From: Greg Kroah-Hartman Date: Thu, 16 Oct 2025 14:13:15 +0000 (+0200) Subject: 6.17-stable patches X-Git-Tag: v5.15.195~59 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=33f1e9096705dcee7f8b9f742bd5120dc03f610d;p=thirdparty%2Fkernel%2Fstable-queue.git 6.17-stable patches added patches: media-iris-allow-stop-on-firmware-only-if-start-was-issued.patch media-iris-allow-substate-transition-to-load-resources-during-output-streaming.patch media-iris-always-destroy-internal-buffers-on-firmware-release-response.patch media-iris-call-correct-power-off-callback-in-cleanup-path.patch media-iris-fix-buffer-count-reporting-in-internal-buffer-check.patch media-iris-fix-firmware-reference-leak-and-unmap-memory-after-load.patch media-iris-fix-format-check-for-capture-plane-in-try_fmt.patch media-iris-fix-missing-last-flag-handling-during-drain.patch media-iris-fix-module-removal-if-firmware-download-failed.patch media-iris-fix-port-streaming-handling.patch media-iris-send-dummy-buffer-address-for-all-codecs-during-drain.patch media-iris-simplify-session-stop-logic-by-relying-on-vb2-checks.patch media-iris-update-vbuf-flags-before-v4l2_m2m_buf_done.patch media-iris-vpu3x-add-mnoc-low-power-handshake-during-hardware-power-off.patch --- diff --git a/queue-6.17/media-iris-allow-stop-on-firmware-only-if-start-was-issued.patch b/queue-6.17/media-iris-allow-stop-on-firmware-only-if-start-was-issued.patch new file mode 100644 index 0000000000..2b9ea99789 --- /dev/null +++ b/queue-6.17/media-iris-allow-stop-on-firmware-only-if-start-was-issued.patch @@ -0,0 +1,47 @@ +From 56a2d85ee8f9b994e5cd17039133218c57c5902b Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Mon, 25 Aug 2025 12:30:33 +0530 +Subject: media: iris: Allow stop on firmware only if start was issued. + +From: Dikshita Agarwal + +commit 56a2d85ee8f9b994e5cd17039133218c57c5902b upstream. + +For HFI Gen1, the instances substate is changed to LOAD_RESOURCES only +when a START command is issues to the firmware. If STOP is called +without a prior START, the firmware may reject the command and throw +some erros. +Handle this by adding a substate check before issuing STOP command to +the firmware. + +Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops") +Cc: stable@vger.kernel.org +Reviewed-by: Vikash Garodia +Tested-by: Vikash Garodia # X1E80100 +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Bryan O'Donoghue # x1e80100-crd +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c +index 3e41c8cb620e..a3461ccf170a 100644 +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c +@@ -202,7 +202,7 @@ static int iris_hfi_gen1_session_stop(struct iris_inst *inst, u32 plane) + inst->flush_responses_pending++; + ret = iris_wait_for_session_response(inst, true); + } +- } else { ++ } else if (inst->sub_state & IRIS_INST_SUB_LOAD_RESOURCES) { + reinit_completion(&inst->completion); + iris_hfi_gen1_packet_session_cmd(inst, &pkt, HFI_CMD_SESSION_STOP); + ret = iris_hfi_queue_cmd_write(core, &pkt, pkt.shdr.hdr.size); +-- +2.51.0 + diff --git a/queue-6.17/media-iris-allow-substate-transition-to-load-resources-during-output-streaming.patch b/queue-6.17/media-iris-allow-substate-transition-to-load-resources-during-output-streaming.patch new file mode 100644 index 0000000000..9f5588969a --- /dev/null +++ b/queue-6.17/media-iris-allow-substate-transition-to-load-resources-during-output-streaming.patch @@ -0,0 +1,53 @@ +From 65f72c6a8d97c0cbdc785cb9a35dc358dee67959 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Mon, 25 Aug 2025 12:30:29 +0530 +Subject: media: iris: Allow substate transition to load resources during output streaming + +From: Dikshita Agarwal + +commit 65f72c6a8d97c0cbdc785cb9a35dc358dee67959 upstream. + +A client (e.g., GST for encoder) can initiate streaming on the capture +port before the output port, causing the instance state to transition to +OUTPUT_STREAMING. When streaming is subsequently started on the output +port, the instance state advances to STREAMING, and the substate should +transition to LOAD_RESOURCES. + +Previously, the code blocked the substate transition to LOAD_RESOURCES +if the instance state was OUTPUT_STREAMING. This update modifies the +logic to permit the substate transition to LOAD_RESOURCES when the +instance state is OUTPUT_STREAMING, thereby supporting this client +streaming sequence. + +Fixes: 547f7b8c5090 ("media: iris: add check to allow sub states transitions") +Cc: stable@vger.kernel.org +Reviewed-by: Vikash Garodia +Tested-by: Vikash Garodia # X1E80100 +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Bryan O'Donoghue # x1e80100-crd +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_state.