Quoting Kieran Bingham (2022-11-03 17:27:56)
> Hi Lee,
>
> Quoting lee (2022-11-03 03:14:27)
> > Adds a driver for the 16MPix IMX519 CSI2 sensor.
> > Whilst the sensor supports 2 or 4 CSI2 data lanes, this driver
> > currently only supports 2 lanes.
> >
> > The following Bayer modes are currently available:
> >
> > 4656x3496 10-bit @ 10fps
> > 3840x2160 10-bit (cropped) @ 21fps
> > 2328x1748 10-bit (binned) @ 30fps
> > 1920x1080 10-bit (cropped/binned) @ 60fps
> > 1280x720 10-bit (cropped/binned) @ 120fps
> >
> > Signed-off-by: Lee Jackson <lee@xxxxxxxxxxx>
> > ---
Found another location with deadlock:
> > +static int imx519_enum_mbus_code(struct v4l2_subdev *sd,
> > + struct v4l2_subdev_state *sd_state,
> > + struct v4l2_subdev_mbus_code_enum *code)
> > +{
> > + struct imx519 *imx519 = to_imx519(sd);
> > +
> > + mutex_lock(&imx519->mutex);
> > +
> > + if (code->index > 0)
> > + return -EINVAL;
> > +
> > + code->code = imx519_get_format_code(imx519);
> > +
> > + mutex_unlock(&imx519->mutex);
> > +
> > + return 0;
> > +}
> > +
> > +static int imx519_enum_frame_size(struct v4l2_subdev *sd,
> > + struct v4l2_subdev_state *sd_state,
> > + struct v4l2_subdev_frame_size_enum *fse)
> > +{
> > + struct imx519 *imx519 = to_imx519(sd);
> > +
> > + mutex_lock(&imx519->mutex);
>
> I've hit a deadlock here.
>
> [ 139.389907] other info that might help us debug this:
> [ 139.396435] Possible unsafe locking scenario:
> [ 139.396435]
> [ 139.402353] CPU0
> [ 139.404797] ----
> [ 139.407243] lock(&imx519->mutex);
> [ 139.410737] lock(&imx519->mutex);
> [ 139.414230]
> [ 139.414230] *** DEADLOCK ***
> [ 139.414230]
> [ 139.420148] May be due to missing lock nesting notation
> [ 139.420148]
> [ 139.426936] 1 lock held by cam/924:
> [ 139.430425] #0: ffff000003feb460 (&imx519->mutex){+.+.}-{3:3}, at: imx519_enum_mbus_code+0x3
> 4/0x70
> [ 139.439490]
> [ 139.439490] stack backtrace:
> [ 139.443847] CPU: 3 PID: 924 Comm: cam Not tainted 6.1.0-rc2-14364-g9c47c8d45623 #41
> [ 139.451505] Hardware name: Polyhex Debix Model A i.MX8MPlus board (DT)
> [ 139.458033] Call trace:
> [ 139.460479] dump_backtrace+0xe4/0x140
> [ 139.464234] show_stack+0x20/0x50
> [ 139.467555] dump_stack_lvl+0x9c/0xd8
> [ 139.471223] dump_stack+0x18/0x34
> [ 139.474544] __lock_acquire+0x103c/0x1920
> [ 139.478556] lock_acquire.part.0+0xf0/0x26c
> [ 139.482743] lock_acquire+0x68/0x84
> [ 139.486234] __mutex_lock+0x8c/0x414
> [ 139.489815] mutex_lock_nested+0x34/0x40
> [ 139.493741] imx519_enum_frame_size+0x34/0xa4
> [ 139.498101] call_enum_frame_size_state+0x8c/0x130
> [ 139.502895] subdev_do_ioctl+0x910/0xdf0
> [ 139.506823] subdev_do_ioctl_lock+0x164/0x220
> [ 139.511183] video_usercopy+0x2ec/0x86c
> [ 139.515021] subdev_ioctl+0x20/0x30
> [ 139.518512] v4l2_ioctl+0x48/0x6c
> [ 139.521835] __arm64_sys_ioctl+0x44c/0xd70
> [ 139.525936] invoke_syscall.constprop.0+0x58/0xf0
> [ 139.530645] do_el0_svc+0x74/0x1a0
> [ 139.534052] el0_svc+0x54/0x124
> [ 139.537198] el0t_64_sync_handler+0xbc/0x13c
> [ 139.541470] el0t_64_sync+0x18c/0x190
>
>
> > +
> > + if (fse->index >= ARRAY_SIZE(supported_modes_10bit))
> > + return -EINVAL;
And both this
> > +
> > + if (fse->code != imx519_get_format_code(imx519))
> > + return -EINVAL;
And this ...
Can leave the function with the mutex held locked forever...
--
Kieran
> > +
> > + fse->min_width = supported_modes_10bit[fse->index].width;
> > + fse->max_width = fse->min_width;
> > + fse->min_height = supported_modes_10bit[fse->index].height;
> > + fse->max_height = fse->min_height;
> > +
> > + mutex_unlock(&imx519->mutex);
> > +
> > + return 0;
> > +}
--
Kieran
