Sebastian Reichel

Multiple people asked camera related questions during my talk as FOSDEM (and after it). I did some basic reverse engineering, so let me share what I know.

The Droid 4 works with a OMAP4430, which has a imaging subsystem (ISS). It is documented quite well in the datasheet and there is a Linux kernel driver available in staging (omap4iss), which was written by Laurent Pinchart (thanks!). This module provides two MIPI CSI-2 interfaces to connect camera sensors. Unfortunately Motorola’s Android system (and LineageOS) do not use this kernel driver. Instead they use a secondary processor, which is part of OMAP4430, to control the ISP and the camera sensors.

For this task a remoteproc kernel driver is used to allocate processor resources for the secondary processor. Then a (closed source) firmware running on this processor handles all camera related work. So in opposite to other peripherals it’s not possible to use the Android kernel source code as documentation. Fortunately it’s possible to see the currently allocated resources in sysfs, so I could extract the resources being required to access each camera sensors:

The flashlight controller is always visible on the bus. The register reset state matches the one provided in the TI LM3559 datasheet. I tested the registers and it behaves exactly as described in the datasheet. The only strange thing is, that the slave address in LM3559’s datasheet is not matching. LM3561’s datasheet provides the correct slave address, but the reset register state does not match. I tested all kind of bits and it should be safe to just assume the chip is LM3559.

If the GPIOs are enabled as output high and the clock is enabled with 24 MHz, the chip responds to i2c queries. The chip uses 16 bit register addresses, 8 bit register data layout. It’s possible to read registers like this:

Apart from that it auto-increments the address:

I assume, that the chip is most likely a MT9M114 (datasheet, out-of-tree driver).

Possible candidates for the GPIOs are:

• CONFIG (this would not reset registers)
• active low RESET_BAR (it has an internal pull-up, so gpio=input would work, but there may be an external pull-down
• 1.8V regulator for Vdigital & Vphy
• 2.5-3V regulator for Vanalog & Vpll

Similar to the front camera, the rear camera needs a couple of GPIOs configured as output high and a clock to become responsive to i2c queries. All available information suggests, that the sensor is OV8830. This sensor is also used by other Motorola phones from 2011 (RAZR), has 8MP and uses 0x36 as i2c address. It also has an 16-bit register address interface as far as I could see and seems to be an OV8820:

There is no public datasheet (apart from this 2 page product info), but I found this driver for msm and this patch for imx. They should give some insight how the chip registers work. Also ov8830.c, ov8830.h, ov8835.h might be similar enough to be useful.

Possible candidates for OV8820 GPIOs are:

• 2.5-3V regulator for Vanalog
• 1.8-3V regulator for Vio
• PWDNB (low-active powerdown)
• RESETB (low-active reset)

The only missing bit is how the sensors are connected to the SoC. Since the ISS has two CSI-2 interfaces, it’s very likely, that Motorola connected each sensor to one of the interfaces respectively. Also I assume, that the 8MP sensor has been connected to the first interface, which allows higher bandwidth.

With this all required information have been collected to fully implement camera support for the Droid 4.

TLDR - this is the Droid 4 camera sensor setup:

– Sebastian