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_state.c b/drivers/media/platform/qcom/iris/iris_state.c +index 104e1687ad39..a21238d2818f 100644 +--- a/drivers/media/platform/qcom/iris/iris_state.c ++++ b/drivers/media/platform/qcom/iris/iris_state.c +@@ -122,7 +122,8 @@ static bool iris_inst_allow_sub_state(struct iris_inst *inst, enum iris_inst_sub + return false; + case IRIS_INST_OUTPUT_STREAMING: + if (sub_state & (IRIS_INST_SUB_DRC_LAST | +- IRIS_INST_SUB_DRAIN_LAST | IRIS_INST_SUB_OUTPUT_PAUSE)) ++ IRIS_INST_SUB_DRAIN_LAST | IRIS_INST_SUB_OUTPUT_PAUSE | ++ IRIS_INST_SUB_LOAD_RESOURCES)) + return true; + return false; + case IRIS_INST_STREAMING: +-- +2.51.0 + diff --git a/queue-6.17/media-iris-always-destroy-internal-buffers-on-firmware-release-response.patch b/queue-6.17/media-iris-always-destroy-internal-buffers-on-firmware-release-response.patch new file mode 100644 index 0000000000..9cd6b07e17 --- /dev/null +++ b/queue-6.17/media-iris-always-destroy-internal-buffers-on-firmware-release-response.patch @@ -0,0 +1,62 @@ +From 9cae3619e465dd1cdaa5a5ffbbaf4f41338b0022 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Mon, 25 Aug 2025 12:30:30 +0530 +Subject: media: iris: Always destroy internal buffers on firmware release response + +From: Dikshita Agarwal + +commit 9cae3619e465dd1cdaa5a5ffbbaf4f41338b0022 upstream. + +Currently, internal buffers are destroyed only if 'PENDING_RELEASE' flag +is set when a release response is received from the firmware, which is +incorrect. Internal buffers should always be destroyed when the firmware +explicitly releases it, regardless of whether the 'PENDING_RELEASE' flag +was set by the driver. This is specially important during force-stop +scenarios, where the firmware may release buffers without driver marking +them for release. +Fix this by removing the incorrect check and ensuring all buffers are +properly cleaned up. + +Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") +Cc: stable@vger.kernel.org +Reviewed-by: Vikash Garodia +Tested-by: Vikash Garodia # X1E80100 +Reviewed-by: Bryan O'Donoghue +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Bryan O'Donoghue # x1e80100-crd +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c +index a8c30fc5c0d0..dda775d463e9 100644 +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_response.c +@@ -424,7 +424,6 @@ static int iris_hfi_gen2_handle_release_internal_buffer(struct iris_inst *inst, + struct iris_buffers *buffers = &inst->buffers[buf_type]; + struct iris_buffer *buf, *iter; + bool found = false; +- int ret = 0; + + list_for_each_entry(iter, &buffers->list, list) { + if (iter->device_addr == buffer->base_address) { +@@ -437,10 +436,8 @@ static int iris_hfi_gen2_handle_release_internal_buffer(struct iris_inst *inst, + return -EINVAL; + + buf->attr &= ~BUF_ATTR_QUEUED; +- if (buf->attr & BUF_ATTR_PENDING_RELEASE) +- ret = iris_destroy_internal_buffer(inst, buf); + +- return ret; ++ return iris_destroy_internal_buffer(inst, buf); + } + + static int iris_hfi_gen2_handle_session_stop(struct iris_inst *inst, +-- +2.51.0 + diff --git a/queue-6.17/media-iris-call-correct-power-off-callback-in-cleanup-path.patch b/queue-6.17/media-iris-call-correct-power-off-callback-in-cleanup-path.patch new file mode 100644 index 0000000000..bd8ba3621f --- /dev/null +++ b/queue-6.17/media-iris-call-correct-power-off-callback-in-cleanup-path.patch @@ -0,0 +1,54 @@ +From 2fbb823a0744665fe6015bd03d435bd334ccecf7 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 2 Jul 2025 15:41:58 +0200 +Subject: media: iris: Call correct power off callback in cleanup path + +From: Krzysztof Kozlowski + +commit 