* [PATCH v4 0/3] media: camss: add support for purwa platform
@ 2026-10-08 8:26 Wenmeng Liu
2026-10-08 8:26 ` [PATCH v4 1/3] dt-bindings: media: Add qcom,x1p42100-camss Wenmeng Liu
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Wenmeng Liu @ 2026-10-08 8:26 UTC (permalink / raw)
To: Bryan O'Donoghue, Vladimir Zapolskiy, Loic Poulain,
Mauro Carvalho Chehab, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Wenmeng Liu, Bryan O'Donoghue
Cc: linux-media, linux-arm-msm, devicetree, linux-kernel,
Krzysztof Kozlowski
This series adds camss support for purwa platform.
Validated on the Purwa EVK with the OG0VA1B sensor.
---
Changes in v4:
- Collect R-b tags from Bryan and Krzysztof on dt-bindings patch.
- Rebase on linux-next and add Bryan`s vfe patch.
- Link to v3: https://lore.kernel.org/all/20260930-purwa_camss-v3-0-0fe2a5b11208@oss.qualcomm.com
Changes in v3:
- Rebased on the latest CSIPHY code.
- Link to v2: https://lore.kernel.org/r/20260511-purwa_camss-v2-0-22608ab9126c@oss.qualcomm.com
Changes in v2:
- Based on the old version of csiphy.
- Remove Src clk. -- Bryan
- Extend the register block of the VFE. -- Bryan
- Add comments for IOMMU. -- Bryan
- Link to v1: https://lore.kernel.org/r/20260410-purwa_camss-v1-0-eedcf6d9d8ee@oss.qualcomm.com
---
Bryan O'Donoghue (1):
media: qcom: camss: vfe: Eliminate ever expanding src_pad_code switch logic
Wenmeng Liu (2):
dt-bindings: media: Add qcom,x1p42100-camss
media: qcom: camss: Add support for X1P42100 CAMSS
.../bindings/media/qcom,x1p42100-camss.yaml | 263 +++++++++++++++++++++
drivers/media/platform/qcom/camss/camss-vfe.c | 20 +-
drivers/media/platform/qcom/camss/camss.c | 216 +++++++++++++++++
drivers/media/platform/qcom/camss/camss.h | 1 +
4 files changed, 482 insertions(+), 18 deletions(-)
---
base-commit: b018686719706a781c45a874ed51374a2dc4b767
change-id: 20260409-purwa_camss-475787b87e14
Best regards,
--
Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v4 1/3] dt-bindings: media: Add qcom,x1p42100-camss
2026-10-08 8:26 [PATCH v4 0/3] media: camss: add support for purwa platform Wenmeng Liu
@ 2026-10-08 8:26 ` Wenmeng Liu
2026-10-08 8:26 ` [PATCH v4 2/3] media: qcom: camss: vfe: Eliminate ever expanding src_pad_code switch logic Wenmeng Liu
2026-10-08 8:27 ` [PATCH v4 3/3] media: qcom: camss: Add support for X1P42100 CAMSS Wenmeng Liu
2 siblings, 0 replies; 6+ messages in thread
From: Wenmeng Liu @ 2026-10-08 8:26 UTC (permalink / raw)
To: Bryan O'Donoghue, Vladimir Zapolskiy, Loic Poulain,
Mauro Carvalho Chehab, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Wenmeng Liu, Bryan O'Donoghue
Cc: linux-media, linux-arm-msm, devicetree, linux-kernel,
Krzysztof Kozlowski
Add bindings for the Camera Subsystem for X1P42100.
The X1P42100 platform provides:
- 2 x CSIPHY
- 3 x TPG
- 3 x CSID
- 2 x CSID Lite
- 1 x IFE
- 2 x IFE Lite
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
---
.../bindings/media/qcom,x1p42100-camss.yaml | 263 +++++++++++++++++++++
1 file changed, 263 insertions(+)
diff --git a/Documentation/devicetree/bindings/media/qcom,x1p42100-camss.yaml b/Documentation/devicetree/bindings/media/qcom,x1p42100-camss.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..c5ea7a7d9fe5025bb15cbddd85b915d136083447
--- /dev/null
+++ b/Documentation/devicetree/bindings/media/qcom,x1p42100-camss.yaml
@@ -0,0 +1,263 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/media/qcom,x1p42100-camss.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm X1P42100 Camera Subsystem (CAMSS)
+
+maintainers:
+ - Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+
+description:
+ The CAMSS IP is a CSI decoder and ISP present on Qualcomm platforms.
