--- /dev/null
+From 56a2d85ee8f9b994e5cd17039133218c57c5902b Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Mon, 25 Aug 2025 12:30:33 +0530
+Subject: media: iris: Allow stop on firmware only if start was issued.
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 56a2d85ee8f9b994e5cd17039133218c57c5902b upstream.
+
+For HFI Gen1, the instances substate is changed to LOAD_RESOURCES only
+when a START command is issues to the firmware. If STOP is called
+without a prior START, the firmware may reject the command and throw
+some erros.
+Handle this by adding a substate check before issuing STOP command to
+the firmware.
+
+Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops")
+Cc: stable@vger.kernel.org
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # X1E80100
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # x1e80100-crd
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
+index 3e41c8cb620e..a3461ccf170a 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
+@@ -202,7 +202,7 @@ static int iris_hfi_gen1_session_stop(struct iris_inst *inst, u32 plane)
+ inst->flush_responses_pending++;
+ ret = iris_wait_for_session_response(inst, true);
+ }
+- } else {
++ } else if (inst->sub_state & IRIS_INST_SUB_LOAD_RESOURCES) {
+ reinit_completion(&inst->completion);
+ iris_hfi_gen1_packet_session_cmd(inst, &pkt, HFI_CMD_SESSION_STOP);
+ ret = iris_hfi_queue_cmd_write(core, &pkt, pkt.shdr.hdr.size);
+--
+2.51.0
+
--- /dev/null
+From 65f72c6a8d97c0cbdc785cb9a35dc358dee67959 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Mon, 25 Aug 2025 12:30:29 +0530
+Subject: media: iris: Allow substate transition to load resources during output streaming
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 65f72c6a8d97c0cbdc785cb9a35dc358dee67959 upstream.
+
+A client (e.g., GST for encoder) can initiate streaming on the capture
+port before the output port, causing the instance state to transition to
+OUTPUT_STREAMING. When streaming is subsequently started on the output
+port, the instance state advances to STREAMING, and the substate should
+transition to LOAD_RESOURCES.
+
+Previously, the code blocked the substate transition to LOAD_RESOURCES
+if the instance state was OUTPUT_STREAMING. This update modifies the
+logic to permit the substate transition to LOAD_RESOURCES when the
+instance state is OUTPUT_STREAMING, thereby supporting this client
+streaming sequence.
+
+Fixes: 547f7b8c5090 ("media: iris: add check to allow sub states transitions")
+Cc: stable@vger.kernel.org
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # X1E80100
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # x1e80100-crd
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_state.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_state.c b/drivers/media/platform/qcom/iris/iris_state.c
+index 104e1687ad39..a21238d2818f 100644
+--- a/drivers/media/platform/qcom/iris/iris_state.c
++++ b/drivers/media/platform/qcom/iris/iris_state.c
+@@ -122,7 +122,8 @@ static bool iris_inst_allow_sub_state(struct iris_inst *inst, enum iris_inst_sub
+ return false;
+ case IRIS_INST_OUTPUT_STREAMING:
+ if (sub_state & (IRIS_INST_SUB_DRC_LAST |
+- IRIS_INST_SUB_DRAIN_LAST | IRIS_INST_SUB_OUTPUT_PAUSE))
++ IRIS_INST_SUB_DRAIN_LAST | IRIS_INST_SUB_OUTPUT_PAUSE |
++ IRIS_INST_SUB_LOAD_RESOURCES))
+ return true;
+ return false;
+ case IRIS_INST_STREAMING:
+--
+2.51.0
+
--- /dev/null
+From 9cae3619e465dd1cdaa5a5ffbbaf4f41338b0022 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Mon, 25 Aug 2025 12:30:30 +0530
+Subject: media: iris: Always destroy internal buffers on firmware release response
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 9cae3619e465dd1cdaa5a5ffbbaf4f41338b0022 upstream.
+
+Currently, internal buffers are destroyed only if 'PENDING_RELEASE' flag
+is set when a release response is received from the firmware, which is
+incorrect. Internal buffers should always be destroyed when the firmware
+explicitly releases it, regardless of whether the 'PENDING_RELEASE' flag
+was set by the driver. This is specially important during force-stop
+scenarios, where the firmware may release buffers without driver marking
+them for release.
+Fix this by removing the incorrect check and ensuring all buffers are
+properly cleaned up.
+
+Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers")
+Cc: stable@vger.kernel.org
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # X1E80100
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # x1e80100-crd
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
+index a8c30fc5c0d0..dda775d463e9 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c
+@@ -424,7 +424,6 @@ static int iris_hfi_gen2_handle_release_internal_buffer(struct iris_inst *inst,
+ struct iris_buffers *buffers = &inst->buffers[buf_type];
+ struct iris_buffer *buf, *iter;
+ bool found = false;
+- int ret = 0;
+
+ list_for_each_entry(iter, &buffers->list, list) {
+ if (iter->device_addr == buffer->base_address) {
+@@ -437,10 +436,8 @@ static int iris_hfi_gen2_handle_release_internal_buffer(struct iris_inst *inst,
+ return -EINVAL;
+
+ buf->attr &= ~BUF_ATTR_QUEUED;
+- if (buf->attr & BUF_ATTR_PENDING_RELEASE)
+- ret = iris_destroy_internal_buffer(inst, buf);
+
+- return ret;
++ return iris_destroy_internal_buffer(inst, buf);
+ }
+
+ static int iris_hfi_gen2_handle_session_stop(struct iris_inst *inst,
+--
+2.51.0
+
--- /dev/null
+From 2fbb823a0744665fe6015bd03d435bd334ccecf7 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Wed, 2 Jul 2025 15:41:58 +0200
+Subject: media: iris: Call correct power off callback in cleanup path
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 2fbb823a0744665fe6015bd03d435bd334ccecf7 upstream.
