2023-12-05 08:10:28

by Tomi Valkeinen

[permalink] [raw]
Subject: [PATCH 0/4] media: rkisp1: Fix IRQ related issues

These fix a few IRQ related issues I noticed when testing i.MX8MP. These
are based on Paul's recently sent "[PATCH v4 00/11] media: rkisp1: Add
support for i.MX8MP" series, but could also be rebased on top of
mainline if needed.

Signed-off-by: Tomi Valkeinen <[email protected]>
---
Tomi Valkeinen (4):
media: rkisp1: Store IRQ lines
media: rkisp1: Fix IRQ handler return values
media: rkisp1: Fix IRQ handling due to shared interrupts
media: rkisp1: Fix IRQ disable race issue

.../platform/rockchip/rkisp1/rkisp1-capture.c | 3 ++
.../media/platform/rockchip/rkisp1/rkisp1-common.h | 13 ++++-
.../media/platform/rockchip/rkisp1/rkisp1-csi.c | 17 ++++++-
.../media/platform/rockchip/rkisp1/rkisp1-dev.c | 58 ++++++++++++++++++----
.../media/platform/rockchip/rkisp1/rkisp1-isp.c | 23 +++++++--
5 files changed, 100 insertions(+), 14 deletions(-)
---
base-commit: dd19f89b915c203d49e3b23ca02446d4fb05d955
change-id: 20231205-rkisp-irq-fix-e123a8a6732f

Best regards,
--
Tomi Valkeinen <[email protected]>


2023-12-05 08:10:30

by Tomi Valkeinen

[permalink] [raw]
Subject: [PATCH 4/4] media: rkisp1: Fix IRQ disable race issue

In rkisp1_isp_stop() and rkisp1_csi_disable() the driver masks the
interrupts and then apparently assumes that the interrupt handler won't
be running, and proceeds in the stop procedure. This is not the case, as
the interrupt handler can already be running, which would lead to the
ISP being disabled while the interrupt handler handling a captured
frame.

It is not clear to me if this problem causes a real issue, but shutting
down the ISP while an interrupt handler is running sounds rather bad.

Signed-off-by: Tomi Valkeinen <[email protected]>
---
drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c | 14 +++++++++++++-
drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c | 20 +++++++++++++++++---
2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
index f6b54654b435..f0cef766fc0c 100644
--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
@@ -125,8 +125,20 @@ static void rkisp1_csi_disable(struct rkisp1_csi *csi)
struct rkisp1_device *rkisp1 = csi->rkisp1;
u32 val;

- /* Mask and clear interrupts. */
+ /* Mask MIPI interrupts. */
rkisp1_write(rkisp1, RKISP1_CIF_MIPI_IMSC, 0);
+
+ /* Flush posted writes */
+ rkisp1_read(rkisp1, RKISP1_CIF_MIPI_IMSC);
+
+ /*
+ * Wait until the IRQ handler has ended. The IRQ handler may get called
+ * even after this, but it will return immediately as the MIPI
+ * interrupts have been masked.
+ */
+ synchronize_irq(rkisp1->irqs[RKISP1_IRQ_MIPI]);
+
+ /* Clear MIPI interrupt status */
rkisp1_write(rkisp1, RKISP1_CIF_MIPI_ICR, ~0);

val = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_CTRL);
diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
index d6b8786661ad..a6dd497c884c 100644
--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
@@ -364,11 +364,25 @@ static void rkisp1_isp_stop(struct rkisp1_isp *isp)
* ISP(mi) stop in mi frame end -> Stop ISP(mipi) ->
* Stop ISP(isp) ->wait for ISP isp off
*/
- /* stop and clear MI and ISP interrupts */
- rkisp1_write(rkisp1, RKISP1_CIF_ISP_IMSC, 0);
- rkisp1_write(rkisp1, RKISP1_CIF_ISP_ICR, ~0);

+ /* Mask MI and ISP interrupts */
+ rkisp1_write(rkisp1, RKISP1_CIF_ISP_IMSC, 0);
rkisp1_write(rkisp1, RKISP1_CIF_MI_IMSC, 0);
+
+ /* Flush posted writes */
+ rkisp1_read(rkisp1, RKISP1_CIF_MI_IMSC);
+
+ /*
+ * Wait until the IRQ handler has ended. The IRQ handler may get called
+ * even after this, but it will return immediately as the MI and ISP
+ * interrupts have been masked.
+ */
+ synchronize_irq(rkisp1->irqs[RKISP1_IRQ_ISP]);
+ if (rkisp1->irqs[RKISP1_IRQ_ISP] != rkisp1->irqs[RKISP1_IRQ_MI])
+ synchronize_irq(rkisp1->irqs[RKISP1_IRQ_MI]);
+
+ /* Clear MI and ISP interrupt status */
+ rkisp1_write(rkisp1, RKISP1_CIF_ISP_ICR, ~0);
rkisp1_write(rkisp1, RKISP1_CIF_MI_ICR, ~0);

/* stop ISP */

--
2.34.1

2023-12-05 08:10:32

by Tomi Valkeinen

[permalink] [raw]
Subject: [PATCH 1/4] media: rkisp1: Store IRQ lines

Store the IRQ lines used by the driver for easy access. These are needed
in future patches which fix IRQ race issues.

Signed-off-by: Tomi Valkeinen <[email protected]>
---
.../media/platform/rockchip/rkisp1/rkisp1-common.h | 11 ++++++++++-
drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 19 ++++++++++++++-----
2 files changed, 24 insertions(+), 6 deletions(-)

diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
index 960ab89c659b..ec28907d978e 100644
--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
@@ -62,6 +62,14 @@ struct regmap;
RKISP1_CIF_ISP_EXP_END | \
RKISP1_CIF_ISP_HIST_MEASURE_RDY)

+/* IRQ lines */
+enum rkisp1_irq_line {
+ RKISP1_IRQ_ISP = 0,
+ RKISP1_IRQ_MI,
+ RKISP1_IRQ_MIPI,
+ RKISP1_NUM_IRQS,
+};
+
/* enum for the resizer pads */
enum rkisp1_rsz_pad {
RKISP1_RSZ_PAD_SINK,
@@ -437,7 +445,6 @@ struct rkisp1_debug {
* struct rkisp1_device - ISP platform device
*
* @base_addr: base register address
- * @irq: the irq number
* @dev: a pointer to the struct device
* @clk_size: number of clocks
* @clks: array of clocks
@@ -457,6 +464,7 @@ struct rkisp1_debug {
* @stream_lock: serializes {start/stop}_streaming callbacks between the capture devices.
* @debug: debug params to be exposed on debugfs
* @info: version-specific ISP information
+ * @irqs: IRQ line numbers
*/
struct rkisp1_device {
void __iomem *base_addr;
@@ -479,6 +487,7 @@ struct rkisp1_device {
struct mutex stream_lock; /* serialize {start/stop}_streaming cb between capture devices */
struct rkisp1_debug debug;
const struct rkisp1_info *info;
+ int irqs[RKISP1_NUM_IRQS];
};

/*
diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
index 2b9886fd0800..76f93614b4cf 100644
--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
@@ -115,6 +115,7 @@
struct rkisp1_isr_data {
const char *name;
irqreturn_t (*isr)(int irq, void *ctx);
+ u32 line_mask;
};

/* ----------------------------------------------------------------------------
@@ -465,9 +466,9 @@ static const char * const px30_isp_clks[] = {
};

static const struct rkisp1_isr_data px30_isp_isrs[] = {
- { "isp", rkisp1_isp_isr },
- { "mi", rkisp1_capture_isr },
- { "mipi", rkisp1_csi_isr },
+ { "isp", rkisp1_isp_isr, BIT(RKISP1_IRQ_ISP) },
+ { "mi", rkisp1_capture_isr, BIT(RKISP1_IRQ_MI) },
+ { "mipi", rkisp1_csi_isr, BIT(RKISP1_IRQ_MIPI) },
};

static const struct rkisp1_info px30_isp_info = {
@@ -488,7 +489,7 @@ static const char * const rk3399_isp_clks[] = {
};

static const struct rkisp1_isr_data rk3399_isp_isrs[] = {
- { NULL, rkisp1_isr },
+ { NULL, rkisp1_isr, BIT(RKISP1_IRQ_ISP) | BIT(RKISP1_IRQ_MI) | BIT(RKISP1_IRQ_MIPI) },
};

static const struct rkisp1_info rk3399_isp_info = {
@@ -509,7 +510,7 @@ static const char * const imx8mp_isp_clks[] = {
};

static const struct rkisp1_isr_data imx8mp_isp_isrs[] = {
- { NULL, rkisp1_isr },
+ { NULL, rkisp1_isr, BIT(RKISP1_IRQ_ISP) | BIT(RKISP1_IRQ_MI) | BIT(RKISP1_IRQ_MIPI) },
};

static const struct rkisp1_info imx8mp_isp_info = {
@@ -566,6 +567,9 @@ static int rkisp1_probe(struct platform_device *pdev)
if (IS_ERR(rkisp1->base_addr))
return PTR_ERR(rkisp1->base_addr);

+ for (unsigned int il = 0; il < RKISP1_NUM_IRQS; ++il)
+ rkisp1->irqs[il] = -1;
+
for (i = 0; i < info->isr_size; i++) {
irq = info->isrs[i].name
? platform_get_irq_byname(pdev, info->isrs[i].name)
@@ -573,6 +577,11 @@ static int rkisp1_probe(struct platform_device *pdev)
if (irq < 0)
return irq;

+ for (unsigned int il = 0; il < RKISP1_NUM_IRQS; ++il) {
+ if (info->isrs[i].line_mask & BIT(il))
+ rkisp1->irqs[il] = irq;
+ }
+
ret = devm_request_irq(dev, irq, info->isrs[i].isr, IRQF_SHARED,
dev_driver_string(dev), dev);
if (ret) {

--
2.34.1

2023-12-05 08:10:47

by Tomi Valkeinen

[permalink] [raw]
Subject: [PATCH 3/4] media: rkisp1: Fix IRQ handling due to shared interrupts

The driver requests the interrupts as IRQF_SHARED, so the interrupt
handlers can be called at any time. If such a call happens while the ISP
is powered down, the SoC will hang as the driver tries to access the
ISP registers.

Fix this by adding a new field, 'irqs_enabled', which is used to bail
out from the interrupt handler when the ISP is not operational.

Signed-off-by: Tomi Valkeinen <[email protected]>
---
.../media/platform/rockchip/rkisp1/rkisp1-capture.c | 3 +++
.../media/platform/rockchip/rkisp1/rkisp1-common.h | 2 ++
drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c | 3 +++
drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 21 +++++++++++++++++++++
drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c | 3 +++
5 files changed, 32 insertions(+)

diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
index b50b044d22af..e92067897f28 100644
--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
@@ -779,6 +779,9 @@ irqreturn_t rkisp1_capture_isr(int irq, void *ctx)
unsigned int i;
u32 status;

+ if (!rkisp1->irqs_enabled)
+ return IRQ_NONE;
+
status = rkisp1_read(rkisp1, RKISP1_CIF_MI_MIS);
if (!status)
return IRQ_NONE;
diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
index ec28907d978e..7f97fdf6e24c 100644
--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
@@ -465,6 +465,7 @@ struct rkisp1_debug {
* @debug: debug params to be exposed on debugfs
* @info: version-specific ISP information
* @irqs: IRQ line numbers
+ * @irqs_enabled: the hardware is enabled and can cause interrupts
*/
struct rkisp1_device {
void __iomem *base_addr;
@@ -488,6 +489,7 @@ struct rkisp1_device {
struct rkisp1_debug debug;
const struct rkisp1_info *info;
int irqs[RKISP1_NUM_IRQS];
+ bool irqs_enabled;
};

/*
diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
index 47f4353a1784..f6b54654b435 100644
--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
@@ -184,6 +184,9 @@ irqreturn_t rkisp1_csi_isr(int irq, void *ctx)
struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
u32 val, status;

+ if (!rkisp1->irqs_enabled)
+ return IRQ_NONE;
+
status = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_MIS);
if (!status)
return IRQ_NONE;
diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
index 1d60f4b8bd09..fbe03f7864e3 100644
--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
@@ -306,6 +306,23 @@ static int __maybe_unused rkisp1_runtime_suspend(struct device *dev)
{
struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);

+ rkisp1->irqs_enabled = false;
+ /* Make sure the IRQ handler will see the above */
+ mb();
+
+ /*
+ * Wait until any running IRQ handler has returned. The IRQ handler
+ * may get called even after this (as it's a shared interrupt line)
+ * but the 'irqs_enabled' flag will make the handler return immediately.
+ */
+ for (unsigned int i = 0; i < RKISP1_NUM_IRQS; ++i) {
+ if (rkisp1->irqs[i] == -1)
+ continue;
+
+ if (i == 0 || rkisp1->irqs[i - 1] != rkisp1->irqs[i])
+ synchronize_irq(rkisp1->irqs[i]);
+ }
+
clk_bulk_disable_unprepare(rkisp1->clk_size, rkisp1->clks);
return pinctrl_pm_select_sleep_state(dev);
}
@@ -322,6 +339,10 @@ static int __maybe_unused rkisp1_runtime_resume(struct device *dev)
if (ret)
return ret;

+ rkisp1->irqs_enabled = true;
+ /* Make sure the IRQ handler will see the above */
+ mb();
+
return 0;
}

diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
index dafbfd230542..d6b8786661ad 100644
--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
@@ -1082,6 +1082,9 @@ irqreturn_t rkisp1_isp_isr(int irq, void *ctx)
struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
u32 status, isp_err;

+ if (!rkisp1->irqs_enabled)
+ return IRQ_NONE;
+
status = rkisp1_read(rkisp1, RKISP1_CIF_ISP_MIS);
if (!status)
return IRQ_NONE;

--
2.34.1

2023-12-05 08:20:35

by Laurent Pinchart

[permalink] [raw]
Subject: Re: [PATCH 3/4] media: rkisp1: Fix IRQ handling due to shared interrupts

Hi Tomi,

Thank you for the patch.

On Tue, Dec 05, 2023 at 10:09:34AM +0200, Tomi Valkeinen wrote:
> The driver requests the interrupts as IRQF_SHARED, so the interrupt
> handlers can be called at any time. If such a call happens while the ISP
> is powered down, the SoC will hang as the driver tries to access the
> ISP registers.

Is IRQF_SHARED actually needed ?

> Fix this by adding a new field, 'irqs_enabled', which is used to bail
> out from the interrupt handler when the ISP is not operational.
>
> Signed-off-by: Tomi Valkeinen <[email protected]>
> ---
> .../media/platform/rockchip/rkisp1/rkisp1-capture.c | 3 +++
> .../media/platform/rockchip/rkisp1/rkisp1-common.h | 2 ++
> drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c | 3 +++
> drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 21 +++++++++++++++++++++
> drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c | 3 +++
> 5 files changed, 32 insertions(+)
>
> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
> index b50b044d22af..e92067897f28 100644
> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
> @@ -779,6 +779,9 @@ irqreturn_t rkisp1_capture_isr(int irq, void *ctx)
> unsigned int i;
> u32 status;
>
> + if (!rkisp1->irqs_enabled)
> + return IRQ_NONE;
> +
> status = rkisp1_read(rkisp1, RKISP1_CIF_MI_MIS);
> if (!status)
> return IRQ_NONE;
> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
> index ec28907d978e..7f97fdf6e24c 100644
> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
> @@ -465,6 +465,7 @@ struct rkisp1_debug {
> * @debug: debug params to be exposed on debugfs
> * @info: version-specific ISP information
> * @irqs: IRQ line numbers
> + * @irqs_enabled: the hardware is enabled and can cause interrupts
> */
> struct rkisp1_device {
> void __iomem *base_addr;
> @@ -488,6 +489,7 @@ struct rkisp1_device {
> struct rkisp1_debug debug;
> const struct rkisp1_info *info;
> int irqs[RKISP1_NUM_IRQS];
> + bool irqs_enabled;
> };
>
> /*
> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> index 47f4353a1784..f6b54654b435 100644
> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> @@ -184,6 +184,9 @@ irqreturn_t rkisp1_csi_isr(int irq, void *ctx)
> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
> u32 val, status;
>
> + if (!rkisp1->irqs_enabled)
> + return IRQ_NONE;
> +
> status = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_MIS);
> if (!status)
> return IRQ_NONE;
> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
> index 1d60f4b8bd09..fbe03f7864e3 100644
> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
> @@ -306,6 +306,23 @@ static int __maybe_unused rkisp1_runtime_suspend(struct device *dev)
> {
> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
>
> + rkisp1->irqs_enabled = false;
> + /* Make sure the IRQ handler will see the above */
> + mb();
> +
> + /*
> + * Wait until any running IRQ handler has returned. The IRQ handler
> + * may get called even after this (as it's a shared interrupt line)
> + * but the 'irqs_enabled' flag will make the handler return immediately.
> + */
> + for (unsigned int i = 0; i < RKISP1_NUM_IRQS; ++i) {
> + if (rkisp1->irqs[i] == -1)
> + continue;
> +
> + if (i == 0 || rkisp1->irqs[i - 1] != rkisp1->irqs[i])
> + synchronize_irq(rkisp1->irqs[i]);
> + }
> +
> clk_bulk_disable_unprepare(rkisp1->clk_size, rkisp1->clks);
> return pinctrl_pm_select_sleep_state(dev);
> }
> @@ -322,6 +339,10 @@ static int __maybe_unused rkisp1_runtime_resume(struct device *dev)
> if (ret)
> return ret;
>
> + rkisp1->irqs_enabled = true;
> + /* Make sure the IRQ handler will see the above */
> + mb();
> +
> return 0;
> }
>
> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> index dafbfd230542..d6b8786661ad 100644
> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> @@ -1082,6 +1082,9 @@ irqreturn_t rkisp1_isp_isr(int irq, void *ctx)
> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
> u32 status, isp_err;
>
> + if (!rkisp1->irqs_enabled)
> + return IRQ_NONE;
> +
> status = rkisp1_read(rkisp1, RKISP1_CIF_ISP_MIS);
> if (!status)
> return IRQ_NONE;