+
+properties:
+ compatible:
+ const: qcom,x1p42100-camss
+
+ reg:
+ maxItems: 12
+
+ reg-names:
+ items:
+ - const: csid0
+ - const: csid1
+ - const: csid2
+ - const: csid_lite0
+ - const: csid_lite1
+ - const: csid_wrapper
+ - const: csitpg0
+ - const: csitpg1
+ - const: csitpg2
+ - const: vfe0
+ - const: vfe_lite0
+ - const: vfe_lite1
+
+ clocks:
+ maxItems: 14
+
+ clock-names:
+ items:
+ - const: camnoc_rt_axi
+ - const: cpas_ahb
+ - const: cpas_fast_ahb
+ - const: cpas_vfe0
+ - const: cpas_vfe_lite
+ - const: csid
+ - const: csid_csiphy_rx
+ - const: gcc_axi_hf
+ - const: vfe0
+ - const: vfe0_fast_ahb
+ - const: vfe_lite
+ - const: vfe_lite_ahb
+ - const: vfe_lite_cphy_rx
+ - const: vfe_lite_csid
+
+ interrupts:
+ maxItems: 8
+
+ interrupt-names:
+ items:
+ - const: csid0
+ - const: csid1
+ - const: csid2
+ - const: csid_lite0
+ - const: csid_lite1
+ - const: vfe0
+ - const: vfe_lite0
+ - const: vfe_lite1
+
+ interconnects:
+ maxItems: 2
+
+ interconnect-names:
+ items:
+ - const: ahb
+ - const: hf_mnoc
+
+ iommus:
+ items:
+ - description: S1 HLOS IFE and IFE_LITE non-protected read
+ - description: S1 HLOS IFE and IFE_LITE non-protected write
+
+ power-domains:
+ items:
+ - description: IFE0 GDSC - Image Front End, Global Distributed Switch Controller.
+ - description: Titan Top GDSC - Titan ISP Block, Global Distributed Switch Controller.
+
+ power-domain-names:
+ items:
+ - const: ife0
+ - const: top
+
+ ports:
+ $ref: /schemas/graph.yaml#/properties/ports
+
+ description:
+ CSI input ports, one per CSID. Each port receives the CSI data
+ decoded by the matching CSIPHY.
+
+ patternProperties:
+ "^port@[01]$":
+ $ref: /schemas/graph.yaml#/$defs/port-base
+ unevaluatedProperties: false
+ description:
+ Input port for receiving CSI data from a CSIPHY.
+
+ properties:
+ endpoint:
+ $ref: video-interfaces.yaml#
+ unevaluatedProperties: false
+
+ properties:
+ data-lanes:
+ minItems: 1
+ maxItems: 4
+
+ bus-type:
+ enum:
+ - 1 # MEDIA_BUS_TYPE_CSI2_CPHY
+ - 4 # MEDIA_BUS_TYPE_CSI2_DPHY
+
+ required:
+ - data-lanes
+
+required:
+ - compatible
+ - reg
+ - reg-names
+ - clocks
+ - clock-names
+ - interrupts
+ - interrupt-names
+ - interconnects
+ - interconnect-names
+ - iommus
+ - power-domains
+ - power-domain-names
+ - ports
+
+additionalProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+ #include <dt-bindings/clock/qcom,x1e80100-gcc.h>
+ #include <dt-bindings/clock/qcom,x1e80100-camcc.h>
+ #include <dt-bindings/interconnect/qcom,icc.h>
+ #include <dt-bindings/interconnect/qcom,x1e80100-rpmh.h>
+ #include <dt-bindings/power/qcom-rpmpd.h>
+
+ soc {
+ #address-cells = <2>;
+ #size-cells = <2>;
+
+ isp@acb7000 {
+ compatible = "qcom,x1p42100-camss";
+
+ reg = <0 0x0acb7000 0 0x2000>,
+ <0 0x0acb9000 0 0x2000>,
+ <0 0x0acbb000 0 0x2000>,
+ <0 0x0acc6000 0 0x1000>,
+ <0 0x0acca000 0 0x1000>,
+ <0 0x0acb6000 0 0x1000>,
+ <0 0x0acf6000 0 0x1000>,
+ <0 0x0acf7000 0 0x1000>,
+ <0 0x0acf8000 0 0x1000>,
+ <0 0x0ac62000 0 0xf000>,