+
+Driver implements different callbacks for the power off controller
+(.power_off_controller):
+
+ - iris_vpu_power_off_controller,
+ - iris_vpu33_power_off_controller,
+
+The generic wrapper for handling power off - iris_vpu_power_off() -
+calls them via 'iris_platform_data->vpu_ops', so shall the cleanup code
+in iris_vpu_power_on().
+
+This makes also sense if looking at caller of iris_vpu_power_on(), which
+unwinds also with the wrapper calling respective platfortm code (unwinds
+with iris_vpu_power_off()).
+
+Otherwise power off sequence on the newer VPU3.3 in error path is not
+complete.
+
+Fixes: c69df5de4ac3 ("media: platform: qcom/iris: add power_off_controller to vpu_ops")
+Cc: stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_vpu_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_vpu_common.c b/drivers/media/platform/qcom/iris/iris_vpu_common.c
+index 268e45acaa7c..42a7c53ce48e 100644
+--- a/drivers/media/platform/qcom/iris/iris_vpu_common.c
++++ b/drivers/media/platform/qcom/iris/iris_vpu_common.c
+@@ -359,7 +359,7 @@ int iris_vpu_power_on(struct iris_core *core)
+ return 0;
+
+ err_power_off_ctrl:
+- iris_vpu_power_off_controller(core);
++ core->iris_platform_data->vpu_ops->power_off_controller(core);
+ err_unvote_icc:
+ iris_unset_icc_bw(core);
+ err:
+--
+2.51.0
+
--- /dev/null
+From cba6aed4223e83ae0f2ed1c0f68d974fd62847bc Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Mon, 25 Aug 2025 12:30:25 +0530
+Subject: media: iris: Fix buffer count reporting in internal buffer check
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit cba6aed4223e83ae0f2ed1c0f68d974fd62847bc upstream.
+
+Initialize the count variable to zero before counting unreleased
+internal buffers in iris_check_num_queued_internal_buffers().
+This prevents stale values from previous iterations and ensures accurate
+error reporting for each buffer type. Without this initialization, the
+count could accumulate across types, leading to incorrect log messages.
+
+Fixes: d2abb1ff5a3c ("media: iris: Verify internal buffer release on close")
+Cc: stable@vger.kernel.org
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # X1E80100
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # x1e80100-crd
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_vidc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/platform/qcom/iris/iris_vidc.c
++++ b/drivers/media/platform/qcom/iris/iris_vidc.c
+@@ -240,6 +240,7 @@ static void iris_check_num_queued_intern
+
+ for (i = 0; i < internal_buffer_count; i++) {
+ buffers = &inst->buffers[internal_buf_type[i]];
++ count = 0;
+ list_for_each_entry_safe(buf, next, &buffers->list, list)
+ count++;
+ if (count)
--- /dev/null
+From 57429b0fddfe3cea21a56326576451a4a4c2019b Mon Sep 17 00:00:00 2001
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+Date: Mon, 18 Aug 2025 11:50:41 +0200
+Subject: media: iris: Fix firmware reference leak and unmap memory after load
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+commit 57429b0fddfe3cea21a56326576451a4a4c2019b upstream.
+
+When we succeed loading the firmware, we don't want to hold on to the
+firmware pointer anymore, since it won't be freed anywhere else. The same
+applies for the mapped memory. Unmapping the memory is particularly
+important since the memory will be protected after the Iris firmware is
+started, so we need to make sure there will be no accidental access to this
+region (even if just a speculative one from the CPU).
+
+Almost the same firmware loading code also exists in venus/firmware.c,
+there it is implemented correctly.
+
+Fix this by dropping the early "return ret" and move the call of
+qcom_scm_pas_auth_and_reset() out of iris_load_fw_to_memory(). We should
+unmap the memory before bringing the firmware out of reset.
+
+Cc: stable@vger.kernel.org
+Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload")
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_firmware.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_firmware.c b/drivers/media/platform/qcom/iris/iris_firmware.c
+index f1b5cd56db32..9ab499fad946 100644
+--- a/drivers/media/platform/qcom/iris/iris_firmware.c
++++ b/drivers/media/platform/qcom/iris/iris_firmware.c
+@@ -60,16 +60,7 @@ static int iris_load_fw_to_memory(struct iris_core *core, const char *fw_name)
+
+ ret = qcom_mdt_load(dev, firmware, fw_name,
+ pas_id, mem_virt, mem_phys, res_size, NULL);
+- if (ret)
+- goto err_mem_unmap;
+
+- ret = qcom_scm_pas_auth_and_reset(pas_id);
+- if (ret)
+- goto err_mem_unmap;
+-
+- return ret;
+-
+-err_mem_unmap:
+ memunmap(mem_virt);
+ err_release_fw:
+ release_firmware(firmware);
+@@ -94,6 +85,12 @@ int iris_fw_load(struct iris_core *core)
+ return -ENOMEM;
+ }
+
++ ret = qcom_scm_pas_auth_and_reset(core->iris_platform_data->pas_id);
++ if (ret) {
++ dev_err(core->dev, "auth and reset failed: %d\n", ret);
++ return ret;
++ }
++
+ ret = qcom_scm_mem_protect_video_var(cp_config->cp_start,
+ cp_config->cp_size,
+ cp_config->cp_nonpixel_start,
+--
+2.51.0
+
--- /dev/null
+From 2dbd2645c07df8de04ee37b24f2395800513391e Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Mon, 25 Aug 2025 12:30:36 +0530
+Subject: media: iris: Fix format check for CAPTURE plane in try_fmt
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 2dbd2645c07df8de04ee37b24f2395800513391e upstream.
+
+Previously, the format validation relied on an array of supported
+formats, which only listed formats for the OUTPUT plane. This caused
+failures when validating formats for the CAPTURE plane.
+Update the check to validate against the only supported format on the
+CAPTURE plane, which is NV12.
+
+Fixes: fde6161d91bb ("media: iris: Add HEVC and VP9 formats for decoder")
+Cc: stable@vger.kernel.org
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # X1E80100
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # x1e80100-crd
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_vdec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_vdec.c b/drivers/media/platform/qcom/iris/iris_vdec.c
+index d670b51c5839..0f5adaac829f 100644
+--- a/drivers/media/platform/qcom/iris/iris_vdec.c
++++ b/drivers/media/platform/qcom/iris/iris_vdec.c
+@@ -158,7 +158,7 @@ int iris_vdec_try_fmt(struct iris_inst *inst, struct v4l2_format *f)
+ }
+ break;
+ case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE:
+- if (!fmt) {
++ if (f->fmt.pix_mp.pixelformat != V4L2_PIX_FMT_NV12) {
+ f_inst = inst->fmt_dst;
+ f->fmt.pix_mp.pixelformat = f_inst->fmt.pix_mp.pixelformat;
+ f->fmt.pix_mp.width = f_inst->fmt.pix_mp.width;
+--
+2.51.0
+
--- /dev/null
+From 8172f57746d68e5c3c743f725435d75c5a4db1ac Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Mon, 25 Aug 2025 12:30:35 +0530
+Subject: media: iris: Fix missing LAST flag handling during drain
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 8172f57746d68e5c3c743f725435d75c5a4db1ac upstream.
+
+Improve drain handling by ensuring the LAST flag is attached to final
+capture buffer when drain response is received from the firmware.
+
+Previously, the driver failed to attach the V4L2_BUF_FLAG_LAST flag when
+a drain response was received from the firmware, relying on userspace to
+mark the next queued buffer as LAST. This update fixes the issue by
+checking the pending drain status, attaching the LAST flag to the
+capture buffer received from the firmware (with EOS attached), and
+returning it to the V4L2 layer correctly.
+
+Fixes: d09100763bed ("media: iris: add support for drain sequence")
+Cc: stable@vger.kernel.org
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # X1E80100
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # x1e80100-crd
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c | 4 +---
+ drivers/media/platform/qcom/iris/iris_state.c | 2 +-
+ drivers/media/platform/qcom/iris/iris_state.h | 1 +
+ 3 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
+index 8d1ce8a19a45..2a9645883383 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c
+@@ -416,8 +416,6 @@ static void iris_hfi_gen1_session_ftb_done(struct iris_inst *inst, void *packet)
+ inst->flush_responses_pending++;
+
+ iris_inst_sub_state_change_drain_last(inst);
+-
+- return;
+ }
+
+ if (iris_split_mode_enabled(inst) && pkt->stream_id == 0) {
+@@ -462,7 +460,7 @@ static void iris_hfi_gen1_session_ftb_done(struct iris_inst *inst, void *packet)
+ timestamp_us = (timestamp_us << 32) | timestamp_lo;
+ } else {
+ if (pkt->stream_id == 1 && !inst->last_buffer_dequeued) {
+- if (iris_drc_pending(inst)) {
++ if (iris_drc_pending(inst) || iris_drain_pending(inst)) {
+ flags |= V4L2_BUF_FLAG_LAST;
+ inst->last_buffer_dequeued = true;
+ }
+diff --git a/drivers/media/platform/qcom/iris/iris_state.c b/drivers/media/platform/qcom/iris/iris_state.c
+index a21238d2818f..d1dc1a863da0 100644
+--- a/drivers/media/platform/qcom/iris/iris_state.c
++++ b/drivers/media/platform/qcom/iris/iris_state.c
+@@ -252,7 +252,7 @@ bool iris_drc_pending(struct iris_inst *inst)
+ inst->sub_state & IRIS_INST_SUB_DRC_LAST;
+ }
+
+-static inline bool iris_drain_pending(struct iris_inst *inst)
++bool iris_drain_pending(struct iris_inst *inst)
+ {
+ return inst->sub_state & IRIS_INST_SUB_DRAIN &&
+ inst->sub_state & IRIS_INST_SUB_DRAIN_LAST;
+diff --git a/drivers/media/platform/qcom/iris/iris_state.h b/drivers/media/platform/qcom/iris/iris_state.h
+index e718386dbe04..b09fa54cf17e 100644
+--- a/drivers/media/platform/qcom/iris/iris_state.h
++++ b/drivers/media/platform/qcom/iris/iris_state.h
+@@ -141,5 +141,6 @@ int iris_inst_sub_state_change_drc_last(struct iris_inst *inst);
+ int iris_inst_sub_state_change_pause(struct iris_inst *inst, u32 plane);
+ bool iris_allow_cmd(struct iris_inst *inst, u32 cmd);
+ bool iris_drc_pending(struct iris_inst *inst);
++bool iris_drain_pending(struct iris_inst *inst);
+
+ #endif
+--
+2.51.0
+
--- /dev/null
+From fde38008fc4f43db8c17869491870df24b501543 Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <neil.armstrong@linaro.org>
+Date: Fri, 22 Aug 2025 11:20:01 +0200
+Subject: media: iris: fix module removal if firmware download failed
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+commit fde38008fc4f43db8c17869491870df24b501543 upstream.
+
+Fix remove if firmware failed to load:
+qcom-iris aa00000.video-codec: Direct firmware load for qcom/vpu/vpu33_p4.mbn failed with error -2
+qcom-iris aa00000.video-codec: firmware download failed
+qcom-iris aa00000.video-codec: core init failed
+
+then:
+$ echo aa00000.video-codec > /sys/bus/platform/drivers/qcom-iris/unbind
+
+Triggers:
+genpd genpd:1:aa00000.video-codec: Runtime PM usage count underflow!
+------------[ cut here ]------------
+video_cc_mvs0_clk already disabled
+WARNING: drivers/clk/clk.c:1206 at clk_core_disable+0xa4/0xac, CPU#1: sh/542
+<snip>
+pc : clk_core_disable+0xa4/0xac
+lr : clk_core_disable+0xa4/0xac
+<snip>
+Call trace:
+ clk_core_disable+0xa4/0xac (P)
+ clk_disable+0x30/0x4c
+ iris_disable_unprepare_clock+0x20/0x48 [qcom_iris]
+ iris_vpu_power_off_hw+0x48/0x58 [qcom_iris]
+ iris_vpu33_power_off_hardware+0x44/0x230 [qcom_iris]
+ iris_vpu_power_off+0x34/0x84 [qcom_iris]
+ iris_core_deinit+0x44/0xc8 [qcom_iris]
+ iris_remove+0x20/0x48 [qcom_iris]
+ platform_remove+0x20/0x30
+ device_remove+0x4c/0x80
+<snip>
+---[ end trace 0000000000000000 ]---
+------------[ cut here ]------------
+video_cc_mvs0_clk already unprepared
+WARNING: drivers/clk/clk.c:1065 at clk_core_unprepare+0xf0/0x110, CPU#2: sh/542
+<snip>
+pc : clk_core_unprepare+0xf0/0x110
+lr : clk_core_unprepare+0xf0/0x110
+<snip>
+Call trace:
+ clk_core_unprepare+0xf0/0x110 (P)
+ clk_unprepare+0x2c/0x44
+ iris_disable_unprepare_clock+0x28/0x48 [qcom_iris]
+ iris_vpu_power_off_hw+0x48/0x58 [qcom_iris]
+ iris_vpu33_power_off_hardware+0x44/0x230 [qcom_iris]
+ iris_vpu_power_off+0x34/0x84 [qcom_iris]
+ iris_core_deinit+0x44/0xc8 [qcom_iris]
+ iris_remove+0x20/0x48 [qcom_iris]
+ platform_remove+0x20/0x30
+ device_remove+0x4c/0x80
+<snip>
+---[ end trace 0000000000000000 ]---
+genpd genpd:0:aa00000.video-codec: Runtime PM usage count underflow!
+------------[ cut here ]------------
+gcc_video_axi0_clk already disabled
+WARNING: drivers/clk/clk.c:1206 at clk_core_disable+0xa4/0xac, CPU#4: sh/542
+<snip>
+pc : clk_core_disable+0xa4/0xac
+lr : clk_core_disable+0xa4/0xac
+<snip>
+Call trace:
+ clk_core_disable+0xa4/0xac (P)
+ clk_disable+0x30/0x4c
+ iris_disable_unprepare_clock+0x20/0x48 [qcom_iris]
+ iris_vpu33_power_off_controller+0x17c/0x428 [qcom_iris]
+ iris_vpu_power_off+0x48/0x84 [qcom_iris]
+ iris_core_deinit+0x44/0xc8 [qcom_iris]
+ iris_remove+0x20/0x48 [qcom_iris]
+ platform_remove+0x20/0x30
+ device_remove+0x4c/0x80
+<snip>
+------------[ cut here ]------------
+gcc_video_axi0_clk already unprepared
+WARNING: drivers/clk/clk.c:1065 at clk_core_unprepare+0xf0/0x110, CPU#4: sh/542
+<snip>
+pc : clk_core_unprepare+0xf0/0x110
+lr : clk_core_unprepare+0xf0/0x110
+<snip>
+Call trace:
+ clk_core_unprepare+0xf0/0x110 (P)
+ clk_unprepare+0x2c/0x44
+ iris_disable_unprepare_clock+0x28/0x48 [qcom_iris]
+ iris_vpu33_power_off_controller+0x17c/0x428 [qcom_iris]
+ iris_vpu_power_off+0x48/0x84 [qcom_iris]
+ iris_core_deinit+0x44/0xc8 [qcom_iris]
+ iris_remove+0x20/0x48 [qcom_iris]
+ platform_remove+0x20/0x30
+ device_remove+0x4c/0x80
+<snip>
+---[ end trace 0000000000000000 ]---
+
+Skip deinit if initialization never succeeded.
+
+Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues")
+Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload")
+Fixes: bb8a95aa038e ("media: iris: implement power management")
+Cc: stable@vger.kernel.org
+Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_core.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_core.c b/drivers/media/platform/qcom/iris/iris_core.c
+index 0fa0a3b549a2..8406c48d635b 100644
+--- a/drivers/media/platform/qcom/iris/iris_core.c
++++ b/drivers/media/platform/qcom/iris/iris_core.c
+@@ -15,10 +15,12 @@ void iris_core_deinit(struct iris_core *core)
+ pm_runtime_resume_and_get(core->dev);
+
+ mutex_lock(&core->lock);
+- iris_fw_unload(core);
+- iris_vpu_power_off(core);
+- iris_hfi_queues_deinit(core);
+- core->state = IRIS_CORE_DEINIT;
++ if (core->state != IRIS_CORE_DEINIT) {
++ iris_fw_unload(core);
++ iris_vpu_power_off(core);
++ iris_hfi_queues_deinit(core);
++ core->state = IRIS_CORE_DEINIT;
++ }
+ mutex_unlock(&core->lock);
+
+ pm_runtime_put_sync(core->dev);
+--
+2.51.0
+
--- /dev/null
+From 4b67ef9b333ed645879b4b1a11e35e019ff4cfea Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Mon, 25 Aug 2025 12:30:28 +0530
+Subject: media: iris: Fix port streaming handling
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 4b67ef9b333ed645879b4b1a11e35e019ff4cfea upstream.
+
+The previous check to block capture port streaming before output port
+was incorrect and caused some valid usecase to fail. While removing that
+check allows capture port to enter streaming independently, it also
+introduced firmware errors due to premature queuing of DPB buffers
+before the firmware session was fully started which happens only when
+streamon is called on output port.
+
+Fix this by deferring DPB buffer queuing to the firmware until both
+capture and output are streaming and state is 'STREAMING'.
+
+Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops")
+Cc: stable@vger.kernel.org
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # X1E80100
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # x1e80100-crd
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ .../media/platform/qcom/iris/iris_buffer.c | 27 +++++++++++++++++++
+ .../media/platform/qcom/iris/iris_buffer.h | 1 +
+ drivers/media/platform/qcom/iris/iris_vb2.c | 8 +++---
+ 3 files changed, 32 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
+index 9f664c241149..23cac5d13129 100644
+--- a/drivers/media/platform/qcom/iris/iris_buffer.c
++++ b/drivers/media/platform/qcom/iris/iris_buffer.c
+@@ -334,6 +334,29 @@ int iris_queue_buffer(struct iris_inst *inst, struct iris_buffer *buf)
+ return 0;
+ }
+
++int iris_queue_internal_deferred_buffers(struct iris_inst *inst, enum iris_buffer_type buffer_type)
++{
++ struct iris_buffer *buffer, *next;
++ struct iris_buffers *buffers;
++ int ret = 0;
++
++ buffers = &inst->buffers[buffer_type];
++ list_for_each_entry_safe(buffer, next, &buffers->list, list) {
++ if (buffer->attr & BUF_ATTR_PENDING_RELEASE)
++ continue;
++ if (buffer->attr & BUF_ATTR_QUEUED)
++ continue;
++
++ if (buffer->attr & BUF_ATTR_DEFERRED) {
++ ret = iris_queue_buffer(inst, buffer);