--
Regards,

Laurent Pinchart

2023-12-05 08:27:48

by Tomi Valkeinen

[permalink] [raw]
Subject: Re: [PATCH 3/4] media: rkisp1: Fix IRQ handling due to shared interrupts

On 05/12/2023 10:20, Laurent Pinchart wrote:
> Hi Tomi,
>
> Thank you for the patch.
>
> On Tue, Dec 05, 2023 at 10:09:34AM +0200, Tomi Valkeinen wrote:
>> The driver requests the interrupts as IRQF_SHARED, so the interrupt
>> handlers can be called at any time. If such a call happens while the ISP
>> is powered down, the SoC will hang as the driver tries to access the
>> ISP registers.
>
> Is IRQF_SHARED actually needed ?

I don't have any answer to that, but it seems to have always been there.
Dropping it would simplify the code, but we can only do that if we are
sure all the platforms the ISP is used on or will be used on won't share
the interrupt.

Tomi

>> Fix this by adding a new field, 'irqs_enabled', which is used to bail
>> out from the interrupt handler when the ISP is not operational.
>>
>> Signed-off-by: Tomi Valkeinen <[email protected]>
>> ---
>> .../media/platform/rockchip/rkisp1/rkisp1-capture.c | 3 +++
>> .../media/platform/rockchip/rkisp1/rkisp1-common.h | 2 ++
>> drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c | 3 +++
>> drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 21 +++++++++++++++++++++
>> drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c | 3 +++
>> 5 files changed, 32 insertions(+)
>>
>> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
>> index b50b044d22af..e92067897f28 100644
>> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
>> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
>> @@ -779,6 +779,9 @@ irqreturn_t rkisp1_capture_isr(int irq, void *ctx)
>> unsigned int i;
>> u32 status;
>>
>> + if (!rkisp1->irqs_enabled)
>> + return IRQ_NONE;
>> +
>> status = rkisp1_read(rkisp1, RKISP1_CIF_MI_MIS);
>> if (!status)
>> return IRQ_NONE;
>> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
>> index ec28907d978e..7f97fdf6e24c 100644
>> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
>> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
>> @@ -465,6 +465,7 @@ struct rkisp1_debug {
>> * @debug: debug params to be exposed on debugfs
>> * @info: version-specific ISP information
>> * @irqs: IRQ line numbers
>> + * @irqs_enabled: the hardware is enabled and can cause interrupts
>> */
>> struct rkisp1_device {
>> void __iomem *base_addr;
>> @@ -488,6 +489,7 @@ struct rkisp1_device {
>> struct rkisp1_debug debug;
>> const struct rkisp1_info *info;
>> int irqs[RKISP1_NUM_IRQS];
>> + bool irqs_enabled;
>> };
>>
>> /*
>> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
>> index 47f4353a1784..f6b54654b435 100644
>> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
>> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
>> @@ -184,6 +184,9 @@ irqreturn_t rkisp1_csi_isr(int irq, void *ctx)
>> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
>> u32 val, status;
>>
>> + if (!rkisp1->irqs_enabled)
>> + return IRQ_NONE;
>> +
>> status = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_MIS);
>> if (!status)
>> return IRQ_NONE;
>> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
>> index 1d60f4b8bd09..fbe03f7864e3 100644
>> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
>> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
>> @@ -306,6 +306,23 @@ static int __maybe_unused rkisp1_runtime_suspend(struct device *dev)
>> {
>> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
>>
>> + rkisp1->irqs_enabled = false;
>> + /* Make sure the IRQ handler will see the above */
>> + mb();
>> +
>> + /*
>> + * Wait until any running IRQ handler has returned. The IRQ handler
>> + * may get called even after this (as it's a shared interrupt line)
>> + * but the 'irqs_enabled' flag will make the handler return immediately.
>> + */
>> + for (unsigned int i = 0; i < RKISP1_NUM_IRQS; ++i) {
>> + if (rkisp1->irqs[i] == -1)
>> + continue;
>> +
>> + if (i == 0 || rkisp1->irqs[i - 1] != rkisp1->irqs[i])
>> + synchronize_irq(rkisp1->irqs[i]);
>> + }
>> +
>> clk_bulk_disable_unprepare(rkisp1->clk_size, rkisp1->clks);
>> return pinctrl_pm_select_sleep_state(dev);
>> }
>> @@ -322,6 +339,10 @@ static int __maybe_unused rkisp1_runtime_resume(struct device *dev)
>> if (ret)
>> return ret;
>>
>> + rkisp1->irqs_enabled = true;
>> + /* Make sure the IRQ handler will see the above */
>> + mb();
>> +
>> return 0;
>> }
>>
>> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
>> index dafbfd230542..d6b8786661ad 100644
>> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
>> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
>> @@ -1082,6 +1082,9 @@ irqreturn_t rkisp1_isp_isr(int irq, void *ctx)
>> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
>> u32 status, isp_err;
>>
>> + if (!rkisp1->irqs_enabled)
>> + return IRQ_NONE;
>> +
>> status = rkisp1_read(rkisp1, RKISP1_CIF_ISP_MIS);
>> if (!status)
>> return IRQ_NONE;
>

