CMLTGPFix: Comet Lake graphics on a 500-series board

//
//  kern_start.cpp
//  CMLTGPFix
//
//  Copyright (c) 2026, A Star Computers
//  SPDX-License-Identifier: BSD-3-Clause (see LICENSE)
//
//  Comet Lake (Gen9.5) iGPU on a 500-series (Tiger Point, TGP) PCH, e.g. Dell OptiPlex 7090.
//  Apple never shipped this pairing: AppleIntelCFLGraphicsFramebuffer handles the PCH hot-plug
//  registers with the Cannon/Sunrise Point layout, so every port reads "HPD is low", no display
//  is ever detected, and plug/unplug interrupts are never decoded.
//
//  Linux i915 (skl_hpd_pin -> icl_hpd_pin for Gen9 BC + TGP) maps the DDIs to TGP HPD pins:
//    DDI B -> HPD_PORT_B   -> SDE bit 17, status SHOTPLUG_CTL_DDI[5:4]   (Apple: bit 21, 0xC4030[1:0])
//    DDI C -> HPD_PORT_TC1 -> SDE bit 24, status SHOTPLUG_CTL_TC[1:0]    (Apple: bit 22, 0xC4030[9:8])
//    DDI D -> HPD_PORT_TC2 -> SDE bit 25, status SHOTPLUG_CTL_TC[5:4]    (Apple: bit 23, 0xC4030[17:16])
//
//  1. Live state: patch the SDEISR masks in AppleIntelFramebufferController::DigPortHDPState.
//  2. Interrupts: enable the TGP hot-plug interrupts after hwEnableInterrupts, and translate them
//     in ProcessInterrupt into the CNP event bits Apple's SWInterruptHandler already dispatches.
//  3. Display sleep: restore the TGP HPD detection enables whenever Apple re-arms hot-plug and
//     before each live-state check (they are lost when the display power domain goes down).
//  4. Wake with HDMI / passive DP++: treat a failed DP status check as connected while HPD is high.
//
//  DDC for HDMI / passive DP++ adapters is config only: Apple's busid is the GMBUS pin, and for
//  Gen9 BC + TGP i915 uses DDI B -> pin 2, DDI C -> pin 9, DDI D -> pin 10 (CNP: 5 / 4 / 6).
//

#include <Headers/plugin_start.hpp>
#include <Headers/kern_api.hpp>
#include <Headers/kern_patcher.hpp>
#include <IOKit/IOService.h>
#include <kern/thread_call.h>
#include <kern/clock.h>
#include <libkern/OSAtomic.h>

static const char *pathCFL[] {
	"/System/Library/Extensions/AppleIntelCFLGraphicsFramebuffer.kext/Contents/MacOS/AppleIntelCFLGraphicsFramebuffer"
};

static KernelPatcher::KextInfo kextCFL {
	"com.apple.driver.AppleIntelCFLGraphicsFramebuffer", pathCFL, arrsize(pathCFL), {true}, {}, KernelPatcher::KextInfo::Unloaded
};

// ---------------------------------------------------------------------------------------------
// 1. Live hot-plug state. DigPortHDPState reads SDEISR (0xC4000) and picks the mask through a
// jump table indexed by displayPath+0x450 (0..3 = DDI A..D): `mov eax, imm32; jmp short`.
// The jmp displacement makes each pattern unique in the binary.
// ---------------------------------------------------------------------------------------------
static const uint8_t findB[]    { 0xB8, 0x00, 0x00, 0x20, 0x00, 0xEB, 0x02 }; // DDI B: bit 21
static const uint8_t replaceB[] { 0xB8, 0x00, 0x00, 0x02, 0x00, 0xEB, 0x02 }; //        bit 17
static const uint8_t findC[]    { 0xB8, 0x00, 0x00, 0x40, 0x00, 0xEB, 0x1E }; // DDI C: bit 22
static const uint8_t replaceC[] { 0xB8, 0x00, 0x00, 0x00, 0x01, 0xEB, 0x1E }; //        bit 24
static const uint8_t findD[]    { 0xB8, 0x00, 0x00, 0x80, 0x00, 0xEB, 0x10 }; // DDI D: bit 23
static const uint8_t replaceD[] { 0xB8, 0x00, 0x00, 0x00, 0x02, 0xEB, 0x10 }; //        bit 25

// ---------------------------------------------------------------------------------------------
// 2. Hot-plug interrupts. Apple's ProcessInterrupt (called from the HW interrupt filter) ORs
// decoded events into controller+0x2C70; SWInterruptHandler then dispatches bits 15..18 (long
// pulse = plug/unplug on port index 0..3) to invokeHotplugHandler(idx) and bits 19..22 (short
// pulse) to invokeShortPulseHandler(idx). TGP status bits are write-1-to-clear.
// ---------------------------------------------------------------------------------------------
static constexpr uint32_t SDEIMR = 0xC4004, SDEIIR = 0xC4008, SDEIER = 0xC400C;
static constexpr uint32_t SHOTPLUG_CTL_DDI = 0xC4030, SHOTPLUG_CTL_TC = 0xC4034;
static constexpr uint32_t TgpHotplugIrqs = (1U << 17) | (1U << 24) | (1U << 25);
static constexpr size_t ControllerMmio = 0x1A08, ControllerPendingEvents = 0x2C70;

static inline uint8_t *controllerMmio(void *controller) {
	return *reinterpret_cast<uint8_t **>(reinterpret_cast<uint8_t *>(controller) + ControllerMmio);
}

static inline volatile uint32_t &mmioReg(uint8_t *mmio, uint32_t reg) {
	return *reinterpret_cast<volatile uint32_t *>(mmio + reg);
}

// HPD detection enables. Firmware sets these at boot, but they are lost when the display power
// domain goes down (display sleep), and Apple re-arms hot-plug with the CNP layout (0xC4030 bits
// 4/12/20/28), which on TGP are status bits. With the enables off SDEISR reads low, so after a
// display sleep the monitor looked unplugged. Restore them without writing back any status bits
// (write-1-to-clear), as i915's icp_ddi_hpd_detection_setup / icp_tc_hpd_detection_setup do.
static constexpr uint32_t DdiHpdEnables = 0x80;         // SHOTPLUG_CTL_DDI_HPD_ENABLE(HPD_PORT_B)
static constexpr uint32_t TcHpdEnables  = 0x88;         // ICP_TC_HPD_ENABLE(TC1) | ICP_TC_HPD_ENABLE(TC2)
static constexpr uint32_t HpdStatusBits = 0x33333333;   // 2-bit status field of every pin nibble
static uint8_t *lastMmio;
static uint32_t hpdRearmCount;

static bool restoreHpdEnables(uint8_t *mmio) {
	lastMmio = mmio;
	uint32_t ddi = mmioReg(mmio, SHOTPLUG_CTL_DDI);
	uint32_t tc  = mmioReg(mmio, SHOTPLUG_CTL_TC);
	if ((ddi & DdiHpdEnables) == DdiHpdEnables && (tc & TcHpdEnables) == TcHpdEnables)
		return false;
	mmioReg(mmio, SHOTPLUG_CTL_DDI) = (ddi & ~HpdStatusBits) | DdiHpdEnables;
	mmioReg(mmio, SHOTPLUG_CTL_TC)  = (tc  & ~HpdStatusBits) | TcHpdEnables;
	hpdRearmCount++;
	return true;
}

using t_hwEnableInterrupts = uint64_t (*)(void *);
static t_hwEnableInterrupts orgHwEnableInterrupts;
static uint32_t irqEnableCount;

static uint64_t wrapHwEnableInterrupts(void *controller) {
	auto ret = orgHwEnableInterrupts(controller);
	if (auto mmio = controllerMmio(controller)) {
		restoreHpdEnables(mmio);
		mmioReg(mmio, SDEIER) |= TgpHotplugIrqs;
		mmioReg(mmio, SDEIMR) &= ~TgpHotplugIrqs;
		irqEnableCount++;
	}
	return ret;
}

// DigPortHDPState(controller, framebuffer, displayPath): make sure detection is enabled before
// the live state is sampled; after re-enabling, give the HPD filter time to settle.
using t_digPortHDPState = uint8_t (*)(void *, void *, void *);
static t_digPortHDPState orgDigPortHDPState;

static uint8_t wrapDigPortHDPState(void *controller, void *framebuffer, void *path) {
	if (auto mmio = controllerMmio(controller))
		if (restoreHpdEnables(mmio))
			IODelay(5000);
	return orgDigPortHDPState(controller, framebuffer, path);
}

// status: the 2-bit SHOTPLUG_CTL field, bit 0 = short pulse, bit 1 = long pulse
static uint32_t cnpEvents(uint32_t status, uint32_t portIndex) {
	uint32_t events = 0;
	if (status & 2) events |= 1U << (15 + portIndex);
	if (status & 1) events |= 1U << (19 + portIndex);
	return events ? events : 1U << (15 + portIndex); // interrupt without status: treat as plug/unplug
}

using t_processInterrupt = bool (*)(void *);
static t_processInterrupt orgProcessInterrupt;
static uint32_t tgpIrqCount, tgpLastEvents;

static bool wrapProcessInterrupt(void *controller) {
	uint32_t events = 0;
	if (auto mmio = controllerMmio(controller)) {
		uint32_t iir = mmioReg(mmio, SDEIIR) & TgpHotplugIrqs;
		if (iir) {
			uint32_t ddi = mmioReg(mmio, SHOTPLUG_CTL_DDI);
			uint32_t tc  = mmioReg(mmio, SHOTPLUG_CTL_TC);
			mmioReg(mmio, SHOTPLUG_CTL_DDI) = ddi;
			mmioReg(mmio, SHOTPLUG_CTL_TC)  = tc;
			mmioReg(mmio, SDEIIR) = iir;
			if (iir & (1U << 17)) events |= cnpEvents((ddi >> 4) & 3, 1);  // DDI B
			if (iir & (1U << 24)) events |= cnpEvents(tc & 3, 2);          // DDI C (TC1)
			if (iir & (1U << 25)) events |= cnpEvents((tc >> 4) & 3, 3);   // DDI D (TC2)
			tgpIrqCount++;
		}
	}

	bool ret = orgProcessInterrupt(controller);
	if (events) {
		OSBitOrAtomic(events, reinterpret_cast<volatile UInt32 *>(reinterpret_cast<uint8_t *>(controller) + ControllerPendingEvents));
		tgpLastEvents = events;
		ret = true;  // make HWInterruptHandler schedule SWInterruptHandler
	}
	return ret;
}

// ---------------------------------------------------------------------------------------------
// 4. HDMI / passive DP++ on wake. AppleIntelFramebuffer::getDisplayStatus(path) checks HPD, then
// powers the sink up over DP AUX; with a passive DP-to-HDMI adapter AUX never answers, so it
// returns 0 ("Setting DP power failed ... likely HDMI/TMDS case"). At boot the HDMI path still
// finds the monitor, but Transition_wake trusts this status and drops the display ("display
// removed in lower powerstate"). If the status is 0 while the port's TGP HPD line is high,
// report it connected; an unplugged monitor (HPD low) still reads as disconnected.
// ---------------------------------------------------------------------------------------------
static constexpr size_t FramebufferController = 0x1D0, DisplayPathPortIndex = 0x450;
static constexpr uint32_t TgpHpdLiveBit[4] { 1U << 16, 1U << 17, 1U << 24, 1U << 25 }; // DDI A..D

using t_getDisplayStatus = uint32_t (*)(void *, void *);
static t_getDisplayStatus orgGetDisplayStatus;
static uint32_t statusOverrideCount;

static uint32_t wrapGetDisplayStatus(void *framebuffer, void *path) {
	uint32_t status = orgGetDisplayStatus(framebuffer, path);
	if (status == 0 && path) {
		auto controller = *reinterpret_cast<void **>(reinterpret_cast<uint8_t *>(framebuffer) + FramebufferController);
		uint8_t idx = *(reinterpret_cast<uint8_t *>(path) + DisplayPathPortIndex);
		if (controller && idx < 4)
			if (auto mmio = controllerMmio(controller))
				if (mmioReg(mmio, 0xC4000) & TgpHpdLiveBit[idx]) {
					status = 1;
					statusOverrideCount++;
				}
	}
	return status;
}

// ---------------------------------------------------------------------------------------------
// Status, published once a minute on our IOService (ioreg -r -c CMLTGPFix): patch and route
// results (0 = ok, otherwise KernelPatcher::Error, -1 = not attempted) and interrupt counters.
// ---------------------------------------------------------------------------------------------
static int patchStatus[3] { -1, -1, -1 };
static int routeStatus = -1;
static int layoutStatus = -1;  // 0 = offsets verified, 1 = mismatch (wrappers skipped)
static thread_call_t statusCall;

static void scheduleStatus(uint32_t seconds) {
	uint64_t deadline;
	clock_interval_to_deadline(seconds, kSecondScale, &deadline);
	thread_call_enter_delayed(statusCall, deadline);
}

static void publishStatus(thread_call_param_t, thread_call_param_t) {
	if (auto self = ADDPR(selfInstance)) {
		self->setProperty("patch-DDI-B", static_cast<unsigned long long>(patchStatus[0]), 32);
		self->setProperty("patch-DDI-C", static_cast<unsigned long long>(patchStatus[1]), 32);
		self->setProperty("patch-DDI-D", static_cast<unsigned long long>(patchStatus[2]), 32);
		self->setProperty("route-status", static_cast<unsigned long long>(routeStatus), 32);
		self->setProperty("layout-status", static_cast<unsigned long long>(layoutStatus), 32);
		self->setProperty("irq-enable-count", irqEnableCount, 32);
		self->setProperty("tgp-irq-count", tgpIrqCount, 32);
		self->setProperty("tgp-last-events", tgpLastEvents, 32);
		self->setProperty("hpd-rearm-count", hpdRearmCount, 32);
		self->setProperty("status-override-count", statusOverrideCount, 32);
		if (lastMmio) {
			self->setProperty("SDEISR", mmioReg(lastMmio, 0xC4000), 32);
			self->setProperty("SHOTPLUG_CTL_DDI", mmioReg(lastMmio, SHOTPLUG_CTL_DDI), 32);
			self->setProperty("SHOTPLUG_CTL_TC", mmioReg(lastMmio, SHOTPLUG_CTL_TC), 32);
		}
	}
	scheduleStatus(60);
}

// The wrappers rely on private structure offsets (controller+0x1A08 MMIO, +0x2C70 pending events,
// framebuffer+0x1D0 controller, displayPath+0x450 port index). A macOS update can change them, so
// before routing we check that the functions still use exactly these displacements; otherwise we
// skip the wrappers (worst case: no display) rather than risk a panic.
static bool codeUsesDisplacement(mach_vm_address_t function, size_t length, uint32_t displacement) {
	if (!function)
		return false;
	auto code = reinterpret_cast<const uint8_t *>(function);
	for (size_t i = 0; i + sizeof(displacement) <= length; i++)
		if (code[i] == (displacement & 0xFF) && code[i + 1] == ((displacement >> 8) & 0xFF) &&
			code[i + 2] == ((displacement >> 16) & 0xFF) && code[i + 3] == ((displacement >> 24) & 0xFF))
			return true;
	return false;
}


static bool layoutMatches(KernelPatcher &patcher, size_t index, mach_vm_address_t address, size_t size) {
	auto dig  = patcher.solveSymbol(index, "__ZN31AppleIntelFramebufferController15DigPortHDPStateEP21AppleIntelFramebufferP21AppleIntelDisplayPath", address, size);
	auto proc = patcher.solveSymbol(index, "__ZN31AppleIntelFramebufferController16ProcessInterruptEv", address, size);
	auto gds  = patcher.solveSymbol(index, "__ZN21AppleIntelFramebuffer16getDisplayStatusEP21AppleIntelDisplayPath", address, size);
	patcher.clearError();
	return codeUsesDisplacement(dig, 0x100, ControllerMmio) &&
		codeUsesDisplacement(dig, 0x100, DisplayPathPortIndex) &&
		codeUsesDisplacement(proc, 0x1800, ControllerPendingEvents) &&
		codeUsesDisplacement(gds, 0x200, FramebufferController);
}

static void processKext(void *, KernelPatcher &patcher, size_t index, mach_vm_address_t address, size_t size) {
	if (index != kextCFL.loadIndex)
		return;

	layoutStatus = layoutMatches(patcher, index, address, size) ? 0 : 1;
	if (layoutStatus != 0) {
		SYSLOG("cmltgp", "framebuffer layout differs from the version this was built for, skipping wrappers");
		goto patchMasks;
	}

	{
	KernelPatcher::RouteRequest requests[] {
		{ "__ZN31AppleIntelFramebufferController15DigPortHDPStateEP21AppleIntelFramebufferP21AppleIntelDisplayPath",
		  wrapDigPortHDPState, orgDigPortHDPState },
		{ "__ZN31AppleIntelFramebufferController18hwEnableInterruptsEv", wrapHwEnableInterrupts, orgHwEnableInterrupts },
		{ "__ZN31AppleIntelFramebufferController16ProcessInterruptEv", wrapProcessInterrupt, orgProcessInterrupt },
		{ "__ZN21AppleIntelFramebuffer16getDisplayStatusEP21AppleIntelDisplayPath", wrapGetDisplayStatus, orgGetDisplayStatus },
	};
	patcher.routeMultiple(index, requests, arrsize(requests), address, size);
	routeStatus = static_cast<int>(patcher.getError());
	if (patcher.getError() != KernelPatcher::Error::NoError)
		SYSLOG("cmltgp", "interrupt routing FAILED (%d)", patcher.getError());
	patcher.clearError();
	}

patchMasks:
	// The mask patches are safe on any version: a pattern that no longer matches is simply not applied.
	const KernelPatcher::LookupPatch patches[] {
		{ &kextCFL, findB, replaceB, sizeof(findB), 1 },
		{ &kextCFL, findC, replaceC, sizeof(findC), 1 },
		{ &kextCFL, findD, replaceD, sizeof(findD), 1 },
	};
	const char *names[] { "DDI B", "DDI C", "DDI D" };

	for (size_t i = 0; i < arrsize(patches); i++) {
		patcher.applyLookupPatch(&patches[i]);
		patchStatus[i] = static_cast<int>(patcher.getError());
		if (patcher.getError() != KernelPatcher::Error::NoError)
			SYSLOG("cmltgp", "HPD mask patch %s FAILED (%d)", names[i], patcher.getError());
		patcher.clearError();
	}
}

static void pluginStart() {
	lilu.onKextLoadForce(&kextCFL, 1, processKext);
	statusCall = thread_call_allocate(publishStatus, nullptr);
	if (statusCall)
		scheduleStatus(10);
}

static const char *bootargOff[]   { "-cmltgpoff" };
static const char *bootargDebug[] { "-cmltgpdbg" };
static const char *bootargBeta[]  { "-cmltgpbeta" };

PluginConfiguration ADDPR(config) {
	xStringify(PRODUCT_NAME),
	parseModuleVersion(xStringify(MODULE_VERSION)),
	LiluAPI::AllowNormal | LiluAPI::AllowInstallerRecovery | LiluAPI::AllowSafeMode,
	bootargOff, arrsize(bootargOff),
	bootargDebug, arrsize(bootargDebug),
	bootargBeta, arrsize(bootargBeta),
	KernelVersion::BigSur,
	KernelVersion::Tahoe,
	pluginStart
};

#!/bin/bash
# Copyright (c) 2026, A Star Computers. SPDX-License-Identifier: BSD-3-Clause (see LICENSE)
# Builds CMLTGPFix.kext without Xcode (Command Line Tools only). Run on the Mac from this folder,
# with Lilu-1.7.2/ and MacKernelSDK-master/ unpacked one level up.
set -e
cd "$(dirname "$0")"
SDK=../MacKernelSDK-master
LILU=../Lilu-1.7.2/Lilu
OUT=build/CMLTGPFix.kext
rm -rf build && mkdir -p "$OUT/Contents/MacOS"

cat > build/kmod_info.c <<'EOF'
#include <mach/mach_types.h>
extern kern_return_t _start(kmod_info_t *ki, void *data);
extern kern_return_t _stop(kmod_info_t *ki, void *data);
__attribute__((visibility("default"))) KMOD_EXPLICIT_DECL(org.cmltgpfix.CMLTGPFix, "1.3.1", _start, _stop)
extern kern_return_t CMLTGPFix_kern_start(kmod_info_t *, void *);
extern kern_return_t CMLTGPFix_kern_stop(kmod_info_t *, void *);
__private_extern__ kmod_start_func_t *_realmain = CMLTGPFix_kern_start;
__private_extern__ kmod_stop_func_t *_antimain = CMLTGPFix_kern_stop;
__private_extern__ int _kext_apple_cc = __APPLE_CC__;
EOF

COMMON="-arch x86_64 -mmacosx-version-min=11.0 -mkernel -nostdinc -fno-builtin -fno-common -fno-stack-protector
  -D KERNEL -D KERNEL_PRIVATE -D DRIVER_PRIVATE -D APPLE -D NeXT
  -D PRODUCT_NAME=CMLTGPFix -D MODULE_VERSION=1.3.1
  -I $SDK/Headers -I $LILU -O2 -Wno-deprecated-declarations"
CXXFLAGS="$COMMON -x c++ -std=c++17 -fapple-kext -fno-exceptions -fno-rtti"

clang $COMMON -x c -c build/kmod_info.c -o build/kmod_info.o
clang $CXXFLAGS -c kern_start.cpp -o build/kern_start.o
clang $CXXFLAGS -c $LILU/Library/plugin_start.cpp -o build/plugin_start.o

CCKEXT=$(ls /Library/Developer/CommandLineTools/usr/lib/clang/*/lib/darwin/libclang_rt.cc_kext.a 2>/dev/null | head -1)
clang -arch x86_64 -mmacosx-version-min=11.0 -nostdlib -Xlinker -kext -Xlinker -no_data_const \
  build/kmod_info.o build/kern_start.o build/plugin_start.o \
  -L$SDK/Library/x86_64 -lkmod ${CCKEXT:+$CCKEXT} -o "$OUT/Contents/MacOS/CMLTGPFix"

cp Info.plist "$OUT/Contents/Info.plist"
echo "built $OUT"
nm -u "$OUT/Contents/MacOS/CMLTGPFix" | head -30

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>CFBundleDevelopmentRegion</key>
	<string>en</string>
	<key>CFBundleExecutable</key>
	<string>CMLTGPFix</string>
	<key>CFBundleIdentifier</key>
	<string>org.cmltgpfix.CMLTGPFix</string>
	<key>CFBundleInfoDictionaryVersion</key>
	<string>6.0</string>
	<key>CFBundleName</key>
	<string>CMLTGPFix</string>
	<key>CFBundlePackageType</key>
	<string>KEXT</string>
	<key>CFBundleShortVersionString</key>
	<string>1.3.1</string>
	<key>CFBundleSignature</key>
	<string>????</string>
	<key>CFBundleVersion</key>
	<string>1.3.1</string>
	<key>IOKitPersonalities</key>
	<dict>
		<key>org.cmltgpfix.CMLTGPFix</key>
		<dict>
			<key>CFBundleIdentifier</key>
			<string>org.cmltgpfix.CMLTGPFix</string>
			<key>IOClass</key>
			<string>CMLTGPFix</string>
			<key>IOMatchCategory</key>
			<string>CMLTGPFix</string>
			<key>IOProviderClass</key>
			<string>IOResources</string>
			<key>IOResourceMatch</key>
			<string>IOKit</string>
		</dict>
	</dict>
	<key>NSHumanReadableCopyright</key>
	<string>Copyright © 2026 A Star Computers. BSD-3-Clause.</string>
	<key>OSBundleCompatibleVersion</key>
	<string>1.0</string>
	<key>OSBundleLibraries</key>
	<dict>
		<key>as.vit9696.Lilu</key>
		<string>1.3.1</string>
		<key>com.apple.kpi.bsd</key>
		<string>12.0.0</string>
		<key>com.apple.kpi.dsep</key>
		<string>12.0.0</string>
		<key>com.apple.kpi.iokit</key>
		<string>12.0.0</string>
		<key>com.apple.kpi.libkern</key>
		<string>12.0.0</string>
		<key>com.apple.kpi.mach</key>
		<string>12.0.0</string>
		<key>com.apple.kpi.unsupported</key>
		<string>12.0.0</string>
	</dict>
	<key>OSBundleRequired</key>
	<string>Root</string>
</dict>
</plist>

BSD 3-Clause License

Copyright (c) 2026, A Star Computers

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this
   list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.

3. Neither the name of the copyright holder nor the names of its
   contributors may be used to endorse or promote products derived from
   this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.