v4l2 + imx mipi camera driver crashes (Android 11 1.2.0)

[dennis3]

Is this a bug in the i.mx8 kernel driver for mipi camera capture?

[ 2094.183477] ------------[ cut here ]------------
[ 2094.183486] list_del corruption. next->prev should be ffff0000947dc7a0, but was ffff0000947dfba0
[ 2094.183556] WARNING: CPU: 0 PID: 0 at lib/list_debug.c:56 __list_del_entry_valid+0xd8/0xe0
[ 2094.183559] Modules linked in: synaptics_dsx_i2c brcmfmac brcmutil
[ 2094.183570] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.70-gaf34fea87d72 #2
[ 2094.183572] Hardware name: Liger iMX8mp TCUv20 MIPI + HDMI + WIFI (DT)
[ 2094.183576] pstate: 60400085 (nZCv daIf +PAN -UAO)
[ 2094.183580] pc : __list_del_entry_valid+0xd8/0xe0
[ 2094.183583] lr : __list_del_entry_valid+0xd8/0xe0
[ 2094.183585] sp : ffff800010003e10
[ 2094.183587] x29: ffff800010003e10 x28: ffff8000122a1018 
[ 2094.183590] x27: ffff8000122b5938 x26: ffff8000ed49b000 
[ 2094.183593] x25: ffff0000f895c080 x24: ffff0000f895d0f8 
[ 2094.183596] x23: ffff0000947dc7a0 x22: ffff0000f895d8a0 
[ 2094.183599] x21: ffff0000f92b8010 x20: ffff0000947dfba0 
[ 2094.183602] x19: ffff0000947dc7a0 x18: ffff800010005040 
[ 2094.183606] x17: 0000000000000000 x16: 0000000000000000 
[ 2094.183608] x15: 0000000000000082 x14: 0000000000000064 
[ 2094.183611] x13: 0000000000015c94 x12: 0000000000000000 
[ 2094.183614] x11: 0000000000000001 x10: 0000000000000000 
[ 2094.183617] x9 : d48ab363fb0b0500 x8 : d48ab363fb0b0500 
[ 2094.183620] x7 : 0000000000000000 x6 : ffff80001284c584 
[ 2094.183623] x5 : 0000000000000000 x4 : 0000000000000004 
[ 2094.183626] x3 : 0000000000000010 x2 : 0000000000000007 
[ 2094.183629] x1 : 0000000000000006 x0 : 0000000000000054 
[ 2094.183633] Call trace:
[ 2094.183638] __list_del_entry_valid+0xd8/0xe0
[ 2094.183643] mxc_isi_cap_frame_write_done+0x184/0x220
[ 2094.183646] mxc_isi_irq_handler+0xf8/0x1c0
[ 2094.183650] __handle_irq_event_percpu+0xfc/0x274
[ 2094.183653] handle_irq_event+0x60/0x128
[ 2094.183657] handle_fasteoi_irq+0x10c/0x208
[ 2094.183660] __handle_domain_irq+0x80/0xc4
[ 2094.183663] gic_handle_irq+0xb8/0x15c
[ 2094.183666] el1_irq+0x104/0x200
[ 2094.183670] cpuidle_enter_state+0x158/0x2d4
[ 2094.183673] cpuidle_enter+0x38/0x50
[ 2094.183677] do_idle+0x1a4/0x294
[ 2094.183680] cpu_startup_entry+0x24/0x28
[ 2094.183684] rest_init+0xd8/0xe8
[ 2094.183689] arch_call_rest_init+0x10/0x1c
[ 2094.183692] start_kernel+0x32c/0x3a4
[ 2094.183694] ---[ end trace bd160ff9bd8428e3 ]---
[ 2094.483502] ------------[ cut here ]------------
[ 2094.483510] list_add double add: new=ffff0000947dc5f0, prev=ffff0000947dc5f0, next=ffff0000f895cb48.
[ 2094.483550] WARNING: CPU: 0 PID: 0 at lib/list_debug.c:31 __list_add_valid+0xc8/0xd0
[ 2094.483552] Modules linked in: synaptics_dsx_i2c brcmfmac brcmutil
[ 2094.483562] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W         5.4.70-gaf34fea87d72 #2
[ 2094.483564] Hardware name: Liger iMX8mp TCUv20 MIPI + HDMI + WIFI (DT)
[ 2094.483568] pstate: 60400085 (nZCv daIf +PAN -UAO)
[ 2094.483571] pc : __list_add_valid+0xc8/0xd0
[ 2094.483574] lr : __list_add_valid+0xc8/0xd0
[ 2094.483576] sp : ffff800010003da0
[ 2094.483578] x29: ffff800010003da0 x28: ffff8000122a1018 
[ 2094.483581] x27: ffff8000122b5938 x26: ffff0000f895cb48 
[ 2094.483586] x25: ffff0000947dc5f0 x24: ffff0000947dc5f0 
[ 2094.483589] x23: 0000000000000080 x22: ffff0000f895cb58 
[ 2094.483592] x21: ffff0000947dc5f0 x20: ffff0000947dc5f0 
[ 2094.483595] x19: ffff0000f895cb48 x18: ffff800010005048 
[ 2094.483600] x17: 0000000000000000 x16: 0000000000000000 
[ 2094.483603] x15: 0000000000000082 x14: 0000000000000068 
[ 2094.483606] x13: 00000000000165f8 x12: 0000000000000000 
[ 2094.483609] x11: 0000000000000001 x10: 0000000000000000 
[ 2094.483612] x9 : d48ab363fb0b0500 x8 : d48ab363fb0b0500 
[ 2094.483615] x7 : 0000000000000000 x6 : ffff80001284cee8 
[ 2094.483618] x5 : 0000000000000000 x4 : 0000000000000004 
[ 2094.483621] x3 : 000000002e383462 x2 : 0000000000000007 
[ 2094.483624] x1 : 0000000000000006 x0 : 0000000000000058 
[ 2094.483627] Call trace:
[ 2094.483632] __list_add_valid+0xc8/0xd0
[ 2094.483636] vb2_buffer_done+0x114/0x2a0
[ 2094.483641] mxc_isi_cap_frame_write_done+0x10c/0x220
[ 2094.483644] mxc_isi_irq_handler+0xf8/0x1c0
[ 2094.483648] __handle_irq_event_percpu+0xfc/0x274
[ 2094.483651] handle_irq_event+0x60/0x128
[ 2094.483654] handle_fasteoi_irq+0x10c/0x208
[ 2094.483657] __handle_domain_irq+0x80/0xc4
[ 2094.483661] gic_handle_irq+0xb8/0x15c
[ 2094.483664] el1_irq+0x104/0x200
[ 2094.483668] cpuidle_enter_state+0x158/0x2d4
[ 2094.483671] cpuidle_enter+0x38/0x50
[ 2094.483674] do_idle+0x1a4/0x294
[ 2094.483677] cpu_startup_entry+0x24/0x28
[ 2094.483682] rest_init+0xd8/0xe8
[ 2094.483686] arch_call_rest_init+0x10/0x1c
[ 2094.483688] start_kernel+0x32c/0x3a4
[ 2094.483691] ---[ end trace bd160ff9bd8428e4 ]---

If I just leave my device streaming images from the camera for some time, this will eventually happen.  It appears to work fine in the short term but streaming from the camera long enough will produce this error.   Our device is running Android 11 1.2.0 currently. (Linux 5.4.70).  The device will hang or crash/reboot when this error occurs.

[Zhiming_Liu]

Android 11 1.2.0 don't support i.MX8QM, you can see release note

[dennis3]

I'm sorry.  I failed to clarify more clearly our platform.

We are using the i.mx8m Plus processor.  I do believe it is supported on this release.