diff --git a/drivers/amlogic/media_modules/frame_provider/decoder/h264/vh264_4k2k.c b/drivers/amlogic/media_modules/frame_provider/decoder/h264/vh264_4k2k.c
index f1351b458ec9..cbbe36f59fa3 100644
--- a/drivers/amlogic/media_modules/frame_provider/decoder/h264/vh264_4k2k.c
+++ b/drivers/amlogic/media_modules/frame_provider/decoder/h264/vh264_4k2k.c
@@ -37,6 +37,10 @@
 #include <linux/amlogic/media/codec_mm/codec_mm.h>
 #include <linux/amlogic/media/video_sink/video_keeper.h>
 #include "../utils/firmware.h"
+#include <linux/amlogic/tee.h>
+#include "../../../common/chips/decoder_cpu_ver_info.h"
+
+
 
 #define MEM_NAME "codec_264_4k"
 
@@ -942,8 +946,7 @@ static void vh264_4k2k_put_timer_func(unsigned long arg)
 		struct vframe_s *vf;
 
 		if (kfifo_get(&recycle_q, &vf)) {
-			if ((vf->index >= 0)
-					&& (vf->index < DECODE_BUFFER_NUM_MAX)
+			if ((vf->index < DECODE_BUFFER_NUM_MAX)
 					&& (--vfbuf_use[vf->index] == 0)) {
 				WRITE_VREG(BUFFER_RECYCLE, vf->index + 1);
 				vf->index = DECODE_BUFFER_NUM_MAX;
@@ -1408,7 +1411,7 @@ static s32 vh264_4k2k_init(void)
 	int ret = -1, size = -1;
 	char *buf = vmalloc(0x1000 * 16);
 
-	if (IS_ERR_OR_NULL(buf))
+	if (buf == NULL)
 		return -ENOMEM;
 
 	pr_info("\nvh264_4k2k_init\n");
@@ -1418,8 +1421,10 @@ static s32 vh264_4k2k_init(void)
 	stat |= STAT_TIMER_INIT;
 
 	ret = vh264_4k2k_local_init();
-	if (ret < 0)
+	if (ret < 0) {
+		vfree(buf);
 		return ret;
+	}
 	amvdec_enable();
 
 	/* -- ucode loading (amrisc and swap code) */
@@ -1484,19 +1489,6 @@ static s32 vh264_4k2k_init(void)
 	/*slice*/
 	memcpy((u8 *) mc_cpu_addr + 0x3000, buf + 0x4000, 0x3000);
 
-	if (ret < 0) {
-		amvdec_disable();
-		if (!H264_4K2K_SINGLE_CORE)
-			amvdec2_disable();
-		pr_info("vh264_4k2k load firmware error.\n");
-		if (mc_cpu_addr) {
-			dma_free_coherent(amports_get_dma_device(),
-				MC_TOTAL_SIZE, mc_cpu_addr, mc_dma_handle);
-			mc_cpu_addr = NULL;
-		}
-
-		return -EBUSY;
-	}
 	stat |= STAT_MC_LOAD;
 
 	/* enable AMRISC side protocol */
diff --git a/drivers/amlogic/media_modules/frame_provider/decoder/utils/vdec.c b/drivers/amlogic/media_modules/frame_provider/decoder/utils/vdec.c
index 181870f9575f..be29c334b9ee 100644
--- a/drivers/amlogic/media_modules/frame_provider/decoder/utils/vdec.c
+++ b/drivers/amlogic/media_modules/frame_provider/decoder/utils/vdec.c
@@ -1780,14 +1780,13 @@ void vdec_free_cmabuf(void)
 	mutex_unlock(&vdec_mutex);
 }
 
-int vdec_core_request(struct vdec_s *vdec, unsigned long mask)
+void vdec_core_request(struct vdec_s *vdec, unsigned long mask)
 {
 	vdec->core_mask |= mask;
 
 	if (vdec->slave)
 		vdec->slave->core_mask |= mask;
 
-	return 0;
 }
 EXPORT_SYMBOL(vdec_core_request);
 
diff --git a/drivers/amlogic/media_modules/frame_provider/decoder/utils/vdec.h b/drivers/amlogic/media_modules/frame_provider/decoder/utils/vdec.h
index 1d67cd11c588..ce15b076b51b 100644
--- a/drivers/amlogic/media_modules/frame_provider/decoder/utils/vdec.h
+++ b/drivers/amlogic/media_modules/frame_provider/decoder/utils/vdec.h
@@ -395,7 +395,7 @@ extern unsigned long vdec_ready_to_run(struct vdec_s *vdec, unsigned long mask);
 
 extern void vdec_prepare_run(struct vdec_s *vdec, unsigned long mask);
 
-extern int vdec_core_request(struct vdec_s *vdec, unsigned long mask);
+extern void vdec_core_request(struct vdec_s *vdec, unsigned long mask);
 
 extern int vdec_core_release(struct vdec_s *vdec, unsigned long mask);
 
diff --git a/drivers/amlogic/media_modules/stream_input/parser/esparser.c b/drivers/amlogic/media_modules/stream_input/parser/esparser.c
index 883dd429e9e2..cdd78961eb03 100644
--- a/drivers/amlogic/media_modules/stream_input/parser/esparser.c
+++ b/drivers/amlogic/media_modules/stream_input/parser/esparser.c
@@ -61,6 +61,9 @@
 #define PARSER_DISCARD      (ES_DISCARD | ES_PARSER_START)
 #define PARSER_BUSY         (ES_PARSER_BUSY)
 
+#define MAX_DRM_PACKAGE_SIZE 0x500000
+
+
 static unsigned char *search_pattern;
 static dma_addr_t search_pattern_map;
 static u32 audio_real_wp;
@@ -747,6 +750,10 @@ ssize_t drm_write(struct file *file, struct stream_buf_s *stbuf,
 	}
 
 	if ((drm->drm_flag & TYPE_DRMINFO) && (drm->drm_hasesdata == 0)) {
+		if (drm->drm_pktsize > MAX_DRM_PACKAGE_SIZE) {
+			pr_err("drm package size is error, size is %u\n", drm->drm_pktsize);
+			return -EINVAL;
+		}
 		/* buf only has drminfo not have esdata; */
 		realbuf = drm->drm_phy;
 		realcount = drm->drm_pktsize;
@@ -757,6 +764,10 @@ ssize_t drm_write(struct file *file, struct stream_buf_s *stbuf,
 		 *drm->drm_hasesdata,stbuf->type,buf);
 		 */
 	} else if (drm->drm_hasesdata == 1) {	/* buf is drminfo+es; */
+		if (drm->drm_pktsize > MAX_DRM_PACKAGE_SIZE) {
+			pr_err("drm package size is error, size is %u\n", drm->drm_pktsize);
+			return -EINVAL;
+		}
 		realcount = drm->drm_pktsize;
 		realbuf = (unsigned long)buf + sizeof(struct drm_info);
 		isphybuf = 0;
diff --git a/drivers/amlogic/media_modules/stream_input/parser/tsdemux.c b/drivers/amlogic/media_modules/stream_input/parser/tsdemux.c
index 7ea5b8f0da6e..05f235c821c3 100644
--- a/drivers/amlogic/media_modules/stream_input/parser/tsdemux.c
+++ b/drivers/amlogic/media_modules/stream_input/parser/tsdemux.c
@@ -47,6 +47,8 @@
 #include <linux/reset.h>
 #include "../amports/amports_priv.h"
 
+#define MAX_DRM_PACKAGE_SIZE 0x500000
+
 
 static const char tsdemux_fetch_id[] = "tsdemux-fetch-id";
 static const char tsdemux_irq_id[] = "tsdemux-irq-id";
@@ -821,7 +823,12 @@ ssize_t drm_tswrite(struct file *file,
 
 	if (drm->drm_flag == TYPE_DRMINFO && drm->drm_level == DRM_LEVEL1) {
 		/* buf only has drminfo not have esdata; */
-		realcount = drm->drm_pktsize;
+		if (drm->drm_pktsize <= MAX_DRM_PACKAGE_SIZE)
+			realcount = drm->drm_pktsize;
+		else {
+			pr_err("drm package size is error, size is %u\n", drm->drm_pktsize);
+			return -EINVAL;
+		}
 		realbuf = drm->drm_phy;
 		isphybuf = 1;
 	} else
diff --git a/drivers/amlogic/media_modules/stream_input/subtitle/subtitle.c b/drivers/amlogic/media_modules/stream_input/subtitle/subtitle.c
index 5affce48b6ec..bfcf6122e7d8 100644
--- a/drivers/amlogic/media_modules/stream_input/subtitle/subtitle.c
+++ b/drivers/amlogic/media_modules/stream_input/subtitle/subtitle.c
@@ -113,9 +113,9 @@ static ssize_t store_curr(struct class *class, struct class_attribute *attr,
 	ssize_t r;
 
 	r = kstrtoint(buf, 0, &curr);
-	//r = sscanf(buf, "%d", &curr);
-	/* if ((r != 1)) */
-	/* return -EINVAL; */
+	if (r < 0)
+		return -EINVAL;
+
 
 	subtitle_current = curr;
 
@@ -135,8 +135,8 @@ static ssize_t store_index(struct class *class, struct class_attribute *attr,
 	ssize_t r;
 
 	r = kstrtoint(buf, 0, &curr);
-	/* if ((r != 1)) */
-	/* return -EINVAL; */
+	if (r < 0)
+		return -EINVAL;
 
 	subtitle_index = curr;
 
@@ -158,8 +158,9 @@ static ssize_t store_reset(struct class *class, struct class_attribute *attr,
 	r = kstrtoint(buf, 0, &reset);
 
 	pr_info("reset is %d\n", reset);
-	/* if ((r != 1)) */
-	/* return -EINVAL; */
+	if (r < 0)
+		return -EINVAL;
+
 
 	subtitle_reset = reset;
 
@@ -179,8 +180,8 @@ static ssize_t store_type(struct class *class, struct class_attribute *attr,
 	ssize_t r;
 
 	r = kstrtoint(buf, 0, &type);
-	/* if ((r != 1)) */
-	/* return -EINVAL; */
+	if (r < 0)
+		return -EINVAL;
 
 	subtitle_type = type;
 
@@ -200,8 +201,8 @@ static ssize_t store_width(struct class *class, struct class_attribute *attr,
 	ssize_t r;
 
 	r = kstrtoint(buf, 0, &width);
-	/* if ((r != 1)) */
-	/* return -EINVAL; */
+	if (r < 0)
+		return -EINVAL;
 
 	subtitle_width = width;
 
@@ -221,8 +222,8 @@ static ssize_t store_height(struct class *class, struct class_attribute *attr,
 	ssize_t r;
 
 	r = kstrtoint(buf, 0, &height);
-	/* if ((r != 1)) */
-	/* return -EINVAL; */
+	if (r < 0)
+		return -EINVAL;
 
 	subtitle_height = height;
 
@@ -242,7 +243,7 @@ static ssize_t store_total(struct class *class, struct class_attribute *attr,
 	ssize_t r;
 
 	r = kstrtoint(buf, 0, &total);
-	if ((r <= 0))
+	if (r < 0)
 		return -EINVAL;
 	pr_info("subtitle num is %d\n", total);
 	subtitle_total = total;
@@ -266,7 +267,7 @@ static ssize_t store_enable(struct class *class, struct class_attribute *attr,
 	ssize_t r;
 
 	r = kstrtoint(buf, 0, &mode);
-	if ((r != 1))
+	if (r < 0)
 		return -EINVAL;
 	pr_info("subtitle enable is %d\n", mode);
 	subtitle_enable = mode ? 1 : 0;
@@ -290,7 +291,7 @@ static ssize_t store_size(struct class *class, struct class_attribute *attr,
 	ssize_t r;
 
 	r = kstrtoint(buf, 0, &ssize);
-	if ((r <= 0))
+	if (r < 0)
 		return -EINVAL;
 	pr_info("subtitle size is %d\n", ssize);
 	subtitle_data[subtitle_write_pos].subtitle_size = ssize;
@@ -311,7 +312,7 @@ static ssize_t store_startpts(struct class *class, struct class_attribute *attr,
 	ssize_t r;
 
 	r = kstrtoint(buf, 0, &spts);
-	if ((r <= 0))
+	if (r < 0)
 		return -EINVAL;
 	pr_info("subtitle start pts is %x\n", spts);
 	subtitle_start_pts = spts;
@@ -370,7 +371,7 @@ static ssize_t store_fps(struct class *class, struct class_attribute *attr,
 	ssize_t r;
 
 	r = kstrtoint(buf, 0, &ssize);
-	if ((r <= 0))
+	if (r < 0)
 		return -EINVAL;
 	pr_info("subtitle fps is %d\n", ssize);
 	subtitle_fps = ssize;
@@ -391,7 +392,7 @@ static ssize_t store_subtype(struct class *class, struct class_attribute *attr,
 	ssize_t r;
 
 	r = kstrtoint(buf, 0, &ssize);
-	if ((r <= 0))
+	if (r < 0)
 		return -EINVAL;
 	pr_info("subtitle subtype is %d\n", ssize);
 	subtitle_subtype = ssize;