linux-kernel - Re: [PATCH 2/3] media: rzg2l-cru: Use only frame end interrupts for DMA stopping state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aYn3UZ-O4HNc4lvY@zed>
Date: Mon, 9 Feb 2026 16:13:26 +0100
From: Jacopo Mondi <jacopo.mondi@...asonboard.com>
To: Tommaso Merciai <tommaso.merciai.xr@...renesas.com>
Cc: tomm.merciai@...il.com, linux-renesas-soc@...r.kernel.org, 
	biju.das.jz@...renesas.com, Mauro Carvalho Chehab <mchehab@...nel.org>, 
	Laurent Pinchart <laurent.pinchart+renesas@...asonboard.com>, Hans Verkuil <hverkuil@...nel.org>, 
	Lad Prabhakar <prabhakar.mahadev-lad.rj@...renesas.com>, Daniel Scally <dan.scally+renesas@...asonboard.com>, 
	Jacopo Mondi <jacopo.mondi@...asonboard.com>, linux-media@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/3] media: rzg2l-cru: Use only frame end interrupts for
 DMA stopping state

Hi Tommaso

On Tue, Dec 30, 2025 at 06:09:16PM +0100, Tommaso Merciai wrote:
> On RZ/G3E the CRU driver relies on frame end interrupts to detect the
> completion of an active frame when stopping DMA.

Why do you think it does so ?

I read in rzg2l_cru_stop_image_processing()

	/* Stop the operation of image conversion */
	rzg2l_cru_write(cru, ICnEN, 0);

	/* Wait for streaming to stop */
	while ((rzg2l_cru_read(cru, ICnMS) & ICnMS_IA) && retries++ < RZG2L_RETRIES) {
		spin_unlock_irqrestore(&cru->qlock, flags);
		msleep(RZG2L_TIMEOUT_MS);
		spin_lock_irqsave(&cru->qlock, flags);
	}

Which seems to suggest the driver is polling a register to detect when
the Image Converter is still processing data or not.

>
> Update the driver to enable only frame end interrupts (CRUnIE2_FExE),
> dropping the use of frame start interrupts, which are not required for
> this flow.

This might be ok, but I don't think it's related to to detecting when
the DMA has actually stopped.

>
> Fix the interrupt status handling in the DMA stopping state by checking
> the correct frame end status bits (FExS) instead of the frame start ones
> (FSxS). Add a dedicated CRUnINTS2_FExS() macro to reflect the actual
> register bit layout.
>
> This ensures that DMA stopping is triggered by the intended frame end
> events and avoids incorrect interrupt handling.

I don't see where the frame end interrupt triggers the DMA stopping,
sorry

>
> Signed-off-by: Tommaso Merciai <tommaso.merciai.xr@...renesas.com>
> ---
>  .../media/platform/renesas/rzg2l-cru/rzg2l-cru-regs.h    | 1 +
>  drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c   | 9 ++++-----
>  2 files changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-cru-regs.h b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-cru-regs.h
> index a5a57369ef0e..102a2fec5037 100644
> --- a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-cru-regs.h
> +++ b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-cru-regs.h
> @@ -19,6 +19,7 @@
>
>  #define CRUnINTS_SFS			BIT(16)
>
> +#define CRUnINTS2_FExS(x)		BIT(((x) * 3) + 1)
>  #define CRUnINTS2_FSxS(x)		BIT(((x) * 3))
>
>  #define CRUnRST_VRESETN			BIT(0)
> diff --git a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> index 480e9b5dbcfe..34e74e5796e8 100644
> --- a/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> +++ b/drivers/media/platform/renesas/rzg2l-cru/rzg2l-video.c
> @@ -437,7 +437,6 @@ static int rzg2l_cru_get_virtual_channel(struct rzg2l_cru_dev *cru)
>
>  void rzg3e_cru_enable_interrupts(struct rzg2l_cru_dev *cru)
>  {
> -	rzg2l_cru_write(cru, CRUnIE2, CRUnIE2_FSxE(cru->svc_channel));
>  	rzg2l_cru_write(cru, CRUnIE2, CRUnIE2_FExE(cru->svc_channel));
>  }
>
> @@ -697,10 +696,10 @@ irqreturn_t rzg3e_cru_irq(int irq, void *data)
>  		}
>
>  		if (cru->state == RZG2L_CRU_DMA_STOPPING) {
> -			if (irq_status & CRUnINTS2_FSxS(0) ||
> -			    irq_status & CRUnINTS2_FSxS(1) ||
> -			    irq_status & CRUnINTS2_FSxS(2) ||
> -			    irq_status & CRUnINTS2_FSxS(3))
> +			if (irq_status & CRUnINTS2_FExS(0) ||
> +			    irq_status & CRUnINTS2_FExS(1) ||
> +			    irq_status & CRUnINTS2_FExS(2) ||
> +			    irq_status & CRUnINTS2_FExS(3))

As the cru->state flag is accessed and set to RZG2L_CRU_DMA_STOPPING
without any lock and concurrently inspected by the IRQ handler, I guess
litterally anything can happen. Which makes me wonder
1) is the STOPPING condition useful at all
2) what is the purpose of this error detection

Thanks
  j

>  				dev_dbg(cru->dev, "IRQ while state stopping\n");
>  			return IRQ_HANDLED;
>  		}
> --
> 2.43.0
>