Subsystems

Camera

The main camera: power-up and identification are written; no frame reaches memory yet.

Hardware

The main camera is a Samsung S5K JN1 (chip ID 0x38e1) on I2C4 at 0x2d, with its lens driver and EEPROM on the same bus. Its rails come from an LDO chip on I2C2 at 0x29 (its enable pin is GPIO 122; the outputs LDO2, 3, 5 and 7 are the camera’s); the sensor’s reset is GPIO 20 and its master clock GPIO 141 (24 MHz). The SoC side is CAMSYS, SENINF (the MIPI receiver) and CAMSV, behind their power domains and clock muxes. The vendor kernel’s project list names more sensors (an OV64B40, a Hi-1634Q, an S5K3P9SP, GC02M1 and OV02B1B ones); only the JN1 has been handled here.

Driver

mtk_cam.c (mp_cam_steps) runs the camera in steps and refuses to go on unless each step reads back what Android’s sequence puts there. Step 0, read only, at boot and on the USB link’s cam status: the camera pins, the LDO chip’s registers, the JN1’s ID only when the LDO chip says its rails are on, and the SoC side (mt6781_cam.c). Step 1, only on the link’s cam power: the JN1 powered up in realme’s sequence at Android’s voltages (mtk_cam_ldo.h), its chip ID read (it needs about 10 ms after the master clock), and everything switched off again in reverse; off always runs, whatever failed, and all is off within 5 s. Only the LDO outputs and enables, GPIO 20 and GPIO 141 are written, each read back; the LDO chip’s own enable pin is left alone, as Android leaves it.

Steps beyond these (the sensor’s register set, streaming and the receiver) are developed on a branch that is not on the main branch of the kernel at 76b737c.

Device tree

With --camera: /arm-io/isp (camera-rear, which is what MobileGestalt’s rear-facing-camera and still-camera ask), and i2c2 and i2c4 for the LDO chip and the sensor. See Device tree.

Boot-arguments

mp_cam_steps in the catalogue: 0 by default and on a safe boot; 1 is step 0; 2 also allows step 1.

User space

mapple-captured answers the capture services that iOS asks mediaserverd for: one back camera that shows a test pattern, previewed into a CAImageQueue, with JPEG photos of it; recording, brackets and moment capture are refused. There is no sensor image yet.

Status

device.conf: missing.

Seen: the JN1’s ID read at 12 ms after the master clock and everything switched off again (run 44); in later runs, on the camera branch, the receiver counting the sensor’s packets, and a step that stopped safely before any frame reached memory (run 47).

Known issues

• No frame from the sensor reaches memory; the camera app shows a test pattern.
• After a cam power the touch landed offset until a restart once (run 44); the next run’s camera step showed the same grid-to-screen mapping (run 45).

Source files

bsd/dev/mtk_cam.c, mtk_cam_ldo.h of the kernel at 76b737c; osfmk/arm64/mt6781_cam.c of the MT6781 layer at 426b4f6; tools/mappled/mapple-captured.c of mapple_userland at 4f8127b; tools/mkadt.py of mapple_build at f7431bb.