2023-12-05 11:50:10

by Adam Ford

[permalink] [raw]
Subject: Re: [PATCH 3/4] media: rkisp1: Fix IRQ handling due to shared interrupts

On Tue, Dec 5, 2023 at 2:27 AM Tomi Valkeinen
<[email protected]> wrote:
>
> On 05/12/2023 10:20, Laurent Pinchart wrote:
> > Hi Tomi,
> >
> > Thank you for the patch.
> >
> > On Tue, Dec 05, 2023 at 10:09:34AM +0200, Tomi Valkeinen wrote:
> >> The driver requests the interrupts as IRQF_SHARED, so the interrupt
> >> handlers can be called at any time. If such a call happens while the ISP
> >> is powered down, the SoC will hang as the driver tries to access the
> >> ISP registers.
> >
> > Is IRQF_SHARED actually needed ?
>
> I don't have any answer to that, but it seems to have always been there.
> Dropping it would simplify the code, but we can only do that if we are
> sure all the platforms the ISP is used on or will be used on won't share
> the interrupt.

I can't speak for the Rockchip, but from what I can see, the imx8mp
has multiple causes for Interrupt 74 and 75, but they all appear to
be ISP1 and ISP2 related.

adam
>
> Tomi
>
> >> Fix this by adding a new field, 'irqs_enabled', which is used to bail
> >> out from the interrupt handler when the ISP is not operational.
> >>
> >> Signed-off-by: Tomi Valkeinen <[email protected]>
> >> ---
> >> .../media/platform/rockchip/rkisp1/rkisp1-capture.c | 3 +++
> >> .../media/platform/rockchip/rkisp1/rkisp1-common.h | 2 ++
> >> drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c | 3 +++
> >> drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 21 +++++++++++++++++++++
> >> drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c | 3 +++
> >> 5 files changed, 32 insertions(+)
> >>
> >> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
> >> index b50b044d22af..e92067897f28 100644
> >> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
> >> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
> >> @@ -779,6 +779,9 @@ irqreturn_t rkisp1_capture_isr(int irq, void *ctx)
> >> unsigned int i;
> >> u32 status;
> >>
> >> + if (!rkisp1->irqs_enabled)
> >> + return IRQ_NONE;
> >> +
> >> status = rkisp1_read(rkisp1, RKISP1_CIF_MI_MIS);
> >> if (!status)
> >> return IRQ_NONE;
> >> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
> >> index ec28907d978e..7f97fdf6e24c 100644
> >> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
> >> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
> >> @@ -465,6 +465,7 @@ struct rkisp1_debug {
> >> * @debug: debug params to be exposed on debugfs
> >> * @info: version-specific ISP information
> >> * @irqs: IRQ line numbers
> >> + * @irqs_enabled: the hardware is enabled and can cause interrupts
> >> */
> >> struct rkisp1_device {
> >> void __iomem *base_addr;
> >> @@ -488,6 +489,7 @@ struct rkisp1_device {
> >> struct rkisp1_debug debug;
> >> const struct rkisp1_info *info;
> >> int irqs[RKISP1_NUM_IRQS];
> >> + bool irqs_enabled;
> >> };
> >>
> >> /*
> >> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> >> index 47f4353a1784..f6b54654b435 100644
> >> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> >> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> >> @@ -184,6 +184,9 @@ irqreturn_t rkisp1_csi_isr(int irq, void *ctx)
> >> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
> >> u32 val, status;
> >>
> >> + if (!rkisp1->irqs_enabled)
> >> + return IRQ_NONE;
> >> +
> >> status = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_MIS);
> >> if (!status)
> >> return IRQ_NONE;
> >> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
> >> index 1d60f4b8bd09..fbe03f7864e3 100644
> >> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
> >> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
> >> @@ -306,6 +306,23 @@ static int __maybe_unused rkisp1_runtime_suspend(struct device *dev)
> >> {
> >> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
> >>
> >> + rkisp1->irqs_enabled = false;
> >> + /* Make sure the IRQ handler will see the above */
> >> + mb();
> >> +
> >> + /*
> >> + * Wait until any running IRQ handler has returned. The IRQ handler
> >> + * may get called even after this (as it's a shared interrupt line)
> >> + * but the 'irqs_enabled' flag will make the handler return immediately.
> >> + */
> >> + for (unsigned int i = 0; i < RKISP1_NUM_IRQS; ++i) {
> >> + if (rkisp1->irqs[i] == -1)
> >> + continue;
> >> +
> >> + if (i == 0 || rkisp1->irqs[i - 1] != rkisp1->irqs[i])
> >> + synchronize_irq(rkisp1->irqs[i]);
> >> + }
> >> +
> >> clk_bulk_disable_unprepare(rkisp1->clk_size, rkisp1->clks);
> >> return pinctrl_pm_select_sleep_state(dev);
> >> }
> >> @@ -322,6 +339,10 @@ static int __maybe_unused rkisp1_runtime_resume(struct device *dev)
> >> if (ret)
> >> return ret;
> >>
> >> + rkisp1->irqs_enabled = true;
> >> + /* Make sure the IRQ handler will see the above */
> >> + mb();
> >> +
> >> return 0;
> >> }
> >>
> >> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> >> index dafbfd230542..d6b8786661ad 100644
> >> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> >> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> >> @@ -1082,6 +1082,9 @@ irqreturn_t rkisp1_isp_isr(int irq, void *ctx)
> >> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
> >> u32 status, isp_err;
> >>
> >> + if (!rkisp1->irqs_enabled)
> >> + return IRQ_NONE;
> >> +
> >> status = rkisp1_read(rkisp1, RKISP1_CIF_ISP_MIS);
> >> if (!status)
> >> return IRQ_NONE;
> >
>

2023-12-05 12:02:21

by Laurent Pinchart

[permalink] [raw]
Subject: Re: [PATCH 3/4] media: rkisp1: Fix IRQ handling due to shared interrupts

On Tue, Dec 05, 2023 at 05:49:30AM -0600, Adam Ford wrote:
> On Tue, Dec 5, 2023 at 2:27 AM Tomi Valkeinen wrote:
> > On 05/12/2023 10:20, Laurent Pinchart wrote:
> > > On Tue, Dec 05, 2023 at 10:09:34AM +0200, Tomi Valkeinen wrote:
> > >> The driver requests the interrupts as IRQF_SHARED, so the interrupt
> > >> handlers can be called at any time. If such a call happens while the ISP
> > >> is powered down, the SoC will hang as the driver tries to access the
> > >> ISP registers.
> > >
> > > Is IRQF_SHARED actually needed ?
> >
> > I don't have any answer to that, but it seems to have always been there.
> > Dropping it would simplify the code, but we can only do that if we are
> > sure all the platforms the ISP is used on or will be used on won't share
> > the interrupt.
>
> I can't speak for the Rockchip, but from what I can see, the imx8mp
> has multiple causes for Interrupt 74 and 75, but they all appear to
> be ISP1 and ISP2 related.

The ISP has multiple interrupt lines. In some SoCs, they're all wired to
a single line of the IRQ controller (e.g. RK3399 and i.MX8MP), while
other SoCs use separate interrupts (e.g. PX30). I have checked the PX30,
RK3399 and i.MX8MP datasheets, and the ISP interrupts are not shared
with any other peripheral. I think it's thus safe to drop IRQF_SHARED.

> > >> Fix this by adding a new field, 'irqs_enabled', which is used to bail
> > >> out from the interrupt handler when the ISP is not operational.
> > >>
> > >> Signed-off-by: Tomi Valkeinen <[email protected]>
> > >> ---
> > >> .../media/platform/rockchip/rkisp1/rkisp1-capture.c | 3 +++
> > >> .../media/platform/rockchip/rkisp1/rkisp1-common.h | 2 ++
> > >> drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c | 3 +++
> > >> drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 21 +++++++++++++++++++++
> > >> drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c | 3 +++
> > >> 5 files changed, 32 insertions(+)
> > >>
> > >> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
> > >> index b50b044d22af..e92067897f28 100644
> > >> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
> > >> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-capture.c
> > >> @@ -779,6 +779,9 @@ irqreturn_t rkisp1_capture_isr(int irq, void *ctx)
> > >> unsigned int i;
> > >> u32 status;
> > >>
> > >> + if (!rkisp1->irqs_enabled)
> > >> + return IRQ_NONE;
> > >> +
> > >> status = rkisp1_read(rkisp1, RKISP1_CIF_MI_MIS);
> > >> if (!status)
> > >> return IRQ_NONE;
> > >> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
> > >> index ec28907d978e..7f97fdf6e24c 100644
> > >> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
> > >> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-common.h
> > >> @@ -465,6 +465,7 @@ struct rkisp1_debug {
> > >> * @debug: debug params to be exposed on debugfs
> > >> * @info: version-specific ISP information
> > >> * @irqs: IRQ line numbers
> > >> + * @irqs_enabled: the hardware is enabled and can cause interrupts
> > >> */
> > >> struct rkisp1_device {
> > >> void __iomem *base_addr;
> > >> @@ -488,6 +489,7 @@ struct rkisp1_device {
> > >> struct rkisp1_debug debug;
> > >> const struct rkisp1_info *info;
> > >> int irqs[RKISP1_NUM_IRQS];
> > >> + bool irqs_enabled;
> > >> };
> > >>
> > >> /*
> > >> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> > >> index 47f4353a1784..f6b54654b435 100644
> > >> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> > >> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> > >> @@ -184,6 +184,9 @@ irqreturn_t rkisp1_csi_isr(int irq, void *ctx)
> > >> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
> > >> u32 val, status;
> > >>
> > >> + if (!rkisp1->irqs_enabled)
> > >> + return IRQ_NONE;
> > >> +
> > >> status = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_MIS);
> > >> if (!status)
> > >> return IRQ_NONE;
> > >> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
> > >> index 1d60f4b8bd09..fbe03f7864e3 100644
> > >> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
> > >> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
> > >> @@ -306,6 +306,23 @@ static int __maybe_unused rkisp1_runtime_suspend(struct device *dev)
> > >> {
> > >> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
> > >>
> > >> + rkisp1->irqs_enabled = false;
> > >> + /* Make sure the IRQ handler will see the above */
> > >> + mb();
> > >> +
> > >> + /*
> > >> + * Wait until any running IRQ handler has returned. The IRQ handler
> > >> + * may get called even after this (as it's a shared interrupt line)
> > >> + * but the 'irqs_enabled' flag will make the handler return immediately.
> > >> + */
> > >> + for (unsigned int i = 0; i < RKISP1_NUM_IRQS; ++i) {
> > >> + if (rkisp1->irqs[i] == -1)
> > >> + continue;
> > >> +
> > >> + if (i == 0 || rkisp1->irqs[i - 1] != rkisp1->irqs[i])
> > >> + synchronize_irq(rkisp1->irqs[i]);
> > >> + }
> > >> +
> > >> clk_bulk_disable_unprepare(rkisp1->clk_size, rkisp1->clks);
> > >> return pinctrl_pm_select_sleep_state(dev);
> > >> }
> > >> @@ -322,6 +339,10 @@ static int __maybe_unused rkisp1_runtime_resume(struct device *dev)
> > >> if (ret)
> > >> return ret;
> > >>
> > >> + rkisp1->irqs_enabled = true;
> > >> + /* Make sure the IRQ handler will see the above */
> > >> + mb();
> > >> +
> > >> return 0;
> > >> }
> > >>
> > >> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> > >> index dafbfd230542..d6b8786661ad 100644
> > >> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> > >> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> > >> @@ -1082,6 +1082,9 @@ irqreturn_t rkisp1_isp_isr(int irq, void *ctx)
> > >> struct rkisp1_device *rkisp1 = dev_get_drvdata(dev);
> > >> u32 status, isp_err;
> > >>
> > >> + if (!rkisp1->irqs_enabled)
> > >> + return IRQ_NONE;
> > >> +
> > >> status = rkisp1_read(rkisp1, RKISP1_CIF_ISP_MIS);
> > >> if (!status)
> > >> return IRQ_NONE;

--
Regards,

Laurent Pinchart

2023-12-05 12:14:12

by Laurent Pinchart

[permalink] [raw]
Subject: Re: [PATCH 4/4] media: rkisp1: Fix IRQ disable race issue

Hi Tomi,

Thank you for the patch.

On Tue, Dec 05, 2023 at 10:09:35AM +0200, Tomi Valkeinen wrote:
> In rkisp1_isp_stop() and rkisp1_csi_disable() the driver masks the
> interrupts and then apparently assumes that the interrupt handler won't
> be running, and proceeds in the stop procedure. This is not the case, as
> the interrupt handler can already be running, which would lead to the
> ISP being disabled while the interrupt handler handling a captured
> frame.
>
> It is not clear to me if this problem causes a real issue, but shutting
> down the ISP while an interrupt handler is running sounds rather bad.

Agreed.

> Signed-off-by: Tomi Valkeinen <[email protected]>
> ---
> drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c | 14 +++++++++++++-
> drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c | 20 +++++++++++++++++---
> 2 files changed, 30 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> index f6b54654b435..f0cef766fc0c 100644
> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
> @@ -125,8 +125,20 @@ static void rkisp1_csi_disable(struct rkisp1_csi *csi)
> struct rkisp1_device *rkisp1 = csi->rkisp1;
> u32 val;
>
> - /* Mask and clear interrupts. */
> + /* Mask MIPI interrupts. */
> rkisp1_write(rkisp1, RKISP1_CIF_MIPI_IMSC, 0);
> +
> + /* Flush posted writes */
> + rkisp1_read(rkisp1, RKISP1_CIF_MIPI_IMSC);
> +
> + /*
> + * Wait until the IRQ handler has ended. The IRQ handler may get called
> + * even after this, but it will return immediately as the MIPI
> + * interrupts have been masked.
> + */

This comment will need to be updated if patch 3/4 gets replaced by a
patch that drops IRQF_SHARED.

> + synchronize_irq(rkisp1->irqs[RKISP1_IRQ_MIPI]);
> +
> + /* Clear MIPI interrupt status */
> rkisp1_write(rkisp1, RKISP1_CIF_MIPI_ICR, ~0);
>
> val = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_CTRL);
> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> index d6b8786661ad..a6dd497c884c 100644
> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
> @@ -364,11 +364,25 @@ static void rkisp1_isp_stop(struct rkisp1_isp *isp)
> * ISP(mi) stop in mi frame end -> Stop ISP(mipi) ->
> * Stop ISP(isp) ->wait for ISP isp off
> */
> - /* stop and clear MI and ISP interrupts */
> - rkisp1_write(rkisp1, RKISP1_CIF_ISP_IMSC, 0);
> - rkisp1_write(rkisp1, RKISP1_CIF_ISP_ICR, ~0);
>
> + /* Mask MI and ISP interrupts */
> + rkisp1_write(rkisp1, RKISP1_CIF_ISP_IMSC, 0);
> rkisp1_write(rkisp1, RKISP1_CIF_MI_IMSC, 0);
> +
> + /* Flush posted writes */
> + rkisp1_read(rkisp1, RKISP1_CIF_MI_IMSC);
> +
> + /*
> + * Wait until the IRQ handler has ended. The IRQ handler may get called
> + * even after this, but it will return immediately as the MI and ISP
> + * interrupts have been masked.
> + */

Same here.

> + synchronize_irq(rkisp1->irqs[RKISP1_IRQ_ISP]);
> + if (rkisp1->irqs[RKISP1_IRQ_ISP] != rkisp1->irqs[RKISP1_IRQ_MI])
> + synchronize_irq(rkisp1->irqs[RKISP1_IRQ_MI]);

It would be nice if we could avoid the double synchronize_irq() for
platforms where RKISP1_IRQ_MIPI and RKISP1_IRQ_ISP are identical, but I
understand that would be difficult.

> +
> + /* Clear MI and ISP interrupt status */
> + rkisp1_write(rkisp1, RKISP1_CIF_ISP_ICR, ~0);
> rkisp1_write(rkisp1, RKISP1_CIF_MI_ICR, ~0);
>
> /* stop ISP */

--
Regards,

Laurent Pinchart

2023-12-06 10:08:37

by Tomi Valkeinen

[permalink] [raw]
Subject: Re: [PATCH 4/4] media: rkisp1: Fix IRQ disable race issue

On 05/12/2023 14:13, Laurent Pinchart wrote:
> Hi Tomi,
>
> Thank you for the patch.
>
> On Tue, Dec 05, 2023 at 10:09:35AM +0200, Tomi Valkeinen wrote:
>> In rkisp1_isp_stop() and rkisp1_csi_disable() the driver masks the
>> interrupts and then apparently assumes that the interrupt handler won't
>> be running, and proceeds in the stop procedure. This is not the case, as
>> the interrupt handler can already be running, which would lead to the
>> ISP being disabled while the interrupt handler handling a captured
>> frame.
>>
>> It is not clear to me if this problem causes a real issue, but shutting
>> down the ISP while an interrupt handler is running sounds rather bad.
>
> Agreed.
>
>> Signed-off-by: Tomi Valkeinen <[email protected]>
>> ---
>> drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c | 14 +++++++++++++-
>> drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c | 20 +++++++++++++++++---
>> 2 files changed, 30 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
>> index f6b54654b435..f0cef766fc0c 100644
>> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
>> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c
>> @@ -125,8 +125,20 @@ static void rkisp1_csi_disable(struct rkisp1_csi *csi)
>> struct rkisp1_device *rkisp1 = csi->rkisp1;
>> u32 val;
>>
>> - /* Mask and clear interrupts. */
>> + /* Mask MIPI interrupts. */
>> rkisp1_write(rkisp1, RKISP1_CIF_MIPI_IMSC, 0);
>> +
>> + /* Flush posted writes */
>> + rkisp1_read(rkisp1, RKISP1_CIF_MIPI_IMSC);
>> +
>> + /*
>> + * Wait until the IRQ handler has ended. The IRQ handler may get called
>> + * even after this, but it will return immediately as the MIPI
>> + * interrupts have been masked.
>> + */
>
> This comment will need to be updated if patch 3/4 gets replaced by a
> patch that drops IRQF_SHARED.

I don't think it needs an update, as the irq handling is divided into
multiple parts. The handler here may get called due to a MI or ISP
interrupt, and vice versa.

Tomi

>
>> + synchronize_irq(rkisp1->irqs[RKISP1_IRQ_MIPI]);
>> +
>> + /* Clear MIPI interrupt status */
>> rkisp1_write(rkisp1, RKISP1_CIF_MIPI_ICR, ~0);
>>
>> val = rkisp1_read(rkisp1, RKISP1_CIF_MIPI_CTRL);
>> diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
>> index d6b8786661ad..a6dd497c884c 100644
>> --- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
>> +++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
>> @@ -364,11 +364,25 @@ static void rkisp1_isp_stop(struct rkisp1_isp *isp)
>> * ISP(mi) stop in mi frame end -> Stop ISP(mipi) ->
>> * Stop ISP(isp) ->wait for ISP isp off
>> */
>> - /* stop and clear MI and ISP interrupts */
>> - rkisp1_write(rkisp1, RKISP1_CIF_ISP_IMSC, 0);
>> - rkisp1_write(rkisp1, RKISP1_CIF_ISP_ICR, ~0);
>>
>> + /* Mask MI and ISP interrupts */
>> + rkisp1_write(rkisp1, RKISP1_CIF_ISP_IMSC, 0);
>> rkisp1_write(rkisp1, RKISP1_CIF_MI_IMSC, 0);
>> +
>> + /* Flush posted writes */
>> + rkisp1_read(rkisp1, RKISP1_CIF_MI_IMSC);
>> +
>> + /*
>> + * Wait until the IRQ handler has ended. The IRQ handler may get called
>> + * even after this, but it will return immediately as the MI and ISP
>> + * interrupts have been masked.
>> + */
>
> Same here.
>
>> + synchronize_irq(rkisp1->irqs[RKISP1_IRQ_ISP]);
>> + if (rkisp1->irqs[RKISP1_IRQ_ISP] != rkisp1->irqs[RKISP1_IRQ_MI])
>> + synchronize_irq(rkisp1->irqs[RKISP1_IRQ_MI]);
>
> It would be nice if we could avoid the double synchronize_irq() for
> platforms where RKISP1_IRQ_MIPI and RKISP1_IRQ_ISP are identical, but I
> understand that would be difficult.
>
>> +
>> + /* Clear MI and ISP interrupt status */
>> + rkisp1_write(rkisp1, RKISP1_CIF_ISP_ICR, ~0);
>> rkisp1_write(rkisp1, RKISP1_CIF_MI_ICR, ~0);
>>
>> /* stop ISP */
>