From nobody Mon May 25 06:41:09 2026 Received: from mail-oo1-f54.google.com (mail-oo1-f54.google.com [209.85.161.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7CF54258CCC for ; Sun, 17 May 2026 14:35:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779028507; cv=none; b=TqPhsoVS5yCHA/kgSC1IXB7APVI4rA5T3F7PYs0ycekt9Vl25rsJsJhJqNvjb8A3Ij/F3S4jGm20IgkmCqgYE2vC69qVJmiR9Jx9QthCpbtPPdadr9eqwy88bFzBRqvkGS+9mSx5MrjJXxu2w9Ul88aiVSt11JZ3gCIAo33Mf+4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779028507; c=relaxed/simple; bh=FF9ZfazRE2/igLFALqrXMsLabkFJ7d22RgehowDupYE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=PbH0mfesTiCNN7rRIl8/VDicbEqDhUQjSL1FxIYIBDmlRHc/fb17wTMeiEKrQujM706GyWAAVvcs+iQWn8o/UCbQM+kx+9IC521Fa1oQTAZUP5McrcXwYsK6E6al8rAsWJxSUkd3OZONqeiERQPQ2Ry5EdfC06UTSEeT8mVXDVw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XtKEv08m; arc=none smtp.client-ip=209.85.161.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XtKEv08m" Received: by mail-oo1-f54.google.com with SMTP id 006d021491bc7-6948ed7139eso590263eaf.0 for ; Sun, 17 May 2026 07:35:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779028503; x=1779633303; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=+5Tj8pIpwcuaWArASM+0sAuUc3qYDkIHm69X0MuttiY=; b=XtKEv08mBJZk2SURyGVbkq4zTvgklKutVPPiPHuJ1B5odCB+DLD87W+lIuxh8CIMjh qUGBvEwFfW+ajGlzipLds+zaR9RYQRdj8R5exPYdO8owM6+VBaXQgHBj8oD8vuGXbHoE cjcw1HB46TjpE3eJVnd0/jLMk6hI/OZGHfF2GlAalhjIVCazqGEu7xxyW3XpN2xt9FtZ ZU4cEAyZMMsIVJgR/5jdtYTUWndPXqLe93Epw6vPNSqugpkm686gQ0572hC/wjQ9W6Lk uW8TR78Zw2qTuPB+5nN3HX+K9lZlYI5e7nipjorOIz8gAEaLgGa2i+aPcXojrF9tprxe k5oQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779028503; x=1779633303; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=+5Tj8pIpwcuaWArASM+0sAuUc3qYDkIHm69X0MuttiY=; b=Mg3l/JDoBXz+P7yumL0XSHSxw0HEkoM2T1+7RuEkBTxlcSilUvEE2/9MikrHRzKsRd LdVxhnetHH147B3kG+RcwJYZlzLklHJrE8QiY+14kVWS/X7nDZRzJmSNAjYWnpCS8Vme OqBg+/+QdAlh58ovc7og4C8pdb/E4VIl6NUSYWhcs7I4s7ltu3TeTG2z4izeVFqhe9Xm D6MxVGVDMCEL6QFB8uXUyp/PQJE2jtnOb2+y9tsrVnZWBwPdrwpQadDdtSqukZbJ4GsY faYd/Ded/O667Ajjl2FI/3EIsq7HXMXTlYZ/+3yizf47XkTGf4sVlShumrnaUuM2/8Pf LfOA== X-Forwarded-Encrypted: i=1; AFNElJ8yeRCIZQnRyMOpl85LLlCB5FghvwyvhyUmWxP/XmJZBfeNCRlL8KZHvOYUwp70KV+v5P0s5VFbfppnUu8=@vger.kernel.org X-Gm-Message-State: AOJu0YyXISmpZ8t0ui5wBydIWVJc04dzpE8yIVeIeRt42JMHHQosYMql Qt3KkYLbgqf4GOvaab7vWM2JOqeKQxZF5UuQhI5ao3y4GycxIE+6LgdZ X-Gm-Gg: Acq92OGqAI4+l7bgcSTQQFMuZInKfBuVVPCw/+ErOnRNmB/5GmHS7nORtRI8+MuwzfU 5TgATK1m2HP41GcC3wWtqDdkpgK1puf70v8OpVmAPY9SlxslAKWCb3j7wnl8Asj/cX00/97AlYo liuHOqNe/IaD1fOxXQ9PomGxSxNXYnYrDjKCcyOHYYkvCAPXfR8Y9jaloAbQndb4PuwY4d3iLjx 8yaMLgat/Q+o8U9RoF3FfUQonHTPjk66T6P+HCJgrJksss9qx5qcJ4Rz5sc4k7R4UC3bopQUlTI 5v+pSfhs930vefJi1Wu1eJ9JXUw5nz9N20LgPDitftrq0AzwkZKvAF3e2IaTajDhomu3Xsqc2UM elqhFVd3MV8PX1texVnRa8deEB+hNkvgMlR+LqRPahJXrbdAnFsd7Tg4k0JN86Q50jXtxLynuSp ETGCIROaNGYuEbi9MZgJyieyHDqluZnCywU10I4GWd X-Received: by 2002:a05:6820:151f:b0:69c:502f:bcde with SMTP id 006d021491bc7-69c950fe8c7mr7870649eaf.49.1779028503353; Sun, 17 May 2026 07:35:03 -0700 (PDT) Received: from MacMini.lan ([172.127.162.94]) by smtp.gmail.com with ESMTPSA id 006d021491bc7-69d0465461bsm4114183eaf.7.2026.05.17.07.35.02 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sun, 17 May 2026 07:35:02 -0700 (PDT) From: shayderrr To: sakari.ailus@linux.intel.com, bingbu.cao@intel.com, mchehab@kernel.org, gregkh@linuxfoundation.org Cc: linux-media@vger.kernel.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org, Pranav Bajjuri Subject: [PATCH] media: ipu7: fix boot config memory leak and replace polling loops Date: Sun, 17 May 2026 09:34:56 -0500 Message-ID: <20260517143456.81109-1-darknessshayder@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Pranav Bajjuri Free boot_config DMA allocation if queue memory alloc fails in ipu7_boot_init_boot_config(). Replace hand-rolled timeout loops in ipu7_boot_start_fw() and ipu7_boot_stop_fw() with read_poll_timeout(). Fix variable declaration order in cell reset, start, and stop to follow reverse Christmas tree convention. Signed-off-by: Pranav Bajjuri --- drivers/staging/media/ipu7/ipu7-boot.c | 88 +++++++++++--------------- 1 file changed, 36 insertions(+), 52 deletions(-) diff --git a/drivers/staging/media/ipu7/ipu7-boot.c b/drivers/staging/media= /ipu7/ipu7-boot.c index d7901ff78b38..f081c39604a7 100644 --- a/drivers/staging/media/ipu7/ipu7-boot.c +++ b/drivers/staging/media/ipu7/ipu7-boot.c @@ -22,8 +22,8 @@ #include "ipu7-platform-regs.h" #include "ipu7-syscom.h" =20 -#define IPU_FW_START_STOP_TIMEOUT 2000 -#define IPU_BOOT_CELL_RESET_TIMEOUT (2 * USEC_PER_SEC) +#define IPU_FW_START_STOP_TIMEOUT 2000 +#define IPU_BOOT_CELL_RESET_TIMEOUT (2 * USEC_PER_SEC) #define BOOT_STATE_IS_CRITICAL(s) IA_GOFO_FW_BOOT_STATE_IS_CRITICAL(s) #define BOOT_STATE_IS_READY(s) ((s) =3D=3D IA_GOFO_FW_BOOT_STATE_READY) #define BOOT_STATE_IS_INACTIVE(s) ((s) =3D=3D IA_GOFO_FW_BOOT_STATE_INACTI= VE) @@ -39,17 +39,17 @@ struct ipu7_boot_context { static const struct ipu7_boot_context contexts[IPU_SUBSYS_NUM] =3D { { /* ISYS */ - .dmem_address =3D IPU_ISYS_DMEM_OFFSET, - .status_ctrl_reg =3D BUTTRESS_REG_DRV_IS_UCX_CONTROL_STATUS, - .fw_start_address_reg =3D BUTTRESS_REG_DRV_IS_UCX_START_ADDR, - .fw_code_base_reg =3D IS_UC_CTRL_BASE + .dmem_address =3D IPU_ISYS_DMEM_OFFSET, + .status_ctrl_reg =3D BUTTRESS_REG_DRV_IS_UCX_CONTROL_STATUS, + .fw_start_address_reg =3D BUTTRESS_REG_DRV_IS_UCX_START_ADDR, + .fw_code_base_reg =3D IS_UC_CTRL_BASE }, { /* PSYS */ - .dmem_address =3D IPU_PSYS_DMEM_OFFSET, - .status_ctrl_reg =3D BUTTRESS_REG_DRV_PS_UCX_CONTROL_STATUS, - .fw_start_address_reg =3D BUTTRESS_REG_DRV_PS_UCX_START_ADDR, - .fw_code_base_reg =3D PS_UC_CTRL_BASE + .dmem_address =3D IPU_PSYS_DMEM_OFFSET, + .status_ctrl_reg =3D BUTTRESS_REG_DRV_PS_UCX_CONTROL_STATUS, + .fw_start_address_reg =3D BUTTRESS_REG_DRV_PS_UCX_START_ADDR, + .fw_code_base_reg =3D PS_UC_CTRL_BASE } }; =20 @@ -85,9 +85,9 @@ static int ipu7_boot_cell_reset(const struct ipu7_bus_dev= ice *adev) { const struct ipu7_boot_context *ctx =3D &contexts[adev->subsys]; const struct device *dev =3D &adev->auxdev.dev; + void __iomem *base =3D adev->isp->base; u32 ucx_ctrl_status =3D ctx->status_ctrl_reg; u32 timeout =3D IPU_BOOT_CELL_RESET_TIMEOUT; - void __iomem *base =3D adev->isp->base; u32 val, val2; int ret; =20 @@ -134,8 +134,8 @@ static int ipu7_boot_cell_reset(const struct ipu7_bus_d= evice *adev) static void ipu7_boot_cell_start(const struct ipu7_bus_device *adev) { const struct ipu7_boot_context *ctx =3D &contexts[adev->subsys]; - void __iomem *base =3D adev->isp->base; const struct device *dev =3D &adev->auxdev.dev; + void __iomem *base =3D adev->isp->base; u32 val; =20 dev_dbg(dev, "starting cell...\n"); @@ -152,8 +152,8 @@ static void ipu7_boot_cell_start(const struct ipu7_bus_= device *adev) static void ipu7_boot_cell_stop(const struct ipu7_bus_device *adev) { const struct ipu7_boot_context *ctx =3D &contexts[adev->subsys]; - void __iomem *base =3D adev->isp->base; const struct device *dev =3D &adev->auxdev.dev; + void __iomem *base =3D adev->isp->base; u32 val; =20 dev_dbg(dev, "stopping cell...\n"); @@ -187,16 +187,14 @@ static int ipu7_boot_cell_init(const struct ipu7_bus_= device *adev) } =20 static void init_boot_config(struct ia_gofo_boot_config *boot_config, - u32 length, u8 major) + u32 config_size, u8 major) { - /* syscom version, new syscom2 version */ - boot_config->length =3D length; + boot_config->length =3D config_size; boot_config->config_version.major =3D 1U; boot_config->config_version.minor =3D 0U; boot_config->config_version.subminor =3D 0U; boot_config->config_version.patch =3D 0U; =20 - /* msg version for task interface */ boot_config->client_version_support.num_versions =3D 1U; boot_config->client_version_support.versions[0].major =3D major; boot_config->client_version_support.versions[0].minor =3D 0U; @@ -221,7 +219,7 @@ int ipu7_boot_init_boot_config(struct ipu7_bus_device *= adev, =20 dev_dbg(dev, "boot config queues_nr: %d freq: %u sys_conf: 0x%pad\n", num_queues, uc_freq, &subsys_config); - /* Allocate boot config. */ + adev->boot_config_size =3D sizeof(*cfgs) * num_queues + sizeof(*boot_config); adev->boot_config =3D ipu7_dma_alloc(adev, adev->boot_config_size, @@ -257,12 +255,15 @@ int ipu7_boot_init_boot_config(struct ipu7_bus_device= *adev, qconfigs[i].queue_size =3D queue_size; } =20 - /* Allocate queue memory */ syscom->queue_mem =3D ipu7_dma_alloc(adev, total_queue_size_aligned, &syscom->queue_mem_dma_addr, GFP_KERNEL, 0); if (!syscom->queue_mem) { dev_err(dev, "Failed to allocate queue memory.\n"); + ipu7_dma_free(adev, adev->boot_config_size, + adev->boot_config, + adev->boot_config_dma_addr, 0); + adev->boot_config =3D NULL; return -ENOMEM; } syscom->queue_mem_size =3D total_queue_size_aligned; @@ -312,7 +313,6 @@ EXPORT_SYMBOL_NS_GPL(ipu7_boot_release_boot_config, "IN= TEL_IPU7"); int ipu7_boot_start_fw(const struct ipu7_bus_device *adev) { const struct device *dev =3D &adev->auxdev.dev; - u32 timeout =3D IPU_FW_START_STOP_TIMEOUT; void __iomem *base =3D adev->isp->base; u32 boot_state, last_boot_state; u32 indices_addr, msg_ver, id; @@ -323,37 +323,26 @@ int ipu7_boot_start_fw(const struct ipu7_bus_device *= adev) return ret; =20 dev_dbg(dev, "start booting fw...\n"); - /* store "uninit" state to syscom/boot state reg */ write_fw_boot_param(adev, IA_GOFO_FW_BOOT_STATE_ID, IA_GOFO_FW_BOOT_STATE_UNINIT); - /* - * Set registers to zero - * (not strictly required, but recommended for diagnostics) - */ write_fw_boot_param(adev, IA_GOFO_FW_BOOT_SYSCOM_QUEUE_INDICES_BASE_ID, 0); write_fw_boot_param(adev, IA_GOFO_FW_BOOT_MESSAGING_VERSION_ID, 0); - /* store firmware configuration address */ write_fw_boot_param(adev, IA_GOFO_FW_BOOT_CONFIG_ID, adev->boot_config_dma_addr); =20 - /* Kick uC, then wait for boot complete */ ipu7_boot_cell_start(adev); =20 last_boot_state =3D IA_GOFO_FW_BOOT_STATE_UNINIT; - while (timeout--) { - boot_state =3D read_fw_boot_param(adev, - IA_GOFO_FW_BOOT_STATE_ID); - if (boot_state !=3D last_boot_state) { - dev_dbg(dev, "boot state changed from 0x%x to 0x%x\n", - last_boot_state, boot_state); - last_boot_state =3D boot_state; - } - if (BOOT_STATE_IS_CRITICAL(boot_state) || - BOOT_STATE_IS_READY(boot_state)) - break; - usleep_range(1000, 1200); - } + ret =3D read_poll_timeout(read_fw_boot_param, boot_state, + BOOT_STATE_IS_CRITICAL(boot_state) || + BOOT_STATE_IS_READY(boot_state), + 1000, IPU_FW_START_STOP_TIMEOUT * 1000ULL, + false, adev, IA_GOFO_FW_BOOT_STATE_ID); + + if (boot_state !=3D last_boot_state) + dev_dbg(dev, "boot state changed from 0x%x to 0x%x\n", + last_boot_state, boot_state); =20 if (BOOT_STATE_IS_CRITICAL(boot_state)) { ipu7_dump_fw_error_log(adev); @@ -365,13 +354,11 @@ int ipu7_boot_start_fw(const struct ipu7_bus_device *= adev) } dev_dbg(dev, "fw boot done.\n"); =20 - /* Get FW syscom queue indices addr */ id =3D IA_GOFO_FW_BOOT_SYSCOM_QUEUE_INDICES_BASE_ID; indices_addr =3D read_fw_boot_param(adev, id); adev->syscom->queue_indices =3D base + indices_addr; dev_dbg(dev, "fw queue indices offset is 0x%x\n", indices_addr); =20 - /* Get message version. */ msg_ver =3D read_fw_boot_param(adev, IA_GOFO_FW_BOOT_MESSAGING_VERSION_ID); dev_dbg(dev, "ipu message version is 0x%08x\n", msg_ver); @@ -383,8 +370,8 @@ EXPORT_SYMBOL_NS_GPL(ipu7_boot_start_fw, "INTEL_IPU7"); int ipu7_boot_stop_fw(const struct ipu7_bus_device *adev) { const struct device *dev =3D &adev->auxdev.dev; - u32 timeout =3D IPU_FW_START_STOP_TIMEOUT; u32 boot_state; + int ret; =20 boot_state =3D read_fw_boot_param(adev, IA_GOFO_FW_BOOT_STATE_ID); if (BOOT_STATE_IS_CRITICAL(boot_state) || @@ -394,18 +381,15 @@ int ipu7_boot_stop_fw(const struct ipu7_bus_device *a= dev) return -EBUSY; } =20 - /* Issue shutdown to start shutdown process */ dev_dbg(dev, "stopping fw...\n"); write_fw_boot_param(adev, IA_GOFO_FW_BOOT_STATE_ID, IA_GOFO_FW_BOOT_STATE_SHUTDOWN_CMD); - while (timeout--) { - boot_state =3D read_fw_boot_param(adev, - IA_GOFO_FW_BOOT_STATE_ID); - if (BOOT_STATE_IS_CRITICAL(boot_state) || - BOOT_STATE_IS_INACTIVE(boot_state)) - break; - usleep_range(1000, 1200); - } + + ret =3D read_poll_timeout(read_fw_boot_param, boot_state, + BOOT_STATE_IS_CRITICAL(boot_state) || + BOOT_STATE_IS_INACTIVE(boot_state), + 1000, IPU_FW_START_STOP_TIMEOUT * 1000ULL, + false, adev, IA_GOFO_FW_BOOT_STATE_ID); =20 if (BOOT_STATE_IS_CRITICAL(boot_state)) { ipu7_dump_fw_error_log(adev); --=20 2.50.1 (Apple Git-155)