++ if (ret)
++ return ret;
++ }
++ }
++
++ return ret;
++}
++
+ int iris_queue_internal_buffers(struct iris_inst *inst, u32 plane)
+ {
+ const struct iris_platform_data *platform_data = inst->core->iris_platform_data;
+@@ -358,6 +381,10 @@ int iris_queue_internal_buffers(struct iris_inst *inst, u32 plane)
+ continue;
+ if (buffer->attr & BUF_ATTR_QUEUED)
+ continue;
++ if (buffer->type == BUF_DPB && inst->state != IRIS_INST_STREAMING) {
++ buffer->attr |= BUF_ATTR_DEFERRED;
++ continue;
++ }
+ ret = iris_queue_buffer(inst, buffer);
+ if (ret)
+ return ret;
+diff --git a/drivers/media/platform/qcom/iris/iris_buffer.h b/drivers/media/platform/qcom/iris/iris_buffer.h
+index 00825ad2dc3a..b9b011faa13a 100644
+--- a/drivers/media/platform/qcom/iris/iris_buffer.h
++++ b/drivers/media/platform/qcom/iris/iris_buffer.h
+@@ -105,6 +105,7 @@ int iris_get_buffer_size(struct iris_inst *inst, enum iris_buffer_type buffer_ty
+ void iris_get_internal_buffers(struct iris_inst *inst, u32 plane);
+ int iris_create_internal_buffers(struct iris_inst *inst, u32 plane);
+ int iris_queue_internal_buffers(struct iris_inst *inst, u32 plane);
++int iris_queue_internal_deferred_buffers(struct iris_inst *inst, enum iris_buffer_type buffer_type);
+ int iris_destroy_internal_buffer(struct iris_inst *inst, struct iris_buffer *buffer);
+ int iris_destroy_all_internal_buffers(struct iris_inst *inst, u32 plane);
+ int iris_destroy_dequeued_internal_buffers(struct iris_inst *inst, u32 plane);
+diff --git a/drivers/media/platform/qcom/iris/iris_vb2.c b/drivers/media/platform/qcom/iris/iris_vb2.c
+index 8b17c7c39487..e62ed7a57df2 100644
+--- a/drivers/media/platform/qcom/iris/iris_vb2.c
++++ b/drivers/media/platform/qcom/iris/iris_vb2.c
+@@ -173,9 +173,6 @@ int iris_vb2_start_streaming(struct vb2_queue *q, unsigned int count)
+
+ inst = vb2_get_drv_priv(q);
+
+- if (V4L2_TYPE_IS_CAPTURE(q->type) && inst->state == IRIS_INST_INIT)
+- return 0;
+-
+ mutex_lock(&inst->lock);
+ if (inst->state == IRIS_INST_ERROR) {
+ ret = -EBUSY;
+@@ -203,7 +200,10 @@ int iris_vb2_start_streaming(struct vb2_queue *q, unsigned int count)
+
+ buf_type = iris_v4l2_type_to_driver(q->type);
+
+- ret = iris_queue_deferred_buffers(inst, buf_type);
++ if (inst->state == IRIS_INST_STREAMING)
++ ret = iris_queue_internal_deferred_buffers(inst, BUF_DPB);
++ if (!ret)
++ ret = iris_queue_deferred_buffers(inst, buf_type);
+ if (ret)
+ goto error;
+
+--
+2.51.0
+
--- /dev/null
+From dec073dd8452e174a69db8444e0932e6b4f31c99 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Mon, 25 Aug 2025 12:30:34 +0530
+Subject: media: iris: Send dummy buffer address for all codecs during drain
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit dec073dd8452e174a69db8444e0932e6b4f31c99 upstream.
+
+Firmware can handle a dummy address for buffers with the EOS flag. To
+ensure consistent behavior across all codecs, update the drain
+command to always send a dummy buffer address.
+
+This makes the drain handling uniform and avoids any codec specific
+assumptions.
+
+Fixes: 478c4478610d ("media: iris: Add codec specific check for VP9 decoder drain handling")
+Cc: stable@vger.kernel.org
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # X1E80100
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # x1e80100-crd
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
+@@ -397,8 +397,7 @@ static int iris_hfi_gen1_session_drain(s
+ ip_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_EMPTY_BUFFER;
+ ip_pkt.shdr.session_id = inst->session_id;
+ ip_pkt.flags = HFI_BUFFERFLAG_EOS;
+- if (inst->codec == V4L2_PIX_FMT_VP9)
+- ip_pkt.packet_buffer = 0xdeadb000;
++ ip_pkt.packet_buffer = 0xdeadb000;
+
+ return iris_hfi_queue_cmd_write(inst->core, &ip_pkt, ip_pkt.shdr.hdr.size);
+ }
--- /dev/null
+From 0fe10666d3b4d0757b7f4671892523855ee68cc8 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Mon, 25 Aug 2025 12:30:32 +0530
+Subject: media: iris: Simplify session stop logic by relying on vb2 checks
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 0fe10666d3b4d0757b7f4671892523855ee68cc8 upstream.
+
+Remove earlier complex conditional checks in the non-streaming path that
+attempted to verify if stop was called on a plane that was previously
+started. These explicit checks are redundant, as vb2 already ensures
+that stop is only called on ports that have been started, maintaining
+correct buffer state management.
