* [PATCH v5 0/3] media: camss: add support for purwa platform
@ 2026-10-09 8:11 Wenmeng Liu
2026-10-09 8:11 ` [PATCH v5 1/3] dt-bindings: media: Add qcom,x1p42100-camss Wenmeng Liu
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Wenmeng Liu @ 2026-10-09 8:11 UTC (permalink / raw)
To: Bryan O'Donoghue, Vladimir Zapolskiy, Loic Poulain,
Mauro Carvalho Chehab, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Wenmeng Liu, Bryan O'Donoghue
Cc: linux-media, linux-arm-msm, devicetree, linux-kernel,
Krzysztof Kozlowski
This series adds camss support for purwa platform.
Validated on the Purwa EVK with the OG0VA1B sensor.
---
Changes in v5:
- Set line_num of IFE0 to 3. -- Bryan
- Introduce CAMSS_CSIPHY_RES_PHY_API() to describe PHY API based csiphy
resources and use it for X1P42100. -- Bryan
- Link to v4: https://lore.kernel.org/r/20261008-purwa_camss-v4-0-bcf11bf2c650@oss.qualcomm.com
Changes in v4:
- Collect R-b tags from Bryan and Krzysztof on dt-bindings patch.
- Rebase on linux-next and add Bryan`s vfe patch.
- Link to v3: https://lore.kernel.org/all/20260930-purwa_camss-v3-0-0fe2a5b11208@oss.qualcomm.com
Changes in v3:
- Rebased on the latest CSIPHY code.
- Link to v2: https://lore.kernel.org/r/20260511-purwa_camss-v2-0-22608ab9126c@oss.qualcomm.com
Changes in v2:
- Based on the old version of csiphy.
- Remove Src clk. -- Bryan
- Extend the register block of the VFE. -- Bryan
- Add comments for IOMMU. -- Bryan
- Link to v1: https://lore.kernel.org/r/20260410-purwa_camss-v1-0-eedcf6d9d8ee@oss.qualcomm.com
---
Bryan O'Donoghue (1):
media: qcom: camss: vfe: Eliminate ever expanding src_pad_code switch logic
Wenmeng Liu (2):
dt-bindings: media: Add qcom,x1p42100-camss
media: qcom: camss: Add support for X1P42100 CAMSS
.../bindings/media/qcom,x1p42100-camss.yaml | 263 +++++++++++++++++++++
drivers/media/platform/qcom/camss/camss-vfe.c | 20 +-
drivers/media/platform/qcom/camss/camss.c | 215 +++++++++++++++++
drivers/media/platform/qcom/camss/camss.h | 1 +
4 files changed, 481 insertions(+), 18 deletions(-)
---
base-commit: b018686719706a781c45a874ed51374a2dc4b767
change-id: 20260409-purwa_camss-475787b87e14
Best regards,
--
Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v5 1/3] dt-bindings: media: Add qcom,x1p42100-camss
2026-10-09 8:11 [PATCH v5 0/3] media: camss: add support for purwa platform Wenmeng Liu
@ 2026-10-09 8:11 ` Wenmeng Liu
2026-10-09 8:11 ` [PATCH v5 2/3] media: qcom: camss: vfe: Eliminate ever expanding src_pad_code switch logic Wenmeng Liu
2026-10-09 8:11 ` [PATCH v5 3/3] media: qcom: camss: Add support for X1P42100 CAMSS Wenmeng Liu
2 siblings, 0 replies; 5+ messages in thread
From: Wenmeng Liu @ 2026-10-09 8:11 UTC (permalink / raw)
To: Bryan O'Donoghue, Vladimir Zapolskiy, Loic Poulain,
Mauro Carvalho Chehab, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Wenmeng Liu, Bryan O'Donoghue
Cc: linux-media, linux-arm-msm, devicetree, linux-kernel,
Krzysztof Kozlowski
Add bindings for the Camera Subsystem for X1P42100.
The X1P42100 platform provides:
- 2 x CSIPHY
- 3 x TPG
- 3 x CSID
- 2 x CSID Lite
- 1 x IFE
- 2 x IFE Lite
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
---
.../bindings/media/qcom,x1p42100-camss.yaml | 263 +++++++++++++++++++++
1 file changed, 263 insertions(+)
diff --git a/Documentation/devicetree/bindings/media/qcom,x1p42100-camss.yaml b/Documentation/devicetree/bindings/media/qcom,x1p42100-camss.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..c5ea7a7d9fe5025bb15cbddd85b915d136083447
--- /dev/null
+++ b/Documentation/devicetree/bindings/media/qcom,x1p42100-camss.yaml
@@ -0,0 +1,263 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/media/qcom,x1p42100-camss.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm X1P42100 Camera Subsystem (CAMSS)
+
+maintainers:
+ - Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
+
+description:
+ The CAMSS IP is a CSI decoder and ISP present on Qualcomm platforms.
+
+properties:
+ compatible:
+ const: qcom,x1p42100-camss
+
+ reg:
+ maxItems: 12
+
+ reg-names:
+ items:
+ - const: csid0
+ - const: csid1
+ - const: csid2
+ - const: csid_lite0
+ - const: csid_lite1
+ - const: csid_wrapper
+ - const: csitpg0
+ - const: csitpg1
+ - const: csitpg2
+ - const: vfe0
+ - const: vfe_lite0
+ - const: vfe_lite1
+
+ clocks:
+ maxItems: 14
+
+ clock-names:
+ items:
+ - const: camnoc_rt_axi
+ - const: cpas_ahb
+ - const: cpas_fast_ahb
+ - const: cpas_vfe0
+ - const: cpas_vfe_lite
+ - const: csid
+ - const: csid_csiphy_rx
+ - const: gcc_axi_hf
+ - const: vfe0
+ - const: vfe0_fast_ahb
+ - const: vfe_lite
+ - const: vfe_lite_ahb
+ - const: vfe_lite_cphy_rx
+ - const: vfe_lite_csid
+
+ interrupts:
+ maxItems: 8
+
+ interrupt-names:
+ items:
+ - const: csid0
+ - const: csid1
+ - const: csid2
+ - const: csid_lite0
+ - const: csid_lite1
+ - const: vfe0
+ - const: vfe_lite0
+ - const: vfe_lite1
+
+ interconnects:
+ maxItems: 2
+
+ interconnect-names:
+ items:
+ - const: ahb
+ - const: hf_mnoc
+
+ iommus:
+ items:
+ - description: S1 HLOS IFE and IFE_LITE non-protected read
+ - description: S1 HLOS IFE and IFE_LITE non-protected write
+
+ power-domains:
+ items:
+ - description: IFE0 GDSC - Image Front End, Global Distributed Switch Controller.
+ - description: Titan Top GDSC - Titan ISP Block, Global Distributed Switch Controller.
+
+ power-domain-names:
+ items:
+ - const: ife0
+ - const: top
+
+ ports:
+ $ref: /schemas/graph.yaml#/properties/ports
+
+ description:
+ CSI input ports, one per CSID. Each port receives the CSI data
+ decoded by the matching CSIPHY.
+
+ patternProperties:
+ "^port@[01]$":
+ $ref: /schemas/graph.yaml#/$defs/port-base
+ unevaluatedProperties: false
+ description:
+ Input port for receiving CSI data from a CSIPHY.
+
+ properties:
+ endpoint:
+ $ref: video-interfaces.yaml#
+ unevaluatedProperties: false
+
+ properties:
+ data-lanes:
+ minItems: 1
+ maxItems: 4
+
+ bus-type:
+ enum:
+ - 1 # MEDIA_BUS_TYPE_CSI2_CPHY
+ - 4 # MEDIA_BUS_TYPE_CSI2_DPHY
+
+ required:
+ - data-lanes
+
+required:
+ - compatible
+ - reg
+ - reg-names
+ - clocks
+ - clock-names
+ - interrupts
+ - interrupt-names
+ - interconnects
+ - interconnect-names
+ - iommus
+ - power-domains
+ - power-domain-names
+ - ports
+
+additionalProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+ #include <dt-bindings/clock/qcom,x1e80100-gcc.h>
+ #include <dt-bindings/clock/qcom,x1e80100-camcc.h>
+ #include <dt-bindings/interconnect/qcom,icc.h>
+ #include <dt-bindings/interconnect/qcom,x1e80100-rpmh.h>
+ #include <dt-bindings/power/qcom-rpmpd.h>
+
+ soc {
+ #address-cells = <2>;
+ #size-cells = <2>;
+
+ isp@acb7000 {
+ compatible = "qcom,x1p42100-camss";
+
+ reg = <0 0x0acb7000 0 0x2000>,
+ <0 0x0acb9000 0 0x2000>,
+ <0 0x0acbb000 0 0x2000>,
+ <0 0x0acc6000 0 0x1000>,
+ <0 0x0acca000 0 0x1000>,
+ <0 0x0acb6000 0 0x1000>,
+ <0 0x0acf6000 0 0x1000>,
+ <0 0x0acf7000 0 0x1000>,
+ <0 0x0acf8000 0 0x1000>,
+ <0 0x0ac62000 0 0xf000>,
+ <0 0x0acc7000 0 0x1000>,
+ <0 0x0accb000 0 0x1000>;
+
+ reg-names = "csid0",
+ "csid1",
+ "csid2",
+ "csid_lite0",
+ "csid_lite1",
+ "csid_wrapper",
+ "csitpg0",
+ "csitpg1",
+ "csitpg2",
+ "vfe0",
+ "vfe_lite0",
+ "vfe_lite1";
+
+ clocks = <&camcc CAM_CC_CAMNOC_AXI_RT_CLK>,
+ <&camcc CAM_CC_CPAS_AHB_CLK>,
+ <&camcc CAM_CC_CPAS_FAST_AHB_CLK>,
+ <&camcc CAM_CC_CPAS_IFE_0_CLK>,
+ <&camcc CAM_CC_CPAS_IFE_LITE_CLK>,
+ <&camcc CAM_CC_CSID_CLK>,
+ <&camcc CAM_CC_CSID_CSIPHY_RX_CLK>,
+ <&gcc GCC_CAMERA_HF_AXI_CLK>,
+ <&camcc CAM_CC_IFE_0_CLK>,
+ <&camcc CAM_CC_IFE_0_FAST_AHB_CLK>,
+ <&camcc CAM_CC_IFE_LITE_CLK>,
+ <&camcc CAM_CC_IFE_LITE_AHB_CLK>,
+ <&camcc CAM_CC_IFE_LITE_CPHY_RX_CLK>,
+ <&camcc CAM_CC_IFE_LITE_CSID_CLK>;
+
+ clock-names = "camnoc_rt_axi",
+ "cpas_ahb",
+ "cpas_fast_ahb",
+ "cpas_vfe0",
+ "cpas_vfe_lite",
+ "csid",
+ "csid_csiphy_rx",
+ "gcc_axi_hf",
+ "vfe0",
+ "vfe0_fast_ahb",
+ "vfe_lite",
+ "vfe_lite_ahb",
+ "vfe_lite_cphy_rx",
+ "vfe_lite_csid";
+
+ interrupts = <GIC_SPI 464 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 466 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 431 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 468 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 359 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 465 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 469 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 360 IRQ_TYPE_EDGE_RISING>;
+
+ interrupt-names = "csid0",
+ "csid1",
+ "csid2",
+ "csid_lite0",
+ "csid_lite1",
+ "vfe0",
+ "vfe_lite0",
+ "vfe_lite1";
+
+ interconnects = <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+ &config_noc SLAVE_CAMERA_CFG QCOM_ICC_TAG_ACTIVE_ONLY>,
+ <&mmss_noc MASTER_CAMNOC_HF QCOM_ICC_TAG_ALWAYS
+ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+
+ interconnect-names = "ahb",
+ "hf_mnoc";
+
+ iommus = <&apps_smmu 0x800 0x60>,
+ <&apps_smmu 0x820 0x60>;
+
+ power-domains = <&camcc CAM_CC_IFE_0_GDSC>,
+ <&camcc CAM_CC_TITAN_TOP_GDSC>;
+
+ power-domain-names = "ife0",
+ "top";
+
+ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ port@0 {
+ reg = <0>;
+ camss_csiphy0_ep: endpoint {
+ data-lanes = <1 2>;
+ remote-endpoint = <&csiphy0_out>;
+ };
+ };
+ };
+ };
+ };
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v5 2/3] media: qcom: camss: vfe: Eliminate ever expanding src_pad_code switch logic
2026-10-09 8:11 [PATCH v5 0/3] media: camss: add support for purwa platform Wenmeng Liu
2026-10-09 8:11 ` [PATCH v5 1/3] dt-bindings: media: Add qcom,x1p42100-camss Wenmeng Liu
@ 2026-10-09 8:11 ` Wenmeng Liu
2026-10-09 8:11 ` [PATCH v5 3/3] media: qcom: camss: Add support for X1P42100 CAMSS Wenmeng Liu
2 siblings, 0 replies; 5+ messages in thread
From: Wenmeng Liu @ 2026-10-09 8:11 UTC (permalink / raw)
To: Bryan O'Donoghue, Vladimir Zapolskiy, Loic Poulain,
Mauro Carvalho Chehab, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Wenmeng Liu, Bryan O'Donoghue
Cc: linux-media, linux-arm-msm, devicetree, linux-kernel
From: Bryan O'Donoghue <bod@kernel.org>
Use the default case for the common source pad format handling.
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
---
drivers/media/platform/qcom/camss/camss-vfe.c | 19 +------------------
1 file changed, 1 insertion(+), 18 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
index 2680a9914765fa2c8f3c2b38a5f4f0e0bcf4d873..b1d9fe0010e119059c539c20c238c3e050ff7036 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe.c
@@ -340,20 +340,7 @@ static u32 vfe_src_pad_code(struct vfe_line *line, u32 sink_code,
return sink_code;
}
break;
- case CAMSS_660:
- case CAMSS_2290:
- case CAMSS_6150:
- case CAMSS_6350:
- case CAMSS_7280:
- case CAMSS_8x96:
- case CAMSS_8250:
- case CAMSS_8280XP:
- case CAMSS_8300:
- case CAMSS_845:
- case CAMSS_8550:
- case CAMSS_8650:
- case CAMSS_8775P:
- case CAMSS_X1E80100:
+ default:
switch (sink_code) {
case MEDIA_BUS_FMT_YUYV8_1X16:
{
@@ -414,10 +401,6 @@ static u32 vfe_src_pad_code(struct vfe_line *line, u32 sink_code,
return sink_code;
}
break;
- default:
- WARN(1, "Unsupported HW version: %x\n",
- vfe->camss->res->version);
- break;
}
return 0;
}
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH v5 3/3] media: qcom: camss: Add support for X1P42100 CAMSS
2026-10-09 8:11 [PATCH v5 0/3] media: camss: add support for purwa platform Wenmeng Liu
2026-10-09 8:11 ` [PATCH v5 1/3] dt-bindings: media: Add qcom,x1p42100-camss Wenmeng Liu
2026-10-09 8:11 ` [PATCH v5 2/3] media: qcom: camss: vfe: Eliminate ever expanding src_pad_code switch logic Wenmeng Liu
@ 2026-10-09 8:11 ` Wenmeng Liu
2026-10-09 8:28 ` sashiko-bot
2 siblings, 1 reply; 5+ messages in thread
From: Wenmeng Liu @ 2026-10-09 8:11 UTC (permalink / raw)
To: Bryan O'Donoghue, Vladimir Zapolskiy, Loic Poulain,
Mauro Carvalho Chehab, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Wenmeng Liu, Bryan O'Donoghue
Cc: linux-media, linux-arm-msm, devicetree, linux-kernel
Add CAMSS support for the Qualcomm X1P42100 (Purwa) SoC.
The X1P42100 CAMSS is a cut-down variant of the X1E80100 (Hamoa)
CAMSS. Compared to X1E80100 it has:
- 2 x CSIPHY (CSIPHY0 and CSIPHY4) instead of 4
- 1 x IFE instead of 2
- only the ahb and hf_mnoc interconnect paths
The CSID, CSID Lite, IFE Lite and TPG blocks are the same as on
X1E80100, so reuse the existing CSID/VFE 680 ops and the X1E80100
TPG and CSID wrapper resources.
The CSIPHYs are handled through the PHY API, so no CSIPHY
resources other than the lane format are needed.
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
---
drivers/media/platform/qcom/camss/camss-vfe.c | 1 +
drivers/media/platform/qcom/camss/camss.c | 215 ++++++++++++++++++++++++++
drivers/media/platform/qcom/camss/camss.h | 1 +
3 files changed, 217 insertions(+)
diff --git a/drivers/media/platform/qcom/camss/camss-vfe.c b/drivers/media/platform/qcom/camss/camss-vfe.c
index b1d9fe0010e119059c539c20c238c3e050ff7036..81cb4377586994727006d0ec83e53ac57233f765 100644
--- a/drivers/media/platform/qcom/camss/camss-vfe.c
+++ b/drivers/media/platform/qcom/camss/camss-vfe.c
@@ -1997,6 +1997,7 @@ static int vfe_bpl_align_rdi(struct vfe_device *vfe)
case CAMSS_8650:
case CAMSS_8775P:
case CAMSS_X1E80100:
+ case CAMSS_X1P42100:
ret = 16;
break;
default:
diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
index c54185c93a8a98fc6a20fdb8e0f9f8e61bc41058..5f0e5cadc06d51e16668d23ef9a3d8f13be81724 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -36,6 +36,13 @@
/* Top-level CAMSS version register */
#define CAMSS_HW_VERSION 0x0
+/* CSIPHY resources for PHY API devices, only id and formats are needed */
+#define CAMSS_CSIPHY_RES_PHY_API(_id, _formats) \
+ .csiphy = { \
+ .id = (_id), \
+ .formats = (_formats), \
+ }
+
static const struct parent_dev_ops vfe_parent_dev_ops;
static const struct camss_subdev_resources csiphy_res_8x16[] = {
@@ -4452,6 +4459,197 @@ static const struct resources_wrapper csid_wrapper_res_x1e80100 = {
.reg = "csid_wrapper",
};
+static const struct camss_subdev_resources csiphy_res_x1p42100[] = {
+ /* CSIPHY0 */
+ {
+ CAMSS_CSIPHY_RES_PHY_API(0, &csiphy_formats_sdm845),
+ },
+ /* CSIPHY4 */
+ {
+ CAMSS_CSIPHY_RES_PHY_API(4, &csiphy_formats_sdm845),
+ },
+};
+
+static const struct camss_subdev_resources csid_res_x1p42100[] = {
+ /* CSID0 */
+ {
+ .regulators = {},
+ .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb",
+ "csid", "csid_csiphy_rx" },
+ .clock_rate = { { 0 },
+ { 64000000, 80000000 },
+ { 80000000, 100000000, 200000000,
+ 300000000, 400000000 },
+ { 300000000, 400000000, 480000000 },
+ { 300000000, 400000000, 480000000 }, },
+ .reg = { "csid0" },
+ .interrupt = { "csid0" },
+ .csid = {
+ .hw_ops = &csid_ops_680,
+ .parent_dev_ops = &vfe_parent_dev_ops,
+ .formats = &csid_formats_gen2
+ },
+ },
+ /* CSID1 */
+ {
+ .regulators = {},
+ .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb",
+ "csid", "csid_csiphy_rx" },
+ .clock_rate = { { 0 },
+ { 64000000, 80000000 },
+ { 80000000, 100000000, 200000000,
+ 300000000, 400000000 },
+ { 300000000, 400000000, 480000000 },
+ { 300000000, 400000000, 480000000 }, },
+ .reg = { "csid1" },
+ .interrupt = { "csid1" },
+ .csid = {
+ .hw_ops = &csid_ops_680,
+ .parent_dev_ops = &vfe_parent_dev_ops,
+ .formats = &csid_formats_gen2
+ },
+ },
+ /* CSID2 */
+ {
+ .regulators = {},
+ .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb",
+ "csid", "csid_csiphy_rx" },
+ .clock_rate = { { 0 },
+ { 64000000, 80000000 },
+ { 80000000, 100000000, 200000000,
+ 300000000, 400000000 },
+ { 300000000, 400000000, 480000000 },
+ { 300000000, 400000000, 480000000 }, },
+ .reg = { "csid2" },
+ .interrupt = { "csid2" },
+ .csid = {
+ .hw_ops = &csid_ops_680,
+ .parent_dev_ops = &vfe_parent_dev_ops,
+ .formats = &csid_formats_gen2
+ },
+ },
+ /* CSID_LITE0 */
+ {
+ .regulators = {},
+ .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb",
+ "csid", "csid_csiphy_rx" },
+ .clock_rate = { { 0 },
+ { 64000000, 80000000 },
+ { 80000000, 100000000, 200000000,
+ 300000000, 400000000 },
+ { 300000000, 400000000, 480000000 },
+ { 300000000, 400000000, 480000000 }, },
+ .reg = { "csid_lite0" },
+ .interrupt = { "csid_lite0" },
+ .csid = {
+ .is_lite = true,
+ .hw_ops = &csid_ops_680,
+ .parent_dev_ops = &vfe_parent_dev_ops,
+ .formats = &csid_formats_gen2
+ }
+ },
+ /* CSID_LITE1 */
+ {
+ .regulators = {},
+ .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb",
+ "csid", "csid_csiphy_rx" },
+ .clock_rate = { { 0 },
+ { 64000000, 80000000 },
+ { 80000000, 100000000, 200000000,
+ 300000000, 400000000 },
+ { 300000000, 400000000, 480000000 },
+ { 300000000, 400000000, 480000000 }, },
+ .reg = { "csid_lite1" },
+ .interrupt = { "csid_lite1" },
+ .csid = {
+ .is_lite = true,
+ .hw_ops = &csid_ops_680,
+ .parent_dev_ops = &vfe_parent_dev_ops,
+ .formats = &csid_formats_gen2
+ }
+ },
+};
+
+static const struct camss_subdev_resources vfe_res_x1p42100[] = {
+ /* IFE0 */
+ {
+ .regulators = {},
+ .clock = { "camnoc_rt_axi", "cpas_ahb", "cpas_fast_ahb",
+ "cpas_vfe0", "vfe0_fast_ahb", "vfe0" },
+ .clock_rate = { { 400000000 },
+ { 0 },
+ { 0 },
+ { 0 },
+ { 0 },
+ { 345600000, 432000000, 594000000, 675000000,
+ 727000000 }, },
+ .reg = { "vfe0" },
+ .interrupt = { "vfe0" },
+ .vfe = {
+ .line_num = 3,
+ .pd_name = "ife0",
+ .hw_ops = &vfe_ops_680,
+ .formats_rdi = &vfe_formats_rdi_845,
+ .formats_pix = &vfe_formats_pix_845
+ },
+ },
+ /* IFE_LITE_0 */
+ {
+ .regulators = {},
+ .clock = { "camnoc_rt_axi", "cpas_ahb", "vfe_lite_ahb",
+ "cpas_vfe_lite", "vfe_lite", "vfe_lite_csid" },
+ .clock_rate = { { 400000000 },
+ { 0 },
+ { 0 },
+ { 0 },
+ { 266666667, 400000000, 480000000 },
+ { 266666667, 400000000, 480000000 }, },
+ .reg = { "vfe_lite0" },
+ .interrupt = { "vfe_lite0" },
+ .vfe = {
+ .is_lite = true,
+ .line_num = 4,
+ .hw_ops = &vfe_ops_680,
+ .formats_rdi = &vfe_formats_rdi_845,
+ .formats_pix = &vfe_formats_pix_845
+ },
+ },
+ /* IFE_LITE_1 */
+ {
+ .regulators = {},
+ .clock = { "camnoc_rt_axi", "cpas_ahb", "vfe_lite_ahb",
+ "cpas_vfe_lite", "vfe_lite", "vfe_lite_csid" },
+ .clock_rate = { { 400000000 },
+ { 0 },
+ { 0 },
+ { 0 },
+ { 266666667, 400000000, 480000000 },
+ { 266666667, 400000000, 480000000 }, },
+ .reg = { "vfe_lite1" },
+ .interrupt = { "vfe_lite1" },
+ .vfe = {
+ .is_lite = true,
+ .line_num = 4,
+ .hw_ops = &vfe_ops_680,
+ .formats_rdi = &vfe_formats_rdi_845,
+ .formats_pix = &vfe_formats_pix_845
+ },
+ },
+};
+
+static const struct resources_icc icc_res_x1p42100[] = {
+ {
+ .name = "ahb",
+ .icc_bw_tbl.avg = 150000,
+ .icc_bw_tbl.peak = 300000,
+ },
+ {
+ .name = "hf_mnoc",
+ .icc_bw_tbl.avg = 2097152,
+ .icc_bw_tbl.peak = 2097152,
+ },
+};
+
/*
* camss_add_clock_margin - Add margin to clock frequency rate
* @rate: Clock frequency rate
@@ -5809,6 +6007,22 @@ static const struct camss_resources x1e80100_resources = {
.vfe_num = ARRAY_SIZE(vfe_res_x1e80100),
};
+static const struct camss_resources x1p42100_resources = {
+ .version = CAMSS_X1P42100,
+ .pd_name = "top",
+ .csiphy_res = csiphy_res_x1p42100,
+ .tpg_res = tpg_res_x1e80100,
+ .csid_res = csid_res_x1p42100,
+ .vfe_res = vfe_res_x1p42100,
+ .csid_wrapper_res = &csid_wrapper_res_x1e80100,
+ .icc_res = icc_res_x1p42100,
+ .icc_path_num = ARRAY_SIZE(icc_res_x1p42100),
+ .csiphy_num = ARRAY_SIZE(csiphy_res_x1p42100),
+ .tpg_num = ARRAY_SIZE(tpg_res_x1e80100),
+ .csid_num = ARRAY_SIZE(csid_res_x1p42100),
+ .vfe_num = ARRAY_SIZE(vfe_res_x1p42100),
+};
+
static const struct of_device_id camss_dt_match[] = {
{ .compatible = "qcom,msm8916-camss", .data = &msm8916_resources },
{ .compatible = "qcom,msm8939-camss", .data = &msm8939_resources },
@@ -5828,6 +6042,7 @@ static const struct of_device_id camss_dt_match[] = {
{ .compatible = "qcom,sm8550-camss", .data = &sm8550_resources },
{ .compatible = "qcom,sm8650-camss", .data = &sm8650_resources },
{ .compatible = "qcom,x1e80100-camss", .data = &x1e80100_resources },
+ { .compatible = "qcom,x1p42100-camss", .data = &x1p42100_resources },
{ .compatible = "qcom,glymur-camss", .data = &x1e80100_resources },
{ }
};
diff --git a/drivers/media/platform/qcom/camss/camss.h b/drivers/media/platform/qcom/camss/camss.h
index 7dc2fd9f03e0dc2ded8e4a603d6cfec4d8e6a62b..523050295209d84e7f72f54bce9a96ed9df442aa 100644
--- a/drivers/media/platform/qcom/camss/camss.h
+++ b/drivers/media/platform/qcom/camss/camss.h
@@ -97,6 +97,7 @@ enum camss_version {
CAMSS_8650,
CAMSS_8775P,
CAMSS_X1E80100,
+ CAMSS_X1P42100,
};
enum icc_count {
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v5 3/3] media: qcom: camss: Add support for X1P42100 CAMSS
2026-10-09 8:11 ` [PATCH v5 3/3] media: qcom: camss: Add support for X1P42100 CAMSS Wenmeng Liu
@ 2026-10-09 8:28 ` sashiko-bot
0 siblings, 0 replies; 5+ messages in thread
From: sashiko-bot @ 2026-10-09 8:28 UTC (permalink / raw)
To: Wenmeng Liu; +Cc: conor+dt, robh, devicetree, media-ci
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] media: qcom: camss: CSID_LITE power on failure and incorrect VFE mapping due to 1:1 ID assumption
- [High] media: qcom: camss: NULL ptr deref in legacy init on malformed DT
- [High] media: qcom: camss: OOB array access due to missing DT port bounds check
--
commit f107a0f6644c97e69bdf263cd7e5e868d13b9438
Author: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
media: qcom: camss: Add support for X1P42100 CAMSS
Add CAMSS support for the Qualcomm X1P42100 (Purwa) SoC.
> diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
> index c54185c93a8a9..5f0e5cadc06d5 100644
> --- a/drivers/media/platform/qcom/camss/camss.c
> +++ b/drivers/media/platform/qcom/camss/camss.c
> @@ -36,6 +36,13 @@
> /* Top-level CAMSS version register */
> #define CAMSS_HW_VERSION 0x0
>
> +/* CSIPHY resources for PHY API devices, only id and formats are needed */
> +#define CAMSS_CSIPHY_RES_PHY_API(_id, _formats) \
> + .csiphy = { \
> + .id = (_id), \
> + .formats = (_formats), \
> + }
[Severity: High]
Does this macro leave the hw_ops pointer uninitialized?
If a device tree is malformed or lacks endpoints, camss_detect_legacy_phy()
will leave camss->legacy_phy as true. This causes camss_init_subdevices() to
use the legacy initialization path:
camss_init_subdevices()
msm_csiphy_subdev_init_legacy()
csiphy->res->hw_ops->init(csiphy);
Since this macro does not set hw_ops, will this result in a NULL pointer
dereference during driver probe when legacy_phy defaults to true?
[ ... ]
> +static const struct camss_subdev_resources csiphy_res_x1p42100[] = {
> + /* CSIPHY0 */
> + {
> + CAMSS_CSIPHY_RES_PHY_API(0, &csiphy_formats_sdm845),
> + },
> + /* CSIPHY4 */
> + {
> + CAMSS_CSIPHY_RES_PHY_API(4, &csiphy_formats_sdm845),
> + },
> +};
[Severity: High]
Can a device tree mapping for CSIPHY4 cause an out-of-bounds array access?
camss_parse_endpoint_node() assigns the device tree port endpoint directly to
csd->interface.csiphy_id without checking bounds:
csd->interface.csiphy_id = vep.base.port;
Later, camss_subdev_notifier_bound() uses this unvalidated ID to index the
dynamically allocated camss->csiphy array:
u8 id = csd->interface.csiphy_id;
struct csiphy_device *csiphy = &camss->csiphy[id];
Since the X1P42100 SoC has a csiphy_num of 2, mapping CSIPHY4 to port@4 in the
device tree would cause an out-of-bounds access at camss->csiphy[4] during
device probe.
[ ... ]
> + /* CSID_LITE0 */
> + {
> + .regulators = {},
> + .clock = { "gcc_axi_hf", "cpas_ahb", "cpas_fast_ahb",
> + "csid", "csid_csiphy_rx" },
> + .clock_rate = { { 0 },
> + { 64000000, 80000000 },
> + { 80000000, 100000000, 200000000,
> + 300000000, 400000000 },
> + { 300000000, 400000000, 480000000 },
> + { 300000000, 400000000, 480000000 }, },
> + .reg = { "csid_lite0" },
> + .interrupt = { "csid_lite0" },
> + .csid = {
> + .is_lite = true,
> + .hw_ops = &csid_ops_680,
> + .parent_dev_ops = &vfe_parent_dev_ops,
[Severity: High]
Will CSID_LITE0 fail to power on because its ID is too high?
When powering on a CSID, csid_set_power() calls:
csid->res->parent_dev_ops->get(camss, csid->id);
For vfe_parent_dev_ops_get(), it checks if the ID is strictly less than
camss->res->vfe_num. The vfe_num for X1P42100 is 3, but CSID_LITE0 has an ID
of 3, and CSID_LITE1 has an ID of 4.
Since 3 < 3 and 4 < 3 are false, vfe_parent_dev_ops_get() will return -EINVAL.
Additionally, this direct 1:1 index mapping seems to incorrectly pair CSID1
and CSID2 with IFE_LITE_0 and IFE_LITE_1 instead of full IFEs.
> + .formats = &csid_formats_gen2
> + }
> + },
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261009-purwa_camss-v5-0-58c13dc7c4d2@oss.qualcomm.com?part=3
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-09 8:28 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-09 8:11 [PATCH v5 0/3] media: camss: add support for purwa platform Wenmeng Liu
2026-10-09 8:11 ` [PATCH v5 1/3] dt-bindings: media: Add qcom,x1p42100-camss Wenmeng Liu
2026-10-09 8:11 ` [PATCH v5 2/3] media: qcom: camss: vfe: Eliminate ever expanding src_pad_code switch logic Wenmeng Liu
2026-10-09 8:11 ` [PATCH v5 3/3] media: qcom: camss: Add support for X1P42100 CAMSS Wenmeng Liu
2026-10-09 8:28 ` sashiko-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox