kernel/drivers/media/platform/qcom/camss, branch linux-rolling-stable

media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()

2026-03-04T12:21:10Z

[ Upstream commit d965919af524e68cb2ab1a685872050ad2ee933d ] vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop bound and passes the index to vfe_isr_reg_update(). However, vfe->line[] array is defined with VFE_LINE_NUM_MAX(4): struct vfe_line line[VFE_LINE_NUM_MAX]; When index is 4, 5, 6, the access to vfe->line[line_id] exceeds the array bounds and resulting in out-of-bounds memory access. Fix this by using separate loops for output lines and write masters. Fixes: 4edc8eae715c ("media: camss: Add initial support for VFE hardware version Titan 480") Signed-off-by: Alper Ak Cc: stable@vger.kernel.org Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin

media: qcom: camss: Do not enable cpas fast ahb clock for SM8550 VFE lite

2026-03-04T12:20:02Z

[ Upstream commit a89e490ba3551823511588b7b3828d67f8b82954 ] The clock is needed to stream images over a full VFE IP on SM8550 CAMSS, and it should not be enabled, when an image stream is routed over any of two lite VFE IPs on the SoC. Signed-off-by: Vladimir Zapolskiy Acked-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin

media: qcom: camss: Add support for MSM8939

2025-11-06T11:43:56Z

The camera subsystem for the MSM8939 is the same as MSM8916 except with 3 CSID instead of 2, and some higher clock rates. As a quirk, this SoC needs writing values to 2 VFE VBIF registers (see downstream msm8939-camera.dtsi vbif-{regs,settings} properties). This fixes black stripes across sensor and garbage in CSID TPG outputs. Add support for the MSM8939 camera subsystem. Reviewed-by: Bryan O'Donoghue Signed-off-by: Vincent Knecht Signed-off-by: André Apitzsch Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: qcom: camss: vfe: Add VBIF setting support

2025-11-06T11:43:56Z

Some devices need writing values to VFE VBIF registers. Add helper functions to do this. Reviewed-by: Bryan O'Donoghue Signed-off-by: Vincent Knecht Signed-off-by: André Apitzsch Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: qcom: camss: Add CSIPHY 2.2.0 lane configuration for SM8650

2025-11-06T11:43:56Z

Add a configuration for all CSI lanes into D-PHY bus mode on Qualcomm SM8650 CAMSS CSIPHY IPs. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8650-QRD Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: qcom: camss: Add Qualcomm SM8650 CAMSS support

2025-11-06T11:43:56Z

Add the basic support of CAMSS IP on Qualcomm SM8650 SoC powered boards. SM8650 CAMSS provides: - 6 x CSIPHY, - 3 x CSID, 2 x CSID Lite, - 3 x VFE, 2 x VFE Lite. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8650-QRD Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: qcom: camss: Enable setting the rate to camnoc_rt_axi clock

2025-11-06T11:43:55Z

On hardware architectures where a single CAMNOC module is split into two, one for each of the real time (RT) and non real time (NRT) modules within camera sub system, processing VFE output over the AXI bus requires enabling and setting the appropriate clock rate for the RT CAMNOC. This change lays the groundwork for supporting such configurations. Signed-off-by: Hangxiang Ma Reviewed-by: Bryan O'Donoghue Reviewed-by: Vijay Kumar Tumati Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: qcom: camss: Use a macro to specify the initial buffer count

2025-11-06T11:43:55Z

Replace the hardcoded buffer count value with a macro to enable operating on these buffers elsewhere in the CAMSS driver based on this count. Some of the hardware architectures require deferring the AUP and REG update until after the CSID configuration and this macro is expected to be useful in such scenarios. Signed-off-by: Hangxiang Ma Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: qcom: camss: drop unused module alias

2025-11-06T11:43:55Z

The driver has never supported anything but OF probing so drop the unused platform module alias. Signed-off-by: Johan Hovold Reviewed-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil

media: qcom: camss: vfe: Fix BPL alignment for QCM2290

2025-09-24T10:52:09Z

VFE-340 requires 8-byte alignment instead of 16-byte. This adjustment prevents image corruption/misaligment when padding is needed. Example: For SRGGB10_1X10/3280x2464, aligned BPL was 4112 instead of 4104 Fixes: 9e89149a19ed ("media: qcom: camss: add support for QCM2290 camss") Signed-off-by: Loic Poulain Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil