[PATCH 2/2] media: qcom: camss: vfe-17x: silence wm-done IRQ on unmapped WMs

[Herman van Hazendonk <github.com@herrie.org>]

vfe_isr_wm_done() handles the per-write-master "frame complete" IRQ.
On VFE 1.7x configurations where a Write Master is allocated to a
secondary purpose (e.g. statistics or DMI buffers) it is not mapped
to any output line, so vfe->wm_output_map[wm] is VFE_LINE_NONE.

Today the function takes the output spinlock first and only then
checks for VFE_LINE_NONE, emitting a rate-limited "Received wm done
for unmapped index" error each time. The error is harmless but it
spams dmesg when a stats path is configured.

Move the VFE_LINE_NONE test in front of the spinlock and return
silently: an unmapped WM simply has nothing to deliver to userspace.
While at it, hoist the wm_output_map[] dereference into a local for
readability.

No functional change for mapped Write Masters.

Signed-off-by: Herman van Hazendonk <github.com@herrie.org>
---
 .../media/platform/qcom/camss/camss-vfe-17x.c | 29 ++++++++++++++-----
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/drivers/media/platform/qcom/camss/camss-vfe-17x.c b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
index 3ad0c3be005f..f639ac02410b 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-17x.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-17x.c
@@ -507,21 +507,36 @@ static void vfe_isr_reg_update(struct vfe_device *vfe, enum vfe_line_id line_id)
  */
 static void vfe_isr_wm_done(struct vfe_device *vfe, u8 wm)
 {
-	struct vfe_line *line = &vfe->line[vfe->wm_output_map[wm]];
+	struct vfe_line *line;
 	struct camss_buffer *ready_buf;
 	struct vfe_output *output;
 	unsigned long flags;
+	int wm_output;
 	u32 index;
 	u64 ts = ktime_get_ns();
 
+	/*
+	 * Some VFE modes route data to secondary WMs that aren't mapped
+	 * to output lines. Silently ignore their IRQs.
+	 *
+	 * vfe->wm_output_map[wm] is written from the stream stop/start
+	 * paths under output_lock held as a mutex; this ISR runs in
+	 * atomic context and cannot take it. Snapshot the value once
+	 * with READ_ONCE() so the check below and the array index that
+	 * follows operate on the same value: otherwise a concurrent
+	 * write of VFE_LINE_NONE (-1) between the two loads would let
+	 * the function pass the check and then dereference
+	 * &vfe->line[-1].
+	 */
+	wm_output = READ_ONCE(vfe->wm_output_map[wm]);
+	if (wm_output == VFE_LINE_NONE)
+		return;
+
+	line = &vfe->line[wm_output];
+
 	spin_lock_irqsave(&vfe->output_lock, flags);
 
-	if (vfe->wm_output_map[wm] == VFE_LINE_NONE) {
-		dev_err_ratelimited(vfe->camss->dev,
-				    "Received wm done for unmapped index\n");
-		goto out_unlock;
-	}
-	output = &vfe->line[vfe->wm_output_map[wm]].output;
+	output = &line->output;
 
 	ready_buf = output->buf[0];
 	if (!ready_buf) {
-- 
2.43.0