+
+Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops")
+Cc: stable@vger.kernel.org
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # X1E80100
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # x1e80100-crd
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ .../qcom/iris/iris_hfi_gen1_command.c | 42 +++++++++----------
+ 1 file changed, 19 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
+index 5fc30d54af4d..3e41c8cb620e 100644
+--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c
+@@ -184,11 +184,25 @@ static int iris_hfi_gen1_session_stop(struct iris_inst *inst, u32 plane)
+ u32 flush_type = 0;
+ int ret = 0;
+
+- if ((V4L2_TYPE_IS_OUTPUT(plane) &&
+- inst->state == IRIS_INST_INPUT_STREAMING) ||
+- (V4L2_TYPE_IS_CAPTURE(plane) &&
+- inst->state == IRIS_INST_OUTPUT_STREAMING) ||
+- inst->state == IRIS_INST_ERROR) {
++ if (inst->state == IRIS_INST_STREAMING) {
++ if (V4L2_TYPE_IS_OUTPUT(plane))
++ flush_type = HFI_FLUSH_ALL;
++ else if (V4L2_TYPE_IS_CAPTURE(plane))
++ flush_type = HFI_FLUSH_OUTPUT;
++
++ reinit_completion(&inst->flush_completion);
++
++ flush_pkt.shdr.hdr.size = sizeof(struct hfi_session_flush_pkt);
++ flush_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_FLUSH;
++ flush_pkt.shdr.session_id = inst->session_id;
++ flush_pkt.flush_type = flush_type;
++
++ ret = iris_hfi_queue_cmd_write(core, &flush_pkt, flush_pkt.shdr.hdr.size);
++ if (!ret) {
++ inst->flush_responses_pending++;
++ ret = iris_wait_for_session_response(inst, true);
++ }
++ } else {
+ reinit_completion(&inst->completion);
+ iris_hfi_gen1_packet_session_cmd(inst, &pkt, HFI_CMD_SESSION_STOP);
+ ret = iris_hfi_queue_cmd_write(core, &pkt, pkt.shdr.hdr.size);
+@@ -207,24 +221,6 @@ static int iris_hfi_gen1_session_stop(struct iris_inst *inst, u32 plane)
+ VB2_BUF_STATE_ERROR);
+ iris_helper_buffers_done(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE,
+ VB2_BUF_STATE_ERROR);
+- } else if (inst->state == IRIS_INST_STREAMING) {
+- if (V4L2_TYPE_IS_OUTPUT(plane))
+- flush_type = HFI_FLUSH_ALL;
+- else if (V4L2_TYPE_IS_CAPTURE(plane))
+- flush_type = HFI_FLUSH_OUTPUT;
+-
+- reinit_completion(&inst->flush_completion);
+-
+- flush_pkt.shdr.hdr.size = sizeof(struct hfi_session_flush_pkt);
+- flush_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_FLUSH;
+- flush_pkt.shdr.session_id = inst->session_id;
+- flush_pkt.flush_type = flush_type;
+-
+- ret = iris_hfi_queue_cmd_write(core, &flush_pkt, flush_pkt.shdr.hdr.size);
+- if (!ret) {
+- inst->flush_responses_pending++;
+- ret = iris_wait_for_session_response(inst, true);
+- }
+ }
+
+ return ret;
+--
+2.51.0
+
--- /dev/null
+From 8a432174ac263fb9dd93d232b99c84e430e6d6b5 Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Mon, 25 Aug 2025 12:30:31 +0530
+Subject: media: iris: Update vbuf flags before v4l2_m2m_buf_done
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 8a432174ac263fb9dd93d232b99c84e430e6d6b5 upstream.
+
+Update the vbuf flags appropriately in error cases before calling
+v4l2_m2m_buf_done(). Previously, the flag update was skippied in error
+scenario, which could result in incorrect state reporting for buffers.
+
+Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response")
+Cc: stable@vger.kernel.org
+Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com>
+Tested-by: Vikash Garodia <quic_vgarodia@quicinc.com> # X1E80100
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-HDK
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # x1e80100-crd
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_buffer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
+index 23cac5d13129..38548ee4749e 100644
+--- a/drivers/media/platform/qcom/iris/iris_buffer.c
++++ b/drivers/media/platform/qcom/iris/iris_buffer.c
+@@ -651,6 +651,8 @@ int iris_vb2_buffer_done(struct iris_inst *inst, struct iris_buffer *buf)
+
+ vb2 = &vbuf->vb2_buf;
+
++ vbuf->flags |= buf->flags;
++
+ if (buf->flags & V4L2_BUF_FLAG_ERROR) {
+ state = VB2_BUF_STATE_ERROR;
+ vb2_set_plane_payload(vb2, 0, 0);
+@@ -659,8 +661,6 @@ int iris_vb2_buffer_done(struct iris_inst *inst, struct iris_buffer *buf)
+ return 0;
+ }
+
+- vbuf->flags |= buf->flags;
+-
+ if (V4L2_TYPE_IS_CAPTURE(type)) {
+ vb2_set_plane_payload(vb2, 0, buf->data_size);
+ vbuf->sequence = inst->sequence_cap++;
+--
+2.51.0
+
--- /dev/null
+From 93fad55aa996eef17a837ed95b1d621ef05d967b Mon Sep 17 00:00:00 2001
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Date: Fri, 22 Aug 2025 11:23:30 +0530
+Subject: media: iris: vpu3x: Add MNoC low power handshake during hardware power-off
+
+From: Dikshita Agarwal <quic_dikshita@quicinc.com>
+
+commit 93fad55aa996eef17a837ed95b1d621ef05d967b upstream.
+
+Add the missing write to AON_WRAPPER_MVP_NOC_LPI_CONTROL before
+reading the LPI status register. Introduce a handshake loop to ensure
+MNoC enters low power mode reliably during VPU3 hardware power-off with
+timeout handling.
+
+Fixes: 02083a1e00ae ("media: platform: qcom/iris: add support for vpu33")
+Cc: stable@vger.kernel.org
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-HDK
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/iris/iris_vpu3x.c | 32 +++++++++++++++++--
+ 1 file changed, 30 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/iris/iris_vpu3x.c b/drivers/media/platform/qcom/iris/iris_vpu3x.c
+index 9b7c9a1495ee..bfc52eb04ed0 100644
+--- a/drivers/media/platform/qcom/iris/iris_vpu3x.c
++++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c
+@@ -19,6 +19,9 @@
+ #define WRAPPER_IRIS_CPU_NOC_LPI_CONTROL (WRAPPER_BASE_OFFS + 0x5C)
+ #define REQ_POWER_DOWN_PREP BIT(0)
+ #define WRAPPER_IRIS_CPU_NOC_LPI_STATUS (WRAPPER_BASE_OFFS + 0x60)
++#define NOC_LPI_STATUS_DONE BIT(0) /* Indicates the NOC handshake is complete */
++#define NOC_LPI_STATUS_DENY BIT(1) /* Indicates the NOC handshake is denied */
++#define NOC_LPI_STATUS_ACTIVE BIT(2) /* Indicates the NOC is active */
+ #define WRAPPER_CORE_CLOCK_CONFIG (WRAPPER_BASE_OFFS + 0x88)
+ #define CORE_CLK_RUN 0x0
+
+@@ -109,7 +112,9 @@ static void iris_vpu3_power_off_hardware(struct iris_core *core)
+
+ static void iris_vpu33_power_off_hardware(struct iris_core *core)
+ {
++ bool handshake_done = false, handshake_busy = false;
+ u32 reg_val = 0, value, i;
++ u32 count = 0;
+ int ret;
+
+ if (iris_vpu3x_hw_power_collapsed(core))
+@@ -128,13 +133,36 @@ static void iris_vpu33_power_off_hardware(struct iris_core *core)
+ goto disable_power;
+ }
+
++ /* Retry up to 1000 times as recommended by hardware documentation */
++ do {
++ /* set MNoC to low power */
++ writel(REQ_POWER_DOWN_PREP, core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL);
++
++ udelay(15);
++
++ value = readl(core->reg_base + AON_WRAPPER_MVP_NOC_LPI_STATUS);
++
++ handshake_done = value & NOC_LPI_STATUS_DONE;
++ handshake_busy = value & (NOC_LPI_STATUS_DENY | NOC_LPI_STATUS_ACTIVE);
++
++ if (handshake_done || !handshake_busy)
++ break;
++
++ writel(0, core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL);
++
++ udelay(15);
++
++ } while (++count < 1000);
++
++ if (!handshake_done && handshake_busy)
++ dev_err(core->dev, "LPI handshake timeout\n");
++
+ ret = readl_poll_timeout(core->reg_base + AON_WRAPPER_MVP_NOC_LPI_STATUS,
+ reg_val, reg_val & BIT(0), 200, 2000);
+ if (ret)
+ goto disable_power;
+
+- /* set MNoC to low power, set PD_NOC_QREQ (bit 0) */
+- writel(BIT(0), core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL);
++ writel(0, core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL);
+
+ writel(CORE_BRIDGE_SW_RESET | CORE_BRIDGE_HW_RESET_DISABLE,
+ core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
+--
+2.51.0
+
nfsd-decouple-the-xprtsec-policy-check-from-check_nfsd_access.patch
nfsd-fix-destination-buffer-size-in-nfsd4_ssc_setup_dul.patch
nfsd-nfserr_jukebox-in-nlm_fopen-should-lead-to-a-retry.patch
+media-iris-call-correct-power-off-callback-in-cleanup-path.patch
+media-iris-fix-firmware-reference-leak-and-unmap-memory-after-load.patch
+media-iris-fix-module-removal-if-firmware-download-failed.patch
+media-iris-vpu3x-add-mnoc-low-power-handshake-during-hardware-power-off.patch
+media-iris-fix-port-streaming-handling.patch
+media-iris-fix-buffer-count-reporting-in-internal-buffer-check.patch
+media-iris-allow-substate-transition-to-load-resources-during-output-streaming.patch
+media-iris-always-destroy-internal-buffers-on-firmware-release-response.patch
+media-iris-simplify-session-stop-logic-by-relying-on-vb2-checks.patch
+media-iris-update-vbuf-flags-before-v4l2_m2m_buf_done.patch
+media-iris-send-dummy-buffer-address-for-all-codecs-during-drain.patch
+media-iris-fix-missing-last-flag-handling-during-drain.patch
+media-iris-fix-format-check-for-capture-plane-in-try_fmt.patch
+media-iris-allow-stop-on-firmware-only-if-start-was-issued.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
