[isp-vvcam] Crash at <sensor>_ioc_qcap()

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

[isp-vvcam] Crash at <sensor>_ioc_qcap()

Jump to solution
2,511 Views
khang_letruong
Senior Contributor III

Dear Community,

I'm trying to port our custom sensor making use of ISP. I've got following crash as below :

 

[  117.158924] enter imx296_ioc_qcap
[  117.158934] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
[  117.167786] Mem abort info:
[  117.170589]   ESR = 0x96000004
[  117.173816]   EC = 0x25: DABT (current EL), IL = 32 bits
[  117.179168]   SET = 0, FnV = 0
[  117.182237]   EA = 0, S1PTW = 0
[  117.185507] Data abort info:
[  117.188420]   ISV = 0, ISS = 0x00000004
[  117.192276]   CM = 0, WnR = 0
[  117.192569] enter viv_video_init_module
[  117.195252] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001b1eed000
[  117.201756] [0000000000000018] pgd=0000000000000000
[  117.206674] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[  117.211896] enter isp_mi_stop
[  117.212247] Modules linked in: vvcam_video(O) imx8_media_dev(C) imx296(O) vvcam_isp(O) vvcam_dwe(]
[  117.230506] CPU: 1 PID: 632 Comm: v4l_id Tainted: G         C O      5.4.70 #1
[  117.237734] Hardware name: NXP i.MX8MPlus EVK board (DT)
[  117.243056] pstate: 20000005 (nzCv daif -PAN -UAO)
[  117.247855] pc : imx296_ioc_qcap+0x70/0x90 [imx296]
[  117.252735] lr : imx296_ioc_qcap+0x68/0x90 [imx296]
[  117.257610] sp : ffff8000125b3b10
[  117.260923] x29: ffff8000125b3b10 x28: 0000000000000000 
[  117.266232] x27: 0000000000000000 x26: 0000000000000000 
[  117.271543] x25: ffff8000125b3cd8 x24: ffff800010c4f630 
[  117.276851] x23: ffff0001704b3458 x22: ffff8000125b3cd8 
[  117.282162] x21: ffff0001714bb800 x20: ffff0001704b3080 
[  117.287472] x19: ffff8000125b3cd8 x18: 0000000000000001 
[  117.292782] x17: 0000000000000000 x16: 0000000000000000 
[  117.298093] x15: ffff0001714bbc70 x14: ffffffffffffffff 
[  117.303404] x13: ffff8000925b3d07 x12: ffff8000125b3d0b 
[  117.308714] x11: ffff800011c21000 x10: ffff800011da9328 
[  117.314024] x9 : 0000000000000000 x8 : ffff8000125b3ae0 
[  117.319335] x7 : 0000000000000004 x6 : 0000000000000000 
[  117.324645] x5 : 0000000000000001 x4 : 0000000000000030 
[  117.329955] x3 : ffff8000125b3d0c x2 : 053c66f28ab10400 
[  117.335265] x1 : 00000000000000ff x0 : 0000000000000000 
[  117.340578] Call trace:
[  117.343027]  imx296_ioc_qcap+0x70/0x90 [imx296]
[  117.347558]  imx296_priv_ioctl+0x8c/0x330 [imx296]
[  117.352353]  subdev_do_ioctl+0x604/0xbd0
[  117.356274]  subdev_do_ioctl_lock+0x84/0xc0
[  117.360457]  video_usercopy+0x218/0x5d0
[  117.364291]  subdev_ioctl+0x14/0x20
[  117.367780]  v4l2_ioctl+0x3c/0x60
[  117.371095]  do_vfs_ioctl+0x964/0xb50
[  117.374755]  ksys_ioctl+0x78/0xb0
[  117.378069]  __arm64_sys_ioctl+0x1c/0xc0
[  117.381994]  el0_svc_common.constprop.0+0x68/0x160
[  117.386782]  el0_svc_handler+0x20/0x80
[  117.390530]  el0_svc+0x8/0x208
[  117.393587] Code: b9401a82 95fe7bef f940b680 52801fe1 (f9400c00) 
[  117.399680] ---[ end trace c78e03005379c710 ]---

 

The related handler in my driver is copied from examples of ov2775 or os08a20 :

 

int imx296_ioc_qcap(struct imx296 *sensor, void *args)
{
	struct v4l2_capability *cap = (struct v4l2_capability *)args;

	pr_debug("enter %s\n", __func__);

	strcpy((char *)cap->driver, "imx296");
	sprintf((char *)cap->bus_info, "csi%d",sensor->csi);
	if(sensor->i2c_client->adapter)
	{//bus_info[8]-i2c bus dev number
		cap->bus_info[VVCAM_CAP_BUS_INFO_I2C_ADAPTER_NR_POS] = (__u8)sensor->i2c_client->adapter->nr;
	}
	else
	{
		cap->bus_info[VVCAM_CAP_BUS_INFO_I2C_ADAPTER_NR_POS] = 0xFF;
	}

	return 0;
}

 

I would like to know if there's some missing initialization/configuration that caused the crash, please ?

Thanks in advance and best regards,
Khang.

Tags (1)
0 Kudos
1 Solution
2,267 Views
khang_letruong
Senior Contributor III

Finally, I'm able to get the valid image data behind ISP block. So this ticket should be closed.

Best regards,
K.

View solution in original post

0 Kudos
15 Replies
2,498 Views
khang_letruong
Senior Contributor III

Sorry for the wrong alert, the crash was being caused by the missing of I2C client assignment during the probing :

	sensor = devm_kmalloc(dev, sizeof(*sensor), GFP_KERNEL);
	if (!sensor)
		return -ENOMEM;
	memset(sensor, 0, sizeof(*sensor));
	sensor->i2c_client = client;

 

Now what I got :

[   53.596092] imx296 1-001a: Get capturing properties ...
[   53.596107] imx296 1-001a: no limit for max-lane-frequency
[   53.596114] imx296 1-001a: no limit for max-data_rate
[   53.596118] imx296 1-001a: Camera is found
[   53.631464] imx8_media_dev: module is from the staging directory, the quality is unknown, you hav.
[   53.632545] mx8-img-md: Registered sensor subdevice: imx296 1-001a (1)
[   53.632556] mx8-img-md: created link [imx296 1-001a] => [mxc-mipi-csi2.0]
[   53.632562] mxc-md 32c00000.bus:camera: mxc_md_create_links
[   53.635970] imx296 1-001a: imx296_set_fmt : fmt = {.which = 0x00000000}
[   53.635980] imx296 1-001a: imx296_set_fmt : mode = {.width = 1440, .height = 1080, .pixel_rate = }
[   53.635991] enter imx296_ioc_qcap
[   53.671225] enter viv_video_init_module
[   53.688338] enter isp_mi_stop


Br,
K.

0 Kudos
2,472 Views
joanxie
NXP TechSupport
NXP TechSupport

I see your another topic:

"https://community.nxp.com/t5/i-MX-Processors/IMX8MP-ISP-gst-launch-does-not-show-anything/td-p/13186...

so you have fixed this by change the data lane?

 

0 Kudos
2,469 Views
khang_letruong
Senior Contributor III

Dear @joanxie ,

Honestly, I'm not really sure about that. The feeling is that MIPI-SCI2 does fetch/feed data into ISP block but for some reason, the data is not correctly displayed at the output of ISP block. And the data does not seem to vary when I move to sensor to different scene, always a same pattern as below :

khang_letruong_0-1628932135812.jpeg

Note that there's some distortion due to incorrect de-warping parameters that I copied as-is from existing example (dewarp/dewarp_config/sensor_dwe_1080P_config.json) I guess.

BR,
Khang

0 Kudos
2,442 Views
joanxie
NXP TechSupport
NXP TechSupport

did you get tool to generate your own camera XML file? could you confirm if your xml file is correct or not?

0 Kudos
2,438 Views
khang_letruong
Senior Contributor III

Dear @joanxie ,

I admit that I copied the XML from existing example of OV2775 with nearest resolution (under units/isi/drv/OV2775/calib/OV2775/OV2775_8M_02_1080p.xml) then modified the sensor name :

 

      <sensor_name index="1" type="char" size="[1 6]">
         IMX296
      </sensor_name>

 

and adapted all the resolutions to the correct one (1440x1080 instead of 1920x1080 or 1080p):

 

     <resolution index="1" type="cell" size="[1 1]">
         <cell index="1" type="struct" size="[1 1]">
            <name index="1" type="char" size="[1 9]">
               1440x1080
            </name>
            <id index="1" type="char" size="[1 10]">
               0x00000001
            </id>
            <width index="1" type="double" size="[1 1]">
               [ 1440]
            </width>
            <height index="1" type="double" size="[1 1]">
               [ 1080]
            </height>
            <framerate index="1" type="cell" size="[1 3]">
               <cell index="1" type="struct" size="[1 1]">
                  <name index="1" type="char" size="[1 6]">
                     FPS_60
                  </name>
                  <fps index="1" type="double" size="[1 1]">
                     [ 60.3333]
                  </fps>
               </cell>
               <cell index="2" type="struct" size="[1 1]">
                  <name index="1" type="char" size="[1 6]">
                     FPS_10
                  </name>
                  <fps index="1" type="double" size="[1 1]">
                     [ 9.9944]
                  </fps>
               </cell>
               <cell index="3" type="struct" size="[1 1]">
                  <name index="1" type="char" size="[1 6]">
                     FPS_05
                  </name>
                  <fps index="1" type="double" size="[1 1]">
                     [ 4.9972]
                  </fps>
               </cell>
            </framerate>
         </cell>
      </resolution>

 

My very first expectation was being able to capture some image with pseudo parameters in XML file despite its quality. However, it seems that I failed with that approach.

Honestly, I have no idea on where to get the XML generator tool you mentioned as well as how to validate whether it is correct since I find no documentation explaining the usage of these parameters together with the ISP block inside the iMX8MP SoC.

Do you think  that a correct XML file is mandatory for achieving the image behind the ISP block without really paying much attention on the quality or calibration? Could you point out the crucial parameters that helps the minimum pipeline work, please?

Also, could you please advice on where and/or how can we obtain the XML generator tool if any?

Thanks in advance in best regards,
Khang

 

0 Kudos
2,424 Views
joanxie
NXP TechSupport
NXP TechSupport

XML is generated by the calibration tool, We have 4 partner enabled for this service. Basler, Nomicam ( Also through Pro support), Lantronix, Innowave. you can contact them to get the tool

2,421 Views
khang_letruong
Senior Contributor III

Hi @joanxie ,

Thanks for the information. Just let you know that in parallel with the bring-up of our custom ISP sensor driver, we are also working with one of the partners that you listed out only for the calibration parameters in the XML file.

Best regards,
Khang

0 Kudos
2,410 Views
joanxie
NXP TechSupport
NXP TechSupport

so your xml already used the parameters from partner, right? as I known, you also can use /opt/imx8-isp/bin/vvext 0 0 to change the parameters

0 Kudos
2,409 Views
khang_letruong
Senior Contributor III

Hi @joanxie,

The XML file is in progress and we haven't received it yet.

BR,
Khang

0 Kudos
2,397 Views
joanxie
NXP TechSupport
NXP TechSupport

ok, if you use that xml file, you should get better performance output, then use tunning tool to get correct output

 

0 Kudos
2,371 Views
khang_letruong
Senior Contributor III

Dear @joanxie ,

We've got the XML file with correct calibration parameters for our custom sensor IMX296 from one of your partner (the second in the list) but I the result is not better. Could you help to advise what to check, especially the porting side, please ?

Best regards,

Khang

0 Kudos
2,369 Views
khang_letruong
Senior Contributor III

I would like to provide additional info related to the MIPI-CSI2 interface :


a. Enabling debug of MIPI-CSI2 driver to show the content of its registers  :

 

setenv mmcargs 'setenv bootargs ${jh_clk} console=${console} root=${mmcroot} imx8-mipi-csi2-sam.debug=2'

 

 

b. When streaming (i.e launching gst-launch) :

 

[ 2036.951196] mxc-mipi-csi2.0: mipi_csis_s_stream: 1, state: 0x0
[ 2036.957070] mxc-mipi-csi2.0: fmt: 0x2008, 1440 x 1080
[ 2036.977135] mxc-mipi-csi2.0: --- mipi_csis_s_stream ---
[ 2036.982377] mxc-mipi-csi2.0:         CSIS_VERSION[0]: 0x03060301
[ 2036.988399] mxc-mipi-csi2.0:        CSIS_CMN_CTRL[4]: 0x00004805
[ 2036.994421] mxc-mipi-csi2.0:        CSIS_CLK_CTRL[8]: 0x000f0000
[ 2037.000471] mxc-mipi-csi2.0:          CSIS_INTMSK[10]: 0x0fffff1f
[ 2037.006603] mxc-mipi-csi2.0:          CSIS_INTSRC[14]: 0x00000000
[ 2037.012713] mxc-mipi-csi2.0:      CSIS_DPHYSTATUS[20]: 0x000000f1
[ 2037.018829] mxc-mipi-csi2.0:        CSIS_DPHYCTRL[24]: 0x0d800003
[ 2037.024962] mxc-mipi-csi2.0:     CSIS_DPHYBCTRL_L[30]: 0x000001f4
[ 2037.031091] mxc-mipi-csi2.0:     CSIS_DPHYBCTRL_H[34]: 0x00000000
[ 2037.037207] mxc-mipi-csi2.0:     CSIS_DPHYSCTRL_L[38]: 0x00000000
[ 2037.043312] mxc-mipi-csi2.0:     CSIS_DPHYSCTRL_H[3c]: 0x00000000
[ 2037.049413] mxc-mipi-csi2.0:   CSIS_ISPCONFIG_CH0[40]: 0x000000ac
[ 2037.055531] mxc-mipi-csi2.0:   CSIS_ISPCONFIG_CH1[50]: 0x000008fd
[ 2037.061645] mxc-mipi-csi2.0:   CSIS_ISPCONFIG_CH2[60]: 0x000008fe
[ 2037.067748] mxc-mipi-csi2.0:   CSIS_ISPCONFIG_CH3[70]: 0x000008ff
[ 2037.073851] mxc-mipi-csi2.0:    CSIS_ISPRESOL_CH0[44]: 0x043805a0
[ 2037.079951] mxc-mipi-csi2.0:    CSIS_ISPRESOL_CH1[54]: 0x80008000
[ 2037.086063] mxc-mipi-csi2.0:    CSIS_ISPRESOL_CH2[64]: 0x80008000
[ 2037.092169] mxc-mipi-csi2.0:    CSIS_ISPRESOL_CH3[74]: 0x80008000
[ 2037.098273] mxc-mipi-csi2.0:     CSIS_ISPSYNC_CH0[48]: 0x00000000
[ 2037.104373] mxc-mipi-csi2.0:     CSIS_ISPSYNC_CH1[58]: 0x00000000
[ 2037.110492] mxc-mipi-csi2.0:     CSIS_ISPSYNC_CH2[68]: 0x00000000
[ 2037.116599] mxc-mipi-csi2.0:     CSIS_ISPSYNC_CH3[78]: 0x00000000
[ 2037.122700] mxc-mipi-csi2.0: --- mipi_csis_s_stream ---
[ 2037.127935] mxc-mipi-csi2.0:    GPR_GASKET_0_CTRL[60]: 0xffff8000
[ 2037.134035] mxc-mipi-csi2.0:   GPR_GASKET_0_HSIZE[64]: 0xffff8000
[ 2037.140137] mxc-mipi-csi2.0:   GPR_GASKET_0_VSIZE[68]: 0xffff8000
[ 2037.146603] enter wdr3_hw_init
[ 2037.149682] wdr3 res: 1440 1080 
[ 2037.153478] enter isp_mi_start
[ 2037.157093] imx296 1-001a: I2C writing value 00 at address 0x3000
[ 2037.201151] imx296 1-001a: I2C writing value 00 at address 0x300a
[ 2037.208047] mxc-mipi-csi2.0: Frame Start: 1
[ 2037.212232] mxc-mipi-csi2.0: status: 01000000
[ 2037.224357] mxc-mipi-csi2.0: Frame End: 1
[ 2037.228367] mxc-mipi-csi2.0: status: 00100000
[ 2037.232748] mxc-mipi-csi2.0: Frame Start: 2
[ 2037.236932] mxc-mipi-csi2.0: status: 01000000
[ 2037.241317] mxc-mipi-csi2.0: Frame End: 2
[ 2037.245324] mxc-mipi-csi2.0: status: 00100000
[ 2037.257486] mxc-mipi-csi2.0: Frame End: 3
[ 2037.261497] mxc-mipi-csi2.0: status: 00100000
[ 2037.265878] mxc-mipi-csi2.0: Frame Start: 3
[ 2037.270074] mxc-mipi-csi2.0: status: 01000000
[ 2037.274501] mxc-mipi-csi2.0: Frame End: 4
[ 2037.278548] mxc-mipi-csi2.0: status: 00100000
[ 2037.283080] enter imx296_s_exp
[ 2037.286178] imx296 1-001a: I2C writing value 01 at address 0x3008
[ 2037.292392] mxc-mipi-csi2.0: Frame Start: 4
[ 2037.292405] mxc-mipi-csi2.0: Frame End: 5
[ 2037.292422] mxc-mipi-csi2.0: status: 01100000
[ 2037.305853] imx296 1-001a: I2C writing value 58 at address 0x308d
[ 2037.312004] mxc-mipi-csi2.0: Frame Start: 5
[ 2037.312007] mxc-mipi-csi2.0: Frame End: 6
[ 2037.312009] mxc-mipi-csi2.0: status: 01100000
[ 2037.324694] mxc-mipi-csi2.0: Frame Start: 6
[ 2037.324697] mxc-mipi-csi2.0: Frame End: 7
[ 2037.324699] mxc-mipi-csi2.0: status: 01100000
[ 2037.337961] imx296 1-001a: I2C writing value 01 at address 0x308e
[ 2037.344091] mxc-mipi-csi2.0: Frame Start: 7
[ 2037.344093] mxc-mipi-csi2.0: Frame End: 8
[ 2037.344094] mxc-mipi-csi2.0: status: 01100000
[ 2037.356871] mxc-mipi-csi2.0: Frame End: 9
[ 2037.360882] mxc-mipi-csi2.0: status: 00100000
[ 2037.365262] mxc-mipi-csi2.0: Frame Start: 8
[ 2037.369446] mxc-mipi-csi2.0: status: 01000000
[ 2037.373849] mxc-mipi-csi2.0: Frame End: 10
[ 2037.377947] mxc-mipi-csi2.0: status: 00100000
[ 2037.382927] imx296 1-001a: I2C writing value 00 at address 0x308f
[ 2037.389762] imx296 1-001a: I2C writing value 00 at address 0x3008
[ 2037.395880] mxc-mipi-csi2.0: Frame Start: 9
[ 2037.395882] mxc-mipi-csi2.0: Frame End: 11
[ 2037.395883] mxc-mipi-csi2.0: status: 01100000
[ 2037.408629] mxc-mipi-csi2.0: Frame Start: 10
[ 2037.408633] mxc-mipi-csi2.0: Frame End: 12
[ 2037.408635] mxc-mipi-csi2.0: status: 01100000
[ 2037.422166] enter imx296_s_gain
[ 2037.425354] mxc-mipi-csi2.0: Frame Start: 11
[ 2037.425356] mxc-mipi-csi2.0: Frame End: 13
[ 2037.425358] mxc-mipi-csi2.0: status: 01100000
[ 2037.438204] imx296 1-001a: I2C writing value 01 at address 0x3008
[ 2037.444345] mxc-mipi-csi2.0: Frame Start: 12
[ 2037.444348] mxc-mipi-csi2.0: Frame End: 14
[ 2037.444354] mxc-mipi-csi2.0: status: 01100000
[ 2037.457163] mxc-mipi-csi2.0: Frame Start: 13
[ 2037.457167] mxc-mipi-csi2.0: Frame End: 15
[ 2037.457168] mxc-mipi-csi2.0: status: 01100000
[ 2037.470850] imx296 1-001a: I2C writing value 00 at address 0x3204
...

 

 

 

The 2 most important registers seem to be programmed with correct values in order to fetch RAW10 1440x1080 :
- CSIS_ISPCONFIG_CH0 :  0x000000ac → DATAFORMAT = 0xac >> 2 = 0x2b = RAW10

CSIS_ISPCONFIG_CHx.png

- CSIS_ISPRESOL_CH0 : 0x043805a0 → VRESOL=0x0438=1080; HRESOL=0x05a0=1440
CSIS_ISPRESOL_CHx.png

So it seems that MIPI-CSI2 does fetch correct data into ISP. IS there anything else that I forgot to configure ?

Best regards,
Khang

 

0 Kudos
2,268 Views
khang_letruong
Senior Contributor III

Finally, I'm able to get the valid image data behind ISP block. So this ticket should be closed.

Best regards,
K.

0 Kudos
2,045 Views
quercuspau
Contributor II

Hi @khang_letruong ,

I saw in your previous logs that CSI clock is stopped (CSIS_DPHYSTATUS[20]: 0x000000f1). How did you fix this problem? Could you describe the solution of your previous problem?

Thanks and BR

0 Kudos
2,030 Views
khang_letruong
Senior Contributor III

Hi @quercuspau ,

Sorry that I did nothing to resolve. The log (registers dumping) was taken when the ISP already worked well with the captured image in certain previous comment of this thread, except that it was a test pattern from the sensor with some distortion due to bad .json file for dewarping.

Regards,

K.

 

0 Kudos