+ <0 0x0acc7000 0 0x1000>,
+ <0 0x0accb000 0 0x1000>;
+
+ reg-names = "csid0",
+ "csid1",
+ "csid2",
+ "csid_lite0",
+ "csid_lite1",
+ "csid_wrapper",
+ "csitpg0",
+ "csitpg1",
+ "csitpg2",
+ "vfe0",
+ "vfe_lite0",
+ "vfe_lite1";
+
+ clocks = <&camcc CAM_CC_CAMNOC_AXI_RT_CLK>,
+ <&camcc CAM_CC_CPAS_AHB_CLK>,
+ <&camcc CAM_CC_CPAS_FAST_AHB_CLK>,
+ <&camcc CAM_CC_CPAS_IFE_0_CLK>,
+ <&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+ <&camcc CAM_CC_CSID_CLK>,
+ <&camcc CAM_CC_CSID_CSIPHY_RX_CLK>,
+ <&gcc GCC_CAMERA_HF_AXI_CLK>,
+ <&camcc CAM_CC_IFE_0_CLK>,
+ <&camcc CAM_CC_IFE_0_FAST_AHB_CLK>,
+ <&camcc CAM_CC_IFE_LITE_CLK>,
+ <&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+ <&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+ <&camcc CAM_CC_IFE_LITE_CSID_CLK>;
+
+ clock-names = "camnoc_rt_axi",
+ "cpas_ahb",
+ "cpas_fast_ahb",
+ "cpas_vfe0",
+ "cpas_vfe_lite",
+ "csid",
+ "csid_csiphy_rx",
+ "gcc_axi_hf",
+ "vfe0",
+ "vfe0_fast_ahb",
+ "vfe_lite",
+ "vfe_lite_ahb",
+ "vfe_lite_cphy_rx",
+ "vfe_lite_csid";
+
+ interrupts = <GIC_SPI 464 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 466 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 431 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 359 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 360 IRQ_TYPE_EDGE_RISING>;
+
+ interrupt-names = "csid0",
+ "csid1",
+ "csid2",
+ "csid_lite0",
+ "csid_lite1",
+ "vfe0",
+ "vfe_lite0",
+ "vfe_lite1";
+
+ interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+ &config_noc SLAVE_CAMERA_CFG QCOM_ICC_TAG_ACTIVE_ONLY>,
+ <&mmss_noc MASTER_CAMNOC_HF QCOM_ICC_TAG_ALWAYS
+ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+
+ interconnect-names = "ahb",
+ "hf_mnoc";
+
+ iommus = <&apps_smmu 0x800 0x60>,
+ <&apps_smmu 0x820 0x60>;
+
+ power-domains = <&camcc CAM_CC_IFE_0_GDSC>,
+ <&camcc CAM_CC_TITAN_TOP_GDSC>;
+
+ power-domain-names = "ife0",
+ "top";
+
+ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ port@0 {
+ reg = <0>;
+ camss_csiphy0_ep: endpoint {
+ data-lanes = <1 2>;
+ remote-endpoint = <&csiphy0_out>;
+ };
+ };
+ };
+ };
+ };
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v4 2/3] media: qcom: camss: vfe: Eliminate ever expanding src_pad_code switch logic
2026-10-08 8:26 [PATCH v4 0/3] media: camss: add support for purwa platform Wenmeng Liu
2026-10-08 8:26 ` [PATCH v4 1/3] dt-bindings: media: Add qcom,x1p42100-camss Wenmeng Liu
@ 2026-10-08 8:26 ` Wenmeng Liu
2026-10-08 8:27 ` [PATCH v4 3/3] media: qcom: camss: Add support for X1P42100 CAMSS Wenmeng Liu
2 siblings, 0 replies; 6+ messages in thread
From: Wenmeng Liu @ 2026-10-08 8:26 UTC (permalink / raw)
To: Bryan O'Donoghue, Vladimir Zapolskiy, Loic Poulain,
Mauro Carvalho Chehab, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Wenmeng Liu, Bryan O'Donoghue
Cc: linux-media, linux-arm-msm, devicetree, linux-kernel
From: Bryan O'Donoghue <bod@kernel.org>
Use the default case for the common source pad format handling.
