Re: [REQUEST FOR GUIDANCE] Dell Panther Lake IR camera (HIMX1092 / Synaptics SVP7500 06CB:0701) — port-2 streaming gated by bridge secure-handshake

[Laurent Pinchart <laurent.pinchart@ideasonboard.com>]

On Tue, May 12, 2026 at 09:24:13PM -0400, Jake Steinman wrote:
> Hi all,
> 
> Cold mail to a wide CC, sending once instead of many — apologies for the
> broadcast. Community Linux camera-enable effort on Dell PB16250 (Panther Lake,
> Synaptics SVP7500 bridge USB 06CB:0701). To my knowledge this is the first
> working Linux RGB camera on any Panther Lake laptop — OV08X40 streams at
> 28.57fps after our IRQF_ONESHOT stability fix in intel_cvs, independently
> reproduced on Dell XPS DA16260 + Fedora 44 Silverblue by another community
> user. IR (HIMX1092) does not stream, and I think we've narrowed it cleanly to a
> bridge-internal secure-auth handshake we can't trigger from outside the Vision
> driver stack.
> 
> What works:
> 
> HIMX1092 probes, chip ID 0x1091 confirmed, bound to ipu7-isys CSI-2 port 2, 1
> lane
> Geometry aligned to Dell production (648×368 SGRBG10, from v81
> graph_settings_hm1092 files)
> IPU7 firmware ACKs STREAM_START_AND_CAPTURE
> intel_ipu7_isys: "stream on CSI2-2 with 1 lanes" (RX listening)
> Sensor MODE_SELECT=0x01 ack'd, intel_cvs port-2 mipi config (0x830, verbatim
> Windows USBPcap, 5×52-byte chunked) returns 0
> Cape FW already at Dell v81 level (1.20.129.0, identical bytes)
> What doesn't:
> 
> ZERO sof_event::csi2-2 in any test, including with RGB streaming concurrently
> at 28.57fps
> 10 host-side hypotheses falsified including geometry, format, MIPI replay
> verbatim, AE-kicks, vision_sensing flag, dual-stream
> Evidence the gate is bridge silicon: usbbridge.sys (Intel Vision driver,
> Windows) ships strings RESET_HANDSHAKE_CTX and 1_BRIDGE_STATE_TRIGGER_CTX. Dell
> v81 06CB0701.bin (1.97MB, magic VISSOCFW) is identical to what our cape boots.
> The handshake exists in cape FW; the trigger isn't a wire opcode visible in
> USBPcap, suggesting it crosses MEI/CSE.
> 
> Pinging this group because the answer probably lives at the intersection: Mario
> (Dell upstream routing), Hans (camera-stack architecture, prior bridge
> enabling), Sakari/Bingbu/Tianshu (IPU7 maintainers), Hans Verkuil (V4L2 second
> opinion), Tomas (MEI/CSE if the trigger crosses HECI), Daniel (INT3472 — DSC0
> only exposes HANDSHAKE/IR_LED GPIOs, AVDD/DOVDD appear bridge-internal),
> Laurent/Kieran (libcamera once unblocked).

This seems to be a question for Intel at this point.

> Not asking anyone to debug — just a pointer on whether the secure-auth path can
> be exposed to a non-Vision-stack driver, or who at Intel/Synaptics owns that
> mechanism. Even "talk to <person>" is enormously helpful.
> 
> Background + reproducer:
> 
> - DKMS fix pack (v0.4, MOK-signed, single-command install): https://github.com/
> jibsta210/svp7500-camera-fix-pack/releases/tag/v0.4
> 
> - Forensic write-up + IR debug history: https://gist.github.com/jibsta210/
> 8316b6a0bc58910891512945c4e91a08
> 
> RELATED:
> 
> https://github.com/intel/ipu7-drivers/issues/26
> https://github.com/intel/ipu7-drivers/issues/51
> https://github.com/intel/ipu7-drivers/issues/72
> https://github.com/intel/vision-drivers/issues/37

-- 
Regards,

Laurent Pinchart