* [PATCH v6 7/8] media: meson: vdec: Fix NULL pointer dereference in ISR handlers
From: Anand Moon @ 2026-05-30 9:42 UTC (permalink / raw)
To: Neil Armstrong, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Kevin Hilman,
Jerome Brunet, Martin Blumenstingl, Mauro Carvalho Chehab,
Greg Kroah-Hartman, Maxime Jourdan, Hans Verkuil,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
moderated list:ARM/Amlogic Meson SoC support, open list,
open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS,
open list:STAGING SUBSYSTEM
Cc: Anand Moon, Nicolas Dufresne, Sashiko
In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com>
The hard interrupt handler (vdec_isr) and the threaded interrupt handler
(vdec_threaded_isr) directly read core->cur_sess without synchronization
or validation. If a streaming teardown concurrently clears core->cur_sess
to NULL while an interrupt is being processed, a NULL pointer dereference
occurs when accessing the session fields or codec operations.
Fix this race condition by using READ_ONCE() to obtain a stable, atomic
snapshot of core->cur_sess. Check if the returned session pointer is NULL,
and return IRQ_NONE immediately if the session has already been torn down.
Cc: Nicolas Dufresne <nicolas@ndufresne.ca>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel.org/
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
---
drivers/staging/media/meson/vdec/vdec.c | 25 ++++++++++++++++++++++---
1 file changed, 22 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index f99335effe17..3897c75b19c8 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -996,17 +996,36 @@ static const struct v4l2_file_operations vdec_fops = {
static irqreturn_t vdec_isr(int irq, void *data)
{
struct amvdec_core *core = data;
- struct amvdec_session *sess = core->cur_sess;
+ struct amvdec_session *sess;
+ irqreturn_t ret = IRQ_HANDLED;
+
+ /*
+ * Use READ_ONCE to secure an atomic snapshot of the pointer,
+ * protecting against concurrent clearing during streaming
+ * teardowns.
+ */
+ sess = READ_ONCE(core->cur_sess);
+ if (!sess)
+ return IRQ_NONE;
sess->last_irq_jiffies = get_jiffies_64();
+ ret = sess->fmt_out->codec_ops->isr(sess);
- return sess->fmt_out->codec_ops->isr(sess);
+ return ret;
}
static irqreturn_t vdec_threaded_isr(int irq, void *data)
{
struct amvdec_core *core = data;
- struct amvdec_session *sess = core->cur_sess;
+ struct amvdec_session *sess;
+
+ /*
+ * Prevent late-stage threaded interrupts from dereferencing a NULL
+ * session.
+ */
+ sess = READ_ONCE(core->cur_sess);
+ if (!sess)
+ return IRQ_NONE;
return sess->fmt_out->codec_ops->threaded_isr(sess);
}
--
2.50.1
^ permalink raw reply related
* [PATCH v6 6/8] media: meson: vdec: Configure DMA mask and segment size in probe
From: Anand Moon @ 2026-05-30 9:42 UTC (permalink / raw)
To: Neil Armstrong, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Kevin Hilman,
Jerome Brunet, Martin Blumenstingl, Mauro Carvalho Chehab,
Greg Kroah-Hartman, Hans Verkuil, Maxime Jourdan,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
moderated list:ARM/Amlogic Meson SoC support, open list,
open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS,
open list:STAGING SUBSYSTEM
Cc: Anand Moon, Nicolas Dufresne, Sashiko
In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com>
The vdec probe routine did not set explicit DMA constraints,
leaving the driver dependent on platform defaults. This could
cause allocation failures or fragmented buffer handling on
systems with stricter DMA limits.
Fix this by:
- Setting a 64 bit coherent DMA mask with
dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64)).
- Configuring the maximum contiguous segment size to UINT_MAX
via vb2_dma_contig_set_max_seg_size().
This aligns the driver with common DMA setup practices and guarantees
large buffer allocations work reliably across platforms.
Cc: Nicolas Dufresne <nicolas@ndufresne.ca>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel.org/
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
---
drivers/staging/media/meson/vdec/vdec.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index 4884ee04b352..f99335effe17 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -1064,6 +1064,15 @@ static int vdec_probe(struct platform_device *pdev)
if (IS_ERR(core->canvas))
return PTR_ERR(core->canvas);
+ ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
+ if (ret)
+ return dev_err_probe(dev, ret, "Failed to set DMA mask\n");
+
+ ret = vb2_dma_contig_set_max_seg_size(dev, UINT_MAX);
+ if (ret)
+ return dev_err_probe(dev, ret,
+ "Failed to set DMA max segment size\n");
+
of_id = of_match_node(vdec_dt_match, dev->of_node);
core->platform = of_id->data;
--
2.50.1
^ permalink raw reply related
* [PATCH v6 5/8] media: meson: vdec: Cancel esparser work during teardown
From: Anand Moon @ 2026-05-30 9:42 UTC (permalink / raw)
To: Neil Armstrong, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Kevin Hilman,
Jerome Brunet, Martin Blumenstingl, Mauro Carvalho Chehab,
Greg Kroah-Hartman, Hans Verkuil, Maxime Jourdan,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
moderated list:ARM/Amlogic Meson SoC support, open list,
open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS,
open list:STAGING SUBSYSTEM
Cc: Anand Moon, Nicolas Dufresne, Sashiko
In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com>
The esparser workqueue could remain active during error unwind,
streaming stop, or device close, leading to use‑after‑free when
work items accessed freed session memory.
Fix this by explicitly cancelling the work in all teardown paths:
- Call cancel_work_sync(&sess->esparser_queue_work) in
vdec_start_streaming() error unwind, vdec_stop_streaming(),
and vdec_close().
- Ensure the workqueue is drained before releasing session
state and buffers.
- Move codec_ops->drain() evaluation earlier in stop_streaming()
using the status snapshot, so draining occurs before buffer
cleanup.
Following change prevents dangling work execution, eliminates
use‑after‑free hazards, and ensures orderly teardown of decoder
resources.
Cc: Nicolas Dufresne <nicolas@ndufresne.ca>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel.org/
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
---
drivers/staging/media/meson/vdec/vdec.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index 698a95566ad2..4884ee04b352 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -380,6 +380,8 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count)
sess->vififo_vaddr, sess->vififo_paddr);
sess->vififo_vaddr = NULL;
bufs_done:
+ cancel_work_sync(&sess->esparser_queue_work);
+
mutex_lock(&core->lock);
if (core->cur_sess == sess)
core->cur_sess = NULL;
@@ -437,6 +439,8 @@ static void vdec_stop_streaming(struct vb2_queue *q)
struct vb2_v4l2_buffer *buf;
enum amvdec_status old_status;
+ cancel_work_sync(&sess->esparser_queue_work);
+
/*
* Safely snapshot the status and clear the hardware owner inside
* the mutex to prevent data races with concurrent STREAMON requests.
@@ -448,7 +452,11 @@ static void vdec_stop_streaming(struct vb2_queue *q)
sess->status = STATUS_STOPPED;
mutex_unlock(&core->lock);
- /* Evaluate the hardware state using our snapshot */
+ if (q->type != V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
+ if (old_status >= STATUS_RUNNING && codec_ops->drain)
+ codec_ops->drain(sess);
+ }
+
if (old_status == STATUS_RUNNING ||
old_status == STATUS_INIT ||
(old_status == STATUS_NEEDS_RESUME &&
@@ -472,16 +480,10 @@ static void vdec_stop_streaming(struct vb2_queue *q)
if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
while ((buf = v4l2_m2m_src_buf_remove(sess->m2m_ctx)))
v4l2_m2m_buf_done(buf, VB2_BUF_STATE_ERROR);
-
sess->streamon_out = 0;
} else {
- /* Drain remaining refs if was still running using the snapshot */
- if (old_status >= STATUS_RUNNING && codec_ops->drain)
- codec_ops->drain(sess);
-
while ((buf = v4l2_m2m_dst_buf_remove(sess->m2m_ctx)))
v4l2_m2m_buf_done(buf, VB2_BUF_STATE_ERROR);
-
sess->streamon_cap = 0;
}
}
@@ -967,6 +969,8 @@ static int vdec_close(struct file *file)
{
struct amvdec_session *sess = file_to_amvdec_session(file);
+ cancel_work_sync(&sess->esparser_queue_work);
+
v4l2_m2m_ctx_release(sess->m2m_ctx);
v4l2_fh_del(&sess->fh, file);
v4l2_fh_exit(&sess->fh);
--
2.50.1
^ permalink raw reply related
* [PATCH v6 4/8] media: meson: vdec: Condition buffer flushing on queue type in start_streaming
From: Anand Moon @ 2026-05-30 9:42 UTC (permalink / raw)
To: Neil Armstrong, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Kevin Hilman,
Jerome Brunet, Martin Blumenstingl, Mauro Carvalho Chehab,
Greg Kroah-Hartman, Maxime Jourdan, Hans Verkuil,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
moderated list:ARM/Amlogic Meson SoC support, open list,
open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS,
open list:STAGING SUBSYSTEM
Cc: Anand Moon, Nicolas Dufresne, Sashiko
In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com>
When vdec_start_streaming() fails, the error path clears buffers from both
the source and destination queues unconditionally. If one queue was already
streaming successfully from a prior invocation, flushing its buffers behind
its back leaves videobuf2 deadlocked waiting for completions.
Fix this by only sweeping buffers from the specific queue type container
that failed to initialize.
Cc: Nicolas Dufresne <nicolas@ndufresne.ca>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel.org/
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
---
drivers/staging/media/meson/vdec/vdec.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index 8a5bf1a96830..698a95566ad2 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -386,15 +386,15 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count)
sess->status = STATUS_STOPPED;
mutex_unlock(&core->lock);
- while ((buf = v4l2_m2m_src_buf_remove(sess->m2m_ctx)))
- v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED);
- while ((buf = v4l2_m2m_dst_buf_remove(sess->m2m_ctx)))
- v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED);
-
- if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
+ if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
sess->streamon_out = 0;
- else
+ while ((buf = v4l2_m2m_src_buf_remove(sess->m2m_ctx)))
+ v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED);
+ } else {
sess->streamon_cap = 0;
+ while ((buf = v4l2_m2m_dst_buf_remove(sess->m2m_ctx)))
+ v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED);
+ }
return ret;
}
--
2.50.1
^ permalink raw reply related
* [PATCH v6 3/8] media: meson: vdec: Handle kthread failure and free codec state
From: Anand Moon @ 2026-05-30 9:42 UTC (permalink / raw)
To: Neil Armstrong, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Kevin Hilman,
Jerome Brunet, Martin Blumenstingl, Mauro Carvalho Chehab,
Greg Kroah-Hartman, Maxime Jourdan, Hans Verkuil,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
moderated list:ARM/Amlogic Meson SoC support, open list,
open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS,
open list:STAGING SUBSYSTEM
Cc: Anand Moon, Nicolas Dufresne, Sashiko
In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com>
vdec_start_streaming() launches a recycle thread when required by the
codec. If kthread_run() fails, the previous error path only powered off
the hardware, leaving sess->priv and codec state allocated. This caused
a permanent leak of the codec context and associated DMA buffers.
Fix this by introducing a dedicated err_cleanup path:
- Call codec_ops->stop() to release the codec context and clear sess->priv.
- Power off the hardware before freeing buffers to avoid DMA faults.
- Free canvas IDs explicitly and set sess->vififo_vaddr = NULL after
dma_free_coherent() to guard against double‑free in fallback stop paths.
- Reset core->cur_sess and sess->status to prevent stale references.
Following change closes the memory leak on kthread_run() failure and ensures
robust cleanup of codec resources in both error and stop paths.
Cc: Nicolas Dufresne <nicolas@ndufresne.ca>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260521090944.F35401F00A3D@smtp.kernel.org/
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
---
drivers/staging/media/meson/vdec/vdec.c | 26 ++++++++++++++++++++++---
1 file changed, 23 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index 7233000e2232..8a5bf1a96830 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -32,6 +32,8 @@ struct dummy_buf {
/* 16 MiB for parsed bitstream swap exchange */
#define SIZE_VIFIFO SZ_16M
+static void vdec_free_canvas(struct amvdec_session *sess);
+
static u32 get_output_size(u32 width, u32 height)
{
return ALIGN(width * height, SZ_64K);
@@ -352,16 +354,31 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count)
sess->sequence_cap = 0;
sess->sequence_out = 0;
- if (vdec_codec_needs_recycle(sess))
+ if (vdec_codec_needs_recycle(sess)) {
sess->recycle_thread = kthread_run(vdec_recycle_thread, sess,
"vdec_recycle");
+ if (IS_ERR(sess->recycle_thread)) {
+ ret = PTR_ERR(sess->recycle_thread);
+ sess->recycle_thread = NULL;
+ goto err_cleanup;
+ }
+ }
schedule_work(&sess->esparser_queue_work);
return 0;
+err_cleanup:
+ vdec_free_canvas(sess);
+ vdec_poweroff(sess);
+ if (codec_ops && codec_ops->stop && sess->priv) {
+ codec_ops->stop(sess);
+ kfree(sess->priv);
+ sess->priv = NULL;
+ }
vififo_free:
dma_free_coherent(sess->core->dev, sess->vififo_size,
sess->vififo_vaddr, sess->vififo_paddr);
+ sess->vififo_vaddr = NULL;
bufs_done:
mutex_lock(&core->lock);
if (core->cur_sess == sess)
@@ -441,8 +458,11 @@ static void vdec_stop_streaming(struct vb2_queue *q)
vdec_poweroff(sess);
vdec_free_canvas(sess);
- dma_free_coherent(sess->core->dev, sess->vififo_size,
- sess->vififo_vaddr, sess->vififo_paddr);
+ if (sess->vififo_vaddr) {
+ dma_free_coherent(sess->core->dev, sess->vififo_size,
+ sess->vififo_vaddr,
+ sess->vififo_paddr);
+ }
vdec_reset_timestamps(sess);
vdec_reset_bufs_recycle(sess);
kfree(sess->priv);
--
2.50.1
^ permalink raw reply related
* [PATCH v6 2/8] media: meson: vdec: Fix concurrent STREAMON / STREAMOFF race conditions
From: Anand Moon @ 2026-05-30 9:42 UTC (permalink / raw)
To: Neil Armstrong, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Kevin Hilman,
Jerome Brunet, Martin Blumenstingl, Mauro Carvalho Chehab,
Greg Kroah-Hartman, Hans Verkuil, Maxime Jourdan,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
moderated list:ARM/Amlogic Meson SoC support, open list,
open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS,
open list:STAGING SUBSYSTEM
Cc: Anand Moon, Nicolas Dufresne, Sashiko
In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com>
The Meson VDEC driver’s start/stop streaming paths previously
updated core->cur_sess and sess->status without synchronization,
leaving a race window between concurrent STREAMON/STREAMOFF calls.
Following change introduces proper locking discipline:
- Hold core->lock when checking or updating core->cur_sess and
sess->status in vdec_start_streaming().
- Snapshot sess->status under the lock in vdec_stop_streaming()
to safely evaluate hardware state after releasing the mutex.
- Ensure error unwind paths clear core->cur_sess and reset
sess->status inside the lock.
This prevents TOCTOU races, avoids data corruption when multiple
sessions contend for the hardware, and ensures consistent session
lifecycle management.
Cc: Nicolas Dufresne <nicolas@ndufresne.ca>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260525104345.C8D501F00A3C@smtp.kernel.org/
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
---
drivers/staging/media/meson/vdec/vdec.c | 62 ++++++++++++++++++-------
1 file changed, 46 insertions(+), 16 deletions(-)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index 4ffebba2341d..7233000e2232 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -286,11 +286,6 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count)
struct vb2_v4l2_buffer *buf;
int ret;
- if (core->cur_sess && core->cur_sess != sess) {
- ret = -EBUSY;
- goto bufs_done;
- }
-
if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE)
sess->streamon_out = 1;
else
@@ -308,9 +303,29 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count)
}
if (sess->status == STATUS_RUNNING ||
- sess->status == STATUS_NEEDS_RESUME ||
- sess->status == STATUS_INIT)
+ sess->status == STATUS_NEEDS_RESUME)
+ return 0;
+
+ /*
+ * Secure the core hardware lock before checking availability
+ * and updating session states to prevent STREAMON race conditions.
+ */
+ mutex_lock(&core->lock);
+ if (core->cur_sess && core->cur_sess != sess) {
+ mutex_unlock(&core->lock);
+ ret = -EBUSY;
+ goto bufs_done;
+ }
+
+ /* If already half-initialized, do not re-initialize */
+ if (sess->status == STATUS_INIT) {
+ mutex_unlock(&core->lock);
return 0;
+ }
+
+ sess->status = STATUS_INIT;
+ core->cur_sess = sess;
+ mutex_unlock(&core->lock);
sess->vififo_size = SIZE_VIFIFO;
sess->vififo_vaddr =
@@ -341,8 +356,6 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count)
sess->recycle_thread = kthread_run(vdec_recycle_thread, sess,
"vdec_recycle");
- sess->status = STATUS_INIT;
- core->cur_sess = sess;
schedule_work(&sess->esparser_queue_work);
return 0;
@@ -350,6 +363,12 @@ static int vdec_start_streaming(struct vb2_queue *q, unsigned int count)
dma_free_coherent(sess->core->dev, sess->vififo_size,
sess->vififo_vaddr, sess->vififo_paddr);
bufs_done:
+ mutex_lock(&core->lock);
+ if (core->cur_sess == sess)
+ core->cur_sess = NULL;
+ sess->status = STATUS_STOPPED;
+ mutex_unlock(&core->lock);
+
while ((buf = v4l2_m2m_src_buf_remove(sess->m2m_ctx)))
v4l2_m2m_buf_done(buf, VB2_BUF_STATE_QUEUED);
while ((buf = v4l2_m2m_dst_buf_remove(sess->m2m_ctx)))
@@ -399,10 +418,23 @@ static void vdec_stop_streaming(struct vb2_queue *q)
struct amvdec_codec_ops *codec_ops = sess->fmt_out->codec_ops;
struct amvdec_core *core = sess->core;
struct vb2_v4l2_buffer *buf;
+ enum amvdec_status old_status;
- if (sess->status == STATUS_RUNNING ||
- sess->status == STATUS_INIT ||
- (sess->status == STATUS_NEEDS_RESUME &&
+ /*
+ * Safely snapshot the status and clear the hardware owner inside
+ * the mutex to prevent data races with concurrent STREAMON requests.
+ */
+ mutex_lock(&core->lock);
+ old_status = sess->status;
+ if (core->cur_sess == sess)
+ core->cur_sess = NULL;
+ sess->status = STATUS_STOPPED;
+ mutex_unlock(&core->lock);
+
+ /* Evaluate the hardware state using our snapshot */
+ if (old_status == STATUS_RUNNING ||
+ old_status == STATUS_INIT ||
+ (old_status == STATUS_NEEDS_RESUME &&
(!sess->streamon_out || !sess->streamon_cap))) {
if (vdec_codec_needs_recycle(sess))
kthread_stop(sess->recycle_thread);
@@ -415,8 +447,6 @@ static void vdec_stop_streaming(struct vb2_queue *q)
vdec_reset_bufs_recycle(sess);
kfree(sess->priv);
sess->priv = NULL;
- core->cur_sess = NULL;
- sess->status = STATUS_STOPPED;
}
if (q->type == V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE) {
@@ -425,8 +455,8 @@ static void vdec_stop_streaming(struct vb2_queue *q)
sess->streamon_out = 0;
} else {
- /* Drain remaining refs if was still running */
- if (sess->status >= STATUS_RUNNING && codec_ops->drain)
+ /* Drain remaining refs if was still running using the snapshot */
+ if (old_status >= STATUS_RUNNING && codec_ops->drain)
codec_ops->drain(sess);
while ((buf = v4l2_m2m_dst_buf_remove(sess->m2m_ctx)))
--
2.50.1
^ permalink raw reply related
* [PATCH v6 1/8] media: meson: vdec: Fix memory leaks and lifetime of m2m device
From: Anand Moon @ 2026-05-30 9:42 UTC (permalink / raw)
To: Neil Armstrong, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Kevin Hilman,
Jerome Brunet, Martin Blumenstingl, Mauro Carvalho Chehab,
Greg Kroah-Hartman, Maxime Jourdan, Hans Verkuil,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
moderated list:ARM/Amlogic Meson SoC support, open list,
open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS,
open list:STAGING SUBSYSTEM
Cc: Anand Moon, Nicolas Dufresne, Sashiko
In-Reply-To: <20260530094326.11892-1-linux.amoon@gmail.com>
The driver was initializing the v4l2 m2m device instance per-session
within vdec_open() and releasing it inside vdec_close(). This approach
is faulty because the m2m device represents the hardware context and
should persist across multiple open sessions.
Fix this design flaw by shifting v4l2_m2m_init() to vdec_probe() and
v4l2_m2m_release() to vdec_remove(). Correspondingly, move the m2m_dev
pointer from struct amvdec_session to struct amvdec_core.
Additionally, this patch addresses two critical resource leaks:
1. Adds a missing v4l2_ctrl_handler_free() in vdec_close() to clean up
allocated control handlers upon session closure.
2. Introduces proper unwinding logic via a new 'err_fh_del' label in
vdec_open() to ensure that file handles (v4l2_fh) are fully deregistered
if subsequent session resource allocations fail.
This was identified via kmemleak:
unreferenced object 0xffff0000205d6878 (size 8):
comm "v4l_id", pid 5289, jiffies 4294938580
hex dump (first 8 bytes):
40 d2 49 18 00 00 ff ff @.I.....
backtrace (crc d3204599):
kmemleak_alloc+0xc8/0xf0
__kvmalloc_node_noprof+0x60c/0x850
v4l2_ctrl_handler_init_class+0x1b4/0x2e8 [videodev]
vdec_open+0x1f4/0x788 [meson_vdec]
v4l2_open+0x144/0x460 [videodev]
chrdev_open+0x1ac/0x500
do_dentry_open+0x3f0/0xfe8
vfs_open+0x68/0x320
do_open+0x2d8/0x9a8
path_openat+0x1d0/0x4f0
do_filp_open+0x190/0x380
do_sys_openat2+0xf8/0x1b0
__arm64_sys_openat+0x13c/0x1e8
invoke_syscall+0xdc/0x268
el0_svc_common.constprop.0+0x178/0x258
do_el0_svc+0x4c/0x70
Cc: Nicolas Dufresne <nicolas@ndufresne.ca>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260520045905.6ACBA1F000E9@smtp.kernel.org/#t
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
---
drivers/staging/media/meson/vdec/vdec.c | 33 ++++++++++++++-----------
drivers/staging/media/meson/vdec/vdec.h | 4 +--
2 files changed, 20 insertions(+), 17 deletions(-)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index 4b77ec1af5a7..4ffebba2341d 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -153,7 +153,7 @@ static void vdec_m2m_job_abort(void *priv)
{
struct amvdec_session *sess = priv;
- v4l2_m2m_job_finish(sess->m2m_dev, sess->m2m_ctx);
+ v4l2_m2m_job_finish(sess->core->m2m_dev, sess->m2m_ctx);
}
static const struct v4l2_m2m_ops vdec_m2m_ops = {
@@ -873,23 +873,16 @@ static int vdec_open(struct file *file)
sess->core = core;
- sess->m2m_dev = v4l2_m2m_init(&vdec_m2m_ops);
- if (IS_ERR(sess->m2m_dev)) {
- dev_err(dev, "Fail to v4l2_m2m_init\n");
- ret = PTR_ERR(sess->m2m_dev);
- goto err_free_sess;
- }
-
- sess->m2m_ctx = v4l2_m2m_ctx_init(sess->m2m_dev, sess, m2m_queue_init);
+ sess->m2m_ctx = v4l2_m2m_ctx_init(core->m2m_dev, sess, m2m_queue_init);
if (IS_ERR(sess->m2m_ctx)) {
dev_err(dev, "Fail to v4l2_m2m_ctx_init\n");
ret = PTR_ERR(sess->m2m_ctx);
- goto err_m2m_release;
+ goto err_fh_del;
}
ret = vdec_init_ctrls(sess);
if (ret)
- goto err_m2m_release;
+ goto err_free_sess;
sess->pixfmt_cap = formats[0].pixfmts_cap[0];
sess->fmt_out = &formats[0];
@@ -913,8 +906,8 @@ static int vdec_open(struct file *file)
return 0;
-err_m2m_release:
- v4l2_m2m_release(sess->m2m_dev);
+err_fh_del:
+ v4l2_fh_exit(&sess->fh);
err_free_sess:
kfree(sess);
return ret;
@@ -925,9 +918,9 @@ static int vdec_close(struct file *file)
struct amvdec_session *sess = file_to_amvdec_session(file);
v4l2_m2m_ctx_release(sess->m2m_ctx);
- v4l2_m2m_release(sess->m2m_dev);
v4l2_fh_del(&sess->fh, file);
v4l2_fh_exit(&sess->fh);
+ v4l2_ctrl_handler_free(&sess->ctrl_handler);
mutex_destroy(&sess->lock);
mutex_destroy(&sess->bufs_recycle_lock);
@@ -1057,10 +1050,17 @@ static int vdec_probe(struct platform_device *pdev)
if (ret)
return ret;
+ core->m2m_dev = v4l2_m2m_init(&vdec_m2m_ops);
+ if (IS_ERR(core->m2m_dev)) {
+ dev_err(dev, "Failed to initialize v4l2 m2m device\n");
+ return PTR_ERR(core->m2m_dev);
+ }
+
ret = v4l2_device_register(dev, &core->v4l2_dev);
if (ret) {
dev_err(dev, "Couldn't register v4l2 device\n");
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto err_m2m_release;
}
vdev = video_device_alloc();
@@ -1095,6 +1095,8 @@ static int vdec_probe(struct platform_device *pdev)
err_vdev_release:
video_device_release(vdev);
v4l2_device_unregister(&core->v4l2_dev);
+err_m2m_release:
+ v4l2_m2m_release(core->m2m_dev);
return ret;
}
@@ -1104,6 +1106,7 @@ static void vdec_remove(struct platform_device *pdev)
video_unregister_device(core->vdev_dec);
v4l2_device_unregister(&core->v4l2_dev);
+ v4l2_m2m_release(core->m2m_dev);
}
static struct platform_driver meson_vdec_driver = {
diff --git a/drivers/staging/media/meson/vdec/vdec.h b/drivers/staging/media/meson/vdec/vdec.h
index 7a5d8e871d70..cc0cfafb8a95 100644
--- a/drivers/staging/media/meson/vdec/vdec.h
+++ b/drivers/staging/media/meson/vdec/vdec.h
@@ -63,6 +63,7 @@ struct amvdec_session;
* @vdec_hevcf_clk: VDEC_HEVCF clock
* @esparser_reset: RESET for the PARSER
* @vdev_dec: video device for the decoder
+ * @m2m_dev: v4l2 m2m device
* @v4l2_dev: v4l2 device
* @cur_sess: current decoding session
* @lock: video device lock
@@ -87,6 +88,7 @@ struct amvdec_core {
struct reset_control *esparser_reset;
struct video_device *vdev_dec;
+ struct v4l2_m2m_dev *m2m_dev;
struct v4l2_device v4l2_dev;
struct amvdec_session *cur_sess;
@@ -183,7 +185,6 @@ enum amvdec_status {
*
* @core: reference to the vdec core struct
* @fh: v4l2 file handle
- * @m2m_dev: v4l2 m2m device
* @m2m_ctx: v4l2 m2m context
* @ctrl_handler: V4L2 control handler
* @ctrl_min_buf_capture: V4L2 control V4L2_CID_MIN_BUFFERS_FOR_CAPTURE
@@ -230,7 +231,6 @@ struct amvdec_session {
struct amvdec_core *core;
struct v4l2_fh fh;
- struct v4l2_m2m_dev *m2m_dev;
struct v4l2_m2m_ctx *m2m_ctx;
struct v4l2_ctrl_handler ctrl_handler;
struct v4l2_ctrl *ctrl_min_buf_capture;
--
2.50.1
^ permalink raw reply related
* [PATCH v6 0/8] media: meson: Fix memory leak in error path in vdec
From: Anand Moon @ 2026-05-30 9:42 UTC (permalink / raw)
To: Neil Armstrong, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Kevin Hilman,
Jerome Brunet, Martin Blumenstingl, Mauro Carvalho Chehab,
Greg Kroah-Hartman, Hans Verkuil, Maxime Jourdan,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
open list:DRM DRIVERS FOR AMLOGIC SOCS,
moderated list:ARM/Amlogic Meson SoC support, open list,
open list:MESON VIDEO DECODER DRIVER FOR AMLOGIC SOCS,
open list:STAGING SUBSYSTEM
Cc: Anand Moon
v6: Changes
The previous approach had some technical issues, so this new version
takes a slightly different approach, I have fixed the DMA warnings
found during basic testing.
I have donse basic testing on the Odroid N2+ and found that
the clocks are not enabling for decoder.
It also seems some Mali GPU configurations are still missing.
You can reproduce the test case using:
mpv --hwdec=v4l2m2m Big_Buck_Bunny_1080_10s_30MB.mp4
Please let me know your feedback so we can discuss and address these
points!
Thanks
-Anand
V5: Changes
[v5] https://lore.kernel.org/all/20260525095216.12078-2-linux.amoon@gmail.com/
Following chamges try to fix the memory leak reported by Sashiko
New issues:
- [High] The newly added error path in `vdec_start_streaming()` leaks
`sess->priv` when `kthread_run()` fails.
Pre-existing issues:
- [Critical] Race condition between hardware power-on and `core->cur_sess`
initialization leads to a NULL pointer dereference in the IRQ handler.
- [High] Returning buffers for both source and destination queues upon
single-queue failure orphans active queue buffers.
- [High] Concurrent sessions can bypass the hardware exclusivity check,
leading to simultaneous hardware programming.
--
V4: Changes:
v4: https://lore.kernel.org/all/20260521073449.10057-2-linux.amoon@gmail.com/
Following chamges try to fix the memory leak reported by Sashiko
Pre-existing issues:
- [Critical] The `sess->esparser_queue_work` work item is not canceled
before freeing the session context, leading to a potential Use-After-Free
vulnerability.
- [High] The patch attempts to fix a memory leak reported by kmemleak,
but misdiagnoses the root cause and leaves the primary memory leak
(the V4L2 control handler) unresolved.
- [High] The driver does not verify if `kthread_run()` returns an `ERR_PTR`,
leading to a kernel panic when `kthread_stop()` is called.
Thanks
-Anand
Anand Moon (8):
media: meson: vdec: Fix memory leaks and lifetime of m2m device
media: meson: vdec: Fix concurrent STREAMON / STREAMOFF race
conditions
media: meson: vdec: Handle kthread failure and free codec state
media: meson: vdec: Condition buffer flushing on queue type in
start_streaming
media: meson: vdec: Cancel esparser work during teardown
media: meson: vdec: Configure DMA mask and segment size in probe
media: meson: vdec: Fix NULL pointer dereference in ISR handlers
gpu: drm: meson: Fix DMA max segment size for DMABUF imports
drivers/gpu/drm/meson/meson_drv.c | 2 +
drivers/staging/media/meson/vdec/vdec.c | 179 +++++++++++++++++-------
drivers/staging/media/meson/vdec/vdec.h | 4 +-
3 files changed, 136 insertions(+), 49 deletions(-)
base-commit: f5e5d3509bffb95c6648eb9795f7f236852ae62d
--
2.50.1
^ permalink raw reply
* [PATCH] staging: rtl8723bs: remove unnecessary parentheses
From: Eugene Mavick @ 2026-05-30 3:16 UTC (permalink / raw)
To: gregkh, error27, khomenkov, ethantidmore06; +Cc: Eugene Mavick
Remove unnecessary parentheses to clear checkpatch.pl warnings
Example of fixed warnings:
CHECK: Unnecessary parentheses around dvobj->cam_cache[id]
CHECK: Unnecessary parentheses around 'val != 0xfe'
Checkpatch warnings regarding line length above 100 columns on modified
lines were also fixed
Signed-off-by: Eugene Mavick <mavick4022@gmail.com>
---
.../staging/rtl8723bs/core/rtw_wlan_util.c | 92 ++++++++++---------
1 file changed, 48 insertions(+), 44 deletions(-)
diff --git a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
index 1d37c2d5b10d..0c5b1db77a61 100644
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -118,7 +118,7 @@ int is_basicrate(struct adapter *padapter, unsigned char rate)
for (i = 0; i < NumRates; i++) {
val = pmlmeext->basicrate[i];
- if ((val != 0xff) && (val != 0xfe))
+ if (val != 0xff && val != 0xfe)
if (rate == ratetbl_val_2wifirate(val))
return true;
}
@@ -351,7 +351,7 @@ int is_client_associated_to_ap(struct adapter *padapter)
return _FAIL;
pmlmeext = &padapter->mlmeextpriv;
- pmlmeinfo = &(pmlmeext->mlmext_info);
+ pmlmeinfo = &pmlmeext->mlmext_info;
if ((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && ((pmlmeinfo->state & 0x03) == WIFI_FW_STATION_STATE))
return true;
@@ -362,7 +362,7 @@ int is_client_associated_to_ap(struct adapter *padapter)
int is_client_associated_to_ibss(struct adapter *padapter)
{
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
if ((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && ((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE))
return true;
@@ -374,7 +374,7 @@ int is_IBSS_empty(struct adapter *padapter)
{
unsigned int i;
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
for (i = IBSS_START_MAC_ID; i < NUM_STA; i++) {
if (pmlmeinfo->FW_sta_info[i].status == 1)
@@ -477,7 +477,7 @@ void clear_cam_cache(struct adapter *adapter, u8 id)
spin_lock_bh(&cam_ctl->lock);
- memset(&(dvobj->cam_cache[id]), 0, sizeof(struct cam_entry_cache));
+ memset(&dvobj->cam_cache[id], 0, sizeof(struct cam_entry_cache));
spin_unlock_bh(&cam_ctl->lock);
}
@@ -629,7 +629,7 @@ int allocate_fw_sta_entry(struct adapter *padapter)
{
unsigned int mac_id;
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
for (mac_id = IBSS_START_MAC_ID; mac_id < NUM_STA; mac_id++) {
if (pmlmeinfo->FW_sta_info[mac_id].status == 0) {
@@ -645,7 +645,7 @@ int allocate_fw_sta_entry(struct adapter *padapter)
void flush_all_cam_entry(struct adapter *padapter)
{
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
invalidate_cam_all(padapter);
/* clear default key related key search setting */
@@ -657,19 +657,19 @@ void flush_all_cam_entry(struct adapter *padapter)
int WMM_param_handler(struct adapter *padapter, struct ndis_80211_var_ie *pIE)
{
/* struct registry_priv *pregpriv = &padapter->registrypriv; */
- struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+ struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
if (pmlmepriv->qospriv.qos_option == 0) {
pmlmeinfo->WMM_enable = 0;
return false;
}
- if (!memcmp(&(pmlmeinfo->WMM_param), (pIE->data + 6), sizeof(struct WMM_para_element)))
+ if (!memcmp(&pmlmeinfo->WMM_param, (pIE->data + 6), sizeof(struct WMM_para_element)))
return false;
- memcpy(&(pmlmeinfo->WMM_param), (pIE->data + 6), sizeof(struct WMM_para_element));
+ memcpy(&pmlmeinfo->WMM_param, (pIE->data + 6), sizeof(struct WMM_para_element));
pmlmeinfo->WMM_enable = 1;
return true;
@@ -709,7 +709,7 @@ void WMMOnAssocRsp(struct adapter *padapter)
u32 acParm, i;
u32 edca[4], inx[4];
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
struct registry_priv *pregpriv = &padapter->registrypriv;
@@ -810,9 +810,9 @@ static void bwmode_update_check(struct adapter *padapter, struct ndis_80211_var_
unsigned char new_bwmode;
unsigned char new_ch_offset;
struct HT_info_element *pHT_info;
- struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
+ struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
struct registry_priv *pregistrypriv = &padapter->registrypriv;
struct ht_priv *phtpriv = &pmlmepriv->htpriv;
u8 cbw40_enable = 0;
@@ -853,7 +853,7 @@ static void bwmode_update_check(struct adapter *padapter, struct ndis_80211_var_
new_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
}
- if ((new_bwmode != pmlmeext->cur_bwmode) || (new_ch_offset != pmlmeext->cur_ch_offset)) {
+ if (new_bwmode != pmlmeext->cur_bwmode || new_ch_offset != pmlmeext->cur_ch_offset) {
pmlmeinfo->bwmode_updated = true;
pmlmeext->cur_bwmode = new_bwmode;
@@ -867,7 +867,7 @@ static void bwmode_update_check(struct adapter *padapter, struct ndis_80211_var_
if (true == pmlmeinfo->bwmode_updated) {
struct sta_info *psta;
- struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network);
+ struct wlan_bssid_ex *cur_network = &pmlmeinfo->network;
struct sta_priv *pstapriv = &padapter->stapriv;
/* set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode); */
@@ -897,7 +897,7 @@ void HT_caps_handler(struct adapter *padapter, struct ndis_80211_var_ie *pIE)
u8 max_AMPDU_len, min_MPDU_spacing;
u8 cur_ldpc_cap = 0, cur_stbc_cap = 0;
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
struct ht_priv *phtpriv = &pmlmepriv->htpriv;
@@ -960,7 +960,7 @@ void HT_caps_handler(struct adapter *padapter, struct ndis_80211_var_ie *pIE)
void HT_info_handler(struct adapter *padapter, struct ndis_80211_var_ie *pIE)
{
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
struct ht_priv *phtpriv = &pmlmepriv->htpriv;
@@ -974,7 +974,7 @@ void HT_info_handler(struct adapter *padapter, struct ndis_80211_var_ie *pIE)
return;
pmlmeinfo->HT_info_enable = 1;
- memcpy(&(pmlmeinfo->HT_info), pIE->data, pIE->length);
+ memcpy(&pmlmeinfo->HT_info, pIE->data, pIE->length);
}
void HTOnAssocRsp(struct adapter *padapter)
@@ -983,9 +983,9 @@ void HTOnAssocRsp(struct adapter *padapter)
unsigned char min_MPDU_spacing;
/* struct registry_priv *pregpriv = &padapter->registrypriv; */
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
- if ((pmlmeinfo->HT_info_enable) && (pmlmeinfo->HT_caps_enable)) {
+ if (pmlmeinfo->HT_info_enable && pmlmeinfo->HT_caps_enable) {
pmlmeinfo->HT_enable = 1;
} else {
pmlmeinfo->HT_enable = 0;
@@ -1010,20 +1010,20 @@ void HTOnAssocRsp(struct adapter *padapter)
void ERP_IE_handler(struct adapter *padapter, struct ndis_80211_var_ie *pIE)
{
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
if (pIE->length > 1)
return;
pmlmeinfo->ERP_enable = 1;
- memcpy(&(pmlmeinfo->ERP_IE), pIE->data, pIE->length);
+ memcpy(&pmlmeinfo->ERP_IE, pIE->data, pIE->length);
}
void VCS_update(struct adapter *padapter, struct sta_info *psta)
{
struct registry_priv *pregpriv = &padapter->registrypriv;
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
switch (pregpriv->vrtl_carrier_sense) {/* 0:off 1:on 2:auto */
case 0: /* off */
@@ -1043,7 +1043,7 @@ void VCS_update(struct adapter *padapter, struct sta_info *psta)
case 2: /* auto */
default:
- if ((pmlmeinfo->ERP_enable) && (pmlmeinfo->ERP_IE & BIT(1))) {
+ if (pmlmeinfo->ERP_enable && (pmlmeinfo->ERP_IE & BIT(1))) {
if (pregpriv->vcs_type == 1) {
psta->rtsen = 1;
psta->cts2self = 0;
@@ -1078,7 +1078,7 @@ int rtw_check_bcn_info(struct adapter *Adapter, u8 *pframe, u32 packet_len)
unsigned int len;
unsigned char *p;
unsigned short val16, subtype;
- struct wlan_network *cur_network = &(Adapter->mlmepriv.cur_network);
+ struct wlan_network *cur_network = &Adapter->mlmepriv.cur_network;
/* u8 wpa_ie[255], rsn_ie[255]; */
u16 wpa_len = 0, rsn_len = 0;
u8 encryp_protocol = 0;
@@ -1110,7 +1110,9 @@ int rtw_check_bcn_info(struct adapter *Adapter, u8 *pframe, u32 packet_len)
if (!bssid)
return true;
- if ((pmlmepriv->timeBcnInfoChkStart != 0) && (jiffies_to_msecs(jiffies - pmlmepriv->timeBcnInfoChkStart) > DISCONNECT_BY_CHK_BCN_FAIL_OBSERV_PERIOD_IN_MS)) {
+ if (pmlmepriv->timeBcnInfoChkStart != 0 &&
+ (jiffies_to_msecs(jiffies - pmlmepriv->timeBcnInfoChkStart) >
+ DISCONNECT_BY_CHK_BCN_FAIL_OBSERV_PERIOD_IN_MS)) {
pmlmepriv->timeBcnInfoChkStart = 0;
pmlmepriv->NumOfBcnInfoChkFail = 0;
}
@@ -1213,13 +1215,13 @@ int rtw_check_bcn_info(struct adapter *Adapter, u8 *pframe, u32 packet_len)
if (encryp_protocol == ENCRYP_PROTOCOL_WPA || encryp_protocol == ENCRYP_PROTOCOL_WPA2) {
pbuf = rtw_get_wpa_ie(&bssid->ies[12], &wpa_ielen, bssid->ie_length - 12);
- if (pbuf && (wpa_ielen > 0)) {
+ if (pbuf && wpa_ielen > 0) {
rtw_parse_wpa_ie(pbuf, wpa_ielen + 2, &group_cipher,
&pairwise_cipher, &is_8021x);
} else {
pbuf = rtw_get_wpa2_ie(&bssid->ies[12], &wpa_ielen, bssid->ie_length - 12);
- if (pbuf && (wpa_ielen > 0))
+ if (pbuf && wpa_ielen > 0)
rtw_parse_wpa2_ie(pbuf, wpa_ielen + 2, &group_cipher,
&pairwise_cipher, &is_8021x);
}
@@ -1243,8 +1245,10 @@ int rtw_check_bcn_info(struct adapter *Adapter, u8 *pframe, u32 packet_len)
pmlmepriv->NumOfBcnInfoChkFail++;
- if ((pmlmepriv->timeBcnInfoChkStart != 0) && (jiffies_to_msecs(jiffies - pmlmepriv->timeBcnInfoChkStart) <= DISCONNECT_BY_CHK_BCN_FAIL_OBSERV_PERIOD_IN_MS)
- && (pmlmepriv->NumOfBcnInfoChkFail >= DISCONNECT_BY_CHK_BCN_FAIL_THRESHOLD)) {
+ if (pmlmepriv->timeBcnInfoChkStart != 0 &&
+ (jiffies_to_msecs(jiffies - pmlmepriv->timeBcnInfoChkStart) <=
+ DISCONNECT_BY_CHK_BCN_FAIL_OBSERV_PERIOD_IN_MS)
+ && pmlmepriv->NumOfBcnInfoChkFail >= DISCONNECT_BY_CHK_BCN_FAIL_THRESHOLD) {
pmlmepriv->timeBcnInfoChkStart = 0;
pmlmepriv->NumOfBcnInfoChkFail = 0;
return _FAIL;
@@ -1296,8 +1300,8 @@ unsigned int is_ap_in_tkip(struct adapter *padapter)
u32 i;
struct ndis_80211_var_ie *pIE;
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
- struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
+ struct wlan_bssid_ex *cur_network = &pmlmeinfo->network;
if (rtw_get_capability((struct wlan_bssid_ex *)cur_network) & WLAN_CAPABILITY_PRIVACY) {
for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.ie_length;) {
@@ -1332,7 +1336,7 @@ int support_short_GI(struct adapter *padapter, struct HT_caps_element *pHT_caps,
{
unsigned char bit_offset;
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
if (!(pmlmeinfo->HT_enable))
return _FAIL;
@@ -1438,7 +1442,7 @@ unsigned char check_assoc_AP(u8 *pframe, uint len)
void update_IOT_info(struct adapter *padapter)
{
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
switch (pmlmeinfo->assoc_AP_vendor) {
case HT_IOT_PEER_MARVELL:
@@ -1468,7 +1472,7 @@ void update_IOT_info(struct adapter *padapter)
void update_capinfo(struct adapter *Adapter, u16 updateCap)
{
struct mlme_ext_priv *pmlmeext = &Adapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
bool ShortPreamble;
/* Check preamble mode, 2005.01.06, by rcnjko. */
@@ -1520,11 +1524,11 @@ void update_wireless_mode(struct adapter *padapter)
int network_type = 0;
u32 SIFS_Timer;
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
- struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
+ struct wlan_bssid_ex *cur_network = &pmlmeinfo->network;
unsigned char *rate = cur_network->supported_rates;
- if ((pmlmeinfo->HT_info_enable) && (pmlmeinfo->HT_caps_enable))
+ if (pmlmeinfo->HT_info_enable && pmlmeinfo->HT_caps_enable)
pmlmeinfo->HT_enable = 1;
if (pmlmeinfo->HT_enable)
@@ -1544,7 +1548,7 @@ void update_wireless_mode(struct adapter *padapter)
SetHwReg8723BS(padapter, HW_VAR_RESP_SIFS, (u8 *)&SIFS_Timer);
- SetHwReg8723BS(padapter, HW_VAR_WIRELESS_MODE, (u8 *)&(pmlmeext->cur_wireless_mode));
+ SetHwReg8723BS(padapter, HW_VAR_WIRELESS_MODE, (u8 *)&pmlmeext->cur_wireless_mode);
if (pmlmeext->cur_wireless_mode & WIRELESS_11B)
update_mgnt_tx_rate(padapter, IEEE80211_CCK_RATE_1MB);
@@ -1569,8 +1573,8 @@ int update_sta_support_rate(struct adapter *padapter, u8 *pvar_ie, uint var_ie_l
unsigned int ie_len;
struct ndis_80211_var_ie *pIE;
int support_rate_num = 0;
- struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
pIE = (struct ndis_80211_var_ie *)rtw_get_ie(pvar_ie, WLAN_EID_SUPP_RATES, &ie_len, var_ie_len);
if (!pIE)
@@ -1596,7 +1600,7 @@ void process_addba_req(struct adapter *padapter, u8 *paddba_req, u8 *addr)
struct sta_priv *pstapriv = &padapter->stapriv;
struct ADDBA_request *preq = (struct ADDBA_request *)paddba_req;
struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
psta = rtw_get_stainfo(pstapriv, addr);
@@ -1639,7 +1643,7 @@ void adaptive_early_32k(struct mlme_ext_priv *pmlmeext, u8 *pframe, uint len)
__le32 *pbuf;
u64 tsf = 0;
u32 delay_ms;
- struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
pmlmeext->bcn_cnt++;
--
2.51.2
^ permalink raw reply related
* [PATCH] staging: media: atomisp: align block comments to match kernel style
From: Mohan Sudhandhiram M @ 2026-05-29 15:43 UTC (permalink / raw)
To: Hans de Goede, Mauro Carvalho Chehab, Sakari Ailus,
Greg Kroah-Hartman
Cc: linux-media, linux-staging, linux-kernel, Mohan Sudhandhiram M
Fix checkpatch.pl warnings regarding block comments that did not align
the '*' on each line. Removed the custom banner formatting and replaced
it with standard kernel block comments to improve readability and comply
with kernel coding guidelines.
Signed-off-by: Mohan Sudhandhiram M <mohan86108@gmail.com>
---
.../atomisp/pci/runtime/frame/src/frame.c | 27 +++++++++----------
1 file changed, 12 insertions(+), 15 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/runtime/frame/src/frame.c b/drivers/staging/media/atomisp/pci/runtime/frame/src/frame.c
index 8614efc28..66161942b 100644
--- a/drivers/staging/media/atomisp/pci/runtime/frame/src/frame.c
+++ b/drivers/staging/media/atomisp/pci/runtime/frame/src/frame.c
@@ -17,10 +17,9 @@
#define NV12_TILEY_TILE_WIDTH 128
#define NV12_TILEY_TILE_HEIGHT 32
-
-/**************************************************************************
-** Static functions declarations
-**************************************************************************/
+/*
+ * Static functions declarations
+ */
static void frame_init_plane(struct ia_css_frame_plane *plane,
unsigned int width,
unsigned int stride,
@@ -75,11 +74,9 @@ static struct ia_css_frame *frame_create(unsigned int width,
static unsigned
ia_css_elems_bytes_from_info(
const struct ia_css_frame_info *info);
-
-/**************************************************************************
-** CSS API functions, exposed by ia_css.h
-**************************************************************************/
-
+/*
+ * CSS API functions, exposed by ia_css.h
+ */
int ia_css_frame_allocate_from_info(struct ia_css_frame **frame,
const struct ia_css_frame_info *info)
{
@@ -141,9 +138,9 @@ void ia_css_frame_free(struct ia_css_frame *frame)
IA_CSS_LEAVE_PRIVATE("void");
}
-/**************************************************************************
-** Module public functions
-**************************************************************************/
+/*
+ * Module public functions
+ */
int ia_css_frame_check_info(const struct ia_css_frame_info *info)
{
@@ -435,9 +432,9 @@ int ia_css_dma_configure_from_info(struct dma_port_config *config,
return 0;
}
-/**************************************************************************
-** Static functions
-**************************************************************************/
+/*
+ * Static functions
+ */
static void frame_init_plane(struct ia_css_frame_plane *plane,
unsigned int width,
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v2] staging: sm750fb: rename pv_reg to io_base
From: neha arora @ 2026-05-29 11:28 UTC (permalink / raw)
To: Dan Carpenter
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <CAOWJOpvJnSeS=1sO2mujC9tNi9_cQGgJ6S0j6xvkAp8KRnudjg@mail.gmail.com>
I have submitted patch v3 with note and Signed-off-by line
Regards,
Onish
On Fri, May 29, 2026 at 4:50 PM neha arora <neharora23587@gmail.com> wrote:
>
> I have submitted patch v3 with note and Signed-off-by line.
>
> Regards,
> Onish
>
> On Fri, May 29, 2026 at 4:11 PM Dan Carpenter <error27@gmail.com> wrote:
>>
>> On Fri, May 29, 2026 at 03:22:33PM +0530, Onish Sharma wrote:
>> > Rename pv_reg to io_base to follow kernel naming style and improve
>> > readability.
>> >
>> > No functional changes intended.
>>
>> Run your patches through checkpatch. Also v2 patches need to be sent
>> in a specific format. This should be [PATCH v2 1/2]
>>
>> https://staticthinking.wordpress.com/2022/07/27/how-to-send-a-v2-patch/
>>
>> > ---
>> ^^^
>> There needs to be a note here to say what changed.
>>
>> regards,
>> dan carpenter
>>
^ permalink raw reply
* Re: [PATCH v2] staging: sm750fb: remove unused variable
From: neha arora @ 2026-05-29 11:25 UTC (permalink / raw)
To: Dan Carpenter
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <ahlszyY6Nd9ANz-X@stanley.mountain>
Hi Dan,
After looking into the structural dependencies and the cross-casting
between init_status and initchip_param, I've decided that this
refactoring is outside the scope of what I want to work on at this
time.
Please feel free to drop my previous patch. I'm going to shift my
focus to other areas.
Regards,
Onish
On Fri, May 29, 2026 at 4:09 PM Dan Carpenter <error27@gmail.com> wrote:
>
> On Fri, May 29, 2026 at 03:42:42PM +0530, Onish Sharma wrote:
> > Remove the set_all_eng_off flag and its associated cleanup logic.
> > The variable is redundant as the hardware should be initialized to a
> > known state regardless of prior usage.
> >
> > Suggested-by: Dan Carpenter <error27@gmail.com>
> > Signed-off-by: Onish Sharma <neharora23587@gmail.com>
> > ---
>
> Sorry, miscommunication. This breaks the driver. This is also a bit
> more involved than I thought...
>
> There are two structs:
>
> struct init_status {
> ushort power_mode;
> /* below three clocks are in unit of MHZ*/
> ushort chip_clk;
> ushort mem_clk;
> ushort master_clk;
> ushort setAllEngOff;
> ushort reset_memory;
> };
>
> And struct initchip_param. The initchip_param is exactly the same but
> with all the struct members renamed and comments added. They have to
> match because we cast back and forth.
>
> Why do we have two different struct that have to be the same? You might
> think it is for API, but as near as I can see that is not the case.
> Maybe it was at some point? We should get rid of one struct. Which
> everyone is API is the one we should keep. If neither is API then get
> rid of init_status and keep initchip_param.
>
> After that we can talk about getting rid of setAllEngOff/set_all_eng_off.
>
> regards,
> dan carpenter
>
^ permalink raw reply
* [PATCH v3] staging: sm750fb: rename pv_reg to io_base
From: Onish Sharma @ 2026-05-29 11:19 UTC (permalink / raw)
To: sudipm.mukherjee, teddy.wang, gregkh
Cc: linux-fbdev, linux-staging, linux-kernel, Onish Sharma
Rename pv_reg to io_base to follow kernel naming style and improve
readability.
No functional changes intended.
Signed-off-by: Onish Sharma <neharora23587@gmail.com>
---
Changes in v3:
- Added mandatory Signed-off-by line.
- Rename pv_reg to io_base to remove hungarian notation
drivers/staging/sm750fb/sm750.c | 4 ++--
drivers/staging/sm750fb/sm750.h | 2 +-
drivers/staging/sm750fb/sm750_hw.c | 12 ++++++------
3 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 716a8935f58d..c2d2864f135b 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -743,7 +743,7 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
* must be set after crtc member initialized
*/
crtc->cursor.offset = crtc->o_screen + crtc->vidmem_size - 1024;
- crtc->cursor.mmio = sm750_dev->pv_reg +
+ crtc->cursor.mmio = sm750_dev->io_base +
0x800f0 + (int)crtc->channel * 0x140;
crtc->cursor.max_h = 64;
@@ -1047,7 +1047,7 @@ static void lynxfb_pci_remove(struct pci_dev *pdev)
sm750fb_framebuffer_release(sm750_dev);
arch_phys_wc_del(sm750_dev->mtrr.vram);
- iounmap(sm750_dev->pv_reg);
+ iounmap(sm750_dev->io_base);
iounmap(sm750_dev->vmem);
pci_release_region(pdev, 1);
kfree(g_settings);
diff --git a/drivers/staging/sm750fb/sm750.h b/drivers/staging/sm750fb/sm750.h
index e8885133da2e..c42800313c6a 100644
--- a/drivers/staging/sm750fb/sm750.h
+++ b/drivers/staging/sm750fb/sm750.h
@@ -97,7 +97,7 @@ struct sm750_dev {
unsigned long vidreg_start;
__u32 vidmem_size;
__u32 vidreg_size;
- void __iomem *pv_reg;
+ void __iomem *io_base;
unsigned char __iomem *vmem;
/* locks*/
spinlock_t slock;
diff --git a/drivers/staging/sm750fb/sm750_hw.c b/drivers/staging/sm750fb/sm750_hw.c
index 95f797e5776a..dc1118808b4f 100644
--- a/drivers/staging/sm750fb/sm750_hw.c
+++ b/drivers/staging/sm750fb/sm750_hw.c
@@ -23,18 +23,18 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
}
/* now map mmio and vidmem */
- sm750_dev->pv_reg =
+ sm750_dev->io_base =
ioremap(sm750_dev->vidreg_start, sm750_dev->vidreg_size);
- if (!sm750_dev->pv_reg) {
+ if (!sm750_dev->io_base) {
dev_err(&pdev->dev, "mmio failed\n");
ret = -EFAULT;
goto err_release_region;
}
- sm750_dev->accel.dpr_base = sm750_dev->pv_reg + DE_BASE_ADDR_TYPE1;
- sm750_dev->accel.dp_port_base = sm750_dev->pv_reg + DE_PORT_ADDR_TYPE1;
+ sm750_dev->accel.dpr_base = sm750_dev->io_base + DE_BASE_ADDR_TYPE1;
+ sm750_dev->accel.dp_port_base = sm750_dev->io_base + DE_PORT_ADDR_TYPE1;
- mmio750 = sm750_dev->pv_reg;
+ mmio750 = sm750_dev->io_base;
sm750_set_chip_type(sm750_dev->devid, sm750_dev->revid);
sm750_dev->vidmem_start = pci_resource_start(pdev, 0);
@@ -58,7 +58,7 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
return 0;
err_unmap_reg:
- iounmap(sm750_dev->pv_reg);
+ iounmap(sm750_dev->io_base);
err_release_region:
pci_release_region(pdev, 1);
return ret;
--
2.54.0
^ permalink raw reply related
* Re: [PATCH v2] staging: sm750fb: remove unused variable
From: Dan Carpenter @ 2026-05-29 10:44 UTC (permalink / raw)
To: Onish Sharma
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <ahlszyY6Nd9ANz-X@stanley.mountain>
On Fri, May 29, 2026 at 01:39:11PM +0300, Dan Carpenter wrote:
> Which everyone is API is the one we should keep.
s/everyone/ever one/
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH v2 1/3] staging: rtl8723bs: remove unnecessary braces and comments
From: Dan Carpenter @ 2026-05-29 10:42 UTC (permalink / raw)
To: Vitaliy Slivinskiy; +Cc: gregkh, linux-staging, linux-kernel, dan.carpenter
In-Reply-To: <20260529095503.130909-2-phant0m.mail2023@gmail.com>
On Fri, May 29, 2026 at 12:55:01PM +0300, Vitaliy Slivinskiy wrote:
> Fix checkpatch.pl warning about unnecessary braces for single statement blocks. Also clean up the sentinel entry in the sdio_ids array as suggested by reviewers.
>
> Signed-off-by: Vitaliy Slivinskiy <phant0m.mail2023@gmail.com>
Please, wait a day between resends.
Run checkpatch etc.
Follow the v2 rules.
https://staticthinking.wordpress.com/2022/07/27/how-to-send-a-v2-patch/
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH v2] staging: sm750fb: rename pv_reg to io_base
From: Dan Carpenter @ 2026-05-29 10:41 UTC (permalink / raw)
To: Onish Sharma
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <20260529095233.9015-1-neharora23587@gmail.com>
On Fri, May 29, 2026 at 03:22:33PM +0530, Onish Sharma wrote:
> Rename pv_reg to io_base to follow kernel naming style and improve
> readability.
>
> No functional changes intended.
Run your patches through checkpatch. Also v2 patches need to be sent
in a specific format. This should be [PATCH v2 1/2]
https://staticthinking.wordpress.com/2022/07/27/how-to-send-a-v2-patch/
> ---
^^^
There needs to be a note here to say what changed.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH v2] staging: sm750fb: remove unused variable
From: Dan Carpenter @ 2026-05-29 10:39 UTC (permalink / raw)
To: Onish Sharma
Cc: sudipm.mukherjee, teddy.wang, gregkh, linux-fbdev, linux-staging,
linux-kernel
In-Reply-To: <20260529101242.10189-1-neharora23587@gmail.com>
On Fri, May 29, 2026 at 03:42:42PM +0530, Onish Sharma wrote:
> Remove the set_all_eng_off flag and its associated cleanup logic.
> The variable is redundant as the hardware should be initialized to a
> known state regardless of prior usage.
>
> Suggested-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Onish Sharma <neharora23587@gmail.com>
> ---
Sorry, miscommunication. This breaks the driver. This is also a bit
more involved than I thought...
There are two structs:
struct init_status {
ushort power_mode;
/* below three clocks are in unit of MHZ*/
ushort chip_clk;
ushort mem_clk;
ushort master_clk;
ushort setAllEngOff;
ushort reset_memory;
};
And struct initchip_param. The initchip_param is exactly the same but
with all the struct members renamed and comments added. They have to
match because we cast back and forth.
Why do we have two different struct that have to be the same? You might
think it is for API, but as near as I can see that is not the case.
Maybe it was at some point? We should get rid of one struct. Which
everyone is API is the one we should keep. If neither is API then get
rid of init_status and keep initchip_param.
After that we can talk about getting rid of setAllEngOff/set_all_eng_off.
regards,
dan carpenter
^ permalink raw reply
* [PATCH v2] staging: sm750fb: remove unused variable
From: Onish Sharma @ 2026-05-29 10:12 UTC (permalink / raw)
To: sudipm.mukherjee
Cc: teddy.wang, gregkh, linux-fbdev, linux-staging, linux-kernel,
Onish Sharma, Dan Carpenter
In-Reply-To: <ahlXYIqzu4O5-u9J@stanley.mountain>
Remove the set_all_eng_off flag and its associated cleanup logic.
The variable is redundant as the hardware should be initialized to a
known state regardless of prior usage.
Suggested-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Onish Sharma <neharora23587@gmail.com>
---
drivers/staging/sm750fb/ddk750_chip.c | 28 ---------------------------
drivers/staging/sm750fb/ddk750_chip.h | 7 -------
drivers/staging/sm750fb/sm750.c | 1 -
drivers/staging/sm750fb/sm750.h | 1 -
4 files changed, 37 deletions(-)
diff --git a/drivers/staging/sm750fb/ddk750_chip.c b/drivers/staging/sm750fb/ddk750_chip.c
index 0bb56bbec43f..553654a77170 100644
--- a/drivers/staging/sm750fb/ddk750_chip.c
+++ b/drivers/staging/sm750fb/ddk750_chip.c
@@ -262,34 +262,6 @@ int ddk750_init_hw(struct initchip_param *p_init_param)
reg |= MISC_CTRL_LOCALMEM_RESET;
poke32(MISC_CTRL, reg);
}
-
- if (p_init_param->set_all_eng_off == 1) {
- sm750_enable_2d_engine(0);
-
- /* Disable Overlay, if a former application left it on */
- reg = peek32(VIDEO_DISPLAY_CTRL);
- reg &= ~DISPLAY_CTRL_PLANE;
- poke32(VIDEO_DISPLAY_CTRL, reg);
-
- /* Disable video alpha, if a former application left it on */
- reg = peek32(VIDEO_ALPHA_DISPLAY_CTRL);
- reg &= ~DISPLAY_CTRL_PLANE;
- poke32(VIDEO_ALPHA_DISPLAY_CTRL, reg);
-
- /* Disable alpha plane, if a former application left it on */
- reg = peek32(ALPHA_DISPLAY_CTRL);
- reg &= ~DISPLAY_CTRL_PLANE;
- poke32(ALPHA_DISPLAY_CTRL, reg);
-
- /* Disable DMA Channel, if a former application left it on */
- reg = peek32(DMA_ABORT_INTERRUPT);
- reg |= DMA_ABORT_INTERRUPT_ABORT_1;
- poke32(DMA_ABORT_INTERRUPT, reg);
-
- /* Disable DMA Power, if a former application left it on */
- sm750_enable_dma(0);
- }
-
/* We can add more initialization as needed. */
return 0;
diff --git a/drivers/staging/sm750fb/ddk750_chip.h b/drivers/staging/sm750fb/ddk750_chip.h
index ee2e9d90f7dd..2a13debc179f 100644
--- a/drivers/staging/sm750fb/ddk750_chip.h
+++ b/drivers/staging/sm750fb/ddk750_chip.h
@@ -76,13 +76,6 @@ struct initchip_param {
*/
unsigned short master_clock;
- /*
- * 0 = leave all engine state untouched.
- * 1 = make sure they are off: 2D, Overlay,
- * video alpha, alpha, hardware cursors
- */
- unsigned short set_all_eng_off;
-
/*
* 0 = Do not reset the memory controller
* 1 = Reset the memory controller
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index c2d2864f135b..127db29883d2 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -848,7 +848,6 @@ static void sm750fb_setup(struct sm750_dev *sm750_dev, char *src)
sm750_dev->init_parm.mem_clk = 0;
sm750_dev->init_parm.master_clk = 0;
sm750_dev->init_parm.power_mode = 0;
- sm750_dev->init_parm.set_all_eng_off = 0;
sm750_dev->init_parm.reset_memory = 1;
/* defaultly turn g_hwcursor on for both view */
diff --git a/drivers/staging/sm750fb/sm750.h b/drivers/staging/sm750fb/sm750.h
index c42800313c6a..7ab13da5d7cc 100644
--- a/drivers/staging/sm750fb/sm750.h
+++ b/drivers/staging/sm750fb/sm750.h
@@ -44,7 +44,6 @@ struct init_status {
ushort chip_clk;
ushort mem_clk;
ushort master_clk;
- ushort set_all_eng_off;
ushort reset_memory;
};
--
2.54.0
^ permalink raw reply related
* [PATCH v2 3/3] staging: rtl8723bs: clean up blank lines and function formatting
From: Vitaliy Slivinskiy @ 2026-05-29 9:55 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, dan.carpenter, Vitaliy Slivinskiy
In-Reply-To: <20260529095503.130909-1-phant0m.mail2023@gmail.com>
Fix checkpatch.pl checks regarding multiple blank lines, missing blank lines after functions, and function declarations ending with an open parenthesis.
Signed-off-by: Vitaliy Slivinskiy <phant0m.mail2023@gmail.com>
---
drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
index 9d936b834..06f1b2ff0 100644
--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
@@ -48,7 +48,6 @@ static void sd_sync_int_hdl(struct sdio_func *func)
{
struct dvobj_priv *psdpriv;
-
psdpriv = sdio_get_drvdata(func);
if (!psdpriv->if1)
@@ -151,6 +150,7 @@ static void sdio_deinit(struct dvobj_priv *dvobj)
sdio_release_host(func);
}
}
+
static struct dvobj_priv *sdio_dvobj_init(struct sdio_func *func)
{
struct dvobj_priv *dvobj = NULL;
@@ -214,8 +214,7 @@ static void sd_intf_stop(struct adapter *padapter)
rtw_sdio_disable_interrupt(padapter);
}
-
-static struct adapter *rtw_sdio_if1_init(struct dvobj_priv *dvobj, const struct sdio_device_id *pdid)
+static struct adapter *rtw_sdio_if1_init(struct dvobj_priv *dvobj, const struct sdio_device_id *pdid)
{
int status = _FAIL;
struct net_device *pnetdev;
@@ -248,7 +247,6 @@ static struct adapter *rtw_sdio_if1_init(struct dvobj_priv *dvobj, const struct
/* 4 3.1 set hardware operation functions */
rtw_set_hal_ops(padapter);
-
/* 3 5. initialize Chip version */
padapter->intf_start = &sd_intf_start;
padapter->intf_stop = &sd_intf_stop;
@@ -334,9 +332,7 @@ static void rtw_sdio_if1_deinit(struct adapter *if1)
* notes: drv_init() is called when the bus driver has located a card for us to support.
* We accept the new device by returning 0.
*/
-static int rtw_drv_init(
- struct sdio_func *func,
- const struct sdio_device_id *id)
+static int rtw_drv_init(struct sdio_func *func, const struct sdio_device_id *id)
{
int status = _FAIL;
struct adapter *if1 = NULL;
--
2.53.0
^ permalink raw reply related
* [PATCH v2 2/3] staging: rtl8723bs: fix spacing around conditional operators
From: Vitaliy Slivinskiy @ 2026-05-29 9:55 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, dan.carpenter, Vitaliy Slivinskiy
In-Reply-To: <20260529095503.130909-1-phant0m.mail2023@gmail.com>
Fix checkpatch.pl warning regarding missing spaces around the ternary operator.
Signed-off-by: Vitaliy Slivinskiy <phant0m.mail2023@gmail.com>
---
drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
index f0aa5bc8a..9d936b834 100644
--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
@@ -78,7 +78,7 @@ static int sdio_alloc_irq(struct dvobj_priv *dvobj)
sdio_release_host(func);
- return err?_FAIL:_SUCCESS;
+ return err ? _FAIL : _SUCCESS;
}
static void sdio_free_irq(struct dvobj_priv *dvobj)
--
2.53.0
^ permalink raw reply related
* [PATCH v2 1/3] staging: rtl8723bs: remove unnecessary braces and comments
From: Vitaliy Slivinskiy @ 2026-05-29 9:55 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, dan.carpenter, Vitaliy Slivinskiy
In-Reply-To: <20260529095503.130909-1-phant0m.mail2023@gmail.com>
Fix checkpatch.pl warning about unnecessary braces for single statement blocks. Also clean up the sentinel entry in the sdio_ids array as suggested by reviewers.
Signed-off-by: Vitaliy Slivinskiy <phant0m.mail2023@gmail.com>
---
drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
index c43a0391a..f0aa5bc8a 100644
--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
@@ -20,7 +20,7 @@ static const struct sdio_device_id sdio_ids[] = {
{ SDIO_DEVICE(0x024c, 0x0626), },
{ SDIO_DEVICE(0x024c, 0x0627), },
{ SDIO_DEVICE(0x024c, 0xb723), },
- { /* end: all zeroes */ },
+ { }
};
MODULE_DEVICE_TABLE(sdio, sdio_ids);
--
2.53.0
^ permalink raw reply related
* [PATCH v2 0/3] staging: rtl8723bs: clean up coding style in sdio_intf.c
From: Vitaliy Slivinskiy @ 2026-05-29 9:55 UTC (permalink / raw)
To: gregkh; +Cc: linux-staging, linux-kernel, dan.carpenter, Vitaliy Slivinskiy
*** BLURB HERE ***
This patch series fixes several coding style issues in sdio_intf.c
reported by checkpatch.pl, including unnecessary braces, spacing
around conditional operators, and formatting of function declarations.
Changes in v2:
- Split the changes into three separate patches as requested.
- Fixed the sentinel entry in the sdio_ids array to have no comment and no trailing comma.
--
2.53.0
^ permalink raw reply
* [PATCH v2] staging: sm750fb: rename pv_reg to io_base
From: Onish Sharma @ 2026-05-29 9:52 UTC (permalink / raw)
To: sudipm.mukherjee
Cc: teddy.wang, gregkh, linux-fbdev, linux-staging, linux-kernel,
Onish Sharma
In-Reply-To: <ahhN_kiSb-yRWfiI@stanley.mountain>
Rename pv_reg to io_base to follow kernel naming style and improve
readability.
No functional changes intended.
---
drivers/staging/sm750fb/sm750.c | 4 ++--
drivers/staging/sm750fb/sm750.h | 2 +-
drivers/staging/sm750fb/sm750_hw.c | 12 ++++++------
3 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/staging/sm750fb/sm750.c b/drivers/staging/sm750fb/sm750.c
index 716a8935f58d..c2d2864f135b 100644
--- a/drivers/staging/sm750fb/sm750.c
+++ b/drivers/staging/sm750fb/sm750.c
@@ -743,7 +743,7 @@ static int lynxfb_set_fbinfo(struct fb_info *info, int index)
* must be set after crtc member initialized
*/
crtc->cursor.offset = crtc->o_screen + crtc->vidmem_size - 1024;
- crtc->cursor.mmio = sm750_dev->pv_reg +
+ crtc->cursor.mmio = sm750_dev->io_base +
0x800f0 + (int)crtc->channel * 0x140;
crtc->cursor.max_h = 64;
@@ -1047,7 +1047,7 @@ static void lynxfb_pci_remove(struct pci_dev *pdev)
sm750fb_framebuffer_release(sm750_dev);
arch_phys_wc_del(sm750_dev->mtrr.vram);
- iounmap(sm750_dev->pv_reg);
+ iounmap(sm750_dev->io_base);
iounmap(sm750_dev->vmem);
pci_release_region(pdev, 1);
kfree(g_settings);
diff --git a/drivers/staging/sm750fb/sm750.h b/drivers/staging/sm750fb/sm750.h
index e8885133da2e..c42800313c6a 100644
--- a/drivers/staging/sm750fb/sm750.h
+++ b/drivers/staging/sm750fb/sm750.h
@@ -97,7 +97,7 @@ struct sm750_dev {
unsigned long vidreg_start;
__u32 vidmem_size;
__u32 vidreg_size;
- void __iomem *pv_reg;
+ void __iomem *io_base;
unsigned char __iomem *vmem;
/* locks*/
spinlock_t slock;
diff --git a/drivers/staging/sm750fb/sm750_hw.c b/drivers/staging/sm750fb/sm750_hw.c
index 95f797e5776a..dc1118808b4f 100644
--- a/drivers/staging/sm750fb/sm750_hw.c
+++ b/drivers/staging/sm750fb/sm750_hw.c
@@ -23,18 +23,18 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
}
/* now map mmio and vidmem */
- sm750_dev->pv_reg =
+ sm750_dev->io_base =
ioremap(sm750_dev->vidreg_start, sm750_dev->vidreg_size);
- if (!sm750_dev->pv_reg) {
+ if (!sm750_dev->io_base) {
dev_err(&pdev->dev, "mmio failed\n");
ret = -EFAULT;
goto err_release_region;
}
- sm750_dev->accel.dpr_base = sm750_dev->pv_reg + DE_BASE_ADDR_TYPE1;
- sm750_dev->accel.dp_port_base = sm750_dev->pv_reg + DE_PORT_ADDR_TYPE1;
+ sm750_dev->accel.dpr_base = sm750_dev->io_base + DE_BASE_ADDR_TYPE1;
+ sm750_dev->accel.dp_port_base = sm750_dev->io_base + DE_PORT_ADDR_TYPE1;
- mmio750 = sm750_dev->pv_reg;
+ mmio750 = sm750_dev->io_base;
sm750_set_chip_type(sm750_dev->devid, sm750_dev->revid);
sm750_dev->vidmem_start = pci_resource_start(pdev, 0);
@@ -58,7 +58,7 @@ int hw_sm750_map(struct sm750_dev *sm750_dev, struct pci_dev *pdev)
return 0;
err_unmap_reg:
- iounmap(sm750_dev->pv_reg);
+ iounmap(sm750_dev->io_base);
err_release_region:
pci_release_region(pdev, 1);
return ret;
--
2.54.0
^ permalink raw reply related
* Re: [PATCH] staging: rtl8723bs: clean up coding style in sdio_intf.c
From: Dan Carpenter @ 2026-05-29 7:44 UTC (permalink / raw)
To: Vitaliy Slivinskiy; +Cc: gregkh, linux-staging, linux-kernel
In-Reply-To: <20260528184415.63810-1-phant0m.mail2023@gmail.com>
On Thu, May 28, 2026 at 09:44:15PM +0300, Vitaliy Slivinskiy wrote:
> Fix checkpatch.pl warnings: remove unnecessary braces for single statement blocks, fix spacing around conditional operators, and remove multiple blank lines.
>
Work against the staging-next tree.
Split this up into multiple patches.
Run your patch through checkpatch.
> Signed-off-by: Vitaliy Slivinskiy <phant0m.mail2023@gmail.com>
> ---
> drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 18 ++++++------------
> 1 file changed, 6 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
> index d0feb28b7..17829b982 100644
> --- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
> +++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
> @@ -19,7 +19,7 @@ static const struct sdio_device_id sdio_ids[] = {
> { SDIO_DEVICE(0x024c, 0x0626), },
> { SDIO_DEVICE(0x024c, 0x0627), },
> { SDIO_DEVICE(0x024c, 0xb723), },
> - { /* end: all zeroes */ },
> + { /* end: all zeroes */ },
This should just be:
{ }
No comment because it's obvious. No comma on the end because
nothing can be added after a sentinal.
> };
> MODULE_DEVICE_TABLE(sdio, sdio_ids);
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH v9 0/3] staging: rtl8723bs: fix several style issues in hal/sdio_halinit.c
From: Dan Carpenter @ 2026-05-29 7:40 UTC (permalink / raw)
To: artur.ugnivenko; +Cc: gregkh, ahmet, linux-kernel, linux-staging
In-Reply-To: <20260528170645.30861-1-artur.ugnivenko@gmx.de>
Looks okay to me now.
Reviewed-by: Dan Carpenter <error27@gmail.com>
regards,
dan carpenter
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox