[PATCH 6.1 032/481] media: camss: vfe-480: Multiple outputs support for SM8250

Greg Kroah-Hartman
2026-03-23T15:24:42Z

6.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Milen Mitkov <quic_mmitkov@quicinc.com>

[ Upstream commit 1c4abf0246d2ad5fabc830f1d9cc3944d5a4ae95 ]

On SM8250 each VFE supports at least 3 RDI channels, or 4
in case of VFE-Lite, so add appropriate IRQ setup and handling.

Signed-off-by: Milen Mitkov <quic_mmitkov@quicinc.com>
Reviewed-by: Robert Foss <robert.foss@linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Acked-by: Robert Foss <robert.foss@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Stable-dep-of: d965919af524 ("media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/qcom/camss/camss-vfe-480.c | 57 ++++++++++++-------
1 file changed, 38 insertions(+), 19 deletions(-)

diff --git a/drivers/media/platform/qcom/camss/camss-vfe-480.c b/drivers/media/platform/qcom/camss/camss-vfe-480.c
index 72f5cfeeb49bf..0063e36a30e05 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe-480.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe-480.c
@@ -93,6 +93,8 @@ static inline int bus_irq_mask_0_comp_done(struct vfe_device *vfe, int n)
#define RDI_WM(n) ((IS_LITE ? 0 : 23) + (n))
#define RDI_COMP_GROUP(n) ((IS_LITE ? 0 : 11) + (n))

+#define MAX_VFE_OUTPUT_LINES 4
+
static u32 vfe_hw_version(struct vfe_device *vfe)
{
u32 hw_version = readl_relaxed(vfe->base + VFE_HW_VERSION);
@@ -170,12 +172,26 @@ static inline void vfe_reg_update_clear(struct vfe_device *vfe,

static void vfe_enable_irq_common(struct vfe_device *vfe)
{
- /* enable only the IRQs used: rup and comp_done irqs for RDI0 */
+ /* enable reset ack IRQ and top BUS status IRQ */
writel_relaxed(IRQ_MASK_0_RESET_ACK | IRQ_MASK_0_BUS_TOP_IRQ,
vfe->base + VFE_IRQ_MASK(0));
- writel_relaxed(BUS_IRQ_MASK_0_RDI_RUP(vfe, 0) |
- BUS_IRQ_MASK_0_COMP_DONE(vfe, RDI_COMP_GROUP(0)),
- vfe->base + VFE_BUS_IRQ_MASK(0));
+}
+
+static void vfe_enable_lines_irq(struct vfe_device *vfe)
+{
+ int i;
+ u32 bus_irq_mask = 0;
+
+ for (i = 0; i < MAX_VFE_OUTPUT_LINES; i++) {
+ /* Enable IRQ for newly added lines, but also keep already running lines's IRQ */
+ if (vfe->line[i].output.state == VFE_OUTPUT_RESERVED ||
+ vfe->line[i].output.state == VFE_OUTPUT_ON) {
+ bus_irq_mask |= BUS_IRQ_MASK_0_RDI_RUP(vfe, i)
+ | BUS_IRQ_MASK_0_COMP_DONE(vfe, RDI_COMP_GROUP(i));
+ }
+ }
+
+ writel_relaxed(bus_irq_mask, vfe->base + VFE_BUS_IRQ_MASK(0));
}

static void vfe_isr_reg_update(struct vfe_device *vfe, enum vfe_line_id line_id);
@@ -192,6 +208,7 @@ static irqreturn_t vfe_isr(int irq, void *dev)
{
struct vfe_device *vfe = dev;
u32 status;
+ int i;

status = readl_relaxed(vfe->base + VFE_IRQ_STATUS(0));
writel_relaxed(status, vfe->base + VFE_IRQ_CLEAR(0));
@@ -206,11 +223,14 @@ static irqreturn_t vfe_isr(int irq, void *dev)
writel_relaxed(status, vfe->base + VFE_BUS_IRQ_CLEAR(0));
writel_relaxed(1, vfe->base + VFE_BUS_IRQ_CLEAR_GLOBAL);

- if (status & BUS_IRQ_MASK_0_RDI_RUP(vfe, 0))
- vfe_isr_reg_update(vfe, 0);
+ /* Loop through all WMs IRQs */
+ for (i = 0; i < MSM_VFE_IMAGE_MASTERS_NUM; i++) {
+ if (status & BUS_IRQ_MASK_0_RDI_RUP(vfe, i))
+ vfe_isr_reg_update(vfe, i);

- if (status & BUS_IRQ_MASK_0_COMP_DONE(vfe, RDI_COMP_GROUP(0)))
- vfe_isr_wm_done(vfe, 0);
+ if (status & BUS_IRQ_MASK_0_COMP_DONE(vfe, RDI_COMP_GROUP(i)))
+ vfe_isr_wm_done(vfe, i);
+ }
}

return IRQ_HANDLED;
@@ -233,7 +253,6 @@ static int vfe_get_output(struct vfe_line *line)
struct vfe_device *vfe = to_vfe(line);
struct vfe_output *output;
unsigned long flags;
- int wm_idx;

spin_lock_irqsave(&vfe->output_lock, flags);

@@ -245,12 +264,12 @@ static int vfe_get_output(struct vfe_line *line)

output->wm_num = 1;

- wm_idx = vfe_reserve_wm(vfe, line->id);
- if (wm_idx < 0) {
- dev_err(vfe->camss->dev, "Can not reserve wm\n");
- goto error_get_wm;
- }
- output->wm_idx[0] = wm_idx;
+ /* Correspondence between VFE line number and WM number.
+ * line 0 -> RDI 0, line 1 -> RDI1, line 2 -> RDI2, line 3 -> PIX/RDI3
+ * Note this 1:1 mapping will not work for PIX streams.
+ */
+ output->wm_idx[0] = line->id;
+ vfe->wm_output_map[line->id] = line->id;

output->drop_update_idx = 0;

@@ -258,11 +277,9 @@ static int vfe_get_output(struct vfe_line *line)

return 0;

-error_get_wm:
- vfe_release_wm(vfe, output->wm_idx[0]);
- output->state = VFE_OUTPUT_OFF;
error:
spin_unlock_irqrestore(&vfe->output_lock, flags);
+ output->state = VFE_OUTPUT_OFF;

return -EINVAL;
}
@@ -344,6 +361,8 @@ static int vfe_enable(struct vfe_line *line)

vfe->stream_count++;

+ vfe_enable_lines_irq(vfe);
+
mutex_unlock(&vfe->stream_lock);

ret = vfe_get_output(line);
@@ -550,7 +569,7 @@ static const struct camss_video_ops vfe_video_ops_480 = {
static void vfe_subdev_init(struct device *dev, struct vfe_device *vfe)
{
vfe->video_ops = vfe_video_ops_480;
- vfe->line_num = 1;
+ vfe->line_num = MAX_VFE_OUTPUT_LINES;
}

const struct vfe_hw_ops vfe_ops_480 = {
--
2.51.0