From: David Heidelberg <david@ixit.cz>
Ensure that the link frequency divider correctly accounts for C-PHY
operation. The divider differs between D-PHY and C-PHY, as described
in the MIPI CSI-2 specification.
For more details, see:
https://docs.kernel.org/driver-api/media/tx-rx.html#pixel-rate
Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: David Heidelberg <david@ixit.cz>
---
drivers/media/platform/qcom/camss/camss-csid.c | 11 +++++++----
drivers/media/platform/qcom/camss/camss-csiphy.c | 6 ++----
drivers/media/platform/qcom/camss/camss.c | 18 +++++++++++++++---
drivers/media/platform/qcom/camss/camss.h | 2 +-
4 files changed, 25 insertions(+), 12 deletions(-)
diff --git a/drivers/media/platform/qcom/camss/camss-csid.c b/drivers/media/platform/qcom/camss/camss-csid.c
index b50b0cfe280c1..2fc17c6a15e2e 100644
--- a/drivers/media/platform/qcom/camss/camss-csid.c
+++ b/drivers/media/platform/qcom/camss/camss-csid.c
@@ -534,18 +534,21 @@ const struct csid_format_info *csid_get_fmt_entry(const struct csid_format_info
* csid_set_clock_rates - Calculate and set clock rates on CSID module
* @csiphy: CSID device
*/
-static int csid_set_clock_rates(struct csid_device *csid)
+static int csid_set_clock_rates(struct v4l2_subdev *sd, struct csid_device *csid)
{
struct device *dev = csid->camss->dev;
+ struct csiphy_device *csiphy = v4l2_get_subdevdata(sd);
+ struct csiphy_lanes_cfg *lane_cfg = &csiphy->cfg.csi2->lane_cfg;
const struct csid_format_info *fmt;
+
s64 link_freq;
int i, j;
int ret;
fmt = csid_get_fmt_entry(csid->res->formats->formats, csid->res->formats->nformats,
csid->fmt[MSM_CSIPHY_PAD_SINK].code);
- link_freq = camss_get_link_freq(&csid->subdev.entity, fmt->bpp,
- csid->phy.lane_cnt);
+
+ link_freq = camss_get_link_freq(&csid->subdev.entity, fmt->bpp, lane_cfg);
if (link_freq < 0)
link_freq = 0;
@@ -703,7 +706,7 @@ static int csid_set_power(struct v4l2_subdev *sd, int on)
return ret;
}
- ret = csid_set_clock_rates(csid);
+ ret = csid_set_clock_rates(sd, csid);
if (ret < 0) {
regulator_bulk_disable(csid->num_supplies,
csid->supplies);
diff --git a/drivers/media/platform/qcom/camss/camss-csiphy.c b/drivers/media/platform/qcom/camss/camss-csiphy.c
index 938600f3defe1..ea9dd2cd2e740 100644
--- a/drivers/media/platform/qcom/camss/camss-csiphy.c
+++ b/drivers/media/platform/qcom/camss/camss-csiphy.c
@@ -143,9 +143,8 @@ static int csiphy_set_clock_rates(struct csiphy_device *csiphy)
u8 bpp = csiphy_get_bpp(csiphy->res->formats->formats, csiphy->res->formats->nformats,
csiphy->fmt[MSM_CSIPHY_PAD_SINK].code);
- u8 num_lanes = csiphy->cfg.csi2->lane_cfg.num_data;
- link_freq = camss_get_link_freq(&csiphy->subdev.entity, bpp, num_lanes);
+ link_freq = camss_get_link_freq(&csiphy->subdev.entity, bpp, &csiphy->cfg.csi2->lane_cfg);
if (link_freq < 0)
link_freq = 0;
@@ -270,10 +269,9 @@ static int csiphy_stream_on(struct csiphy_device *csiphy)
u8 lane_mask = csiphy->res->hw_ops->get_lane_mask(&cfg->csi2->lane_cfg);
u8 bpp = csiphy_get_bpp(csiphy->res->formats->formats, csiphy->res->formats->nformats,
csiphy->fmt[MSM_CSIPHY_PAD_SINK].code);
- u8 num_lanes = csiphy->cfg.csi2->lane_cfg.num_data;
u8 val;
- link_freq = camss_get_link_freq(&csiphy->subdev.entity, bpp, num_lanes);
+ link_freq = camss_get_link_freq(&csiphy->subdev.entity, bpp, &csiphy->cfg.csi2->lane_cfg);
if (link_freq < 0) {
dev_err(csiphy->camss->dev,
diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
index ea0c8cf3cd806..4c13bae17007e 100644
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -32,6 +32,14 @@
#define CAMSS_CLOCK_MARGIN_NUMERATOR 105
#define CAMSS_CLOCK_MARGIN_DENOMINATOR 100
+/*
+ * C-PHY encodes data by 16/7 ~ 2.28 bits/symbol
+ * D-PHY doesn't encode data, thus 16/16 = 1 b/s
+ */
+#define CAMSS_COMMON_PHY_DIVIDENT 16
+#define CAMSS_CPHY_DIVISOR 7
+#define CAMSS_DPHY_DIVISOR 16
+
static const struct parent_dev_ops vfe_parent_dev_ops;
static const struct camss_subdev_resources csiphy_res_8x16[] = {
@@ -4280,20 +4288,24 @@ struct media_pad *camss_find_sensor_pad(struct media_entity *entity)
* camss_get_link_freq - Get link frequency from sensor
* @entity: Media entity in the current pipeline
* @bpp: Number of bits per pixel for the current format
- * @lanes: Number of lanes in the link to the sensor
+ * @lane_cfg: CSI2 lane configuration
*
* Return link frequency on success or a negative error code otherwise
*/
s64 camss_get_link_freq(struct media_entity *entity, unsigned int bpp,
- unsigned int lanes)
+ struct csiphy_lanes_cfg *lane_cfg)
{
struct media_pad *sensor_pad;
+ u8 num_lanes = lane_cfg->num_data;
+ bool cphy = lane_cfg->phy_cfg == V4L2_MBUS_CSI2_CPHY;
+ unsigned int div = num_lanes * 2 * (cphy ? CAMSS_CPHY_DIVISOR :
+ CAMSS_DPHY_DIVISOR);
sensor_pad = camss_find_sensor_pad(entity);
if (!sensor_pad)
return -ENODEV;
- return v4l2_get_link_freq(sensor_pad, bpp, 2 * lanes);
+ return v4l2_get_link_freq(sensor_pad, CAMSS_COMMON_PHY_DIVIDENT * bpp, div);
}
/*
diff --git a/drivers/media/platform/qcom/camss/camss.h b/drivers/media/platform/qcom/camss/camss.h
index 6d048414c919e..67be42b4c9174 100644
--- a/drivers/media/platform/qcom/camss/camss.h
+++ b/drivers/media/platform/qcom/camss/camss.h
@@ -163,7 +163,7 @@ int camss_enable_clocks(int nclocks, struct camss_clock *clock,
void camss_disable_clocks(int nclocks, struct camss_clock *clock);
struct media_pad *camss_find_sensor_pad(struct media_entity *entity);
s64 camss_get_link_freq(struct media_entity *entity, unsigned int bpp,
- unsigned int lanes);
+ struct csiphy_lanes_cfg *lane_cfg);
int camss_get_pixel_clock(struct media_entity *entity, u64 *pixel_clock);
int camss_pm_domain_on(struct camss *camss, int id);
void camss_pm_domain_off(struct camss *camss, int id);
--
2.51.0On Sun, Mar 01, 2026 at 01:51:28AM +0100, David Heidelberg via B4 Relay wrote:
> -static int csid_set_clock_rates(struct csid_device *csid)
> +static int csid_set_clock_rates(struct v4l2_subdev *sd, struct csid_device *csid)
> {
> struct device *dev = csid->camss->dev;
> + struct csiphy_device *csiphy = v4l2_get_subdevdata(sd);
> + struct csiphy_lanes_cfg *lane_cfg = &csiphy->cfg.csi2->lane_cfg;
I believe there's a regression here from v3. I've been testing v4 of
this series on SA8775P (kernel 6.18) with a GMSL2 camera pipeline and
hit an invalid pointer dereference in csid_set_clock_rates() during
pipeline power-up:
pc : camss_get_link_freq+0x1c/0xc4 [qcom_camss]
lr : csid_set_power+0xc8/0x404 [qcom_camss]
Code: 910003fd a90153f3 aa0003f4 a9025bf5 (b9400040)
The sd passed here from csid_set_power() is the csid subdev, so the
subdevdata is a csid_device rather than a csiphy_device. The csid_device
stores its linked csiphy_id during csid_link_setup(), so the fix is to
look it up through the camss device array:
static int csid_set_clock_rates(struct csid_device *csid)
{
struct csiphy_device *csiphy = &csid->camss->csiphy[csid->phy.csiphy_id];
struct csiphy_lanes_cfg *lane_cfg = &csiphy->cfg.csi2->lane_cfg;
This also lets us drop the v4l2_subdev parameter entirely since it's
no longer needed. With the above change my pipeline powers on and
streams correctly.
Tested-by: Cory Keitz <ckeitz@amazon.com>
---
Regards,
Cory
On 01/03/2026 00:51, David Heidelberg via B4 Relay wrote:
> From: David Heidelberg <david@ixit.cz>
>
> Ensure that the link frequency divider correctly accounts for C-PHY
> operation. The divider differs between D-PHY and C-PHY, as described
> in the MIPI CSI-2 specification.
>
> For more details, see:
> https://docs.kernel.org/driver-api/media/tx-rx.html#pixel-rate
>
> Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
> Signed-off-by: David Heidelberg <david@ixit.cz>
> ---
> drivers/media/platform/qcom/camss/camss-csid.c | 11 +++++++----
> drivers/media/platform/qcom/camss/camss-csiphy.c | 6 ++----
> drivers/media/platform/qcom/camss/camss.c | 18 +++++++++++++++---
> drivers/media/platform/qcom/camss/camss.h | 2 +-
> 4 files changed, 25 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/media/platform/qcom/camss/camss-csid.c b/drivers/media/platform/qcom/camss/camss-csid.c
> index b50b0cfe280c1..2fc17c6a15e2e 100644
> --- a/drivers/media/platform/qcom/camss/camss-csid.c
> +++ b/drivers/media/platform/qcom/camss/camss-csid.c
> @@ -534,18 +534,21 @@ const struct csid_format_info *csid_get_fmt_entry(const struct csid_format_info
> * csid_set_clock_rates - Calculate and set clock rates on CSID module
> * @csiphy: CSID device
> */
> -static int csid_set_clock_rates(struct csid_device *csid)
> +static int csid_set_clock_rates(struct v4l2_subdev *sd, struct csid_device *csid)
> {
> struct device *dev = csid->camss->dev;
> + struct csiphy_device *csiphy = v4l2_get_subdevdata(sd);
> + struct csiphy_lanes_cfg *lane_cfg = &csiphy->cfg.csi2->lane_cfg;
> const struct csid_format_info *fmt;
> +
> s64 link_freq;
> int i, j;
> int ret;
>
> fmt = csid_get_fmt_entry(csid->res->formats->formats, csid->res->formats->nformats,
> csid->fmt[MSM_CSIPHY_PAD_SINK].code);
> - link_freq = camss_get_link_freq(&csid->subdev.entity, fmt->bpp,
> - csid->phy.lane_cnt);
> +
> + link_freq = camss_get_link_freq(&csid->subdev.entity, fmt->bpp, lane_cfg);
> if (link_freq < 0)
> link_freq = 0;
>
> @@ -703,7 +706,7 @@ static int csid_set_power(struct v4l2_subdev *sd, int on)
> return ret;
> }
>
> - ret = csid_set_clock_rates(csid);
> + ret = csid_set_clock_rates(sd, csid);
> if (ret < 0) {
> regulator_bulk_disable(csid->num_supplies,
> csid->supplies);
> diff --git a/drivers/media/platform/qcom/camss/camss-csiphy.c b/drivers/media/platform/qcom/camss/camss-csiphy.c
> index 938600f3defe1..ea9dd2cd2e740 100644
> --- a/drivers/media/platform/qcom/camss/camss-csiphy.c
> +++ b/drivers/media/platform/qcom/camss/camss-csiphy.c
> @@ -143,9 +143,8 @@ static int csiphy_set_clock_rates(struct csiphy_device *csiphy)
>
> u8 bpp = csiphy_get_bpp(csiphy->res->formats->formats, csiphy->res->formats->nformats,
> csiphy->fmt[MSM_CSIPHY_PAD_SINK].code);
> - u8 num_lanes = csiphy->cfg.csi2->lane_cfg.num_data;
>
> - link_freq = camss_get_link_freq(&csiphy->subdev.entity, bpp, num_lanes);
> + link_freq = camss_get_link_freq(&csiphy->subdev.entity, bpp, &csiphy->cfg.csi2->lane_cfg);
> if (link_freq < 0)
> link_freq = 0;
>
> @@ -270,10 +269,9 @@ static int csiphy_stream_on(struct csiphy_device *csiphy)
> u8 lane_mask = csiphy->res->hw_ops->get_lane_mask(&cfg->csi2->lane_cfg);
> u8 bpp = csiphy_get_bpp(csiphy->res->formats->formats, csiphy->res->formats->nformats,
> csiphy->fmt[MSM_CSIPHY_PAD_SINK].code);
> - u8 num_lanes = csiphy->cfg.csi2->lane_cfg.num_data;
> u8 val;
>
> - link_freq = camss_get_link_freq(&csiphy->subdev.entity, bpp, num_lanes);
> + link_freq = camss_get_link_freq(&csiphy->subdev.entity, bpp, &csiphy->cfg.csi2->lane_cfg);
>
> if (link_freq < 0) {
> dev_err(csiphy->camss->dev,
> diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c
> index ea0c8cf3cd806..4c13bae17007e 100644
> --- a/drivers/media/platform/qcom/camss/camss.c
> +++ b/drivers/media/platform/qcom/camss/camss.c
> @@ -32,6 +32,14 @@
> #define CAMSS_CLOCK_MARGIN_NUMERATOR 105
> #define CAMSS_CLOCK_MARGIN_DENOMINATOR 100
>
> +/*
> + * C-PHY encodes data by 16/7 ~ 2.28 bits/symbol
> + * D-PHY doesn't encode data, thus 16/16 = 1 b/s
> + */
> +#define CAMSS_COMMON_PHY_DIVIDENT 16
> +#define CAMSS_CPHY_DIVISOR 7
> +#define CAMSS_DPHY_DIVISOR 16
> +
> static const struct parent_dev_ops vfe_parent_dev_ops;
>
> static const struct camss_subdev_resources csiphy_res_8x16[] = {
> @@ -4280,20 +4288,24 @@ struct media_pad *camss_find_sensor_pad(struct media_entity *entity)
> * camss_get_link_freq - Get link frequency from sensor
> * @entity: Media entity in the current pipeline
> * @bpp: Number of bits per pixel for the current format
> - * @lanes: Number of lanes in the link to the sensor
> + * @lane_cfg: CSI2 lane configuration
> *
> * Return link frequency on success or a negative error code otherwise
> */
> s64 camss_get_link_freq(struct media_entity *entity, unsigned int bpp,
> - unsigned int lanes)
> + struct csiphy_lanes_cfg *lane_cfg)
> {
> struct media_pad *sensor_pad;
> + u8 num_lanes = lane_cfg->num_data;
> + bool cphy = lane_cfg->phy_cfg == V4L2_MBUS_CSI2_CPHY;
> + unsigned int div = num_lanes * 2 * (cphy ? CAMSS_CPHY_DIVISOR :
> + CAMSS_DPHY_DIVISOR);
>
> sensor_pad = camss_find_sensor_pad(entity);
> if (!sensor_pad)
> return -ENODEV;
>
> - return v4l2_get_link_freq(sensor_pad, bpp, 2 * lanes);
> + return v4l2_get_link_freq(sensor_pad, CAMSS_COMMON_PHY_DIVIDENT * bpp, div);
> }
>
> /*
> diff --git a/drivers/media/platform/qcom/camss/camss.h b/drivers/media/platform/qcom/camss/camss.h
> index 6d048414c919e..67be42b4c9174 100644
> --- a/drivers/media/platform/qcom/camss/camss.h
> +++ b/drivers/media/platform/qcom/camss/camss.h
> @@ -163,7 +163,7 @@ int camss_enable_clocks(int nclocks, struct camss_clock *clock,
> void camss_disable_clocks(int nclocks, struct camss_clock *clock);
> struct media_pad *camss_find_sensor_pad(struct media_entity *entity);
> s64 camss_get_link_freq(struct media_entity *entity, unsigned int bpp,
> - unsigned int lanes);
> + struct csiphy_lanes_cfg *lane_cfg);
> int camss_get_pixel_clock(struct media_entity *entity, u64 *pixel_clock);
> int camss_pm_domain_on(struct camss *camss, int id);
> void camss_pm_domain_off(struct camss *camss, int id);
>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
© 2016 - 2026 Red Hat, Inc.