9uIGZ3LT5jaGlwPwoKU2ltaWxhcmx5LCBhYm92ZSB0aGF0IGNoZWNrLCBpZiBtZXNv bl9jYW52YXNfZ2V0KCkgd2VyZSB0byByZXR1cm4gTlVMTCwKaWYgKElTX0VSUl9PUl9OVUxMKGh3 LT5jYW52YXMpKSByZXR1cm4gUFRSX0VSUihody0+Y2FudmFzKTsgd291bGQgcmV0dXJuIDAuClNo b3VsZCBody0+Y2FudmFzIHVzZSBJU19FUlIoaHctPmNhbnZhcykgYW5kIGh3LT5zZWNfZncgY2hl Y2sgIWh3LT5zZWNfZncgYW5kCnJldHVybiAtRVBST0JFX0RFRkVSPwoKWyAuLi4gXQoKPiBkaWZm IC0tZ2l0IGEvZHJpdmVycy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvYW1sX3ZkZWNfdGVl X2Z3LmMgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2FtbG9naWMvdmRlYy9hbWxfdmRlY190ZWVf ZncuYwo+IG5ldyBmaWxlIG1vZGUgMTAwNjQ0Cj4gaW5kZXggMDAwMDAwMDAwMDAwMC4uOWFmOWVh ZTg4ZmI4OQo+IC0tLSAvZGV2L251bGwKPiArKysgYi9kcml2ZXJzL21lZGlhL3BsYXRmb3JtL2Ft bG9naWMvdmRlYy9hbWxfdmRlY190ZWVfZncuYwoKWyAuLi4gXQoKPiArCS8qIE9wZW4gc2Vzc2lv biAqLwo+ICsJbWVtY3B5KHNlc3NfYXJnLnV1aWQsIHV1aWQuYiwgVEVFX0lPQ1RMX1VVSURfTEVO KTsKPiArCXNlc3NfYXJnLmNsbnRfbG9naW4gPSBURUVfSU9DVExfTE9HSU5fUFVCTElDOwo+ICsJ c2Vzc19hcmcubnVtX3BhcmFtcyA9IFRFRV9QQVJBTV9OVU07Cj4gKwlyZXQgPSB0ZWVfY2xpZW50 X29wZW5fc2Vzc2lvbihjdHgsICZzZXNzX2FyZywgcGFyYW1faW5pdCk7Cj4gKwlpZiAocmV0IDwg MCB8fCBzZXNzX2FyZy5yZXQgIT0gVEVFQ19TVUNDRVNTKSB7Cj4gKwkJZGV2X2luZm8oaHctPmRl diwKPiArCQkJICIlcyBvcGVuIHNlc3Npb24gZmFpbGVkLCBjbWQgPSAldSwgcmV0ID0gJWQsIHJl cyA9IDB4JXgsIG9yaWdpbiA9IDB4JXhcbiIsCj4gKwkJCSBfX2Z1bmNfXywgY21kLCByZXQsIHNl c3NfYXJnLnJldCwgc2Vzc19hcmcucmV0X29yaWdpbik7Cj4gKwkJaWYgKCFyZXQpCj4gKwkJCXJl dCA9IHNlc3NfYXJnLnJldDsKPiArCQlnb3RvIGZyZWVfc2htOwo+ICsJfQo+ICsKPiArCWludl9h cmcuZnVuYyA9IGNtZDsKPiArCWludl9hcmcuc2Vzc2lvbiA9IHNlc3NfYXJnLnNlc3Npb247Cj4g KwlpbnZfYXJnLm51bV9wYXJhbXMgPSBURUVfUEFSQU1fTlVNOwo+ICsKPiArCXdoaWxlIChzZW50 X3NpemUgPCBmd19zaXplKSB7Cj4gKwkJbWVtc2V0KHNobV92YSwgMCwgT05DRV9TRU5UX1NJWkUp Owo+ICsJCWlmIChmd19zaXplIC0gc2VudF9zaXplID4gT05DRV9TRU5UX1NJWkUpIHsKPiArCQkJ bWVtY3B5KHNobV92YSwgKGZpcm13YXJlX2RhdGEgKyBzZW50X3NpemUpLAo+ICsJCQkgICAgICAg T05DRV9TRU5UX1NJWkUpOwo+ICsJCQlwYXJhbV9pbnZva2VbMF0udS5tZW1yZWYuc2l6ZSA9IE9O Q0VfU0VOVF9TSVpFOwo+ICsJCX0gZWxzZSB7Cj4gKwkJCW1lbWNweShzaG1fdmEsIChmaXJtd2Fy ZV9kYXRhICsgc2VudF9zaXplKSwKPiArCQkJICAgICAgIGZ3X3NpemUgLSBzZW50X3NpemUpOwo+ ICsJCQlwYXJhbV9pbnZva2VbMF0udS5tZW1yZWYuc2l6ZSA9IChmd19zaXplIC0gc2VudF9zaXpl KTsKPiArCQl9Cj4gKwkJcGFyYW1faW52b2tlWzBdLnUubWVtcmVmLnNobSA9IHNobTsKPiArCQly ZXQgPSB0ZWVfY2xpZW50X2ludm9rZV9mdW5jKGN0eCwgJmludl9hcmcsIHBhcmFtX2ludm9rZSk7 Cj4gKwkJaWYgKHJldCA8IDAgfHwgKGludl9hcmcucmV0ICE9IFRFRUNfU1VDQ0VTUyAmJiBpbnZf YXJnLnJldCAhPSBURUVDX0VSUk9SX0JVU1kpKSB7Cj4gKwkJCWRldl9pbmZvKGh3LT5kZXYsCj4g KwkJCQkgIiVzIGludm9rZSBmdW5jIGZhaWxlZCwgY21kID0gJXUsIHJldD0gJWQsIHJlcyA9IDB4 JXgsIG9yaWdpbiA9IDB4JXhcbiIsCj4gKwkJCQkgX19mdW5jX18sIGNtZCwgcmV0LCBpbnZfYXJn LnJldCwKPiArCQkJCSBpbnZfYXJnLnJldF9vcmlnaW4pOwo+ICsJCQlpZiAoIXJldCkKPiArCQkJ CXJldCA9IGludl9hcmcucmV0Owo+ICsJCQlnb3RvIGNsb3NlX3Nlc3Npb247Cj4gKwkJfQo+ICsJ CXNlbnRfc2l6ZSArPSBwYXJhbV9pbnZva2VbMF0udS5tZW1yZWYuc2l6ZTsKPiArCX0KClsgLi4u IF0KCj4gKwljdHggPSB0ZWVfY2xpZW50X29wZW5fY29udGV4dChOVUxMLCBvcHRlZV9jdHhfbWF0 Y2gsIE5VTEwsIE5VTEwpOwo+ICsJaWYgKElTX0VSUihjdHgpKSB7Cj4gKwkJZGV2X2luZm8oaHct PmRldiwgIkZhaWxlZCB0byBvcGVuIFRFRSBjb250ZXh0XG4iKTsKPiArCQlyZXQgPSBQVFJfRVJS KGN0eCk7Cj4gKwkJZ290byBmcmVlX2Zpcm13YXJlOwo+ICsJfQoKW1NldmVyaXR5OiBIaWdoXQpJ biBhbWxfdmRlY19kcnZfcHJvYmUoKSAtPiBkZXZfcmVxdWVzdF9od19yZXNvdXJjZXMoKSAtPiBh bWxfdGVlX2Z3X3ByZWxvYWQoKQotPiBwYXNzX2Zpcm13YXJlX3RvX3RlZSgpOgoKMS4gV2hlbiB0 aGUgT1AtVEVFIGRyaXZlciBoYXMgbm90IHJlZ2lzdGVyZWQgaXRzIFRFRSBkZXZpY2UgeWV0LAp0 ZWVfY2xpZW50X29wZW5fY29udGV4dCgpIHJldHVybnMgRVJSX1BUUigtRU5PRU5UKS4gUHJvcGFn YXRpbmcgLUVOT0VOVCBjYXVzZXMKYW1sX3ZkZWNfZHJ2X3Byb2JlKCkgdG8gZmFpbCBwZXJtYW5l bnRseSBpbnN0ZWFkIG9mIGRlZmVycmluZyBwcm9iZSB3aXRoCi1FUFJPQkVfREVGRVIuCgoyLiBJ biB0ZWVfcHRhX2ludm9rZV9jbWQoKSwgd2hlbiB0ZWVfY2xpZW50X29wZW5fc2Vzc2lvbigpIG9y CnRlZV9jbGllbnRfaW52b2tlX2Z1bmMoKSByZXR1cm5zIDAgd2l0aCBzZXNzX2FyZy5yZXQgIT0g VEVFQ19TVUNDRVNTIG9yCmludl9hcmcucmV0ICE9IFRFRUNfU1VDQ0VTUywgcmV0IGlzIGFzc2ln bmVkIHRoZSByYXcgdTMyIFRFRUMgc3RhdHVzIGNvZGUKcmF0aGVyIHRoYW4gYSBuZWdhdGl2ZSBl cnJubyAod2hpY2ggYW1sX3ZkZWNfZHJ2X3Byb2JlKCkgb25seSBjaGVja3MgZm9yCnJldCA8IDAp LgoKMy4gSW4gdGVlX3B0YV9pbnZva2VfY21kKCksIHdoZW4gaW52X2FyZy5yZXQgPT0gVEVFQ19F UlJPUl9CVVNZLCB0aGUgZXJyb3IKYnJhbmNoIGlzIHNraXBwZWQgYW5kIHNlbnRfc2l6ZSArPSBw YXJhbV9pbnZva2VbMF0udS5tZW1yZWYuc2l6ZSBhZHZhbmNlcyBwYXN0CnRoZSBjdXJyZW50IDEy OCBLQiBjaHVuayB3aXRob3V0IHJldHJ5aW5nIGl0LiBXb24ndCB0aGlzIHNpbGVudGx5IGRyb3Ag YQpjaHVuayBvZiBmaXJtd2FyZSBkYXRhPwoKWyAuLi4gXQoKPiBkaWZmIC0tZ2l0IGEvZHJpdmVy cy9tZWRpYS9wbGF0Zm9ybS9hbWxvZ2ljL3ZkZWMvaDI2NC5jIGIvZHJpdmVycy9tZWRpYS9wbGF0 Zm9ybS9hbWxvZ2ljL3ZkZWMvaDI2NC5jCj4gbmV3IGZpbGUgbW9kZSAxMDA2NDQKPiBpbmRleCAw MDAwMDAwMDAwMDAwLi43ZWM3YWY3M2Q0NGM3Cj4gLS0tIC9kZXYvbnVsbAo+ICsrKyBiL2RyaXZl cnMvbWVkaWEvcGxhdGZvcm0vYW1sb2dpYy92ZGVjL2gyNjQuYwoKWyAuLi4gXQoKPiArc3RhdGlj IGludCBwb2NfaXNfaW5fZHBiKGludCBwb2MsIGNvbnN0IHN0cnVjdCB2NGwyX2gyNjRfZHBiX2Vu dHJ5ICpkcGIpCj4gK3sKPiArCWludCBpOwo+ICsJaW50IHJldCA9IDA7Cj4gKwo+ICsJZm9yIChp ID0gMDsgaSA8IFY0TDJfSDI2NF9OVU1fRFBCX0VOVFJJRVM7IGkrKykgewo+ICsJCWlmIChwb2Mg PT0gZHBiW2ldLnRvcF9maWVsZF9vcmRlcl9jbnQpIHsKPiArCQkJcmV0ID0gMTsKPiArCQkJYnJl YWs7Cj4gKwkJfQo+ICsJfQo+ICsKPiArCXJldHVybiByZXQ7Cj4gK30KCltTZXZlcml0eTogSGln aF0KSW4gcG9jX2lzX2luX2RwYigpLCBkcGJbaV0udG9wX2ZpZWxkX29yZGVyX2NudCBpcyBtYXRj aGVkIGFjcm9zcyBhbGwgMTYKZW50cmllcyBvZiBkcGJbXSB3aXRob3V0IGNoZWNraW5nIGRwYltp XS5mbGFncyAmIFY0TDJfSDI2NF9EUEJfRU5UUllfRkxBR19BQ1RJVkUuClRoZSBzYW1lIGlzc3Vl IGFsc28gb2NjdXJzIGluIGdldF9kcGJfYnlfcG9jKCkgZnVydGhlciBiZWxvdzoKCiAgICBzdGF0 aWMgc3RydWN0IHY0bDJfaDI2NF9kcGJfZW50cnkgKgogICAgZ2V0X2RwYl9ieV9wb2Moc3RydWN0 IHY0bDJfY3RybF9oMjY0X2RlY29kZV9wYXJhbXMgKmRlY29kZSwgaW50IHBvYykKICAgIHsKICAg ICAgICBpbnQgaTsKCiAgICAgICAgZm9yIChpID0gMDsgaSA8IFY0TDJfSDI2NF9OVU1fRFBCX0VO VFJJRVM7IGkrKykgewogICAgICAgICAgICBpZiAoZGVjb2RlLT5kcGJbaV0udG9wX2ZpZWxkX29y ZGVyX2NudCA9PSBwb2MpCiAgICAgICAgICAgICAgICByZXR1cm4gJmRlY29kZS0+ZHBiW2ldOwog ICAgICAgIH0KICAgICAgICByZXR1cm4gTlVMTDsKICAgIH0KCkJlY2F1c2UgdW51c2VkIERQQiBl bnRyaWVzIGhhdmUgZmxhZ3MgPT0gMCBhbmQgdG9wX2ZpZWxkX29yZGVyX2NudCA9PSAwIChhbmQK ZXZpY3RlZCBlbnRyaWVzIG1heSByZXRhaW4gdGhlaXIgc3RhbGUgdG9wX2ZpZWxkX29yZGVyX2Nu dCB3aXRoIHRoZSBhY3RpdmUKZmxhZyBjbGVhcmVkKToKCjEuIEluIGgyNjRfY29uZmlnX2RlY29k ZV9zcGVjKCkgLT4gY2xlYXJfdW51c2VkX2NvbF9idWYoKSwgcG9jX2lzX2luX2RwYigpCm1hdGNo ZXMgaW5hY3RpdmUgRFBCIHNsb3RzLCBwcmV2ZW50aW5nIGNhbnZhc19wb3MgYW5kIGNvbG9jYXRl ZF9idWYgc2xvdHMgZnJvbQpiZWluZyByZWxlYXNlZCBvbiBub24tSURSIGZyYW1lcyBhbmQgZXho YXVzdGluZyB0aGUgMTcgY2FudmFzX3BvcyBzbG90cwooZXNwZWNpYWxseSBvbiBtdWx0aS1zbGlj ZSBmcmFtZXMgd2hlcmUgaDI2NF9jb25maWdfZGVjb2RlX3NwZWMoKSBpcyBjYWxsZWQgb24KZXZl cnkgc2xpY2UpLgoKMi4gSW4gaDI2NF9jb25maWdfZGVjb2RlX2J1ZigpLCBpZiBhbiBpbmFjdGl2 ZSBEUEIgc2xvdCB3aXRoCnRvcF9maWVsZF9vcmRlcl9jbnQgPT0gMCBwcmVjZWRlcyBhbiBhY3Rp dmUgcmVmZXJlbmNlIHBpY3R1cmUgd2l0aCBQT0MgMCwKZ2V0X2RwYl9ieV9wb2MoZGVjb2RlLCAw KSByZXR1cm5zIHRoZSBpbmFjdGl2ZSBzbG90LCBzbwppZiAoZHBiICYmIChkcGItPmZsYWdzICYg VjRMMl9IMjY0X0RQQl9FTlRSWV9GTEFHX0FDVElWRSkpIGV2YWx1YXRlcyB0byBmYWxzZQphbmQg d3JpdGVzIDAgaW50byBIMjY0X0JVRkZFUl9JTkZPX0RBVEEgZm9yIHRoZSBhY3RpdmUgcmVmZXJl bmNlIGZyYW1lLgoKU2hvdWxkIGJvdGggcG9jX2lzX2luX2RwYigpIGFuZCBnZXRfZHBiX2J5X3Bv YygpIHJlcXVpcmUKKGRwYltpXS5mbGFncyAmIFY0TDJfSDI2NF9EUEJfRU5UUllfRkxBR19BQ1RJ VkUpPwoKWyAuLi4gXQoKPiArc3RhdGljIGludCBnZXRfcmVmaWR4X2J5X3BpY251bShzdHJ1Y3Qg YW1sX2gyNjRfY3R4ICpoMjY0X2N0eCwgaW50IHBpY19udW0sCj4gKwkJCQlpbnQgY3Vycl9saXN0 KQo+ICt7Cj4gKwlpbnQgaTsKPiArCXN0cnVjdCBoMjY0X2RlY29kZV9idWZfc3BlYyAqcmVmX2xp c3Q7Cj4gKwo+ICsJaWYgKGN1cnJfbGlzdCA9PSAwKQo+ICsJCXJlZl9saXN0ID0gJmgyNjRfY3R4 LT5yZWZfbGlzdDBbMF07Cj4gKwllbHNlCj4gKwkJcmVmX2xpc3QgPSAmaDI2NF9jdHgtPnJlZl9s aXN0MVswXTsKPiArCj4gKwlmb3IgKGkgPSAwOyByZWZfbGlzdFtpXS5kcGI7IGkrKykgewo+ICsJ CWlmIChwaWNfbnVtID09IHJlZl9saXN0W2ldLmRwYi0+cGljX251bSkKPiArCQkJcmV0dXJuIGk7 Cj4gKwl9Cj4gKwo+ICsJcmV0dXJuIC0xOwo+ICt9Cj4gKwo+ICtzdGF0aWMgc3RydWN0IGgyNjRf ZGVjb2RlX2J1Zl9zcGVjICpnZXRfc3RfcmVmcGljX2J5X251bShzdHJ1Y3QgYW1sX2gyNjRfY3R4 ICpoMjY0X2N0eCwKPiArCQkJCQkJCSBpbnQgcGljX251bSwgaW50IGN1cnJfbGlzdCkKPiArewo+ ICsJaW50IGk7Cj4gKwlzdHJ1Y3QgaDI2NF9kZWNvZGVfYnVmX3NwZWMgKnJlZl9saXN0Owo+ICsK PiArCWlmIChjdXJyX2xpc3QgPT0gMCkKPiArCQlyZWZfbGlzdCA9ICZoMjY0X2N0eC0+cmVmX2xp c3QwX3VucmVvcmRlcmVkWzBdOwo+ICsJZWxzZQo+ICsJCXJlZl9saXN0ID0gJmgyNjRfY3R4LT5y ZWZfbGlzdDFfdW5yZW9yZGVyZWRbMF07Cj4gKwo+ICsJZm9yIChpID0gMDsgcmVmX2xpc3RbaV0u ZHBiOyBpKyspIHsKPiArCQlpZiAocGljX251bSA9PSByZWZfbGlzdFtpXS5kcGItPnBpY19udW0g JiYgcmVmX2xpc3RbaV0ubG9uZ190ZXJtX2ZsYWcgPT0gMCkKPiArCQkJcmV0dXJuICZyZWZfbGlz dFtpXTsKPiArCX0KPiArCj4gKwlyZXR1cm4gTlVMTDsKPiArfQo+ICsKPiArc3RhdGljIHN0cnVj dCBoMjY0X2RlY29kZV9idWZfc3BlYyAqZ2V0X2x0X3JlZnBpY19ieV9udW0oc3RydWN0IGFtbF9o MjY0X2N0eCAqaDI2NF9jdHgsCj4gKwkJCQkJCQkgaW50IHBpY19udW0sIGludCBjdXJyX2xpc3Qp Cj4gK3sKPiArCWludCBpOwo+ICsJc3RydWN0IGgyNjRfZGVjb2RlX2J1Zl9zcGVjICpyZWZfbGlz dDsKPiArCj4gKwlpZiAoY3Vycl9saXN0ID09IDApCj4gKwkJcmVmX2xpc3QgPSAmaDI2NF9jdHgt PnJlZl9saXN0MF91bnJlb3JkZXJlZFswXTsKPiArCWVsc2UKPiArCQlyZWZfbGlzdCA9ICZoMjY0 X2N0eC0+cmVmX2xpc3QxX3VucmVvcmRlcmVkWzBdOwo+ICsKPiArCWZvciAoaSA9IDA7IHJlZl9s aXN0W2ldLmRwYjsgaSsrKSB7Cj4gKwkJaWYgKHBpY19udW0gPT0gcmVmX2xpc3RbaV0uZHBiLT5w aWNfbnVtICYmIHJlZl9saXN0W2ldLmxvbmdfdGVybV9mbGFnID09IDEpCj4gKwkJCXJldHVybiAm cmVmX2xpc3RbaV07Cj4gKwl9Cj4gKwo+ICsJcmV0dXJuIE5VTEw7Cj4gK30KPiArCj4gK3N0YXRp YyB2b2lkIHJlb3JkZXJfc2hvcnRfdGVybShzdHJ1Y3Qgc2xpY2UgKmN1cnJfc2xpY2UsIGludCBj dXJfbGlzdCwKPiArCQkJICAgICAgIGludCBwaWNfbnVtX2x4LCBpbnQgKnJlZl9pZHhfbHgpCj4g K3sKClsgLi4uIF0KCj4gKwlmb3IgKGNfaWR4ID0gbnVtX3JlZl9pZHhfbHhfYWN0aXZlOyBjX2lk eCA+ICpyZWZfaWR4X2x4OyBjX2lkeC0tKQo+ICsJCW1lbWNweSgmcmVmX2xpc3RfcmVvcmRlcmVk W2NfaWR4XSwgJnJlZl9saXN0X3Jlb3JkZXJlZFtjX2lkeCAtIDFdLAo+ICsJCSAgICAgICBzaXpl b2Yoc3RydWN0IGgyNjRfZGVjb2RlX2J1Zl9zcGVjKSk7Cj4gKwo+ICsJbWVtY3B5KCZyZWZfbGlz dF9yZW9yZGVyZWRbKnJlZl9pZHhfbHhdLCBwaWNfbHgsIHNpemVvZihzdHJ1Y3QgaDI2NF9kZWNv ZGVfYnVmX3NwZWMpKTsKPiArCWRldl9kYmcoJmN0eC0+ZGV2LT5wbGF0X2Rldi0+ZGV2LCAiJXMg OiBSZWZQaWNMaXN0WFslZCBdID0gcGljICVwIHBpY19udW0oJWQpXG4iLCBfX2Z1bmNfXywKPiAr CQkqcmVmX2lkeF9seCwgcGljX2x4LCByZWZfbGlzdF9yZW9yZGVyZWRbKnJlZl9pZHhfbHhdLmRw Yi0+cGljX251bSk7Cj4gKwkqcmVmX2lkeF9seCA9ICpyZWZfaWR4X2x4ICsgMTsKPiArCj4gKwlu X2lkeCA9ICpyZWZfaWR4X2x4Owo+ICsJZm9yIChjX2lkeCA9ICpyZWZfaWR4X2x4OyBjX2lkeCA8 PSBudW1fcmVmX2lkeF9seF9hY3RpdmU7IGNfaWR4KyspIHsKPiArCQlpZiAocmVmX2xpc3RfcmVv cmRlcmVkW2NfaWR4XS5sb25nX3Rlcm1fZmxhZyB8fCAhcmVmX2xpc3RfcmVvcmRlcmVkW2NfaWR4 XS5kcGIgfHwKPiArCQkgICAgcmVmX2xpc3RfcmVvcmRlcmVkW2NfaWR4XS5kcGItPnBpY19udW0g IT0gcGljX251bV9seCkKPiArCQkJbWVtY3B5KCZyZWZfbGlzdF9yZW9yZGVyZWRbbl9pZHgrK10s ICZyZWZfbGlzdF9yZW9yZGVyZWRbY19pZHhdLAo+ICsJCQkgICAgICAgc2l6ZW9mKHN0cnVjdCBo MjY0X2RlY29kZV9idWZfc3BlYykpOwo+ICsJfQo+ICsKPiArCWgyNjRfY3R4LT5saXN0X3NpemVb Y3VyX2xpc3RdID0gbnVtX3JlZl9pZHhfbHhfYWN0aXZlOwo+ICt9CgpbU2V2ZXJpdHk6IENyaXRp Y2FsXQpDYW4gcmVmZXJlbmNlIGxpc3QgcmVvcmRlcmluZyBhbmQgY2FudmFzIGFsbG9jYXRpb24g cmVhZCBvdXQgb2YgYm91bmRzLApkZXJlZmVyZW5jZSBhIE5VTEwgZHBiIHBvaW50ZXIsIGFuZCBs ZWFrIGhhcmR3YXJlIGNhbnZhc2VzPwoKMS4gSW4gcmVvcmRlcl9zaG9ydF90ZXJtKCkgYW5kIHJl b3JkZXJfbG9uZ190ZXJtKCksIHdoZW4KbnVtX3JlZl9pZHhfbHhfYWN0aXZlID09IDE2IChWNEwy X0gyNjRfTlVNX0RQQl9FTlRSSUVTKSwgdGhlIHNoaWZ0IGxvb3AgY29waWVzCnJlZl9saXN0WzE1 XSBpbnRvIHJlZl9saXN0WzE2XSBhbmQgc2V0cyBsaXN0X3NpemVbY3VyX2xpc3RdID0gMTYuIEJl Y2F1c2UKaDI2NF9yZWxlYXNlX2RlY29kZV9zcGVjKCkgb25seSBjbGVhcnMgaW5kaWNlcyAwIC4u IGxpc3Rfc2l6ZVtjdXJfbGlzdF0gLSAxLApyZWZfbGlzdFsxNl0uZHBiIHJlbWFpbnMgbm9uLU5V TEwuIE9uIGEgc3Vic2VxdWVudCBjYWxsIHdoZXJlCnJlZl9saXN0WzAuLjE2XS5kcGIgYXJlIGFs bCBub24tTlVMTCwgdGhlIGxvb3BzIGluIGdldF9yZWZpZHhfYnlfcGljbnVtKCksCmdldF9zdF9y ZWZwaWNfYnlfbnVtKCksIGFuZCBnZXRfbHRfcmVmcGljX2J5X251bSgpIGhhdmUgbm8gdXBwZXIg Ym91bmQgb24gaQphbmQgcmVhZCBwYXN0IHRoZSBlbmQgb2YgcmVmX2xpc3QwW10gLyByZWZfbGlz dDFbXS4KCjIuIFdoZW4gbnVtX3JlZl9pZHhfbHhfYWN0aXZlIGV4Y2VlZHMgdGhlIG51bWJlciBv ZiB2YWxpZCBlbnRyaWVzIGJ1aWx0IGJ5CmgyNjRfY29uZmlnX3JlZl9saXN0cygpIChvciB3aGVu IGgyNjRfY29uZmlnX3JlZl9zcGVjKCkgZmFpbHMgb24gYW4gZW50cnkpLApyZW9yZGVyX3Nob3J0 X3Rlcm0oKSBhbmQgcmVvcmRlcl9sb25nX3Rlcm0oKSBzZXQKaDI2NF9jdHgtPmxpc3Rfc2l6ZVtj dXJfbGlzdF0gPSBudW1fcmVmX2lkeF9seF9hY3RpdmUuIFRoZW4gZ2V0X2NhbnZhc19pbmRleCgp CmFsbG9jYXRlcyBoYXJkd2FyZSBjYW52YXNlcyB2aWEgY29uZmlnX2RlY29kZV9jYW52YXMoKSBm b3IgZXZlcnkgZW50cnkgdXAgdG8KbGlzdF9zaXplW2N1cl9saXN0XSB3aXRob3V0IGNoZWNraW5n IGJ1Zi0+dXNlZCBvciBidWYtPnZhbGlkIChhbHNvIHdyaXRpbmcgRE1BCmFkZHJlc3MgMCB0byBB TkMwX0NBTlZBU19BRERSIGZvciBjYW52YXNfcG9zIDApLCB3aGVyZWFzCmgyNjRfcmVsZWFzZV9k ZWNvZGVfc3BlYygpIG9ubHkgZnJlZXMgY2FudmFzZXMgd2hlbiBpZiAoYnVmLT51c2VkKSBpcyB0 cnVlLApwZXJtYW5lbnRseSBsZWFraW5nIGNhbnZhc2VzIGZyb20gdGhlIG1lc29uX2NhbnZhcyBw b29sLiBJbiBhZGRpdGlvbiwgaW4KaDI2NF90aHJlYWRlZF9pc3JfZnVuYygpLCBoMjY0X3JlbGVh c2VfZGVjb2RlX3NwZWMoKSBpcyBvbmx5IGNhbGxlZCBiZWZvcmUKZ2V0X2NhbnZhc19pbmRleCgp IHdoZW4gZmlyc3RfbWJfaW5fc2xpY2UgIT0gMCwgc28gYSBzZWNvbmQKSDI2NF9TTElDRV9IRUFE RVJfRE9ORSBpbnRlcnJ1cHQgd2l0aCBmaXJzdF9tYl9pbl9zbGljZSA9PSAwIGxlYWtzIHRoZQpj YW52YXNlcyBhbGxvY2F0ZWQgZm9yIHRoZSBmaXJzdCBzbGljZS4KCjMuIEluIGgyNjRfY29uZmln X2RlY29kZV9idWYoKSwgd2hlbiBoMjY0X2N0eC0+bGlzdF9zaXplWzFdID4gMCwKY29sb2NhdGVf cGljID0gJmgyNjRfY3R4LT5yZWZfbGlzdDFbMF0gZGVyZWZlcmVuY2VzCmNvbG9jYXRlX3BpYy0+ ZHBiLT50b3BfZmllbGRfb3JkZXJfY250IHdpdGhvdXQgY2hlY2tpbmcgY29sb2NhdGVfcGljLT52 YWxpZCBvcgpjb2xvY2F0ZV9waWMtPmRwYiAhPSBOVUxMLgoKWyAuLi4gXQoKPiArCXJlYWRfcG9s bF90aW1lb3V0KHJlYWRfZG9zX3JlZywgcmVnX3ZhbCwKPiArCQkJICAhKHJlZ192YWwgJiAweDgw MCksCj4gKwkJCSAgMTAsIDAsIHRydWUsIGh3LCBIMjY0X0NPX01CX1JXX0NUTCk7CgpbU2V2ZXJp dHk6IEhpZ2hdCkluIGgyNjRfY29uZmlnX2RlY29kZV9idWYoKSwgcmVhZF9wb2xsX3RpbWVvdXQo KSBpcyBjYWxsZWQgd2l0aCB0aW1lb3V0X3VzID0gMAp3aGlsZSB2ZGVjX3RocmVhZGVkX2lzcl9o YW5kbGVyKCkgaG9sZHMgaHctPmN0eF9tdXRleC4KClNpbmNlIHRpbWVvdXRfdXMgPSAwIHBvbGxz IGluZGVmaW5pdGVseSBpbiByZWFkX3BvbGxfdGltZW91dCgpLCBpZiBiaXQgMTEKKDB4ODAwKSBv ZiBIMjY0X0NPX01CX1JXX0NUTCBkb2VzIG5vdCBjbGVhciwgd29uJ3QgdmRlY190aHJlYWRlZF9p c3JfaGFuZGxlcigpCnNwaW4gZm9yZXZlciB1bmRlciBody0+Y3R4X211dGV4IGFuZCBjYXVzZSBh bWxfaDI2NF9kZWNfcnVuKCkgdG8gZGVhZGxvY2sgb24KbXV0ZXhfbG9jaygmZGVjX2h3LT5jdHhf bXV0ZXgpIHdoZW4gd2FpdF9ldmVudF9pbnRlcnJ1cHRpYmxlX3RpbWVvdXQoKQpleHBpcmVzPwoK PiArCj4gKwkvKiBjb2wgYnVmIGZvciBjdXJyIGZyYW1lICovCj4gKwljb2xvY2F0ZV9hZHJfb2Zm c2V0ID0gQ09MX1NJWkVfRk9SX09ORV9NQjsKPiArCWlmICh1c2VfbW9kZV84eDhfZmxhZykKPiAr CQljb2xvY2F0ZV9hZHJfb2Zmc2V0ID4+PSAyOwo+ICsJY29sb2NhdGVfYWRyX29mZnNldCAqPSBj dXJyX3NsaWNlLT5maXJzdF9tYl9pbl9zbGljZTsKPiArCj4gKwlpZiAoaDI2NF9jdHgtPmN1cnJf c3BlYy5jb2xfYnVmX2luZGV4ID49IDAgJiYKPiArCSAgICBoMjY0X2N0eC0+Y3Vycl9zcGVjLmNv bF9idWZfaW5kZXggPCBoMjY0X2N0eC0+Y29sb2NhdGVkX2J1Zl9udW0pIHsKPiArCSAgICAvKiBj b2xsYXRlZF9jbWFfYWRkciBpcyBsaW1pdGVkIHRvIDMyYml0IGJ5IGZsYWcgR0ZQX0RNQTMyIHdo ZW4gYWxsb2NhdGVkICovCj4gKwkJY29sb2NhdGVfd3JfYWRyID0gKHVuc2lnbmVkIGludCloMjY0 X2N0eC0+Y29sbGF0ZWRfY21hX2FkZHIgKwo+ICsJCSAgICAoKGgyNjRfY3R4LT5vbmVfY29sX2J1 Zl9zaXplICoKPiArCQkgICAgICBoMjY0X2N0eC0+Y3Vycl9zcGVjLmNvbF9idWZfaW5kZXgpID4+ ICh1c2VfbW9kZV84eDhfZmxhZyA/IDIgOiAwKSk7Cj4gKwkJaWYgKGNvbG9jYXRlX2Fkcl9vZmZz ZXQgPiBoMjY0X2N0eC0+b25lX2NvbF9idWZfc2l6ZSB8fAo+ICsJCSAgICBjb2xvY2F0ZV93cl9h ZHIgKyBoMjY0X2N0eC0+b25lX2NvbF9idWZfc2l6ZSA+Cj4gKwkJICAgICh1bnNpZ25lZCBpbnQp aDI2NF9jdHgtPmNvbGxhdGVkX2NtYV9hZGRyX2VuZCkgewo+ICsJCQlkZXZfZXJyKGh3LT5kZXYs Cj4gKwkJCQkiRXJyb3IsIGNvbG9jYXRlIGJ1ZiBpcyBub3QgZW5vdWdoLCBpbmRleCBpcyAlZFxu IiwKPiArCQkJCWgyNjRfY3R4LT5jdXJyX3NwZWMuY29sX2J1Zl9pbmRleCk7Cj4gKwkJCXJldHVy biAtMTsKPiArCQl9Cj4gKwkJcmVnbWFwX3dyaXRlKGh3LT5tYXBbRE9TX0JVU10sIEgyNjRfQ09f TUJfV1JfQUREUiwKPiArCQkJICAgICAoY29sb2NhdGVfd3JfYWRyICsgY29sb2NhdGVfYWRyX29m ZnNldCkpOwo+ICsJCWRldl9kYmcoaHctPmRldiwgImNvbCBidWZmZXIgYWRkciA9IDB4JXggY29s X2J1Zl9pbmRleCAlZFxuIiwKPiArCQkJKGNvbG9jYXRlX3dyX2FkciArIGNvbG9jYXRlX2Fkcl9v ZmZzZXQpLAo+ICsJCQloMjY0X2N0eC0+Y3Vycl9zcGVjLmNvbF9idWZfaW5kZXgpOwo+ICsJfSBl bHNlIHsKPiArCQlyZWdtYXBfd3JpdGUoaHctPm1hcFtET1NfQlVTXSwgSDI2NF9DT19NQl9XUl9B RERSLCAweGZmZmZmZmZmKTsKPiArCQlkZXZfZGJnKGh3LT5kZXYsICJjb2wgYnVmZmVyIGFkZHIg PSAweGZmZmZmZmZmXG4iKTsKPiArCX0KPiArCj4gKwlpZiAoaDI2NF9jdHgtPmxpc3Rfc2l6ZVsx XSA+IDApIHsKPiArCQlzdHJ1Y3QgaDI2NF9kZWNvZGVfYnVmX3NwZWMgKmNvbG9jYXRlX3BpYyA9 Cj4gKwkJICAgICZoMjY0X2N0eC0+cmVmX2xpc3QxWzBdOwo+ICsJCXN0cnVjdCBoMjY0X2RlY29k ZV9idWZfc3BlYyAqY3Vycl9waWMgPSAmaDI2NF9jdHgtPmN1cnJfc3BlYzsKPiArCQlpbnQgbDEw X3N0cnVjdHVyZSA9IDI7CS8qIGZvciBwaWMgc3RydWN0ID09IEZSQU1FLCBkZWZhdWx0IHRvIDIg Ki8KPiArCQlpbnQgY3VyX2NvbG9jYXRlX3JlZl90eXBlOwo+ICsJCXVuc2lnbmVkIGludCBjb2xv Y2F0ZV9yZF9hZHI7Cj4gKwkJdW5zaWduZWQgaW50IGNvbG9jYXRlX3JkX2Fkcl9vZmZzZXQgPSAw Owo+ICsJCXVuc2lnbmVkIGludCB2YWw7Cj4gKwo+ICsJCWN1cl9jb2xvY2F0ZV9yZWZfdHlwZSA9 Cj4gKwkJICAgIChhYnMoY3Vycl9waWMtPnBvYyAtIGNvbG9jYXRlX3BpYy0+ZHBiLT50b3BfZmll bGRfb3JkZXJfY250KSA8Cj4gKwkJICAgICBhYnMoY3Vycl9waWMtPnBvYyAtIGNvbG9jYXRlX3Bp Yy0+ZHBiLT5ib3R0b21fZmllbGRfb3JkZXJfY250KSkgPyAwIDogMTsKPiArCQljb2xvY2F0ZV9y ZF9hZHJfb2Zmc2V0ID0gQ09MX1NJWkVfRk9SX09ORV9NQjsKPiArCQlpZiAodXNlX21vZGVfOHg4 X2ZsYWcpCj4gKwkJCWNvbG9jYXRlX3JkX2Fkcl9vZmZzZXQgPj49IDI7Cj4gKwo+ICsJCWNvbG9j YXRlX3JkX2Fkcl9vZmZzZXQgKj0gY3Vycl9zbGljZS0+Zmlyc3RfbWJfaW5fc2xpY2U7Cj4gKwkJ aWYgKGNvbG9jYXRlX3BpYy0+Y29sX2J1Zl9pbmRleCA+PSAwICYmCj4gKwkJICAgIGNvbG9jYXRl X3BpYy0+Y29sX2J1Zl9pbmRleCA8IGgyNjRfY3R4LT5jb2xvY2F0ZWRfYnVmX251bSkgewo+ICsJ CSAgICAvKiBjb2xsYXRlZF9jbWFfYWRkciBpcyBsaW1pdGVkIHRvIDMyYml0IGJ5IGZsYWcgR0ZQ X0RNQTMyIHdoZW4gYWxsb2NhdGVkICovCj4gKwkJCWNvbG9jYXRlX3JkX2FkciA9ICh1bnNpZ25l ZCBpbnQpaDI2NF9jdHgtPmNvbGxhdGVkX2NtYV9hZGRyICsKPiArCQkJICAgICgoaDI2NF9jdHgt Pm9uZV9jb2xfYnVmX3NpemUgKgo+ICsJCQkgICAgICBjb2xvY2F0ZV9waWMtPmNvbF9idWZfaW5k ZXgpID4+ICh1c2VfbW9kZV84eDhfZmxhZwo+ICsJCQkJCQkJICAgICAgID8gMiA6IDApKTsKPiAr CQkJaWYgKGNvbG9jYXRlX3JkX2Fkcl9vZmZzZXQgPiBoMjY0X2N0eC0+b25lX2NvbF9idWZfc2l6 ZSB8fAo+ICsJCQkgICAgY29sb2NhdGVfcmRfYWRyICsgaDI2NF9jdHgtPm9uZV9jb2xfYnVmX3Np emUgPgo+ICsJCQkgICAgKHVuc2lnbmVkIGludCloMjY0X2N0eC0+Y29sbGF0ZWRfY21hX2FkZHJf ZW5kKSB7Cj4gKwkJCQlkZXZfZXJyKGh3LT5kZXYsCj4gKwkJCQkJIkVycm9yLCBjb2xvY2F0ZSBy ZCBidWYgaXMgbm90IGVub3VnaCwgaW5kZXggaXMgJWRcbiIsCj4gKwkJCQkJY29sb2NhdGVfcGlj LT5jb2xfYnVmX2luZGV4KTsKPiArCQkJCXJldHVybiAtMTsKPiArCQkJfQo+ICsJCQl2YWwgID0g KChjb2xvY2F0ZV9yZF9hZHJfb2Zmc2V0ICsgY29sb2NhdGVfcmRfYWRyKSA+PiAzKSB8Cj4gKwkJ CQkoY3VyX2NvbG9jYXRlX3JlZl90eXBlIDw8IDI5KSB8Cj4gKwkJCQkobDEwX3N0cnVjdHVyZSA8 PCAzMCk7Cj4gKwkJCXJlZ21hcF93cml0ZShody0+bWFwW0RPU19CVVNdLCBIMjY0X0NPX01CX1JE X0FERFIsIHZhbCk7CgpbU2V2ZXJpdHk6IENyaXRpY2FsXQpJbiBoMjY0X2NvbmZpZ19kZWNvZGVf YnVmKCksIGNhbiBhIHNsaWNlIHdpdGggYSBub24temVybyBmaXJzdF9tYl9pbl9zbGljZQpwcm9n cmFtIEgyNjRfQ09fTUJfV1JfQUREUiBhbmQgSDI2NF9DT19NQl9SRF9BRERSIHRvIERNQSBwYXN0 IHRoZSBlbmQgb2YgdGhlCmNvbG9jYXRlZCBidWZmZXIgc2xvdCBvciBwYXN0IGgyNjRfY3R4LT5j b2xsYXRlZF9jbWFfYWRkcl9lbmQ/CgpXaGVuIHVzZV9tb2RlXzh4OF9mbGFnIGlzIHNldCwgZWFj aCBzbG90J3Mgc3RyaWRlIGlzCmgyNjRfY3R4LT5vbmVfY29sX2J1Zl9zaXplID4+IDIsIGJ1dCBj b2xvY2F0ZV9hZHJfb2Zmc2V0IGFuZApjb2xvY2F0ZV9yZF9hZHJfb2Zmc2V0IGFyZSBjb21wYXJl ZCBhZ2FpbnN0IHRoZSB1bnNoaWZ0ZWQKaDI2NF9jdHgtPm9uZV9jb2xfYnVmX3NpemUsIGFsbG93 aW5nIHRoZSBvZmZzZXQgdG8gY3Jvc3MgaW50byB0aGUgbmV4dCAzCmNvbG9jYXRlZCBidWZmZXIg c2xvdHMuCgpGdXJ0aGVybW9yZSwgdGhlIGVuZC1hZGRyZXNzIGNoZWNrIHRlc3RzCmNvbG9jYXRl X3dyX2FkciArIGgyNjRfY3R4LT5vbmVfY29sX2J1Zl9zaXplID4gaDI2NF9jdHgtPmNvbGxhdGVk X2NtYV9hZGRyX2VuZAp3aXRob3V0IGFkZGluZyBjb2xvY2F0ZV9hZHJfb2Zmc2V0IChhbmQgbGlr ZXdpc2UgZm9yIGNvbG9jYXRlX3JkX2FkciB3aXRob3V0CmNvbG9jYXRlX3JkX2Fkcl9vZmZzZXQp LCBzbyB3aGVuIGNvbF9idWZfaW5kZXggaXMgYXQgdGhlIGVuZCBvZiB0aGUgYnVmZmVyIGFuZApj b2xvY2F0ZV9hZHJfb2Zmc2V0ID4gMCwgY29sb2NhdGVfd3JfYWRyICsgY29sb2NhdGVfYWRyX29m ZnNldCBjYW4gcG9pbnQgdXAgdG8Kb25lX2NvbF9idWZfc2l6ZSBieXRlcyBwYXN0IGNvbGxhdGVk X2NtYV9hZGRyX2VuZC4KClsgLi4uIF0KCj4gK30KClsgLi4uIF0KCj4gLS0gCj4gMi40My4wCgot LSAKU2FzaGlrbyBBSSByZXZpZXcgwrcgaHR0cHM6Ly9zYXNoaWtvLmRldi8jL3BhdGNoc2V0LzIw MjYxMDIyLWI0LXM0LXZkZWMtdXBzdHJlYW0tdjEyLTAtNjE2MjQwOTc4NzkyQGFtbG9naWMuY29t P3BhcnQ9NQoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K bGludXgtYW1sb2dpYyBtYWlsaW5nIGxpc3QKbGludXgtYW1sb2dpY0BsaXN0cy5pbmZyYWRlYWQu b3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8vbGludXgtYW1s b2dpYwo= From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792648880; b=uRbmDW+6gBl1AgrMCCXVyCZfozGGybkIjep6Vh6zckLvaF4fP9jouEjPH4wEKqzo3f5G qbPQkPjAPq1V1fk2xGwW+cz2Pa0LnkTCVtZvWOExqN+YWtudW01Dmyr6FBwI5wwhToWyL 4XtTwTd/sq+KFgHrdn3pHtgIQEVXsPHYn805zy1jAQF4FlZCqu89+wZ6quxRrP/Ts2BlE bRasczivUkXm1CNlQwmWfm/Zyh0GBmQFjQYxz635w7WaD3WD8IK4CNNxyuJENAfCpFoEW 7ZgMZWQCxdC6rVncwxv3WQPxncpKJltMn2ewJkQrTYoWRNo5IJXNTywF195yiY2cCtQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792648880; h=Received:DKIM-Signature:Message-ID:From:Subject:Reply-To:To:Cc: In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=4UYII/jxqMf0Quc8mwHI4jTBZTgUQarKMX32yAjEysA=; b=L/H7JRjwZSnDvkpFpAlpehtomcTjcR0FX3r5YBtfQl36a/RU94YqJdzRPo//9WdMb1jc ElKZJIPG9EPwtt6wgQpdwxpxmt0kH60VYfk9vnJOxuaTBeo+yky9Z8hDDdHYs5qaGaf6U v9Vxt6VTJ1yzhssA1H5lC3SbJS4sE/10kDNqSddluuWtRc0AHgWLM1eUlwpE6tabKVrVw mS19qyPZzRdNF0i5Tuv3goerhqta2fYlNu9QvrmVEvmgkylGi9rvC2o86V9f/Zy3A2BB8 HMaOo4Ks3NaH+UHnA9ThTrbyhnEWOu/jQkSZtMyd8MUj1UjjiyhGH8Z+gvJ+hpnHzmg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=P5ukIY0p; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E9C81606A319 for ; Thu, 22 Oct 2026 06:01:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=P5ukIY0p Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A3541F000C1; Thu, 22 Oct 2026 06:01:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1792648879; bh=4UYII/jxqMf0Quc8mwHI4jTBZTgUQarKMX32yAjEysA=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=P5ukIY0pmciuJ3ESYXxuJNznGL7xRM+JIpLf9K9mdsPenrSQKjyE3WMkSv0DxwM7J LjVSNmcoBK8HSzI5CAbXmriLh/96UNe+JSKHwYYcv4zpx6zBsgxnRaC2AllYbVH2+J vLg8lJ+LnyChlUXWHkyXLiTGFJmYzCP6+qVo85Ao8hsqt7n6HR8DFyc2Hugm2djc2a RntP6YgLuGX2rkbxVDHcQDL/op4RN7AupXvyi86M4T6Kuowmk0jTy0ajmRxwrXkkgG yArE+JABw1PsmD/i0k3QjVuXTTu98bXWazooY4VFBc9TTSNrEuuaSe63KAjMJCOd8/ FXKx8st78VODw== Message-ID: From: sashiko-bot@kernel.org Subject: Re: [PATCH v12 5/6] arm64: dts: amlogic: Add video decoder driver support for S4 SOCs Reply-To: sashiko-reviews@lists.linux.dev To: "Zhentao Guo" Cc: linux-amlogic@lists.infradead.org, devicetree@vger.kernel.org, robh@kernel.org, conor+dt@kernel.org, neil.armstrong@linaro.org, media-ci@linuxtv.org In-Reply-To: <20261022-b4-s4-vdec-upstream-v12-5-616240978792@amlogic.com> References: <20261022-b4-s4-vdec-upstream-v12-0-616240978792@amlogic.com> <20261022-b4-s4-vdec-upstream-v12-5-616240978792@amlogic.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Thu, 22 Oct 2026 06:01:18 +0000 X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Thank you for your contribution! Sashiko AI review found 13 potential issue= (s) to consider: - [Critical] media: amlogic: vdec: OOB read and canvas leaks in h264 refere= nce list handling - [Critical] media: amlogic: vdec: colocate buffer OOB DMA write in h264_co= nfig_decode_buf() - [High] media: amlogic: vdec: aml_vdec_init_dec_inst() returns -1 on queue= restart - [High] media: amlogic: vdec: invalid IS_ERR() check on meson_sm_get() in = probe - [High] media: amlogic: vdec: poc_is_in_dpb() and get_dpb_by_poc() ignore = active flag - [High] media: amlogic: vdec: dos clock in vdec_clock_gate_init() is never= enabled - [High] media: amlogic: vdec: ignored power and clock errors in aml_vdec_h= w.c - [High] media: amlogic: vdec: aml_vdec_drv_remove() powers off hw before u= nregistering - [High] media: amlogic: vdec: broken TEE deferral and error codes in aml_v= dec_tee_fw.c - [High] media: amlogic: vdec: infinite poll under ctx_mutex in h264_config= _decode_buf() - [Medium] media: amlogic: vdec: missing REGMAP_MMIO and MEDIA_CONTROLLER s= elects - [Medium] media: amlogic: vdec: aml_vdec_drv_probe() registers video_devic= e too early - [Medium] media: amlogic: vdec: missing set_pic_info() in reset_output_fmt= s() -- commit 7d77b0e5560dd6f7c9fdd465c00fffdff91c7e55 Author: Zhentao Guo arm64: dts: amlogic: Add video decoder driver support for S4 SOCs This series adds the Amlogic S4 V4L2 stateless H.264 video decoder driver in commit 18a11b2c70a7ef55c42ed897bc1624397ec3430c ("decoder: Add V4L2 statele= ss H.264 decoder driver") and enables the corresponding vdec, canvas, and optee device tree nodes in meson-s4.dtsi. > diff --git a/drivers/media/platform/amlogic/vdec/Kconfig b/drivers/media/= platform/amlogic/vdec/Kconfig > new file mode 100644 > index 0000000000000..2c5dd84529621 > --- /dev/null > +++ b/drivers/media/platform/amlogic/vdec/Kconfig > @@ -0,0 +1,18 @@ > +# SPDX-License-Identifier: (GPL-2.0-only OR MIT) > + > +config VIDEO_AMLOGIC_VDEC > + tristate "Amlogic Video Decoder Driver" > + depends on ARCH_MESON || COMPILE_TEST > + depends on VIDEO_DEV > + depends on V4L_MEM2MEM_DRIVERS > + depends on TEE > + depends on MESON_SM > + select VIDEOBUF2_DMA_CONTIG > + select V4L2_H264 > + select V4L2_MEM2MEM_DEV > + select MESON_CANVAS [Severity: Medium] Should VIDEO_AMLOGIC_VDEC also select REGMAP_MMIO and MEDIA_CONTROLLER here? In drivers/media/platform/amlogic/vdec/aml_vdec_hw.c, dev_request_hw_resources() calls devm_regmap_init_mmio(), which fails to li= nk when CONFIG_REGMAP_MMIO is disabled. In addition, aml_vdec_drv_probe() in drivers/media/platform/amlogic/vdec/aml_vdec_drv.c registers a media device with aml_m2m_media_ops (vb2_request_validate and v4l2_m2m_request_queue) for stateless H.264 decoding, which compiles to no-op stubs if CONFIG_MEDIA_CONTROLLER is disabled. In drivers/media/platform/amlogic/vdec/aml_vdec.c, should aml_vdec_queue_init() also set src_vq->requires_requests =3D true alongside src_vq->supports_requests =3D true so non-request buffers are rejected? [ ... ] > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec.c b/drivers/med= ia/platform/amlogic/vdec/aml_vdec.c > new file mode 100644 > index 0000000000000..e65ebb2ce311f > --- /dev/null > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec.c [ ... ] > +static int aml_vdec_init_dec_inst(struct aml_vdec_ctx *ctx) > +{ > + struct aml_vdec_dev *dev =3D ctx->dev; > + struct aml_video_fmt *fmt_out =3D &ctx->dec_fmt[AML_FMT_SRC]; > + int ret =3D -1; > + > + ctx->codec_ops =3D &dev->pvdec_data->codec_ops[fmt_out->codec_type]; > + /* > + * The codec instance is only released when both queues are > + * streamed off: do not allocate a new one (leaking the previous > + * instance) when the output queue is restarted while the > + * capture queue is still streaming. > + */ > + if (ctx->codec_ops->init && !ctx->codec_priv) { > + ret =3D ctx->codec_ops->init(ctx); > + if (ret < 0) > + return ret; > + } > + ctx->curr_dec_type =3D fmt_out->codec_type; > + dev_info(&dev->plat_dev->dev, "%s set curr_dec_type %s\n", > + __func__, dec_type_to_name(ctx->curr_dec_type)); > + > + return ret; > +} [Severity: High] When the output queue is stopped and restarted while the capture queue rema= ins streaming, ctx->codec_priv is already non-NULL, so aml_vdec_init_dec_inst() skips ctx->codec_ops->init(ctx) and returns the initial ret =3D -1. In vb2ops_vdec_start_streaming(): if (aml_vdec_init_dec_inst(ctx) < 0) { while ((src_buf =3D v4l2_m2m_src_buf_remove(ctx->m2m_ctx))) v4l2_m2m_buf_done(src_buf, VB2_BUF_STATE_QUEUED); return -EINVAL; } Won't this cause vb2ops_vdec_start_streaming() to always fail with -EINVAL = on output queue restart unless ret is initialized to 0 in aml_vdec_init_dec_inst()? [ ... ] > +static int vdec_try_fmt_mp(struct aml_vdec_ctx *ctx, enum v4l2_buf_type = type, > + struct v4l2_pix_format_mplane *pix_mp, > + const struct aml_video_fmt *dec_fmt) > +{ > + int i, align; > + > + pix_mp->field =3D V4L2_FIELD_NONE; > + align =3D dec_fmt->align; > + > + if (V4L2_TYPE_IS_OUTPUT(type)) { > + pix_mp->num_planes =3D dec_fmt->num_planes; > + pix_mp->pixelformat =3D dec_fmt->fourcc; > + if (!pix_mp->plane_fmt[0].sizeimage) > + pix_mp->plane_fmt[0].sizeimage =3D > + (pix_mp->height * pix_mp->width * 3) / 2; > + pix_mp->height =3D ALIGN(pix_mp->height, align); > + pix_mp->width =3D ALIGN(pix_mp->width, align); > + } else { > + pix_mp->height =3D ctx->pix_fmt[AML_FMT_SRC].height; > + pix_mp->width =3D ctx->pix_fmt[AML_FMT_SRC].width; > + } > + > + v4l2_apply_frmsize_constraints(&pix_mp->width, &pix_mp->height, > + &dec_fmt->stepwise); [ ... ] > +static int vdec_s_fmt_output(struct aml_vdec_ctx *ctx, struct v4l2_forma= t *f) > +{ > + struct v4l2_pix_format_mplane *pix_mp =3D &f->fmt.pix_mp; > + struct v4l2_pix_format_mplane *cap_fmt =3D &ctx->pix_fmt[AML_FMT_DST]; > + const struct aml_video_fmt *out_fmt; > + struct vb2_queue *vq, *peer_vq; > + int ret; > + > + vq =3D v4l2_m2m_get_vq(ctx->m2m_ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE); > + if (vb2_is_busy(vq) && > + pix_mp->pixelformat !=3D ctx->pix_fmt[AML_FMT_SRC].pixelformat) > + return -EBUSY; > + > + /* > + * Since s_fmt output will reset the width and height in the capture qu= eue, > + * s_fmt_output with resolution change should not take effect when capt= ure > + * queue is busy. > + */ > + peer_vq =3D v4l2_m2m_get_vq(ctx->m2m_ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE_M= PLANE); > + if (vb2_is_busy(peer_vq) && > + (pix_mp->width !=3D cap_fmt->width || > + pix_mp->height !=3D cap_fmt->height)) > + return -EBUSY; [ ... ] > +static void reset_output_fmts(struct aml_vdec_ctx *ctx) > +{ > + struct aml_vdec_dev *dev =3D ctx->dev; > + const struct aml_video_fmt *out_fmt; > + struct v4l2_pix_format_mplane fmt; > + > + /* reset default output fmt to V4L2_PIX_FMT_H264_SLICE */ > + out_fmt =3D aml_vdec_get_video_fmt(dev, V4L2_PIX_FMT_H264_SLICE); > + if (!out_fmt) > + return; > + > + ctx->dec_fmt[AML_FMT_SRC] =3D *out_fmt; > + > + memset(&fmt, 0, sizeof(struct v4l2_pix_format_mplane)); > + > + fmt.height =3D out_fmt->stepwise.min_height; > + fmt.width =3D out_fmt->stepwise.min_width; > + /* reset bytesperline to 0 for output fmts */ > + fmt.plane_fmt[0].bytesperline =3D 0; > + fmt.colorspace =3D V4L2_COLORSPACE_DEFAULT; > + fmt.ycbcr_enc =3D V4L2_YCBCR_ENC_DEFAULT; > + fmt.quantization =3D V4L2_QUANTIZATION_DEFAULT; > + fmt.xfer_func =3D V4L2_XFER_FUNC_DEFAULT; > + vdec_try_fmt_mp(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE, &fmt, > + out_fmt); > + > + ctx->pix_fmt[AML_FMT_SRC] =3D fmt; > +} [Severity: Medium] In fops_vcodec_open() -> aml_vdec_reset_fmts() -> reset_output_fmts(), set_pic_info() is not called after vdec_try_fmt_mp(). If userspace starts streaming without calling vdec_s_fmt_output(), won't ctx->pic_info.fb_size[= 0] remain 0, causing h264_config_decode_spec() and h264_config_ref_spec() in drivers/media/platform/amlogic/vdec/h264.c to set c_dma_addr equal to y_dma_addr for single-planar NV12/NV21 capture buffers? Also in vdec_try_fmt_mp(), pix_mp->plane_fmt[0].sizeimage is calculated from pix_mp->height * pix_mp->width before ALIGN() and v4l2_apply_frmsize_constraints() clamp the dimensions, and in vdec_s_fmt_output(), pix_mp->width and pix_mp->height are compared against = the 64-aligned cap_fmt dimensions before vdec_try_fmt_mp() aligns them. Should sizeimage and the busy resolution check use the aligned and clamped dimensi= ons instead? [ ... ] > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec_drv.c b/drivers= /media/platform/amlogic/vdec/aml_vdec_drv.c > new file mode 100644 > index 0000000000000..1870d56659cf4 > --- /dev/null > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec_drv.c [ ... ] > + ret =3D video_register_device(vfd_dec, VFL_TYPE_VIDEO, -1); > + if (ret) { > + v4l2_err(&dev->v4l2_dev, "Failed to register video device"); > + goto err_vid_dev_register; > + } > + > + dev->mdev.dev =3D &pdev->dev; > + strscpy(dev->mdev.model, AML_VDEC_DRV_NAME, sizeof(dev->mdev.model)); > + media_device_init(&dev->mdev); > + dev->mdev.ops =3D &aml_m2m_media_ops; > + dev->v4l2_dev.mdev =3D &dev->mdev; > + > + ret =3D v4l2_m2m_register_media_controller(dev->m2m_dev_dec, vfd_dec, > + MEDIA_ENT_F_PROC_VIDEO_DECODER); > + if (ret) { > + v4l2_err(&dev->v4l2_dev, "Failed to init mem2mem media controller\n"); > + goto error_m2m_mc_register; > + } > + > + ret =3D media_device_register(&dev->mdev); > + if (ret) { > + v4l2_err(&dev->v4l2_dev, "Failed to register media device"); > + goto err_media_dev_register; > + } > + vdec_enable(dev->dec_hw); > + return 0; [Severity: Medium] In aml_vdec_drv_probe(), video_register_device() exposes the video node to userspace before dev->v4l2_dev.mdev is initialized, before the media controller entities are registered, and before vdec_enable(dev->dec_hw) pow= ers on the VDEC hardware domain and clock. Could a userspace process open the video device immediately after video_register_device() and race with media controller setup or trigger m2mops_vdec_device_run() before vdec_enable() has run? [ ... ] > +static void aml_vdec_drv_remove(struct platform_device *pdev) > +{ > + struct aml_vdec_dev *dev =3D platform_get_drvdata(pdev); > + > + /* > + * The IRQ is devm-managed and only released after remove() > + * returns: mask it and wait for any in-flight threaded handler > + * before powering off the VDEC domain, otherwise the handler > + * could access powered-down registers. > + */ > + disable_irq(dev->dec_hw->dec_irq); > + vdec_disable(dev->dec_hw); > + media_device_unregister(&dev->mdev); > + v4l2_m2m_unregister_media_controller(dev->m2m_dev_dec); > + video_unregister_device(dev->vfd); > + media_device_cleanup(&dev->mdev); > + > + v4l2_m2m_release(dev->m2m_dev_dec); > + dev->pvdec_data->destroy_hw_resource(dev); > + v4l2_device_unregister(&dev->v4l2_dev); > +} [Severity: High] In aml_vdec_drv_remove(), disable_irq() and vdec_disable(dev->dec_hw) power off the VDEC domain and disable the VDEC clock before unregistering the med= ia and video devices or releasing M2M contexts. If a decode job is in flight in aml_h264_dec_run() or an open file handle is subsequently closed via fops_vcodec_release() -> vb2ops_vdec_stop_streaming= () -> aml_h264_exit(), won't read_dos_reg() and aml_stop_vdec_hw() perform MMIO accesses to DOS_BUS registers that have already been powered down and unclocked? > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec_hw.c b/drivers/= media/platform/amlogic/vdec/aml_vdec_hw.c > new file mode 100644 > index 0000000000000..043f0bbf32516 > --- /dev/null > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec_hw.c [ ... ] > +void dos_enable(struct aml_vdec_hw *hw) > +{ > + dos_reg_write_bits(hw, DOS_GCLK_EN0, 0x3ff, 0, 10); > + > + regmap_write(hw->map[DOS_BUS], GCLK_EN, 0x3ff); > + > + regmap_update_bits(hw->map[DOS_BUS], MDEC_PIC_DC_CTRL, (1 << 31), 0); > +} [ ... ] > +static int vdec_clock_gate_init(struct aml_vdec_hw *hw) > +{ > + hw->gates[CLK_DOS].id =3D "dos"; > + hw->gates[CLK_VDEC].id =3D "vdec"; > + hw->gates[CLK_HVDEC].id =3D "hvdec"; > + > + return devm_clk_bulk_get(hw->dev, CLK_MAX, hw->gates); > +} [Severity: High] vdec_clock_gate_init() acquires hw->gates[CLK_DOS] ("dos"), but pm_vdec_power_domain_power_on() and pm_vdec_power_domain_power_off() only enable and disable the "vdec" and "hvdec" clocks, and dos_enable() only wri= tes internal DOS registers. Where is hw->gates[CLK_DOS].clk prepared and enabled before dos_local_confi= g() and dos_enable() access DOS_BUS registers? If CLKID_DOS is gated by the bootloader or clk_disable_unused, won't these MMIO accesses hang or abort? [ ... ] > +static int pm_vdec_power_domain_init(struct aml_vdec_hw *hw) > +{ > + int i, err; > + const struct power_manager_s *pm =3D hw->pm; > + struct pm_pd_s *pd =3D pm->pd_data; > + > + mutex_init(&hw->pm_mutex); > + > + for (i =3D 0; i < VDEC_MAX; i++) { > + pd[i].dev =3D dev_pm_domain_attach_by_name(hw->dev, pd[i].name); > + if (IS_ERR_OR_NULL(pd[i].dev)) { > + err =3D PTR_ERR(pd[i].dev); > + dev_dbg(hw->dev, "Get %s failed, pm-domain: %d\n", > + pd[i].name, err); > + pd[i].dev =3D NULL; > + continue; > + } [ ... ] > +static void pm_vdec_power_domain_power_on(struct aml_vdec_hw *hw, int id) > +{ > + const struct power_manager_s *pm =3D hw->pm; > + struct device *dev =3D pm->pd_data[id].dev; > + struct clk_bulk_data *gate_node =3D NULL; > + int ret =3D 0; > + > + if (id =3D=3D VDEC) > + gate_node =3D vdec_get_clk_by_name(hw, "vdec"); > + else if (id =3D=3D HVDEC) > + gate_node =3D vdec_get_clk_by_name(hw, "hvdec"); > + > + if (gate_node) { > + ret =3D clk_prepare_enable(gate_node->clk); > + if (ret) { > + dev_err(hw->dev, "failed to enable %s clock: %d\n", > + gate_node->id, ret); > + } else { > + if (id =3D=3D VDEC) { > + clk_set_rate(gate_node->clk, 499999992); > + dev_dbg(hw->dev, "after set, vdec clock is %lu Hz\n", > + clk_get_rate(gate_node->clk)); > + } > + dev_dbg(hw->dev, "the %-15s clock on\n", gate_node->id); > + } > + } else { > + dev_info(hw->dev, "clk %d, unreachable\n", id); > + ret =3D -ENODEV; > + } > + > + if (!ret && dev) { > + ret =3D pm_runtime_resume_and_get(dev); > + if (ret < 0) > + dev_err(hw->dev, "failed to power on %s domain: %d\n", > + pm->pd_data[id].name, ret); > + else > + dev_dbg(dev, "dev: %p link %p the %-15s power on\n", > + dev, pm->pd_data[id].link, pm->pd_data[id].name); > + } > + > + /* > + * Do not touch the DOS registers when the clock or the power > + * domain could not be enabled, the MMIO access would abort. > + */ > + if (!ret) > + dos_local_config(hw, 1, id); > +} > + > +static void pm_vdec_power_domain_power_off(struct aml_vdec_hw *hw, int i= d) > +{ > + const struct power_manager_s *pm =3D hw->pm; > + struct device *dev =3D pm->pd_data[id].dev; > + struct clk_bulk_data *gate_node =3D NULL; > + > + dos_local_config(hw, 0, id); > + > + if (dev) { > + pm_runtime_put_sync(dev); > + dev_dbg(dev, "dev: %p link %p the %-15s power off\n", > + dev, pm->pd_data[id].link, pm->pd_data[id].name); > + } > + > + if (id =3D=3D VDEC) > + gate_node =3D vdec_get_clk_by_name(hw, "vdec"); > + else if (id =3D=3D HVDEC) > + gate_node =3D vdec_get_clk_by_name(hw, "hvdec"); > + > + if (gate_node) { > + clk_disable_unprepare(gate_node->clk); > + dev_dbg(hw->dev, "the %-15s clock off\n", gate_node->id); > + } else { > + dev_info(hw->dev, "clk %d, unreachable\n", id); > + } > +} > + > +static void vdec_poweron(struct aml_vdec_hw *hw, enum vdec_type_e core) > +{ > + if (core >=3D VDEC_MAX) > + return; > + > + mutex_lock(&hw->pm_mutex); > + if (!hw->pm->pd_data[core].dev) > + goto out; > + > + hw->pm->pd_data[core].ref_count++; > + if (hw->pm->pd_data[core].ref_count > 1) > + goto out; > + > + hw->pm->power_on(hw, core); > + > +out: > + mutex_unlock(&hw->pm_mutex); > +} [Severity: High] There appear to be two error-handling issues in the power domain and clock helpers here: 1. In pm_vdec_power_domain_init(), if dev_pm_domain_attach_by_name() returns an error pointer (such as -EPROBE_DEFER) or NULL, pd[i].dev is set to NULL = and the loop continues while returning 0. Then vdec_poweron() sees !hw->pm->pd_data[core].dev and exits without enabling the clock or power domain, while vdec_enable() still returns 0. Won't subsequent MMIO writes in m2mops_vdec_device_run() -> dos_enable() access unpowered and unclocked DOS registers? 2. In pm_vdec_power_domain_power_on(), if clk_prepare_enable(gate_node->clk) succeeds and pm_runtime_resume_and_get(dev) fails, gate_node->clk is left enabled and the failure is not propagated to vdec_poweron() or vdec_enable(= ), leaving ref_count at 1. When vdec_disable() -> vdec_poweroff() -> pm_vdec_power_domain_power_off() later runs, won't it call dos_local_config(hw, 0, id) on the unpowered domain and call pm_runtime_put_sync(dev) despite pm_runtime_resume_and_get(dev) having fail= ed? [ ... ] > + hw->canvas =3D meson_canvas_get(&pdev->dev); > + if (IS_ERR_OR_NULL(hw->canvas)) > + return PTR_ERR(hw->canvas); > + > + sm_np =3D of_parse_phandle(pdev->dev.of_node, "amlogic,secure-monitor",= 0); > + if (!sm_np) > + return -ENODEV; > + > + hw->sec_fw =3D meson_sm_get(sm_np); > + of_node_put(sm_np); > + if (IS_ERR(hw->sec_fw)) > + return PTR_ERR(hw->sec_fw); [Severity: High] In drivers/firmware/meson/meson_sm.c, meson_sm_get() returns NULL (not an ERR_PTR) when the secure-monitor platform device has not probed yet. Because IS_ERR(NULL) is false, dev_request_hw_resources() succeeds with hw->sec_fw =3D=3D NULL instead of returning -EPROBE_DEFER. When decoding st= arts in m2mops_vdec_device_run() -> load_firmware() -> meson_sm_call(hw->sec_fw, ..= .), won't meson_sm_call() dereference a NULL hw->sec_fw pointer on fw->chip? Similarly, above that check, if meson_canvas_get() were to return NULL, if (IS_ERR_OR_NULL(hw->canvas)) return PTR_ERR(hw->canvas); would return 0. Should hw->canvas use IS_ERR(hw->canvas) and hw->sec_fw check !hw->sec_fw a= nd return -EPROBE_DEFER? [ ... ] > diff --git a/drivers/media/platform/amlogic/vdec/aml_vdec_tee_fw.c b/driv= ers/media/platform/amlogic/vdec/aml_vdec_tee_fw.c > new file mode 100644 > index 0000000000000..9af9eae88fb89 > --- /dev/null > +++ b/drivers/media/platform/amlogic/vdec/aml_vdec_tee_fw.c [ ... ] > + /* Open session */ > + memcpy(sess_arg.uuid, uuid.b, TEE_IOCTL_UUID_LEN); > + sess_arg.clnt_login =3D TEE_IOCTL_LOGIN_PUBLIC; > + sess_arg.num_params =3D TEE_PARAM_NUM; > + ret =3D tee_client_open_session(ctx, &sess_arg, param_init); > + if (ret < 0 || sess_arg.ret !=3D TEEC_SUCCESS) { > + dev_info(hw->dev, > + "%s open session failed, cmd =3D %u, ret =3D %d, res =3D 0x%x, origi= n =3D 0x%x\n", > + __func__, cmd, ret, sess_arg.ret, sess_arg.ret_origin); > + if (!ret) > + ret =3D sess_arg.ret; > + goto free_shm; > + } > + > + inv_arg.func =3D cmd; > + inv_arg.session =3D sess_arg.session; > + inv_arg.num_params =3D TEE_PARAM_NUM; > + > + while (sent_size < fw_size) { > + memset(shm_va, 0, ONCE_SENT_SIZE); > + if (fw_size - sent_size > ONCE_SENT_SIZE) { > + memcpy(shm_va, (firmware_data + sent_size), > + ONCE_SENT_SIZE); > + param_invoke[0].u.memref.size =3D ONCE_SENT_SIZE; > + } else { > + memcpy(shm_va, (firmware_data + sent_size), > + fw_size - sent_size); > + param_invoke[0].u.memref.size =3D (fw_size - sent_size); > + } > + param_invoke[0].u.memref.shm =3D shm; > + ret =3D tee_client_invoke_func(ctx, &inv_arg, param_invoke); > + if (ret < 0 || (inv_arg.ret !=3D TEEC_SUCCESS && inv_arg.ret !=3D TEEC= _ERROR_BUSY)) { > + dev_info(hw->dev, > + "%s invoke func failed, cmd =3D %u, ret=3D %d, res =3D 0x%x, origin= =3D 0x%x\n", > + __func__, cmd, ret, inv_arg.ret, > + inv_arg.ret_origin); > + if (!ret) > + ret =3D inv_arg.ret; > + goto close_session; > + } > + sent_size +=3D param_invoke[0].u.memref.size; > + } [ ... ] > + ctx =3D tee_client_open_context(NULL, optee_ctx_match, NULL, NULL); > + if (IS_ERR(ctx)) { > + dev_info(hw->dev, "Failed to open TEE context\n"); > + ret =3D PTR_ERR(ctx); > + goto free_firmware; > + } [Severity: High] In aml_vdec_drv_probe() -> dev_request_hw_resources() -> aml_tee_fw_preload= () -> pass_firmware_to_tee(): 1. When the OP-TEE driver has not registered its TEE device yet, tee_client_open_context() returns ERR_PTR(-ENOENT). Propagating -ENOENT cau= ses aml_vdec_drv_probe() to fail permanently instead of deferring probe with -EPROBE_DEFER. 2. In tee_pta_invoke_cmd(), when tee_client_open_session() or tee_client_invoke_func() returns 0 with sess_arg.ret !=3D TEEC_SUCCESS or inv_arg.ret !=3D TEEC_SUCCESS, ret is assigned the raw u32 TEEC status code rather than a negative errno (which aml_vdec_drv_probe() only checks for ret < 0). 3. In tee_pta_invoke_cmd(), when inv_arg.ret =3D=3D TEEC_ERROR_BUSY, the er= ror branch is skipped and sent_size +=3D param_invoke[0].u.memref.size advances= past the current 128 KB chunk without retrying it. Won't this silently drop a chunk of firmware data? [ ... ] > diff --git a/drivers/media/platform/amlogic/vdec/h264.c b/drivers/media/p= latform/amlogic/vdec/h264.c > new file mode 100644 > index 0000000000000..7ec7af73d44c7 > --- /dev/null > +++ b/drivers/media/platform/amlogic/vdec/h264.c [ ... ] > +static int poc_is_in_dpb(int poc, const struct v4l2_h264_dpb_entry *dpb) > +{ > + int i; > + int ret =3D 0; > + > + for (i =3D 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) { > + if (poc =3D=3D dpb[i].top_field_order_cnt) { > + ret =3D 1; > + break; > + } > + } > + > + return ret; > +} [Severity: High] In poc_is_in_dpb(), dpb[i].top_field_order_cnt is matched across all 16 entries of dpb[] without checking dpb[i].flags & V4L2_H264_DPB_ENTRY_FLAG_A= CTIVE. The same issue also occurs in get_dpb_by_poc() further below: static struct v4l2_h264_dpb_entry * get_dpb_by_poc(struct v4l2_ctrl_h264_decode_params *decode, int poc) { int i; for (i =3D 0; i < V4L2_H264_NUM_DPB_ENTRIES; i++) { if (decode->dpb[i].top_field_order_cnt =3D=3D poc) return &decode->dpb[i]; } return NULL; } Because unused DPB entries have flags =3D=3D 0 and top_field_order_cnt =3D= =3D 0 (and evicted entries may retain their stale top_field_order_cnt with the active flag cleared): 1. In h264_config_decode_spec() -> clear_unused_col_buf(), poc_is_in_dpb() matches inactive DPB slots, preventing canvas_pos and colocated_buf slots f= rom being released on non-IDR frames and exhausting the 17 canvas_pos slots (especially on multi-slice frames where h264_config_decode_spec() is called= on every slice). 2. In h264_config_decode_buf(), if an inactive DPB slot with top_field_order_cnt =3D=3D 0 precedes an active reference picture with POC = 0, get_dpb_by_poc(decode, 0) returns the inactive slot, so if (dpb && (dpb->flags & V4L2_H264_DPB_ENTRY_FLAG_ACTIVE)) evaluates to fal= se and writes 0 into H264_BUFFER_INFO_DATA for the active reference frame. Should both poc_is_in_dpb() and get_dpb_by_poc() require (dpb[i].flags & V4L2_H264_DPB_ENTRY_FLAG_ACTIVE)? [ ... ] > +static int get_refidx_by_picnum(struct aml_h264_ctx *h264_ctx, int pic_n= um, > + int curr_list) > +{ > + int i; > + struct h264_decode_buf_spec *ref_list; > + > + if (curr_list =3D=3D 0) > + ref_list =3D &h264_ctx->ref_list0[0]; > + else > + ref_list =3D &h264_ctx->ref_list1[0]; > + > + for (i =3D 0; ref_list[i].dpb; i++) { > + if (pic_num =3D=3D ref_list[i].dpb->pic_num) > + return i; > + } > + > + return -1; > +} > + > +static struct h264_decode_buf_spec *get_st_refpic_by_num(struct aml_h264= _ctx *h264_ctx, > + int pic_num, int curr_list) > +{ > + int i; > + struct h264_decode_buf_spec *ref_list; > + > + if (curr_list =3D=3D 0) > + ref_list =3D &h264_ctx->ref_list0_unreordered[0]; > + else > + ref_list =3D &h264_ctx->ref_list1_unreordered[0]; > + > + for (i =3D 0; ref_list[i].dpb; i++) { > + if (pic_num =3D=3D ref_list[i].dpb->pic_num && ref_list[i].long_term_f= lag =3D=3D 0) > + return &ref_list[i]; > + } > + > + return NULL; > +} > + > +static struct h264_decode_buf_spec *get_lt_refpic_by_num(struct aml_h264= _ctx *h264_ctx, > + int pic_num, int curr_list) > +{ > + int i; > + struct h264_decode_buf_spec *ref_list; > + > + if (curr_list =3D=3D 0) > + ref_list =3D &h264_ctx->ref_list0_unreordered[0]; > + else > + ref_list =3D &h264_ctx->ref_list1_unreordered[0]; > + > + for (i =3D 0; ref_list[i].dpb; i++) { > + if (pic_num =3D=3D ref_list[i].dpb->pic_num && ref_list[i].long_term_f= lag =3D=3D 1) > + return &ref_list[i]; > + } > + > + return NULL; > +} > + > +static void reorder_short_term(struct slice *curr_slice, int cur_list, > + int pic_num_lx, int *ref_idx_lx) > +{ [ ... ] > + for (c_idx =3D num_ref_idx_lx_active; c_idx > *ref_idx_lx; c_idx--) > + memcpy(&ref_list_reordered[c_idx], &ref_list_reordered[c_idx - 1], > + sizeof(struct h264_decode_buf_spec)); > + > + memcpy(&ref_list_reordered[*ref_idx_lx], pic_lx, sizeof(struct h264_dec= ode_buf_spec)); > + dev_dbg(&ctx->dev->plat_dev->dev, "%s : RefPicListX[%d ] =3D pic %p pic= _num(%d)\n", __func__, > + *ref_idx_lx, pic_lx, ref_list_reordered[*ref_idx_lx].dpb->pic_num); > + *ref_idx_lx =3D *ref_idx_lx + 1; > + > + n_idx =3D *ref_idx_lx; > + for (c_idx =3D *ref_idx_lx; c_idx <=3D num_ref_idx_lx_active; c_idx++) { > + if (ref_list_reordered[c_idx].long_term_flag || !ref_list_reordered[c_= idx].dpb || > + ref_list_reordered[c_idx].dpb->pic_num !=3D pic_num_lx) > + memcpy(&ref_list_reordered[n_idx++], &ref_list_reordered[c_idx], > + sizeof(struct h264_decode_buf_spec)); > + } > + > + h264_ctx->list_size[cur_list] =3D num_ref_idx_lx_active; > +} [Severity: Critical] Can reference list reordering and canvas allocation read out of bounds, dereference a NULL dpb pointer, and leak hardware canvases? 1. In reorder_short_term() and reorder_long_term(), when num_ref_idx_lx_active =3D=3D 16 (V4L2_H264_NUM_DPB_ENTRIES), the shift loop= copies ref_list[15] into ref_list[16] and sets list_size[cur_list] =3D 16. Because h264_release_decode_spec() only clears indices 0 .. list_size[cur_list] - 1, ref_list[16].dpb remains non-NULL. On a subsequent call where ref_list[0..16].dpb are all non-NULL, the loops in get_refidx_by_picnum(), get_st_refpic_by_num(), and get_lt_refpic_by_num() have no upper bound on i and read past the end of ref_list0[] / ref_list1[]. 2. When num_ref_idx_lx_active exceeds the number of valid entries built by h264_config_ref_lists() (or when h264_config_ref_spec() fails on an entry), reorder_short_term() and reorder_long_term() set h264_ctx->list_size[cur_list] =3D num_ref_idx_lx_active. Then get_canvas_in= dex() allocates hardware canvases via config_decode_canvas() for every entry up to list_size[cur_list] without checking buf->used or buf->valid (also writing = DMA address 0 to ANC0_CANVAS_ADDR for canvas_pos 0), whereas h264_release_decode_spec() only frees canvases when if (buf->used) is true, permanently leaking canvases from the meson_canvas pool. In addition, in h264_threaded_isr_func(), h264_release_decode_spec() is only called before get_canvas_index() when first_mb_in_slice !=3D 0, so a second H264_SLICE_HEADER_DONE interrupt with first_mb_in_slice =3D=3D 0 leaks the canvases allocated for the first slice. 3. In h264_config_decode_buf(), when h264_ctx->list_size[1] > 0, colocate_pic =3D &h264_ctx->ref_list1[0] dereferences colocate_pic->dpb->top_field_order_cnt without checking colocate_pic->valid= or colocate_pic->dpb !=3D NULL. [ ... ] > + read_poll_timeout(read_dos_reg, reg_val, > + !(reg_val & 0x800), > + 10, 0, true, hw, H264_CO_MB_RW_CTL); [Severity: High] In h264_config_decode_buf(), read_poll_timeout() is called with timeout_us = =3D 0 while vdec_threaded_isr_handler() holds hw->ctx_mutex. Since timeout_us =3D 0 polls indefinitely in read_poll_timeout(), if bit 11 (0x800) of H264_CO_MB_RW_CTL does not clear, won't vdec_threaded_isr_handle= r() spin forever under hw->ctx_mutex and cause aml_h264_dec_run() to deadlock on mutex_lock(&dec_hw->ctx_mutex) when wait_event_interruptible_timeout() expires? > + > + /* col buf for curr frame */ > + colocate_adr_offset =3D COL_SIZE_FOR_ONE_MB; > + if (use_mode_8x8_flag) > + colocate_adr_offset >>=3D 2; > + colocate_adr_offset *=3D curr_slice->first_mb_in_slice; > + > + if (h264_ctx->curr_spec.col_buf_index >=3D 0 && > + h264_ctx->curr_spec.col_buf_index < h264_ctx->colocated_buf_num) { > + /* collated_cma_addr is limited to 32bit by flag GFP_DMA32 when all= ocated */ > + colocate_wr_adr =3D (unsigned int)h264_ctx->collated_cma_addr + > + ((h264_ctx->one_col_buf_size * > + h264_ctx->curr_spec.col_buf_index) >> (use_mode_8x8_flag ? 2 : 0= )); > + if (colocate_adr_offset > h264_ctx->one_col_buf_size || > + colocate_wr_adr + h264_ctx->one_col_buf_size > > + (unsigned int)h264_ctx->collated_cma_addr_end) { > + dev_err(hw->dev, > + "Error, colocate buf is not enough, index is %d\n", > + h264_ctx->curr_spec.col_buf_index); > + return -1; > + } > + regmap_write(hw->map[DOS_BUS], H264_CO_MB_WR_ADDR, > + (colocate_wr_adr + colocate_adr_offset)); > + dev_dbg(hw->dev, "col buffer addr =3D 0x%x col_buf_index %d\n", > + (colocate_wr_adr + colocate_adr_offset), > + h264_ctx->curr_spec.col_buf_index); > + } else { > + regmap_write(hw->map[DOS_BUS], H264_CO_MB_WR_ADDR, 0xffffffff); > + dev_dbg(hw->dev, "col buffer addr =3D 0xffffffff\n"); > + } > + > + if (h264_ctx->list_size[1] > 0) { > + struct h264_decode_buf_spec *colocate_pic =3D > + &h264_ctx->ref_list1[0]; > + struct h264_decode_buf_spec *curr_pic =3D &h264_ctx->curr_spec; > + int l10_structure =3D 2; /* for pic struct =3D=3D FRAME, default to 2 = */ > + int cur_colocate_ref_type; > + unsigned int colocate_rd_adr; > + unsigned int colocate_rd_adr_offset =3D 0; > + unsigned int val; > + > + cur_colocate_ref_type =3D > + (abs(curr_pic->poc - colocate_pic->dpb->top_field_order_cnt) < > + abs(curr_pic->poc - colocate_pic->dpb->bottom_field_order_cnt)) ?= 0 : 1; > + colocate_rd_adr_offset =3D COL_SIZE_FOR_ONE_MB; > + if (use_mode_8x8_flag) > + colocate_rd_adr_offset >>=3D 2; > + > + colocate_rd_adr_offset *=3D curr_slice->first_mb_in_slice; > + if (colocate_pic->col_buf_index >=3D 0 && > + colocate_pic->col_buf_index < h264_ctx->colocated_buf_num) { > + /* collated_cma_addr is limited to 32bit by flag GFP_DMA32 when al= located */ > + colocate_rd_adr =3D (unsigned int)h264_ctx->collated_cma_addr + > + ((h264_ctx->one_col_buf_size * > + colocate_pic->col_buf_index) >> (use_mode_8x8_flag > + ? 2 : 0)); > + if (colocate_rd_adr_offset > h264_ctx->one_col_buf_size || > + colocate_rd_adr + h264_ctx->one_col_buf_size > > + (unsigned int)h264_ctx->collated_cma_addr_end) { > + dev_err(hw->dev, > + "Error, colocate rd buf is not enough, index is %d\n", > + colocate_pic->col_buf_index); > + return -1; > + } > + val =3D ((colocate_rd_adr_offset + colocate_rd_adr) >> 3) | > + (cur_colocate_ref_type << 29) | > + (l10_structure << 30); > + regmap_write(hw->map[DOS_BUS], H264_CO_MB_RD_ADDR, val); [Severity: Critical] In h264_config_decode_buf(), can a slice with a non-zero first_mb_in_slice program H264_CO_MB_WR_ADDR and H264_CO_MB_RD_ADDR to DMA past the end of the colocated buffer slot or past h264_ctx->collated_cma_addr_end? When use_mode_8x8_flag is set, each slot's stride is h264_ctx->one_col_buf_size >> 2, but colocate_adr_offset and colocate_rd_adr_offset are compared against the unshifted h264_ctx->one_col_buf_size, allowing the offset to cross into the next 3 colocated buffer slots. Furthermore, the end-address check tests colocate_wr_adr + h264_ctx->one_col_buf_size > h264_ctx->collated_cma_addr_= end without adding colocate_adr_offset (and likewise for colocate_rd_adr without colocate_rd_adr_offset), so when col_buf_index is at the end of the buffer = and colocate_adr_offset > 0, colocate_wr_adr + colocate_adr_offset can point up= to one_col_buf_size bytes past collated_cma_addr_end. [ ... ] > +} [ ... ] > --=20 > 2.43.0 --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261022-b4-s4-vdec= -upstream-v12-0-616240978792@amlogic.com?part=3D5