vc_sm_cma: lockdep warnings while capturing from camera

[pobrn]

Describe the bug

dmabuf related lockdep warnings are emitted while capturing using libcamera

Steps to reproduce the behaviour

1. enable lockdep in the kernel
2. start cam -c1 -C (or similar)
3. observe the lockdep warnings in dma_buf_{un,}map_attachment()

Device (s)

Raspberry Pi 4 Mod. B

System

• Linux <hostname> 6.15.0-rc3-v8+ #2 SMP PREEMPT Thu Apr 24 18:47:39 CEST 2025 aarch64 GNU/Linux
• rpi camera module 3 (imx708)

Logs

[   93.311225] ------------[ cut here ]------------
[   93.311240] WARNING: CPU: 1 PID: 325 at drivers/dma-buf/dma-buf.c:1125 dma_buf_map_attachment+0x94/0x160
[   93.325350] Modules linked in: vc4 snd_soc_hdmi_codec drm_exec drm_display_helper cec dw9807_vcm imx708 drm_client_lib drm_dma_helper v3d snd_soc_core bcm2835_codec(C) gpu_sched snd_compress bcm2835_v4l2(C) b
cm2835_isp(C) bcm2835_unicam_legacy drm_shmem_helper brcmfmac rpi_hevc_dec bcm2835_mmal_vchiq(C) drm_kms_helper v4l2_dv_timings snd_pcm_dmaengine snd_bcm2835(C) v4l2_fwnode drm v4l2_mem2mem vc_sm_cma(C) videobuf
2_vmalloc snd_pcm brcmutil v4l2_async videobuf2_dma_contig videobuf2_memops videobuf2_v4l2 i2c_mux_pinctrl drm_panel_orientation_quirks raspberrypi_hwmon videodev snd_timer i2c_mux cfg80211 i2c_brcmstb snd i2c_b
cm2835 videobuf2_common backlight rfkill raspberrypi_gpiomem mc nvmem_rmem uio_pdrv_genirq uio sch_fq_codel fuse nfnetlink ipv6
[   93.391721] CPU: 1 UID: 0 PID: 325 Comm: cam Tainted: G        WC          6.15.0-rc3-v8+ #2 PREEMPT 
[   93.400939] Tainted: [W]=WARN, [C]=CRAP
[   93.404767] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[   93.410593] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   93.417549] pc : dma_buf_map_attachment+0x94/0x160
[   93.422338] lr : dma_buf_map_attachment+0x90/0x160
[   93.427125] sp : ffff80008152b8d0
[   93.430432] x29: ffff80008152b8d0 x28: ffff5e7a086157f0 x27: ffff80008152bc08
[   93.437570] x26: ffffc3af18a34000 x25: 00000000070a2e00 x24: ffff80008152ba10
[   93.444707] x23: ffff5e7a00fb5780 x22: 0000000000000000 x21: 0000000000000000
[   93.451843] x20: 0000000000000000 x19: ffff5e7a070a2e00 x18: 0000000000000000
[   93.458979] x17: 0000000000000000 x16: ffffc3af55c30888 x15: 0000ffff762ae300
[   93.466116] x14: 0000000400000000 x13: 0000000000000000 x12: ffffc3af57241e40
[   93.473252] x11: ffffc3af5755dc90 x10: ffffc3af567b536c x9 : ffffc3af55308d18
[   93.480388] x8 : ffff5e7a0721ab80 x7 : ffffc3af56885000 x6 : 0000000000000000
[   93.487524] x5 : 0000000000000004 x4 : 0000000000000000 x3 : ffff5e7a0721ab80
[   93.494660] x2 : ffff9acb64db2000 x1 : 0000000000000000 x0 : 0000000000000000
[   93.501797] Call trace:
[   93.504237]  dma_buf_map_attachment+0x94/0x160 (P)
[   93.509027]  vc_sm_cma_import_dmabuf_internal+0xc8/0x448 [vc_sm_cma]
[   93.515391]  vc_sm_cma_import_dmabuf+0x60/0xf8 [vc_sm_cma]
[   93.520877]  vchiq_mmal_submit_buffer+0xc4/0x190 [bcm2835_mmal_vchiq]
[   93.527321]  bcm2835_isp_node_buffer_queue+0xa4/0x130 [bcm2835_isp]
[   93.533589]  __enqueue_in_driver+0x78/0x160 [videobuf2_common]
[   93.539434]  vb2_core_qbuf+0x440/0x670 [videobuf2_common]
[   93.544839]  vb2_qbuf+0xb8/0x1a0 [videobuf2_v4l2]
[   93.549549]  vb2_ioctl_qbuf+0x68/0x80 [videobuf2_v4l2]
[   93.554689]  v4l_qbuf+0x50/0x80 [videodev]
[   93.558835]  __video_do_ioctl+0x410/0x4a0 [videodev]
[   93.563836]  video_usercopy+0x2f4/0x890 [videodev]
[   93.568662]  video_ioctl2+0x20/0x50 [videodev]
[   93.573141]  v4l2_ioctl+0x48/0x78 [videodev]
[   93.577445]  __arm64_sys_ioctl+0xbc/0x100
[   93.581454]  invoke_syscall+0x50/0x120
[   93.585199]  el0_svc_common.constprop.0+0xc8/0xf0
[   93.589899]  do_el0_svc+0x24/0x38
[   93.593209]  el0_svc+0x48/0x110
[   93.596348]  el0t_64_sync_handler+0x10c/0x140
[   93.600702]  el0t_64_sync+0x198/0x1a0
[   93.604360] irq event stamp: 217930
[   93.607841] hardirqs last  enabled at (217929): [<ffffc3af555f822c>] ___slab_alloc+0x594/0xfb8
[   93.616451] hardirqs last disabled at (217930): [<ffffc3af5612d694>] el1_dbg+0x24/0x90
[   93.624364] softirqs last  enabled at (217908): [<ffffc3af55e28610>] vchiq_release_internal+0xc0/0x138
[   93.633670] softirqs last disabled at (217906): [<ffffc3af55e285cc>] vchiq_release_internal+0x7c/0x138
[   93.642974] ---[ end trace 0000000000000000 ]---

---

[  201.704425] ------------[ cut here ]------------
[  201.704449] WARNING: CPU: 2 PID: 325 at drivers/dma-buf/dma-buf.c:1228 dma_buf_unmap_attachment+0xd8/0xe8
[  201.718682] Modules linked in: vc4 snd_soc_hdmi_codec drm_exec drm_display_helper cec dw9807_vcm imx708 drm_client_lib drm_dma_helper v3d snd_soc_core bcm2835_codec(C) gpu_sched snd_compress bcm2835_v4l2(C) b
cm2835_isp(C) bcm2835_unicam_legacy drm_shmem_helper brcmfmac rpi_hevc_dec bcm2835_mmal_vchiq(C) drm_kms_helper v4l2_dv_timings snd_pcm_dmaengine snd_bcm2835(C) v4l2_fwnode drm v4l2_mem2mem vc_sm_cma(C) videobuf
2_vmalloc snd_pcm brcmutil v4l2_async videobuf2_dma_contig videobuf2_memops videobuf2_v4l2 i2c_mux_pinctrl drm_panel_orientation_quirks raspberrypi_hwmon videodev snd_timer i2c_mux cfg80211 i2c_brcmstb snd i2c_b
cm2835 videobuf2_common backlight rfkill raspberrypi_gpiomem mc nvmem_rmem uio_pdrv_genirq uio sch_fq_codel fuse nfnetlink ipv6
[  201.785300] CPU: 2 UID: 0 PID: 325 Comm: cam Tainted: G        WC          6.15.0-rc3-v8+ #2 PREEMPT 
[  201.794534] Tainted: [W]=WARN, [C]=CRAP
[  201.798372] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[  201.804207] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  201.811176] pc : dma_buf_unmap_attachment+0xd8/0xe8
[  201.816069] lr : dma_buf_unmap_attachment+0xd4/0xe8
[  201.820960] sp : ffff80008152bcc0
[  201.824276] x29: ffff80008152bcc0 x28: ffff5e7a0721ab80 x27: 0000000000000000
[  201.831436] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
[  201.838592] x23: ffffc3af55665380 x22: ffffc3af55665314 x21: 0000000000000000
[  201.845749] x20: ffff5e7a02d35ac0 x19: ffff5e7a07070b80 x18: 0000000000000000
[  201.852904] x17: 0000000000000000 x16: ffffc3af55c30a90 x15: ffff80008152bcc8
[  201.860059] x14: 0000000000000028 x13: 0000000000011919 x12: ffffc3af5720b020
[  201.867214] x11: ffffc3af5755dc90 x10: ffffc3af567b536c x9 : ffffc3af55308d18
[  201.874370] x8 : ffff80008152bb30 x7 : 0000000000000000 x6 : ffff80008152bbf0
[  201.881524] x5 : ffff80008152bb70 x4 : 0000000000000000 x3 : ffff5e7a0721ab80
[  201.888678] x2 : ffff9acb64dd5000 x1 : 0000000000000000 x0 : 0000000000000000
[  201.895833] Call trace:
[  201.898282]  dma_buf_unmap_attachment+0xd8/0xe8 (P)
[  201.903176]  vc_sm_dma_buf_release+0x7c/0x158 [vc_sm_cma]
[  201.908610]  dma_buf_release+0x48/0xb0
[  201.912371]  __dentry_kill+0xe8/0x210
[  201.916048]  dput.part.0+0x204/0x3e8
[  201.919633]  dput+0x1c/0x38
[  201.922436]  __fput+0x130/0x308
[  201.925589]  ____fput+0x1c/0x30
[  201.928740]  task_work_run+0x88/0x100
[  201.932416]  do_notify_resume+0x15c/0x180
[  201.936440]  el0_svc+0x108/0x110
[  201.939681]  el0t_64_sync_handler+0x10c/0x140
[  201.944050]  el0t_64_sync+0x198/0x1a0
[  201.947719] irq event stamp: 222528
[  201.951208] hardirqs last  enabled at (222527): [<ffffc3af5614043c>] _raw_spin_unlock_irqrestore+0x74/0x80
[  201.960878] hardirqs last disabled at (222528): [<ffffc3af5612d694>] el1_dbg+0x24/0x90
[  201.968805] softirqs last  enabled at (222344): [<ffffc3af552c8d90>] handle_softirqs+0x448/0x4a0
[  201.977602] softirqs last disabled at (222319): [<ffffc3af552102c4>] __do_softirq+0x1c/0x28
[  201.985959] ---[ end trace 0000000000000000 ]---

Additional context

No response

[pobrn]

The following seems to work so far:

diff --git a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
index 4ebe909d7d97..8609d6ec7657 100644
--- a/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
+++ b/drivers/staging/vc04_services/vc-sm-cma/vc_sm.c
@@ -249,9 +244,9 @@ static void vc_sm_clean_up_dmabuf(struct vc_sm_buffer *buffer)
 
        /* Handle cleaning up imported dmabufs */
        if (buffer->import.sgt) {
-               dma_buf_unmap_attachment(buffer->import.attach,
-                                        buffer->import.sgt,
-                                        DMA_BIDIRECTIONAL);
+               dma_buf_unmap_attachment_unlocked(buffer->import.attach,
+                                                 buffer->import.sgt,
+                                                 DMA_BIDIRECTIONAL);
                buffer->import.sgt = NULL;
        }
        if (buffer->import.attach) {
@@ -735,7 +730,7 @@ vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
                goto error;
        }
 
-       sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL);
+       sgt = dma_buf_map_attachment_unlocked(attach, DMA_BIDIRECTIONAL);
        if (IS_ERR(sgt)) {
                ret = PTR_ERR(sgt);
                goto error;
@@ -845,7 +840,7 @@ vc_sm_cma_import_dmabuf_internal(struct vc_sm_privdata_t *private,
        free_kernel_id(import.kernel_id);
        kfree(buffer);
        if (sgt)
-               dma_buf_unmap_attachment(attach, sgt, DMA_BIDIRECTIONAL);
+               dma_buf_unmap_attachment_unlocked(attach, sgt, DMA_BIDIRECTIONAL);
        if (attach)
                dma_buf_detach(dma_buf, attach);
        dma_buf_put(dma_buf);

[pobrn]

Any thoughts about using the _unlocked() variants?

[popcornmix]

@6by9 ?

[6by9]

Sorry, thought I'd replied to these.

Yes, using the _unlocked variants would appear to be the correct thing to do.
It was a long time ago I last looked at this in any detail, and I don't think those variants existed.

[6by9]

#6929 for the PR to 6.12 (it'll get forward ported too)