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
---
drivers/media/platform/qcom/camss/camss-vfe.c | 19 +------------------
1 file changed, 1 insertion(+), 18 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
index 2680a9914765fa2c8f3c2b38a5f4f0e0bcf4d873..b1d9fe0010e119059c539c20c238c3e050ff7036 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe.c
@@ -340,20 +340,7 @@ static u32 vfe_src_pad_code(struct vfe_line *line, u32 sink_code,
return sink_code;
}
break;
- case CAMSS_660:
- case CAMSS_2290:
- case CAMSS_6150:
- case CAMSS_6350:
- case CAMSS_7280:
- case CAMSS_8x96:
- case CAMSS_8250:
- case CAMSS_8280XP:
- case CAMSS_8300:
- case CAMSS_845:
- case CAMSS_8550:
- case CAMSS_8650:
- case CAMSS_8775P:
- case CAMSS_X1E80100:
+ default:
switch (sink_code) {
case MEDIA_BUS_FMT_YUYV8_1X16:
{
@@ -414,10 +401,6 @@ static u32 vfe_src_pad_code(struct vfe_line *line, u32 sink_code,
return sink_code;
}
break;
- default:
- WARN(1, "Unsupported HW version: %x\n",
- vfe->camss->res->version);
- break;
}
return 0;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v4 3/3] media: qcom: camss: Add support for X1P42100 CAMSS
2026-10-08 8:26 [PATCH v4 0/3] media: camss: add support for purwa platform Wenmeng Liu
2026-10-08 8:26 ` [PATCH v4 1/3] dt-bindings: media: Add qcom,x1p42100-camss Wenmeng Liu
2026-10-08 8:26 ` [PATCH v4 2/3] media: qcom: camss: vfe: Eliminate ever expanding src_pad_code switch logic Wenmeng Liu
@ 2026-10-08 8:27 ` Wenmeng Liu
2026-10-08 8:48 ` sashiko-bot
2026-10-08 11:11 ` Bryan O'Donoghue
2 siblings, 2 replies; 6+ messages in thread
From: Wenmeng Liu @ 2026-10-08 8:27 UTC (permalink / raw)
To: Bryan O'Donoghue, Vladimir Zapolskiy, Loic Poulain,
Mauro Carvalho Chehab, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Wenmeng Liu, Bryan O'Donoghue
Cc: linux-media, linux-arm-msm, devicetree, linux-kernel
Add CAMSS support for the Qualcomm X1P42100 (Purwa) SoC.
The X1P42100 CAMSS is a cut-down variant of the X1E80100 (Hamoa)
CAMSS. Compared to X1E80100 it has:
- 2 x CSIPHY (CSIPHY0 and CSIPHY4) instead of 4
- 1 x IFE instead of 2
- only the ahb and hf_mnoc interconnect paths
The CSID, CSID Lite, IFE Lite and TPG blocks are the same as on
X1E80100, so reuse the existing CSID/VFE 680 ops and the X1E80100
TPG and CSID wrapper resources.
The CSIPHYs are handled through the PHY API, so no CSIPHY
resources other than the lane format are needed.
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
---
drivers/media/platform/qcom/camss/camss-vfe.c | 1 +
drivers/media/platform/qcom/camss/camss.c | 216 ++++++++++++++++++++++++++
drivers/media/platform/qcom/camss/camss.h | 1 +
3 files changed, 218 insertions(+)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
index b1d9fe0010e119059c539c20c238c3e050ff7036..81cb4377586994727006d0ec83e53ac57233f765 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe.c
@@ -1997,6 +1997,7 @@ static int vfe_bpl_align_rdi(struct vfe_device *vfe)
case CAMSS_8650:
case CAMSS_8775P:
case CAMSS_X1E80100:
+ case CAMSS_X1P42100:
ret = 16;
break;
default:
diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
index c54185c93a8a98fc6a20fdb8e0f9f8e61bc41058..7bc6b2e61438da9ce0c100fcaf8f669410a6839e 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -4452,6 +4452,205 @@ static const struct resources_wrapper csid_wrapper_res_x1e80100 = {
.reg = "csid_wrapper",
};
+static const struct camss_subdev_resources csiphy_res_x1p42100[] = {
+ /* CSIPHY0 */
+ {
+ .csiphy = {
+ .id = 0,
+ .hw_ops = &csiphy_ops_3ph_1_0,
+ .formats = &csiphy_formats_sdm845
+ },
+ },
+ /* CSIPHY4 */
+ {
+ .csiphy = {
+ .id = 4,
+ .hw_ops = &csiphy_ops_3ph_1_0,
+ .formats = &csiphy_formats_sdm845
+ },
+ },
+};
+
+static const struct camss_subdev_resources csid_res_x1p42100[] = {
+ /* CSID0 */
+ {
+ .regulators = {},
+ .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb",
+ "csid", "csid_csiphy_rx" },
+ .clock_rate = { { 0 },
+ { 64000000, 80000000 },
+ { 80000000, 100000000, 200000000,
+ 300000000, 400000000 },
+ { 300000000, 400000000, 480000000 },
+ { 300000000, 400000000, 480000000 }, },
+ .reg = { "csid0" },
+ .interrupt = { "csid0" },
+ .csid = {
+ .hw_ops = &csid_ops_680,
+ .parent_dev_ops = &vfe_parent_dev_ops,
+ .formats = &csid_formats_gen2
+ },
+ },
+ /* CSID1 */
+ {
+ .regulators = {},
+ .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb",
+ "csid", "csid_csiphy_rx" },
+ .clock_rate = { { 0 },
+ { 64000000, 80000000 },
+ { 80000000, 100000000, 200000000,
+ 300000000, 400000000 },
+ { 300000000, 400000000, 480000000 },
+ { 300000000, 400000000, 480000000 }, },
+ .reg = { "csid1" },
+ .interrupt = { "csid1" },
+ .csid = {
+ .hw_ops = &csid_ops_680,
+ .parent_dev_ops = &vfe_parent_dev_ops,
+ .formats = &csid_formats_gen2
+ },
+ },
+ /* CSID2 */
+ {
+ .regulators = {},
+ .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb",
+ "csid", "csid_csiphy_rx" },
+ .clock_rate = { { 0 },
+ { 64000000, 80000000 },
+ { 80000000, 100000000, 200000000,
+ 300000000, 400000000 },
+ { 300000000, 400000000, 480000000 },
+ { 300000000, 400000000, 480000000 }, },
+ .reg = { "csid2" },
+ .interrupt = { "csid2" },
+ .csid = {
+ .hw_ops = &csid_ops_680,
+ .parent_dev_ops = &vfe_parent_dev_ops,
+ .formats = &csid_formats_gen2
+ },
+ },
+ /* CSID_LITE0 */
+ {
+ .regulators = {},
+ .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb",
+ "csid", "csid_csiphy_rx" },
+ .clock_rate = { { 0 },
+ { 64000000, 80000000 },
+ { 80000000, 100000000, 200000000,
+ 300000000, 400000000 },
+ { 300000000, 400000000, 480000000 },
+ { 300000000, 400000000, 480000000 }, },
+ .reg = { "csid_lite0" },
+ .interrupt = { "csid_lite0" },
+ .csid = {
+ .is_lite = true,
+ .hw_ops = &csid_ops_680,
+ .parent_dev_ops = &vfe_parent_dev_ops,
+ .formats = &csid_formats_gen2
+ }
+ },
+ /* CSID_LITE1 */
+ {
+ .regulators = {},
+ .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb",
+ "csid", "csid_csiphy_rx" },
+ .clock_rate = { { 0 },
+ { 64000000, 80000000 },
+ { 80000000, 100000000, 200000000,
+ 300000000, 400000000 },
+ { 300000000, 400000000, 480000000 },
+ { 300000000, 400000000, 480000000 }, },
+ .reg = { "csid_lite1" },
+ .interrupt = { "csid_lite1" },
+ .csid = {
+ .is_lite = true,
+ .hw_ops = &csid_ops_680,
+ .parent_dev_ops = &vfe_parent_dev_ops,
+ .formats = &csid_formats_gen2
+ }
+ },
+};
+
+static const struct camss_subdev_resources vfe_res_x1p42100[] = {
+ /* IFE0 */
+ {
+ .regulators = {},
+ .clock = { "camnoc_rt_axi", "cpas_ahb", "cpas_fast_ahb",
+ "cpas_vfe0", "vfe0_fast_ahb", "vfe0" },
+ .clock_rate = { { 400000000 },
+ { 0 },
+ { 0 },
+ { 0 },
+ { 0 },
+ { 345600000, 432000000, 594000000, 675000000,
+ 727000000 }, },
+ .reg = { "vfe0" },
+ .interrupt = { "vfe0" },
+ .vfe = {
+ .line_num = 4,
+ .pd_name = "ife0",
+ .hw_ops = &vfe_ops_680,
+ .formats_rdi = &vfe_formats_rdi_845,
+ .formats_pix = &vfe_formats_pix_845
+ },
+ },
+ /* IFE_LITE_0 */
+ {
+ .regulators = {},
+ .clock = { "camnoc_rt_axi", "cpas_ahb", "vfe_lite_ahb",
+ "cpas_vfe_lite", "vfe_lite", "vfe_lite_csid" },
+ .clock_rate = { { 400000000 },
+ { 0 },
+ { 0 },
+ { 0 },
+ { 266666667, 400000000, 480000000 },
+ { 266666667, 400000000, 480000000 }, },
+ .reg = { "vfe_lite0" },
+ .interrupt = { "vfe_lite0" },
+ .vfe = {
+ .is_lite = true,
+ .line_num = 4,
+ .hw_ops = &vfe_ops_680,
+ .formats_rdi = &vfe_formats_rdi_845,
+ .formats_pix = &vfe_formats_pix_845
+ },
+ },
+ /* IFE_LITE_1 */
+ {
+ .regulators = {},
+ .clock = { "camnoc_rt_axi", "cpas_ahb", "vfe_lite_ahb",
+ "cpas_vfe_lite", "vfe_lite", "vfe_lite_csid" },
+ .clock_rate = { { 400000000 },
+ { 0 },
+ { 0 },
+ { 0 },
+ { 266666667, 400000000, 480000000 },
+ { 266666667, 400000000, 480000000 }, },
+ .reg = { "vfe_lite1" },
+ .interrupt = { "vfe_lite1" },
+ .vfe = {
+ .is_lite = true,
+ .line_num = 4,
+ .hw_ops = &vfe_ops_680,
+ .formats_rdi = &vfe_formats_rdi_845,
+ .formats_pix = &vfe_formats_pix_845
+ },
+ },
+};
+
+static const struct resources_icc icc_res_x1p42100[] = {
+ {
+ .name = "ahb",
+ .icc_bw_tbl.avg = 150000,
+ .icc_bw_tbl.peak = 300000,
+ },
+ {
+ .name = "hf_mnoc",
+ .icc_bw_tbl.avg = 2097152,
+ .icc_bw_tbl.peak = 2097152,
+ },
+};
+
/*
* camss_add_clock_margin - Add margin to clock frequency rate
* @rate: Clock frequency rate
@@ -5809,6 +6008,22 @@ static const struct camss_resources x1e80100_resources = {
.vfe_num = ARRAY_SIZE(vfe_res_x1e80100),
};
+static const struct camss_resources x1p42100_resources = {
+ .version = CAMSS_X1P42100,
+ .pd_name = "top",
+ .csiphy_res = csiphy_res_x1p42100,
+ .tpg_res = tpg_res_x1e80100,
+ .csid_res = csid_res_x1p42100,
+ .vfe_res = vfe_res_x1p42100,
+ .csid_wrapper_res = &csid_wrapper_res_x1e80100,
+ .icc_res = icc_res_x1p42100,
+ .icc_path_num = ARRAY_SIZE(icc_res_x1p42100),
+ .csiphy_num = ARRAY_SIZE(csiphy_res_x1p42100),
+ .tpg_num = ARRAY_SIZE(tpg_res_x1e80100),
+ .csid_num = ARRAY_SIZE(csid_res_x1p42100),
+ .vfe_num = ARRAY_SIZE(vfe_res_x1p42100),
+};
+
static const struct of_device_id camss_dt_match[] = {
{ .compatible = "qcom,msm8916-camss", .data = &msm8916_resources },
{ .compatible = "qcom,msm8939-camss", .data = &msm8939_resources },
@@ -5828,6 +6043,7 @@ static const struct of_device_id camss_dt_match[] = {
{ .compatible = "qcom,sm8550-camss", .data = &sm8550_resources },
{ .compatible = "qcom,sm8650-camss", .data = &sm8650_resources },
{ .compatible = "qcom,x1e80100-camss", .data = &x1e80100_resources },
+ { .compatible = "qcom,x1p42100-camss", .data = &x1p42100_resources },
{ .compatible = "qcom,glymur-camss", .data = &x1e80100_resources },
{ }
};
diff --git a/drivers/media/platform/qcom/camss/camss.h b/drivers/media/platform/qcom/camss/camss.h
index 7dc2fd9f03e0dc2ded8e4a603d6cfec4d8e6a62b..523050295209d84e7f72f54bce9a96ed9df442aa 100644
--- a/drivers/media/platform/qcom/camss/camss.h
+++ b/drivers/media/platform/qcom/camss/camss.h
@@ -97,6 +97,7 @@ enum camss_version {
CAMSS_8650,
CAMSS_8775P,
CAMSS_X1E80100,
+ CAMSS_X1P42100,
};
enum icc_count {
--
2.34.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v4 3/3] media: qcom: camss: Add support for X1P42100 CAMSS
2026-10-08 8:27 ` [PATCH v4 3/3] media: qcom: camss: Add support for X1P42100 CAMSS Wenmeng Liu
@ 2026-10-08 8:48 ` sashiko-bot
2026-10-08 11:11 ` Bryan O'Donoghue
1 sibling, 0 replies; 6+ messages in thread
From: sashiko-bot @ 2026-10-08 8:48 UTC (permalink / raw)
To: Wenmeng Liu; +Cc: conor+dt, devicetree, robh, media-ci
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] media: camss: mismatched CSID to VFE indices break power on
- [High] media: camss: null dereference during probe with malformed DT on X1P42100
- [High] media: camss: missing bounds check on DT port number leads to OOB write
--
commit ab38e0eb97dc4d60c438b6b2e2fd2590708e04a4
Author: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
media: qcom: camss: Add support for X1P42100 CAMSS
This commit adds CAMSS support for the Qualcomm X1P42100 (Purwa) SoC.
It defines the X1P42100 hardware configuration, reusing existing CSID/VFE ops
while omitting unused components like CSIPHY1-3 and one IFE.
> diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
> index c54185c93a8a9..7bc6b2e61438d 100644
> --- a/drivers/media/platform/qcom/camss/camss.c
> +++ b/drivers/media/platform/qcom/camss/camss.c
> @@ -4452,6 +4452,205 @@ static const struct resources_wrapper csid_wrapper_res_x1e80100 = {
> .reg = "csid_wrapper",
> };
>
> +static const struct camss_subdev_resources csiphy_res_x1p42100[] = {
> + /* CSIPHY0 */
> + {
> + .csiphy = {
> + .id = 0,
> + .hw_ops = &csiphy_ops_3ph_1_0,
> + .formats = &csiphy_formats_sdm845
> + },
> + },
[Severity: High]
If camss_detect_legacy_phy() falls back to legacy_phy = true due to a
malformed device tree without a phy remote endpoint, camss_init_subdevices()
invokes msm_csiphy_subdev_init_legacy().
That function attempts to map memory using res->reg[0], but since this
structure does not define .reg, it passes a NULL pointer to
platform_get_resource_byname() which then crashes in strcmp().
Additionally, csiphy_init() lacks a case for CAMSS_X1P42100, which leaves
regs->lane_regs uninitialized in this fallback path.
Will this cause a NULL pointer dereference during driver probe?
> + /* CSIPHY4 */
> + {
> + .csiphy = {
> + .id = 4,
> + .hw_ops = &csiphy_ops_3ph_1_0,
> + .formats = &csiphy_formats_sdm845
> + },
> + },
> +};
[Severity: High]
When parsing endpoints from the device tree, camss_parse_endpoint_node()
assigns the device tree port number directly to csd->interface.csiphy_id
without bounds checking against csiphy_num.
If port 4 is used in the device tree to match this hardware ID, csiphy_id
becomes 4. Later, camss_subdev_notifier_bound() uses this unvalidated id
to index into the camss->csiphy array.
Since that array only has 2 elements allocated for X1P42100, could defining
this with id 4 lead to an out-of-bounds memory overwrite during subdevice
binding?
[ ... ]
> +static const struct camss_resources x1p42100_resources = {
> + .version = CAMSS_X1P42100,
> + .pd_name = "top",
> + .csiphy_res = csiphy_res_x1p42100,
> + .tpg_res = tpg_res_x1e80100,
> + .csid_res = csid_res_x1p42100,
> + .vfe_res = vfe_res_x1p42100,
> + .csid_wrapper_res = &csid_wrapper_res_x1e80100,
> + .icc_res = icc_res_x1p42100,
> + .icc_path_num = ARRAY_SIZE(icc_res_x1p42100),
> + .csiphy_num = ARRAY_SIZE(csiphy_res_x1p42100),
> + .tpg_num = ARRAY_SIZE(tpg_res_x1e80100),
> + .csid_num = ARRAY_SIZE(csid_res_x1p42100),
> + .vfe_num = ARRAY_SIZE(vfe_res_x1p42100),
> +};
[Severity: High]
During initialization, csid->id is assigned the index from the resource
array (0 to 4). When csid_set_power() attempts to power on its paired VFE
using its own ID, it calls vfe_parent_dev_ops_get() which checks
if id < camss->res->vfe_num.
For IDs 3 and 4 (CSID_LITE0 and CSID_LITE1), this bounds check fails and
unconditionally returns -EINVAL, aborting the power-up.
Additionally, this 1:1 index pairing appears to cause CSID1 and CSID2 to
incorrectly power up IFE_LITE_0 and IFE_LITE_1 instead of their expected
components.
Does the mismatch between the number of CSIDs (5) and VFEs (3) break the
power-on sequence for the CSID blocks?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261008-purwa_camss-v4-0-bcf11bf2c650@oss.qualcomm.com?part=3
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v4 3/3] media: qcom: camss: Add support for X1P42100 CAMSS
2026-10-08 8:27 ` [PATCH v4 3/3] media: qcom: camss: Add support for X1P42100 CAMSS Wenmeng Liu
2026-10-08 8:48 ` sashiko-bot
@ 2026-10-08 11:11 ` Bryan O'Donoghue
1 sibling, 0 replies; 6+ messages in thread
From: Bryan O'Donoghue @ 2026-10-08 11:11 UTC (permalink / raw)
To: Wenmeng Liu, Bryan O'Donoghue, Vladimir Zapolskiy,
Loic Poulain, Mauro Carvalho Chehab, Rob Herring,
Krzysztof Kozlowski, Conor Dooley
Cc: linux-media, linux-arm-msm, devicetree, linux-kernel
On 08/10/2026 09:27, Wenmeng Liu wrote:
> +static const struct camss_subdev_resources vfe_res_x1p42100[] = {
> + /* IFE0 */
> + {
> + .regulators = {},
> + .clock = { "camnoc_rt_axi", "cpas_ahb", "cpas_fast_ahb",
> + "cpas_vfe0", "vfe0_fast_ahb", "vfe0" },
> + .clock_rate = { { 400000000 },
> + { 0 },
> + { 0 },
> + { 0 },
> + { 0 },
> + { 345600000, 432000000, 594000000, 675000000,
> + 727000000 }, },
> + .reg = { "vfe0" },
> + .interrupt = { "vfe0" },
> + .vfe = {
> + .line_num = 4,
.line_num = 3 until we merge PIX support please.
> + .pd_name = "ife0",
> + .hw_ops = &vfe_ops_680,
> + .formats_rdi = &vfe_formats_rdi_845,
> + .formats_pix = &vfe_formats_pix_845
> + },
> + },
> + /* IFE_LITE_0 */
> + {
> + .regulators = {},
> + .clock = { "camnoc_rt_axi", "cpas_ahb", "vfe_lite_ahb",
> + "cpas_vfe_lite", "vfe_lite", "vfe_lite_csid" },
> + .clock_rate = { { 400000000 },
> + { 0 },
> + { 0 },
> + { 0 },
> + { 266666667, 400000000, 480000000 },
> + { 266666667, 400000000, 480000000 }, },
> + .reg = { "vfe_lite0" },
> + .interrupt = { "vfe_lite0" },
> + .vfe = {
> + .is_lite = true,
> + .line_num = 4,
> + .hw_ops = &vfe_ops_680,
> + .formats_rdi = &vfe_formats_rdi_845,
> + .formats_pix = &vfe_formats_pix_845
> + },
> + },
> + /* IFE_LITE_1 */
> + {
> + .regulators = {},
> + .clock = { "camnoc_rt_axi", "cpas_ahb", "vfe_lite_ahb",
> + "cpas_vfe_lite", "vfe_lite", "vfe_lite_csid" },
> + .clock_rate = { { 400000000 },
> + { 0 },
> + { 0 },
> + { 0 },
> + { 266666667, 400000000, 480000000 },
> + { 266666667, 400000000, 480000000 }, },
> + .reg = { "vfe_lite1" },
> + .interrupt = { "vfe_lite1" },
> + .vfe = {
> + .is_lite = true,
> + .line_num = 4,
VFE lite has four RDIs so this stays @ 4.
> + .hw_ops = &vfe_ops_680,
> + .formats_rdi = &vfe_formats_rdi_845,
> + .formats_pix = &vfe_formats_pix_845
> + },
> + },
> +};
---
bod
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-08 11:11 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-08 8:26 [PATCH v4 0/3] media: camss: add support for purwa platform Wenmeng Liu
2026-10-08 8:26 ` [PATCH v4 1/3] dt-bindings: media: Add qcom,x1p42100-camss Wenmeng Liu
2026-10-08 8:26 ` [PATCH v4 2/3] media: qcom: camss: vfe: Eliminate ever expanding src_pad_code switch logic Wenmeng Liu
2026-10-08 8:27 ` [PATCH v4 3/3] media: qcom: camss: Add support for X1P42100 CAMSS Wenmeng Liu
2026-10-08 8:48 ` sashiko-bot
2026-10-08 11:11 ` Bryan O'Donoghue
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox