diff --git a/kmpp/base/inc/kmpp_obj.h b/kmpp/base/inc/kmpp_obj.h
index 68ad67de..08c18c83 100644
--- a/kmpp/base/inc/kmpp_obj.h
+++ b/kmpp/base/inc/kmpp_obj.h
@@ -64,7 +64,7 @@ rk_s32 kmpp_obj_preset(KmppObj obj, const char *arg, const char *caller);
 /* check object is valid or not */
 rk_s32 kmpp_obj_check(KmppObj obj, const char *caller);
 /* run object's ioctl to kernel with input and output object */
-rk_s32 kmpp_obj_ioctl(KmppObj ctx, rk_s32 cmd, KmppObj in, KmppObj out, const char *caller);
+rk_s32 kmpp_obj_ioctl(KmppObj ctx, rk_s32 cmd, KmppObj in, KmppObj *out, const char *caller);
 
 #define kmpp_obj_get_f(obj, def)                kmpp_obj_get(obj, def, __FUNCTION__)
 #define kmpp_obj_get_by_name_f(obj, name)       kmpp_obj_get_by_name(obj, name, __FUNCTION__)
diff --git a/kmpp/base/inc/kmpp_obj_func.h b/kmpp/base/inc/kmpp_obj_func.h
index fbe53d0f..4af0a92c 100644
--- a/kmpp/base/inc/kmpp_obj_func.h
+++ b/kmpp/base/inc/kmpp_obj_func.h
@@ -87,10 +87,10 @@ KMPP_OBJ_ENTRY_TABLE(KMPP_OBJ_NAME, ENTRY_DECLARE, STRCT_DECLARE,
     rk_s32 CONCAT_US(prefix, func)(KMPP_OBJ_INTF_TYPE ctx, in_type in);
 
 #define IOCTL_OUT(prefix, func, out_type, ...) \
-    rk_s32 CONCAT_US(prefix, func)(KMPP_OBJ_INTF_TYPE ctx, out_type out);
+    rk_s32 CONCAT_US(prefix, func)(KMPP_OBJ_INTF_TYPE ctx, out_type *out);
 
 #define IOCTL_IO_(prefix, func, in_type, out_type, ...) \
-    rk_s32 CONCAT_US(prefix, func)(KMPP_OBJ_INTF_TYPE ctx, in_type in, out_type out);
+    rk_s32 CONCAT_US(prefix, func)(KMPP_OBJ_INTF_TYPE ctx, in_type in, out_type *out);
 
 #ifdef __cplusplus
 extern "C" {
diff --git a/kmpp/base/inc/kmpp_obj_helper.h b/kmpp/base/inc/kmpp_obj_helper.h
index 83c4eb6f..a3d03ba2 100644
--- a/kmpp/base/inc/kmpp_obj_helper.h
+++ b/kmpp/base/inc/kmpp_obj_helper.h
@@ -502,8 +502,8 @@ KMPP_OBJ_ENTRY_TABLE(KMPP_OBJ_NAME, KMPP_OBJ_EXPORT, KMPP_OBJ_EXPORT,
         return kmpp_obj_ioctl(ctx, cmd, in, NULL, __FUNCTION__); \
     }
 
-#define IOCTL_OUT(prefix, name, out_type, ...) \
-    rk_s32 CONCAT_US(prefix, func)(KMPP_OBJ_INTF_TYPE ctx, out_type out) \
+#define IOCTL_OUT(prefix, func, out_type, ...) \
+    rk_s32 CONCAT_US(prefix, func)(KMPP_OBJ_INTF_TYPE ctx, out_type *out) \
     { \
         KmppObjDef def = KMPP_OBJ_DEF(KMPP_OBJ_NAME); \
         static rk_s32 cmd = -1; \
@@ -523,8 +523,8 @@ KMPP_OBJ_ENTRY_TABLE(KMPP_OBJ_NAME, KMPP_OBJ_EXPORT, KMPP_OBJ_EXPORT,
         return kmpp_obj_ioctl(ctx, cmd, NULL, out, __FUNCTION__); \
     }
 
-#define IOCTL_IO_(prefix, name, in_type, out_type, ...) \
-    rk_s32 CONCAT_US(prefix, func)(KMPP_OBJ_INTF_TYPE ctx, in_type in, out_type out) \
+#define IOCTL_IO_(prefix, func, in_type, out_type, ...) \
+    rk_s32 CONCAT_US(prefix, func)(KMPP_OBJ_INTF_TYPE ctx, in_type in, out_type *out) \
     { \
         KmppObjDef def = KMPP_OBJ_DEF(KMPP_OBJ_NAME); \
         static rk_s32 cmd = -1; \
diff --git a/kmpp/base/kmpp_obj.c b/kmpp/base/kmpp_obj.c
index a97a015e..dfad9ad5 100644
--- a/kmpp/base/kmpp_obj.c
+++ b/kmpp/base/kmpp_obj.c
@@ -1051,7 +1051,7 @@ rk_s32 kmpp_obj_get_by_sptr(KmppObj *obj, KmppShmPtr *sptr, const char *caller)
     KmppObjDefImpl *def;
     rk_u8 *uptr = sptr ? sptr->uptr : NULL;
 
-    if (!obj || !sptr || !uptr) {
+    if (!obj) {
         mpp_loge_f("invalid param obj %p sptr %p uptr %p at %s\n",
                    obj, sptr, uptr, caller);
         return rk_nok;
@@ -1059,6 +1059,10 @@ rk_s32 kmpp_obj_get_by_sptr(KmppObj *obj, KmppShmPtr *sptr, const char *caller)
 
     *obj = NULL;
 
+    /* allow NULL sptr and NULL uptr return NULL object value without error */
+    if (!sptr || !uptr)
+        return rk_ok;
+
     if (!p)
         return rk_nok;
 
@@ -1197,7 +1201,7 @@ rk_s32 kmpp_obj_check(KmppObj obj, const char *caller)
     return rk_ok;
 }
 
-rk_s32 kmpp_obj_ioctl(KmppObj ctx, rk_s32 cmd, KmppObj in, KmppObj out, const char *caller)
+rk_s32 kmpp_obj_ioctl(KmppObj ctx, rk_s32 cmd, KmppObj in, KmppObj *out, const char *caller)
 {
     KmppObjs *p = get_objs_f();
     KmppObjDef def_ioc = kmpp_ioc_objdef();
@@ -1273,18 +1277,25 @@ rk_s32 kmpp_obj_ioctl(KmppObj ctx, rk_s32 cmd, KmppObj in, KmppObj out, const ch
         obj_dbg_ioctl("ioctl [u:k] in %#llx : %#llx\n", sptr->uaddr, sptr->kaddr);
     }
 
-    if (out) {
-        KmppShmPtr *sptr = kmpp_obj_to_shm(out);
-
-        kmpp_ioc_set_out(ioc, sptr);
-        obj_dbg_ioctl("ioctl [u:k] out %#llx : %#llx\n", sptr->uaddr, sptr->kaddr);
-    }
-
     ret = ioctl(p->ioc.fd, 0, ioc_arg);
 
     /* if defined ret in ioc object use ret in ioc object */
     kmpp_ioc_get_ret(ioc, &ret);
 
+    if (out) {
+        *out = NULL;
+
+        if (!ret) {
+            KmppShmPtr sptr = { 0 };
+
+            kmpp_ioc_get_out(ioc, &sptr);
+            kmpp_obj_get_by_sptr(out, &sptr, caller);
+
+            obj_dbg_ioctl("ioctl [u:k] out %#llx : %#llx obj %p\n",
+                          sptr.uaddr, sptr.kaddr, *out);
+        }
+    }
+
     kmpp_obj_put(ioc, caller);
 
     return ret;
@@ -1437,7 +1448,7 @@ MPP_OBJ_ACCESS(obj, KmppObj)
 MPP_OBJ_ACCESS(fp, void *)
 
 /* compatible for pointer and structure setup */
-rk_s32 kmpp_obj_set_ptr(KmppObj obj, const char *name, void* val) \
+rk_s32 kmpp_obj_set_ptr(KmppObj obj, const char *name, void* val)
 {
     KmppObjImpl *impl = (KmppObjImpl *)obj;
     rk_s32 ret = rk_nok;
@@ -1480,7 +1491,7 @@ rk_s32 kmpp_obj_get_ptr(KmppObj obj, const char *name, void **val)
 
     if (ret)
         mpp_loge("obj %s get %s ptr failed ret %d\n",
-                impl ? impl->def ? impl->def->name : NULL : NULL, name, ret);
+                 impl ? impl->def ? impl->def->name : NULL : NULL, name, ret);
     return ret;
 }