Surface Go 2 rear camera detected but black on FydeOS v22.1 – IPU3 CSI-2 timeout

On the LOP addressing: correct. lop_page_addr holds the PFN of the LOP table, and the table’s contents are the data-page PFNs. My version logged the data PFN and the table’s bus address but not entry[0].lop_page_addr itself, so it couldn’t actually verify the link you’re asking about. The new version logs all three, including what the value should be, so a mismatch is visible at a glance.

On staleness: also correct, and it matters more than instrumentation hygiene. Those four fields are written only by the DMA engine and nothing clears them when a buffer slot is reused — with 8 buffers, each slot carries values from 8 frames earlier. A completion-only dump could easily have shown us a previous frame’s counters and sent us down the wrong path.

The consequence is bigger though: the driver’s existing “payload length … received …” check reads received from one of those stale-able fields. So your run with no payload warnings does not prove a full transfer happened — it may have been comparing against a leftover value that happened to match. I read too much into that last time. Zeroing the counters at queue time fixes the new dump and the existing warning together.

One trap if you compare against your reconstruction: entry gets advanced by the fill loop, so the zeroing and the queue-time log have to use a saved base pointer, not entry[0].

Reading the output:

  • cur_line_num non-zero at completion → the DMA ran for that frame. If it’s near the frame height while your buffer is untouched, it wrote somewhere else and your theory is confirmed.

  • cur_line_num zero → the DMA never transferred; the completion is bookkeeping over nothing.

  • fbpt_lop_pfn != expect_lop_pfn → the FBPT is pointing at the wrong LOP table, which would be the whole answer.
    9006-DEBUG-cio2-dump-fbpt-dma-fields.patch (1.5 KB)

New result from the instrumented Mobian kernel. While the rear camera was visibly broken, the queue/DMA path looked completely normal:
every QUEUE had ctrl=0x7
every fbpt_lop_pfn matched expect_lop_pfn
DONE repeatedly reported cur_line=1944
DONE repeatedly reported num_of_bytes=6469632 (3328 × 1944)
The DMA-written fields were zeroed at queue time, so these are fresh values rather than stale counters.
Therefore this broken state is not “DMA transferred nothing”, and the FBPT is not pointing at the wrong LOP table.
Separately, a few minutes earlier the same rear camera produced a heavy DPHY synchronization / incomplete-long-packet / inter-frame-discard storm. So there appear to be at least two distinct failure phases: a genuine CSI link-error state and a later visually-broken state where CIO2 still reports complete frames.
I haven’t yet proved whether the completed 1944-line frames contain meaningful pixel data, so I’m not claiming the DMA wrote to the wrong place.