From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id BE9EFC43458 for ; Mon, 13 Jul 2026 12:54:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=EnFmKEW+rTjJjSrhwOqwDaS6ENbHs+eIx9MIx7iPtUY=; b=1jONDvv3BSiYoK t/d1rZiUdjy3X8rzzZ6gd7mx0CmHy/sNagqVc8yK6GDxn/hVELW1bDkx93KQa29MboxpWTLerNFVE +5+dXF/UX/vohJxES/pZV29vSVsmGRPTAN4VqgDDfH8WzKxAmDoHC2KFYtHiGZOucYERuLkhPVJrf KXfI6v3xriIvpNoAEy579aSJd0JIg/d42cHGtsvF3Eft8WyclmDaOoa8t3w2UQJ0l+8VerpEbjfeO MCx2jiN7xpIMuBrkqncQLmOo/QHcHzeBSW3dgISaSJLcqerrRwboRxYyFbK2zX/V6Hz8XqLzF1LPq LY16gH5doH1WNfqFcxsg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjGBJ-00000009Fqg-3L1t; Mon, 13 Jul 2026 12:54:45 +0000 Received: from sea.source.kernel.org ([172.234.252.31]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wjGBI-00000009Fpu-0Mws for linux-amlogic@lists.infradead.org; Mon, 13 Jul 2026 12:54:44 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id D3A8D411BD; Mon, 13 Jul 2026 12:54:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F1031F00A3D; Mon, 13 Jul 2026 12:54:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783947283; bh=qzX7WoC3qvXqkDe9glXp9hxIbPF/2xEOQoFZ6eRB9qs=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=fZE+7puUdRkn6rpP0JIKN9WXG1RbYZ0sW4PDWjzDFhdhJ3KQzBCw4bSUVk/z+pdU9 hVsC6TfBJwiR/RZ0Hqw17gEwTG4zaidOh9QsZfFeRVe2kFafhlqn5ib8KqwQccqHq/ 5V5ZP41yFKzYa2ojGxp3s9HFIzq6h6AOZz3Z4BgnrcqV7814vPl6vO7p+38Sl0EDYK KUggPuGJMi5ppmwmbvFTIqFpE1QH6iO7V9yg0SO3duZODwtz/5ygqKl+AFUfBWJL2D 55kTz59aKrEbQgdq08DeT8ayJ5nXJpJ2nRzEbZOY+zdfjJkdcDBCNM20w+z3zciHqj 6dLpoZqNgM+eQ== From: sashiko-bot@kernel.org Subject: Re: [PATCH v7 12/19] media: meson: vdec: Coordinate m2m task execution inside async loop To: "Anand Moon" Cc: dri-devel@lists.freedesktop.org, neil.armstrong@linaro.org, linux-amlogic@lists.infradead.org In-Reply-To: <20260713120840.17427-13-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> <20260713120840.17427-13-linux.amoon@gmail.com> Date: Mon, 13 Jul 2026 12:54:43 +0000 Message-Id: <20260713125443.7F1031F00A3D@smtp.kernel.org> X-BeenThere: linux-amlogic@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-amlogic" Errors-To: linux-amlogic-bounces+linux-amlogic=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg NyBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpOZXcgaXNzdWVzOgotIFtDcml0aWNh bF0gQW4gQUItQkEgZGVhZGxvY2sgb2NjdXJzIGJldHdlZW4gdGhlIFY0TDIgYFZJRElPQ19TVFJF QU1PRkZgIGlvY3RsIGFuZCB0aGUgd29ya3F1ZXVlIHdvcmtlciBgZXNwYXJzZXJfcXVldWVfYWxs X3NyY2Agb3ZlciBgc2Vzcy0+bG9ja2AuCi0gW0NyaXRpY2FsXSBBIHJlY3Vyc2l2ZSBtdXRleCBz ZWxmLWRlYWRsb2NrIG9jY3VycyBiZWNhdXNlIGBjb3JlLT5sb2NrYCBpcyBtYW51YWxseSBhY3F1 aXJlZCBpbnNpZGUgZnVuY3Rpb25zIGFscmVhZHkgcHJvdGVjdGVkIGJ5IHRoZSBWNEwyIGNvcmUu Ci0gW0hpZ2hdIFRoZSBgZXNwYXJzZXJfcXVldWVfYWxsX3NyY2Agd29ya3F1ZXVlIHRocmVhZCBl bnRlcnMgYSAxMDAlIENQVSBpbmZpbml0ZSBidXN5LWxvb3Agb24gZW1wdHkgcXVldWVzLCBlbmQt b2Ytc3RyZWFtIGJ1ZmZlcnMsIG9yIGhhcmR3YXJlIEZJRk8gZnVsbCBjb25kaXRpb25zLgotIFtI aWdoXSBUaGUgVjRMMiBNMk0gZnJhbWV3b3JrIHBlcm1hbmVudGx5IHN0YWxscyBkdWUgdG8gYSBs ZWFrZWQgam9iIGNvbnRleHQgd2hlbiBgZXNwYXJzZXJfcXVldWVfYWxsX3NyY2AgZXhpdHMgZWFy bHkgb3IgaGl0cyBsb29wIGJyZWFrIGNvbmRpdGlvbnMgd2l0aG91dCBjYWxsaW5nIGB2NGwyX20y bV9qb2JfZmluaXNoKClgLgotIFtIaWdoXSBDbG9zaW5nIGFueSBzZWNvbmRhcnkgZmlsZSBkZXNj cmlwdG9yIHVuY29uZGl0aW9uYWxseSBjbGVhcnMgYGNvcmUtPmN1cl9zZXNzYCwgc3RyaXBwaW5n IGhhcmR3YXJlIG93bmVyc2hpcCBmcm9tIHRoZSBhY3RpdmUgc2Vzc2lvbiBhbmQgY2F1c2luZyBw ZXJtYW5lbnQgRE1BIG1lbW9yeSBsZWFrcy4KClByZS1leGlzdGluZyBpc3N1ZXM6Ci0gW0NyaXRp Y2FsXSBBbiB1bmNvbmRpdGlvbmFsIG91dC1vZi1ib3VuZHMgaGVhcCB3cml0ZSBvY2N1cnMgd2hl biBwYWRkaW5nIGFydGlmaWNpYWxseSBzbWFsbCwgdXNlci1jb250cm9sbGVkIGJ1ZmZlcnMgaW4g YGVzcGFyc2VyX3BhZF9zdGFydF9jb2RlKClgLgotIFtDcml0aWNhbF0gQW4gaW50ZWdlciBvdmVy ZmxvdyBkdXJpbmcgVlA5IHN1Yi1mcmFtZSBsZW5ndGggcGFyc2luZyBhbGxvd3MgYXR0YWNrZXJz IHRvIGJ5cGFzcyBzaXplIGJvdW5kYXJpZXMgYW5kIHRyaWdnZXIgYW4gb3V0LW9mLWJvdW5kcyBg bWVtbW92ZWAgY29weS4KLS0KCi0tLSBQYXRjaCBbMTJdOiBbUEFUQ0ggdjcgMTIvMTldIG1lZGlh OiBtZXNvbjogdmRlYzogQ29vcmRpbmF0ZSBtMm0gdGFzayBleGVjdXRpb24gaW5zaWRlIGFzeW5j IGxvb3AgLS0tCmNvbW1pdCA4ZjhmZmI0NDkyNTczZDZkODJlZTIwOWVjYjM4MmE5ZjVmYmVkOWU0 CkF1dGhvcjogQW5hbmQgTW9vbiA8bGludXguYW1vb25AZ21haWwuY29tPgoKbWVkaWE6IG1lc29u OiB2ZGVjOiBDb29yZGluYXRlIG0ybSB0YXNrIGV4ZWN1dGlvbiBpbnNpZGUgYXN5bmMgbG9vcAoK VGhpcyBjb21taXQgaW50cm9kdWNlcyBwcm9wZXIgVjRMMiBNZW1vcnktdG8tTWVtb3J5IChtMm0p IHNjaGVkdWxlciBwaXBlbGluZSAKdHJhY2tpbmcgYnkgaGFuZGxpbmcgam9iIGZpbmFsaXNhdGlv biBpbnNpZGUgdGhlIGFzeW5jaHJvbm91cyBlc3BhcnNlciAKd29ya3F1ZXVlLiBJdCBkZWZlcnMg dGhlIHNjaGVkdWxpbmcgY2FsbCB0byB2NGwyX20ybV9qb2JfZmluaXNoKCkgdG8gZXhlY3V0ZSAK d2l0aGluIHRoZSB3b3JrZXIgcm91dGluZS4KCj4gZGlmZiAtLWdpdCBhL2RyaXZlcnMvc3RhZ2lu Zy9tZWRpYS9tZXNvbi92ZGVjL2VzcGFyc2VyLmMgYi9kcml2ZXJzL3N0YWdpbmcvbWVkaWEvbWVz b24vdmRlYy9lc3BhcnNlci5jCj4gaW5kZXggYjlmMzZmZWY0YmUxMi4uOTM5YjIzOWMyYWY0NyAx MDA2NDQKPiAtLS0gYS9kcml2ZXJzL3N0YWdpbmcvbWVkaWEvbWVzb24vdmRlYy9lc3BhcnNlci5j Cj4gKysrIGIvZHJpdmVycy9zdGFnaW5nL21lZGlhL21lc29uL3ZkZWMvZXNwYXJzZXIuYwpbIC4u LiBdCj4gQEAgLTQzNyw2ICs0MzgsOSBAQCB2b2lkIGVzcGFyc2VyX3F1ZXVlX2FsbF9zcmMoc3Ry dWN0IHdvcmtfc3RydWN0ICp3b3JrKQo+ICAJCQllbHNlCj4gIAkJCQl2NGwyX20ybV9idWZfZG9u ZSh2YnVmLCBWQjJfQlVGX1NUQVRFX0RPTkUpOwo+ICAKPiArCQkJLyogU2FmZWx5IG5vdGlmeSB0 aGUgVjRMMiBjb3JlIHN1Yi1mcmFtZXdvcmsgKi8KPiArCQkJdjRsMl9tMm1fam9iX2ZpbmlzaChj b3JlLT5tMm1fZGV2LCBzZXNzLT5tMm1fY3R4KTsKPiArCj4gIAkJCS8qIFNldCB0cmFja2luZyBm bGFnIGluZGljYXRpbmcgdHJhbnNhY3Rpb24gY29tcGxldGlvbiAqLwo+ICAJCQlwcm9jZXNzZWRf ZnJhbWUgPSB0cnVlOwo+ICAJCX0KCltTZXZlcml0eTogSGlnaF0KRG9lcyB0aGlzIHdvcmtlciB0 aHJlYWQgcnVuIGludG8gYW4gaW5maW5pdGUgYnVzeS1sb29wIG9uIGVtcHR5IHF1ZXVlcyBvciAK ZW5kLW9mLXN0cmVhbSBidWZmZXJzPwoKSW4gZXNwYXJzZXJfcXVldWVfYWxsX3NyYygpLCB0aGUg Y29kZSB1c2VzIGEgc2NvcGVkX2d1YXJkIGZvciB0aGUgbG9jazoKCgl3aGlsZSAoMSkgewoJCS4u LgoJCXNjb3BlZF9ndWFyZChtdXRleCwgJnNlc3MtPmxvY2spIHsKCQkJaWYgKCF2YnVmKQoJCQkJ YnJlYWs7CgkJfQoJfQoKU2luY2Ugc2NvcGVkX2d1YXJkIGV4cGFuZHMgaW50byBhIGhpZGRlbiBm b3ItbG9vcCwgdGhlIGJyZWFrIHN0YXRlbWVudCBvbmx5IApleGl0cyB0aGUgc2NvcGVkX2d1YXJk J3MgbG9vcCwgbm90IHRoZSBvdXRlciB3aGlsZSAoMSkgbG9vcC4gVGhpcyBjb3VsZCB0cmFwIApl eGVjdXRpb24gaW5kZWZpbml0ZWx5LCBjb25zdW1pbmcgMTAwJSBDUFUgd2hlbiB0aGUgcXVldWUg aXMgZW1wdHksIGhpdHMgYW4gCkVPUyBidWZmZXIsIG9yIHRoZSBoYXJkd2FyZSBGSUZPIGlzIGZ1 bGwuCgpbU2V2ZXJpdHk6IEhpZ2hdCkNvdWxkIHRoZSBWNEwyIE0yTSBqb2IgY29udGV4dCBwZXJt YW5lbnRseSBsZWFrIGlmIHRoZSBzZXNzaW9uIHNodXRzIGRvd24/CgpMb29raW5nIGF0IGVzcGFy c2VyX3F1ZXVlX2FsbF9zcmMoKToKCglzY29wZWRfZ3VhcmQobXV0ZXgsICZzZXNzLT5sb2NrKSB7 CgkJLyogU2FmZSBhdG9taWMgdHJhY2tpbmcgY2hlY2s6IGV4aXQgbG9vcCBpZiBzZXNzaW9uIGlz IHNodXR0aW5nIGRvd24gKi8KCQlpZiAoUkVBRF9PTkNFKHNlc3MtPnNob3VsZF9zdG9wKSkKCQkJ cmV0dXJuOwoKUmV0dXJuaW5nIGVhcmx5IGRpcmVjdGx5IGJ5cGFzc2VzIHRoZSBuZXdseSBhZGRl ZCB2NGwyX20ybV9qb2JfZmluaXNoKCkgY2FsbC4KVGhpcyBjb3VsZCBwZXJtYW5lbnRseSBoYW5n IHRoZSBWNEwyIG1lbW9yeS10by1tZW1vcnkgZnJhbWV3b3JrIGJlY2F1c2UgaXQgCmNvbnNpZGVy cyB0aGUgZGV2aWNlIGJ1c3kgZm9yZXZlciwgcHJldmVudGluZyBmdXJ0aGVyIGRlY29kaW5nIGpv YnMuCgpbU2V2ZXJpdHk6IENyaXRpY2FsXQpJcyB0aGVyZSBhIHJpc2sgb2YgYW4gQUItQkEgZGVh ZGxvY2sgYmV0d2VlbiB0aGUgVjRMMiBWSURJT0NfU1RSRUFNT0ZGIGlvY3RsIAphbmQgdGhlIHdv cmtxdWV1ZSB3b3JrZXI/CgpUaGUgVjRMMiBjb3JlIGZyYW1ld29yayBhY3F1aXJlcyBzZXNzLT5s b2NrIGR1cmluZyBWSURJT0NfU1RSRUFNT0ZGIGFuZCB0aGVuIApjYWxscyB2ZGVjX3N0b3Bfc3Ry ZWFtaW5nKCksIHdoaWNoIHdhaXRzIGZvciB0aGUgYWN0aXZlIHdvcmtlciB0aHJlYWQ6Cgpkcml2 ZXJzL3N0YWdpbmcvbWVkaWEvbWVzb24vdmRlYy92ZGVjLmM6dmRlY19zdG9wX3N0cmVhbWluZygp IHsKCS4uLgoJY2FuY2VsX3dvcmtfc3luYygmc2Vzcy0+ZXNwYXJzZXJfcXVldWVfd29yayk7Cn0K CkNvbmN1cnJlbnRseSwgdGhlIHdvcmtlciB0aHJlYWQgZXNwYXJzZXJfcXVldWVfYWxsX3NyYyBz cGlucyB1cCBhbmQgYmxvY2tzIAphdHRlbXB0aW5nIHRvIGFjcXVpcmUgdGhlIGlkZW50aWNhbCBz ZXNzLT5sb2NrOgoKZHJpdmVycy9zdGFnaW5nL21lZGlhL21lc29uL3ZkZWMvZXNwYXJzZXIuYzpl c3BhcnNlcl9xdWV1ZV9hbGxfc3JjKCkgewoJLi4uCglzY29wZWRfZ3VhcmQobXV0ZXgsICZzZXNz LT5sb2NrKSB7Cn0KClRoaXMgc2VxdWVuY2Ugd291bGQgZW50aXJlbHkgZGVhZGxvY2sgdGhlIHN5 c3RlbSB3aGVuIHN0b3BwaW5nIHRoZSB2aWRlbyBzdHJlYW0uCgo+IGRpZmYgLS1naXQgYS9kcml2 ZXJzL3N0YWdpbmcvbWVkaWEvbWVzb24vdmRlYy92ZGVjLmMgYi9kcml2ZXJzL3N0YWdpbmcvbWVk aWEvbWVzb24vdmRlYy92ZGVjLmMKPiBpbmRleCAwZWIzOWFhNjAxNGVlLi5iM2UxZDk5ZTg4ODlm IDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvc3RhZ2luZy9tZWRpYS9tZXNvbi92ZGVjL3ZkZWMuYwo+ ICsrKyBiL2RyaXZlcnMvc3RhZ2luZy9tZWRpYS9tZXNvbi92ZGVjL3ZkZWMuYwo+IEBAIC0xNDks NiArMTQ5LDE3IEBAIHZkZWNfcXVldWVfcmVjeWNsZShzdHJ1Y3QgYW12ZGVjX3Nlc3Npb24gKnNl c3MsIHN0cnVjdCB2YjJfYnVmZmVyICp2YikKPiAgc3RhdGljIHZvaWQgdmRlY19tMm1fZGV2aWNl X3J1bih2b2lkICpwcml2KQo+ICB7Cj4gIAlzdHJ1Y3QgYW12ZGVjX3Nlc3Npb24gKnNlc3MgPSBw cml2Owo+ICsJc3RydWN0IGFtdmRlY19jb3JlICpjb3JlID0gc2Vzcy0+Y29yZTsKPiArCj4gKwlp ZiAoUkVBRF9PTkNFKHNlc3MtPnNob3VsZF9zdG9wKSkgewo+ICsJCXY0bDJfbTJtX2pvYl9maW5p c2goY29yZS0+bTJtX2Rldiwgc2Vzcy0+bTJtX2N0eCk7Cj4gKwkJcmV0dXJuOwo+ICsJfQo+ICsK PiArCW11dGV4X2xvY2soJmNvcmUtPmxvY2spOwo+ICsJaWYgKCFjb3JlLT5jdXJfc2VzcykKPiAr CQljb3JlLT5jdXJfc2VzcyA9IHNlc3M7Cj4gKwltdXRleF91bmxvY2soJmNvcmUtPmxvY2spOwo+ ICAKPiAgCXNjaGVkdWxlX3dvcmsoJnNlc3MtPmVzcGFyc2VyX3F1ZXVlX3dvcmspOwo+ICB9Cgpb U2V2ZXJpdHk6IENyaXRpY2FsXQpXaWxsIGFjcXVpcmluZyBjb3JlLT5sb2NrIG1hbnVhbGx5IGhl cmUgYW5kIGluIHZkZWNfc3RhcnRfc3RyZWFtaW5nIHJlc3VsdCAKaW4gYSByZWN1cnNpdmUgbXV0 ZXggc2VsZi1kZWFkbG9jaz8KCkJlY2F1c2UgdmRldi0+cXVldWUgaXMgaW50ZW50aW9uYWxseSBs ZWZ0IE5VTEwgZm9yIE0yTSBkZXZpY2VzLCB0aGUgVjRMMiBjb3JlIAppb2N0bCB3cmFwcGVyIHVu Y29uZGl0aW9uYWxseSBhY3F1aXJlcyB2ZGV2LT5sb2NrICh3aGljaCBpcyBtYXBwZWQgdG8gCiZj b3JlLT5sb2NrKSBiZWZvcmUgZGVsZWdhdGluZyBleGVjdXRpb24gdG8gdGhlIGlvY3RsIGltcGxl bWVudGF0aW9ucy4KClRoZSB1bmRlcmx5aW5nIGRyaXZlciBjYWxsYmFjayB2ZGVjX3N0YXJ0X3N0 cmVhbWluZyB0aGVuIGF0dGVtcHRzIHRvIG1hbnVhbGx5IAphY3F1aXJlIGl0IGFnYWluOgoKZHJp dmVycy9zdGFnaW5nL21lZGlhL21lc29uL3ZkZWMvdmRlYy5jOnZkZWNfc3RhcnRfc3RyZWFtaW5n KCkgewoJLi4uCgltdXRleF9sb2NrKCZjb3JlLT5sb2NrKTsKCWlmIChjb3JlLT5jdXJfc2VzcyAm JiBjb3JlLT5jdXJfc2VzcyAhPSBzZXNzKSB7Cn0KClRoaXMgd291bGQgaW1tZWRpYXRlbHkgc2Vs Zi1kZWFkbG9jayB0aGUga2VybmVsIHRocmVhZCBwcm9jZXNzaW5nIApWSURJT0NfU1RSRUFNT04g b3IgVklESU9DX1NUUkVBTU9GRi4KCltTZXZlcml0eTogSGlnaF0KRG9lcyBjbG9zaW5nIGEgc2Vj b25kYXJ5IGZpbGUgZGVzY3JpcHRvciB1bmludGVudGlvbmFsbHkgc3RyaXAgaGFyZHdhcmUgCm93 bmVyc2hpcCBmcm9tIHRoZSBhY3RpdmUgc2Vzc2lvbj8KCkluIHZkZWNfY2xvc2UoKSwgdGhlIHN0 YXRlIG1vZGlmaWNhdGlvbiBpcyBwbGFjZWQgb3V0c2lkZSB0aGUgYWN0aXZlIHNlc3Npb24gCmNo ZWNrIGJsb2NrOgoKZHJpdmVycy9zdGFnaW5nL21lZGlhL21lc29uL3ZkZWMvdmRlYy5jOnZkZWNf Y2xvc2UoKSB7CgkuLi4KCS8qIFNhZmVseSBjbGVhciBoYXJkd2FyZSBvd25lcnNoaXAgc2luY2Ug d2Ugd2VyZSBjb25maXJtZWQgYXMgdGhlIG93bmVyICovCglzbXBfc3RvcmVfcmVsZWFzZSgmY29y ZS0+Y3VyX3Nlc3MsIE5VTEwpOwp9CgpJZiBhIHVzZXItc3BhY2UgcHJvY2VzcyBvcGVucyB0aGUg dmlkZW8gbm9kZSB0d2ljZSwgc3RyZWFtcyBvbiB0aGUgZmlyc3QgCnNlc3Npb24sIGFuZCB0aGVu IGNsb3NlcyB0aGUgc2Vjb25kIHNlc3Npb24sIHRoaXMgY2xlYXJzIGNvcmUtPmN1cl9zZXNzIAp1 bmNvbmRpdGlvbmFsbHkuIFRoaXMgZGVzdHJveXMgdGhlIG93bmVyc2hpcCBzdGF0ZSBvZiB0aGUg YWN0aXZlIHNlc3Npb24sIApieXBhc3NpbmcgaXRzIGNsZWFudXAgc2VxdWVuY2UgYW5kIHBlcm1h bmVudGx5IGxlYWtpbmcgRE1BIGJ1ZmZlcnMgYW5kIGNhbnZhc2VzLgoKW1NldmVyaXR5OiBDcml0 aWNhbF0KVGhpcyBpcyBhIHByZS1leGlzdGluZyBpc3N1ZSwgYnV0IGNhbiBlc3BhcnNlcl9wYWRf c3RhcnRfY29kZSgpIGNhdXNlIGFuIApvdXQtb2YtYm91bmRzIGhlYXAgd3JpdGUgd2hlbiBoYW5k bGluZyBhcnRpZmljaWFsbHkgc21hbGwgYnVmZmVycz8KCklmIHVzZXJzcGFjZSBuZWdvdGlhdGVz IGEgc21hbGwgc2l6ZWltYWdlIGFuZCBxdWV1ZXMgYSB0aW55IGJ1ZmZlciwgdGhlIHBhZGRpbmcg CmZ1bmN0aW9uIGNvbXB1dGVzIHBhZF9zaXplIGJhc2VkIG9uIEVTUEFSU0VSX01JTl9QQUNLRVRf U0laRSBhbmQgZXhlY3V0ZXMgCmEgbWVtc2V0IGJlZm9yZSB2ZXJpZnlpbmcgdGhlIHZiMl9wbGFu ZV9zaXplOgoKZHJpdmVycy9zdGFnaW5nL21lZGlhL21lc29uL3ZkZWMvZXNwYXJzZXIuYzplc3Bh cnNlcl9wYWRfc3RhcnRfY29kZSgpIHsKCS4uLgoJCXBhZF9zaXplID0gRVNQQVJTRVJfTUlOX1BB Q0tFVF9TSVpFIC0gcGF5bG9hZF9zaXplOwoJCW1lbXNldCh2YWRkciArIHBheWxvYWRfc2l6ZSwg MCwgcGFkX3NpemUpOwoJfQoKCWlmICgocGF5bG9hZF9zaXplICsgcGFkX3NpemUgKyBTRUFSQ0hf UEFUVEVSTl9MRU4pID4KCQkJCQkJdmIyX3BsYW5lX3NpemUodmIsIDApKSB7Cn0KClRoaXMgY291 bGQgYWxsb3cgYSBsb2NhbCB1c2VyIHRvIG92ZXJ3cml0ZSBtZW1vcnkgd2l0aCB6ZXJvZXMgYnkg cGFzc2luZyBhIApwYXlsb2FkX3NpemUgb2YgMCwgcmVzdWx0aW5nIGluIGEgNDA5Ni1ieXRlIG1l bXNldC4KCltTZXZlcml0eTogQ3JpdGljYWxdClRoaXMgaXMgYSBwcmUtZXhpc3RpbmcgaXNzdWUs IGJ1dCBtaWdodCBhbiBpbnRlZ2VyIG92ZXJmbG93IGluIAp2cDlfdXBkYXRlX2hlYWRlcigpIGFs bG93IGF0dGFja2VycyB0byB0cmlnZ2VyIGFuIG91dC1vZi1ib3VuZHMgbWVtbW92ZT8KClRoZSBw YXJzZXIgcmVjb25zdHJ1Y3RzIGZyYW1lIGxlbmd0aHMgYnkgYml0LXNoaWZ0aW5nIGJ5dGUgcGF5 bG9hZHM6Cgpkcml2ZXJzL3N0YWdpbmcvbWVkaWEvbWVzb24vdmRlYy9lc3BhcnNlci5jOnZwOV91 cGRhdGVfaGVhZGVyKCkgewoJLi4uCgkJCQlmcmFtZV9zaXplW2N1cl9mcmFtZV0gfD0KCQkJCQko ZHBbbWFnX3B0cl0gPDwgKGN1cl9tYWcgKiA4KSk7Cn0KCklmIGRwW21hZ19wdHJdIGlzID49IDEy OCBhbmQgY3VyX21hZyBpcyAzLCB0aGUgdW5zaWduZWQgOC1iaXQgdmFsdWUgcHJvbW90ZXMgCnRv IGFuIGludCBhbmQgc2hpZnRzIGludG8gdGhlIHNpZ24gYml0LCByZXN1bHRpbmcgaW4gYSBsYXJn ZSBuZWdhdGl2ZSBpbnRlZ2VyLgoKTGF0ZXIsIHRoaXMgbmVnYXRpdmUgZnJhbWVfc2l6ZSBpcyBw YXNzZWQgdG8gbWVtbW92ZSgpOgoKZHJpdmVycy9zdGFnaW5nL21lZGlhL21lc29uL3ZkZWMvZXNw YXJzZXIuYzp2cDlfdXBkYXRlX2hlYWRlcigpIHsKCS4uLgoJCW1lbW1vdmUoZmRhdGEgKyBWUDlf SEVBREVSX1NJWkUsIG9sZF9mcmFtZWRhdGEsIGZyYW1lc2l6ZSk7Cn0KClRoZSBuZWdhdGl2ZSBm cmFtZXNpemUgaW1wbGljaXRseSBjb252ZXJ0cyB0byBhIG1hc3NpdmUgc2l6ZV90LCB3aGljaCBj b3VsZCAKY29ycnVwdCBhcmJpdHJhcnkga2VybmVsIG1lbW9yeS4KCi0tIApTYXNoaWtvIEFJIHJl dmlldyDCtyBodHRwczovL3Nhc2hpa28uZGV2LyMvcGF0Y2hzZXQvMjAyNjA3MTMxMjA4NDAuMTc0 MjctMS1saW51eC5hbW9vbkBnbWFpbC5jb20/cGFydD0xMgoKX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18KbGludXgtYW1sb2dpYyBtYWlsaW5nIGxpc3QKbGlu dXgtYW1sb2dpY0BsaXN0cy5pbmZyYWRlYWQub3JnCmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3Jn L21haWxtYW4vbGlzdGluZm8vbGludXgtYW1sb2dpYwo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0ED6AC44501 for ; Mon, 13 Jul 2026 12:54:46 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 73E7D10E5B8; Mon, 13 Jul 2026 12:54:45 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.b="fZE+7puU"; dkim-atps=neutral Received: from sea.source.kernel.org (sea.source.kernel.org [172.234.252.31]) by gabe.freedesktop.org (Postfix) with ESMTPS id 3336410E5B8 for ; Mon, 13 Jul 2026 12:54:44 +0000 (UTC) Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id D3A8D411BD; Mon, 13 Jul 2026 12:54:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F1031F00A3D; Mon, 13 Jul 2026 12:54:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783947283; bh=qzX7WoC3qvXqkDe9glXp9hxIbPF/2xEOQoFZ6eRB9qs=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=fZE+7puUdRkn6rpP0JIKN9WXG1RbYZ0sW4PDWjzDFhdhJ3KQzBCw4bSUVk/z+pdU9 hVsC6TfBJwiR/RZ0Hqw17gEwTG4zaidOh9QsZfFeRVe2kFafhlqn5ib8KqwQccqHq/ 5V5ZP41yFKzYa2ojGxp3s9HFIzq6h6AOZz3Z4BgnrcqV7814vPl6vO7p+38Sl0EDYK KUggPuGJMi5ppmwmbvFTIqFpE1QH6iO7V9yg0SO3duZODwtz/5ygqKl+AFUfBWJL2D 55kTz59aKrEbQgdq08DeT8ayJ5nXJpJ2nRzEbZOY+zdfjJkdcDBCNM20w+z3zciHqj 6dLpoZqNgM+eQ== From: sashiko-bot@kernel.org Subject: Re: [PATCH v7 12/19] media: meson: vdec: Coordinate m2m task execution inside async loop To: "Anand Moon" Cc: dri-devel@lists.freedesktop.org, neil.armstrong@linaro.org, linux-amlogic@lists.infradead.org In-Reply-To: <20260713120840.17427-13-linux.amoon@gmail.com> References: <20260713120840.17427-1-linux.amoon@gmail.com> <20260713120840.17427-13-linux.amoon@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 13 Jul 2026 12:54:43 +0000 Message-Id: <20260713125443.7F1031F00A3D@smtp.kernel.org> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Thank you for your contribution! Sashiko AI review found 7 potential issue(= s) to consider: New issues: - [Critical] An AB-BA deadlock occurs between the V4L2 `VIDIOC_STREAMOFF` i= octl and the workqueue worker `esparser_queue_all_src` over `sess->lock`. - [Critical] A recursive mutex self-deadlock occurs because `core->lock` is= manually acquired inside functions already protected by the V4L2 core. - [High] The `esparser_queue_all_src` workqueue thread enters a 100% CPU in= finite busy-loop on empty queues, end-of-stream buffers, or hardware FIFO f= ull conditions. - [High] The V4L2 M2M framework permanently stalls due to a leaked job cont= ext when `esparser_queue_all_src` exits early or hits loop break conditions= without calling `v4l2_m2m_job_finish()`. - [High] Closing any secondary file descriptor unconditionally clears `core= ->cur_sess`, stripping hardware ownership from the active session and causi= ng permanent DMA memory leaks. Pre-existing issues: - [Critical] An unconditional out-of-bounds heap write occurs when padding = artificially small, user-controlled buffers in `esparser_pad_start_code()`. - [Critical] An integer overflow during VP9 sub-frame length parsing allows= attackers to bypass size boundaries and trigger an out-of-bounds `memmove`= copy. -- --- Patch [12]: [PATCH v7 12/19] media: meson: vdec: Coordinate m2m task ex= ecution inside async loop --- commit 8f8ffb4492573d6d82ee209ecb382a9f5fbed9e4 Author: Anand Moon media: meson: vdec: Coordinate m2m task execution inside async loop This commit introduces proper V4L2 Memory-to-Memory (m2m) scheduler pipelin= e=20 tracking by handling job finalisation inside the asynchronous esparser=20 workqueue. It defers the scheduling call to v4l2_m2m_job_finish() to execut= e=20 within the worker routine. > diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/stagin= g/media/meson/vdec/esparser.c > index b9f36fef4be12..939b239c2af47 100644 > --- a/drivers/staging/media/meson/vdec/esparser.c > +++ b/drivers/staging/media/meson/vdec/esparser.c [ ... ] > @@ -437,6 +438,9 @@ void esparser_queue_all_src(struct work_struct *work) > else > v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_DONE); > =20 > + /* Safely notify the V4L2 core sub-framework */ > + v4l2_m2m_job_finish(core->m2m_dev, sess->m2m_ctx); > + > /* Set tracking flag indicating transaction completion */ > processed_frame =3D true; > } [Severity: High] Does this worker thread run into an infinite busy-loop on empty queues or=20 end-of-stream buffers? In esparser_queue_all_src(), the code uses a scoped_guard for the lock: while (1) { ... scoped_guard(mutex, &sess->lock) { if (!vbuf) break; } } Since scoped_guard expands into a hidden for-loop, the break statement only= =20 exits the scoped_guard's loop, not the outer while (1) loop. This could tra= p=20 execution indefinitely, consuming 100% CPU when the queue is empty, hits an= =20 EOS buffer, or the hardware FIFO is full. [Severity: High] Could the V4L2 M2M job context permanently leak if the session shuts down? Looking at esparser_queue_all_src(): scoped_guard(mutex, &sess->lock) { /* Safe atomic tracking check: exit loop if session is shutting down */ if (READ_ONCE(sess->should_stop)) return; Returning early directly bypasses the newly added v4l2_m2m_job_finish() cal= l. This could permanently hang the V4L2 memory-to-memory framework because it= =20 considers the device busy forever, preventing further decoding jobs. [Severity: Critical] Is there a risk of an AB-BA deadlock between the V4L2 VIDIOC_STREAMOFF ioct= l=20 and the workqueue worker? The V4L2 core framework acquires sess->lock during VIDIOC_STREAMOFF and the= n=20 calls vdec_stop_streaming(), which waits for the active worker thread: drivers/staging/media/meson/vdec/vdec.c:vdec_stop_streaming() { ... cancel_work_sync(&sess->esparser_queue_work); } Concurrently, the worker thread esparser_queue_all_src spins up and blocks= =20 attempting to acquire the identical sess->lock: drivers/staging/media/meson/vdec/esparser.c:esparser_queue_all_src() { ... scoped_guard(mutex, &sess->lock) { } This sequence would entirely deadlock the system when stopping the video st= ream. > diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/me= dia/meson/vdec/vdec.c > index 0eb39aa6014ee..b3e1d99e8889f 100644 > --- a/drivers/staging/media/meson/vdec/vdec.c > +++ b/drivers/staging/media/meson/vdec/vdec.c > @@ -149,6 +149,17 @@ vdec_queue_recycle(struct amvdec_session *sess, stru= ct vb2_buffer *vb) > static void vdec_m2m_device_run(void *priv) > { > struct amvdec_session *sess =3D priv; > + struct amvdec_core *core =3D sess->core; > + > + if (READ_ONCE(sess->should_stop)) { > + v4l2_m2m_job_finish(core->m2m_dev, sess->m2m_ctx); > + return; > + } > + > + mutex_lock(&core->lock); > + if (!core->cur_sess) > + core->cur_sess =3D sess; > + mutex_unlock(&core->lock); > =20 > schedule_work(&sess->esparser_queue_work); > } [Severity: Critical] Will acquiring core->lock manually here and in vdec_start_streaming result= =20 in a recursive mutex self-deadlock? Because vdev->queue is intentionally left NULL for M2M devices, the V4L2 co= re=20 ioctl wrapper unconditionally acquires vdev->lock (which is mapped to=20 &core->lock) before delegating execution to the ioctl implementations. The underlying driver callback vdec_start_streaming then attempts to manual= ly=20 acquire it again: drivers/staging/media/meson/vdec/vdec.c:vdec_start_streaming() { ... mutex_lock(&core->lock); if (core->cur_sess && core->cur_sess !=3D sess) { } This would immediately self-deadlock the kernel thread processing=20 VIDIOC_STREAMON or VIDIOC_STREAMOFF. [Severity: High] Does closing a secondary file descriptor unintentionally strip hardware=20 ownership from the active session? In vdec_close(), the state modification is placed outside the active sessio= n=20 check block: drivers/staging/media/meson/vdec/vdec.c:vdec_close() { ... /* Safely clear hardware ownership since we were confirmed as the owner */ smp_store_release(&core->cur_sess, NULL); } If a user-space process opens the video node twice, streams on the first=20 session, and then closes the second session, this clears core->cur_sess=20 unconditionally. This destroys the ownership state of the active session,=20 bypassing its cleanup sequence and permanently leaking DMA buffers and canv= ases. [Severity: Critical] This is a pre-existing issue, but can esparser_pad_start_code() cause an=20 out-of-bounds heap write when handling artificially small buffers? If userspace negotiates a small sizeimage and queues a tiny buffer, the pad= ding=20 function computes pad_size based on ESPARSER_MIN_PACKET_SIZE and executes=20 a memset before verifying the vb2_plane_size: drivers/staging/media/meson/vdec/esparser.c:esparser_pad_start_code() { ... pad_size =3D ESPARSER_MIN_PACKET_SIZE - payload_size; memset(vaddr + payload_size, 0, pad_size); } if ((payload_size + pad_size + SEARCH_PATTERN_LEN) > vb2_plane_size(vb, 0)) { } This could allow a local user to overwrite memory with zeroes by passing a= =20 payload_size of 0, resulting in a 4096-byte memset. [Severity: Critical] This is a pre-existing issue, but might an integer overflow in=20 vp9_update_header() allow attackers to trigger an out-of-bounds memmove? The parser reconstructs frame lengths by bit-shifting byte payloads: drivers/staging/media/meson/vdec/esparser.c:vp9_update_header() { ... frame_size[cur_frame] |=3D (dp[mag_ptr] << (cur_mag * 8)); } If dp[mag_ptr] is >=3D 128 and cur_mag is 3, the unsigned 8-bit value promo= tes=20 to an int and shifts into the sign bit, resulting in a large negative integ= er. Later, this negative frame_size is passed to memmove(): drivers/staging/media/meson/vdec/esparser.c:vp9_update_header() { ... memmove(fdata + VP9_HEADER_SIZE, old_framedata, framesize); } The negative framesize implicitly converts to a massive size_t, which could= =20 corrupt arbitrary kernel memory. --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260713120840.1742= 7-1-linux.amoon@gmail.com?part=3D12