linux
linux copied to clipboard
raspberrypi
vc_sm_cma: lockdep warnings while capturing from camera
Describe the bug
dmabuf related lockdep warnings are emitted while capturing using libcamera
Steps to reproduce the behaviour
- enable lockdep in the kernel
- start
cam -c1 -C(or similar) - observe the lockdep warnings in
dma_buf_{un,}map_attachment()
Device (s)
Raspberry Pi 4 Mod. B
System
-
Linux <hostname> 6.15.0-rc3-v8+ #2 SMP PREEMPT Thu Apr 24 18:47:39 CEST 2025 aarch64 GNU/Linux - rpi camera module 3 (imx708)
Logs
[ 93.311225] ------------[ cut here ]------------
[ 93.311240] WARNING: CPU: 1 PID: 325 at drivers/dma-buf/dma-buf.c:1125 dma_buf_map_attachment+0x94/0x160
[ 93.325350] Modules linked in: vc4 snd_soc_hdmi_codec drm_exec drm_display_helper cec dw9807_vcm imx708 drm_client_lib drm_dma_helper v3d snd_soc_core bcm2835_codec(C) gpu_sched snd_compress bcm2835_v4l2(C) b
cm2835_isp(C) bcm2835_unicam_legacy drm_shmem_helper brcmfmac rpi_hevc_dec bcm2835_mmal_vchiq(C) drm_kms_helper v4l2_dv_timings snd_pcm_dmaengine snd_bcm2835(C) v4l2_fwnode drm v4l2_mem2mem vc_sm_cma(C) videobuf
2_vmalloc snd_pcm brcmutil v4l2_async videobuf2_dma_contig videobuf2_memops videobuf2_v4l2 i2c_mux_pinctrl drm_panel_orientation_quirks raspberrypi_hwmon videodev snd_timer i2c_mux cfg80211 i2c_brcmstb snd i2c_b
cm2835 videobuf2_common backlight rfkill raspberrypi_gpiomem mc nvmem_rmem uio_pdrv_genirq uio sch_fq_codel fuse nfnetlink ipv6
[ 93.391721] CPU: 1 UID: 0 PID: 325 Comm: cam Tainted: G WC 6.15.0-rc3-v8+ #2 PREEMPT
[ 93.400939] Tainted: [W]=WARN, [C]=CRAP
[ 93.404767] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[ 93.410593] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 93.417549] pc : dma_buf_map_attachment+0x94/0x160
[ 93.422338] lr : dma_buf_map_attachment+0x90/0x160
[ 93.427125] sp : ffff80008152b8d0
[ 93.430432] x29: ffff80008152b8d0 x28: ffff5e7a086157f0 x27: ffff80008152bc08
[ 93.437570] x26: ffffc3af18a34000 x25: 00000000070a2e00 x24: ffff80008152ba10
[ 93.444707] x23: ffff5e7a00fb5780 x22: 0000000000000000 x21: 0000000000000000
[ 93.451843] x20: 0000000000000000 x19: ffff5e7a070a2e00 x18: 0000000000000000
[ 93.458979] x17: 0000000000000000 x16: ffffc3af55c30888 x15: 0000ffff762ae300
[ 93.466116] x14: 0000000400000000 x13: 0000000000000000 x12: ffffc3af57241e40
[ 93.473252] x11: ffffc3af5755dc90 x10: ffffc3af567b536c x9 : ffffc3af55308d18
[ 93.480388] x8 : ffff5e7a0721ab80 x7 : ffffc3af56885000 x6 : 0000000000000000
[ 93.487524] x5 : 0000000000000004 x4 : 0000000000000000 x3 : ffff5e7a0721ab80
[ 93.494660] x2 : ffff9acb64db2000 x1 : 0000000000000000 x0 : 0000000000000000
[ 93.501797] Call trace:
[ 93.504237] dma_buf_map_attachment+0x94/0x160 (P)
[ 93.509027] vc_sm_cma_import_dmabuf_internal+0xc8/0x448 [vc_sm_cma]
[ 93.515391] vc_sm_cma_import_dmabuf+0x60/0xf8 [vc_sm_cma]
[ 93.520877] vchiq_mmal_submit_buffer+0xc4/0x190 [bcm2835_mmal_vchiq]
[ 93.527321] bcm2835_isp_node_buffer_queue+0xa4/0x130 [bcm2835_isp]
[ 93.533589] __enqueue_in_driver+0x78/0x160 [videobuf2_common]
[ 93.539434] vb2_core_qbuf+0x440/0x670 [videobuf2_common]
[ 93.544839] vb2_qbuf+0xb8/0x1a0 [videobuf2_v4l2]
[ 93.549549] vb2_ioctl_qbuf+0x68/0x80 [videobuf2_v4l2]
[ 93.554689] v4l_qbuf+0x50/0x80 [videodev]
[ 93.558835] __video_do_ioctl+0x410/0x4a0 [videodev]
[ 93.563836] video_usercopy+0x2f4/0x890 [videodev]
[ 93.568662] video_ioctl2+0x20/0x50 [videodev]
[ 93.573141] v4l2_ioctl+0x48/0x78 [videodev]
[ 93.577445] __arm64_sys_ioctl+0xbc/0x100
[ 93.581454] invoke_syscall+0x50/0x120
[ 93.585199] el0_svc_common.constprop.0+0xc8/0xf0
[ 93.589899] do_el0_svc+0x24/0x38
[ 93.593209] el0_svc+0x48/0x110
[ 93.596348] el0t_64_sync_handler+0x10c/0x140
[ 93.600702] el0t_64_sync+0x198/0x1a0
[ 93.604360] irq event stamp: 217930
[ 93.607841] hardirqs last enabled at (217929): [<ffffc3af555f822c>] ___slab_alloc+0x594/0xfb8
[ 93.616451] hardirqs last disabled at (217930): [<ffffc3af5612d694>] el1_dbg+0x24/0x90
[ 93.624364] softirqs last enabled at (217908): [<ffffc3af55e28610>] vchiq_release_internal+0xc0/0x138
[ 93.633670] softirqs last disabled at (217906): [<ffffc3af55e285cc>] vchiq_release_internal+0x7c/0x138
[ 93.642974] ---[ end trace 0000000000000000 ]---
[ 201.704425] ------------[ cut here ]------------
[ 201.704449] WARNING: CPU: 2 PID: 325 at drivers/dma-buf/dma-buf.c:1228 dma_buf_unmap_attachment+0xd8/0xe8
[ 201.718682] Modules linked in: vc4 snd_soc_hdmi_codec drm_exec drm_display_helper cec dw9807_vcm imx708 drm_client_lib drm_dma_helper v3d snd_soc_core bcm2835_codec(C) gpu_sched snd_compress bcm2835_v4l2(C) b
cm2835_isp(C) bcm2835_unicam_legacy drm_shmem_helper brcmfmac rpi_hevc_dec bcm2835_mmal_vchiq(C) drm_kms_helper v4l2_dv_timings snd_pcm_dmaengine snd_bcm2835(C) v4l2_fwnode drm v4l2_mem2mem vc_sm_cma(C) videobuf
2_vmalloc snd_pcm brcmutil v4l2_async videobuf2_dma_contig videobuf2_memops videobuf2_v4l2 i2c_mux_pinctrl drm_panel_orientation_quirks raspberrypi_hwmon videodev snd_timer i2c_mux cfg80211 i2c_brcmstb snd i2c_b
cm2835 videobuf2_common backlight rfkill raspberrypi_gpiomem mc nvmem_rmem uio_pdrv_genirq uio sch_fq_codel fuse nfnetlink ipv6
[ 201.785300] CPU: 2 UID: 0 PID: 325 Comm: cam Tainted: G WC 6.15.0-rc3-v8+ #2 PREEMPT
[ 201.794534] Tainted: [W]=WARN, [C]=CRAP
[ 201.798372] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[ 201.804207] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 201.811176] pc : dma_buf_unmap_attachment+0xd8/0xe8
[ 201.816069] lr : dma_buf_unmap_attachment+0xd4/0xe8
[ 201.820960] sp : ffff80008152bcc0
[ 201.824276] x29: ffff80008152bcc0 x28: ffff5e7a0721ab80 x27: 0000000000000000
[ 201.831436] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
[ 201.838592] x23: ffffc3af55665380 x22: ffffc3af55665314 x21: 0000000000000000
[ 201.845749] x20: ffff5e7a02d35ac0 x19: ffff5e7a07070b80 x18: 0000000000000000
[ 201.852904] x17: 0000000000000000 x16: ffffc3af55c30a90 x15: ffff80008152bcc8
[ 201.860059] x14: 0000000000000028 x13: 0000000000011919 x12: ffffc3af5720b020
[ 201.867214] x11: ffffc3af5755dc90 x10: ffffc3af567b536c x9 : ffffc3af55308d18
[ 201.874370] x8 : ffff80008152bb30 x7 : 0000000000000000 x6 : ffff80008152bbf0
[ 201.881524] x5 : ffff80008152bb70 x4 : 0000000000000000 x3 : ffff5e7a0721ab80
[ 201.888678] x2 : ffff9acb64dd5000 x1 : 0000000000000000 x0 : 0000000000000000
[ 201.895833] Call trace:
[ 201.898282] dma_buf_unmap_attachment+0xd8/0xe8 (P)
[ 201.903176] vc_sm_dma_buf_release+0x7c/0x158 [vc_sm_cma]
[ 201.908610] dma_buf_release+0x48/0xb0
[ 201.912371] __dentry_kill+0xe8/0x210
[ 201.916048] dput.part.0+0x204/0x3e8
[ 201.919633] dput+0x1c/0x38
[ 201.922436] __fput+0x130/0x308
[ 201.925589] ____fput+0x1c/0x30
[ 201.928740] task_work_run+0x88/0x100
[ 201.932416] do_notify_resume+0x15c/0x180
[ 201.936440] el0_svc+0x108/0x110
[ 201.939681] el0t_64_sync_handler+0x10c/0x140
[ 201.944050] el0t_64_sync+0x198/0x1a0
[ 201.947719] irq event stamp: 222528
[ 201.951208] hardirqs last enabled at (222527): [<ffffc3af5614043c>] _raw_spin_unlock_irqrestore+0x74/0x80
[ 201.960878] hardirqs last disabled at (222528): [<ffffc3af5612d694>] el1_dbg+0x24/0x90
[ 201.968805] softirqs last enabled at (222344): [<ffffc3af552c8d90>] handle_softirqs+0x448/0x4a0
[ 201.977602] softirqs last disabled at (222319): [<ffffc3af552102c4>] __do_softirq+0x1c/0x28
[ 201.985959] ---[ end trace 0000000000000000 ]---
Additional context
No response
The following seems to work so far:
diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 4ebe909d7d97..8609d6ec7657 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -249,9 +244,9 @@ static void vc_sm_clean_up_dmabuf(struct vc_sm_buffer *buffer)
/* Handle cleaning up imported dmabufs */
if (buffer->import.sgt) {
- dma_buf_unmap_attachment(buffer->import.attach,
- buffer->import.sgt,
- DMA_BIDIRECTIONAL);
+ dma_buf_unmap_attachment_unlocked(buffer->import.attach,
+ buffer->import.sgt,
+ DMA_BIDIRECTIONAL);
buffer->import.sgt = NULL;
}
if (buffer->import.attach) {
@@ -735,7 +730,7 @@ vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
goto error;
}
- sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
+ sgt = dma_buf_map_attachment_unlocked(attach, DMA_BIDIRECTIONAL);
if (IS_ERR(sgt)) {
ret = PTR_ERR(sgt);
goto error;
@@ -845,7 +840,7 @@ vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
free_kernel_id(import.kernel_id);
kfree(buffer);
if (sgt)
- dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL);
+ dma_buf_unmap_attachment_unlocked(attach, sgt, DMA_BIDIRECTIONAL);
if (attach)
dma_buf_detach(dma_buf, attach);
dma_buf_put(dma_buf);
Sorry, thought I'd replied to these.
Yes, using the _unlocked variants would appear to be the correct thing to do.
It was a long time ago I last looked at this in any detail, and I don't think those variants existed.