2fbb823a0744665fe6015bd03d435bd334ccecf7 upstream. + +Driver implements different callbacks for the power off controller +(.power_off_controller): + + - iris_vpu_power_off_controller, + - iris_vpu33_power_off_controller, + +The generic wrapper for handling power off - iris_vpu_power_off() - +calls them via 'iris_platform_data->vpu_ops', so shall the cleanup code +in iris_vpu_power_on(). + +This makes also sense if looking at caller of iris_vpu_power_on(), which +unwinds also with the wrapper calling respective platfortm code (unwinds +with iris_vpu_power_off()). + +Otherwise power off sequence on the newer VPU3.3 in error path is not +complete. + +Fixes: c69df5de4ac3 ("media: platform: qcom/iris: add power_off_controller to vpu_ops") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Vikash Garodia +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_vpu_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_vpu_common.c b/drivers/media/platform/qcom/iris/iris_vpu_common.c +index 268e45acaa7c..42a7c53ce48e 100644 +--- a/drivers/media/platform/qcom/iris/iris_vpu_common.c ++++ b/drivers/media/platform/qcom/iris/iris_vpu_common.c +@@ -359,7 +359,7 @@ int iris_vpu_power_on(struct iris_core *core) + return 0; + + err_power_off_ctrl: +- iris_vpu_power_off_controller(core); ++ core->iris_platform_data->vpu_ops->power_off_controller(core); + err_unvote_icc: + iris_unset_icc_bw(core); + err: +-- +2.51.0 + diff --git a/queue-6.17/media-iris-fix-buffer-count-reporting-in-internal-buffer-check.patch b/queue-6.17/media-iris-fix-buffer-count-reporting-in-internal-buffer-check.patch new file mode 100644 index 0000000000..7e32d986f2 --- /dev/null +++ b/queue-6.17/media-iris-fix-buffer-count-reporting-in-internal-buffer-check.patch @@ -0,0 +1,41 @@ +From cba6aed4223e83ae0f2ed1c0f68d974fd62847bc Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Mon, 25 Aug 2025 12:30:25 +0530 +Subject: media: iris: Fix buffer count reporting in internal buffer check + +From: Dikshita Agarwal + +commit cba6aed4223e83ae0f2ed1c0f68d974fd62847bc upstream. + +Initialize the count variable to zero before counting unreleased +internal buffers in iris_check_num_queued_internal_buffers(). +This prevents stale values from previous iterations and ensures accurate +error reporting for each buffer type. Without this initialization, the +count could accumulate across types, leading to incorrect log messages. + +Fixes: d2abb1ff5a3c ("media: iris: Verify internal buffer release on close") +Cc: stable@vger.kernel.org +Reviewed-by: Vikash Garodia +Tested-by: Vikash Garodia # X1E80100 +Reviewed-by: Bryan O'Donoghue +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Bryan O'Donoghue # x1e80100-crd +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_vidc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/qcom/iris/iris_vidc.c ++++ b/drivers/media/platform/qcom/iris/iris_vidc.c +@@ -240,6 +240,7 @@ static void iris_check_num_queued_intern + + for (i = 0; i < internal_buffer_count; i++) { + buffers = &inst->buffers[internal_buf_type[i]]; ++ count = 0; + list_for_each_entry_safe(buf, next, &buffers->list, list) + count++; + if (count) diff --git a/queue-6.17/media-iris-fix-firmware-reference-leak-and-unmap-memory-after-load.patch b/queue-6.17/media-iris-fix-firmware-reference-leak-and-unmap-memory-after-load.patch new file mode 100644 index 0000000000..9e69effa7d --- /dev/null +++ b/queue-6.17/media-iris-fix-firmware-reference-leak-and-unmap-memory-after-load.patch @@ -0,0 +1,72 @@ +From 57429b0fddfe3cea21a56326576451a4a4c2019b Mon Sep 17 00:00:00 2001 +From: Stephan Gerhold +Date: Mon, 18 Aug 2025 11:50:41 +0200 +Subject: media: iris: Fix firmware reference leak and unmap memory after load + +From: Stephan Gerhold + +commit 57429b0fddfe3cea21a56326576451a4a4c2019b upstream. + +When we succeed loading the firmware, we don't want to hold on to the +firmware pointer anymore, since it won't be freed anywhere else. The same +applies for the mapped memory. Unmapping the memory is particularly +important since the memory will be protected after the Iris firmware is +started, so we need to make sure there will be no accidental access to this +region (even if just a speculative one from the CPU). + +Almost the same firmware loading code also exists in venus/firmware.c, +there it is implemented correctly. + +Fix this by dropping the early "return ret" and move the call of +qcom_scm_pas_auth_and_reset() out of iris_load_fw_to_memory(). We should +unmap the memory before bringing the firmware out of reset. + +Cc: stable@vger.kernel.org +Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload") +Signed-off-by: Stephan Gerhold +Reviewed-by: Bryan O'Donoghue +Reviewed-by: Dikshita Agarwal +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_firmware.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_firmware.c b/drivers/media/platform/qcom/iris/iris_firmware.c +index f1b5cd56db32..9ab499fad946 100644 +--- a/drivers/media/platform/qcom/iris/iris_firmware.c ++++ b/drivers/media/platform/qcom/iris/iris_firmware.c +@@ -60,16 +60,7 @@ static int iris_load_fw_to_memory(struct iris_core *core, const char *fw_name) + + ret = qcom_mdt_load(dev, firmware, fw_name, + pas_id, mem_virt, mem_phys, res_size, NULL); +- if (ret) +- goto err_mem_unmap; + +- ret = qcom_scm_pas_auth_and_reset(pas_id); +- if (ret) +- goto err_mem_unmap; +- +- return ret; +- +-err_mem_unmap: + memunmap(mem_virt); + err_release_fw: + release_firmware(firmware); +@@ -94,6 +85,12 @@ int iris_fw_load(struct iris_core *core) + return -ENOMEM; + } + ++ ret = qcom_scm_pas_auth_and_reset(core->iris_platform_data->pas_id); ++ if (ret) { ++ dev_err(core->dev, "auth and reset failed: %d\n", ret); ++ return ret; ++ } ++ + ret = qcom_scm_mem_protect_video_var(cp_config->cp_start, + cp_config->cp_size, + cp_config->cp_nonpixel_start, +-- +2.51.0 + diff --git a/queue-6.17/media-iris-fix-format-check-for-capture-plane-in-try_fmt.patch b/queue-6.17/media-iris-fix-format-check-for-capture-plane-in-try_fmt.patch new file mode 100644 index 0000000000..8026747003 --- /dev/null +++ b/queue-6.17/media-iris-fix-format-check-for-capture-plane-in-try_fmt.patch @@ -0,0 +1,46 @@ +From 2dbd2645c07df8de04ee37b24f2395800513391e Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Mon, 25 Aug 2025 12:30:36 +0530 +Subject: media: iris: Fix format check for CAPTURE plane in try_fmt + +From: Dikshita Agarwal + +commit 2dbd2645c07df8de04ee37b24f2395800513391e upstream. + +Previously, the format validation relied on an array of supported +formats, which only listed formats for the OUTPUT plane. This caused +failures when validating formats for the CAPTURE plane. +Update the check to validate against the only supported format on the +CAPTURE plane, which is NV12. + +Fixes: fde6161d91bb ("media: iris: Add HEVC and VP9 formats for decoder") +Cc: stable@vger.kernel.org +Reviewed-by: Vikash Garodia +Tested-by: Vikash Garodia # X1E80100 +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Bryan O'Donoghue # x1e80100-crd +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_vdec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_vdec.c b/drivers/media/platform/qcom/iris/iris_vdec.c +index d670b51c5839..0f5adaac829f 100644 +--- a/drivers/media/platform/qcom/iris/iris_vdec.c ++++ b/drivers/media/platform/qcom/iris/iris_vdec.c +@@ -158,7 +158,7 @@ int iris_vdec_try_fmt(struct iris_inst *inst, struct v4l2_format *f) + } + break; + case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE: +- if (!fmt) { ++ if (f->fmt.pix_mp.pixelformat != V4L2_PIX_FMT_NV12) { + f_inst = inst->fmt_dst; + f->fmt.pix_mp.pixelformat = f_inst->fmt.pix_mp.pixelformat; + f->fmt.pix_mp.width = f_inst->fmt.pix_mp.width; +-- +2.51.0 + diff --git a/queue-6.17/media-iris-fix-missing-last-flag-handling-during-drain.patch b/queue-6.17/media-iris-fix-missing-last-flag-handling-during-drain.patch new file mode 100644 index 0000000000..016fb5b2ca --- /dev/null +++ b/queue-6.17/media-iris-fix-missing-last-flag-handling-during-drain.patch @@ -0,0 +1,86 @@ +From 8172f57746d68e5c3c743f725435d75c5a4db1ac Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Mon, 25 Aug 2025 12:30:35 +0530 +Subject: media: iris: Fix missing LAST flag handling during drain + +From: Dikshita Agarwal + +commit 8172f57746d68e5c3c743f725435d75c5a4db1ac upstream. + +Improve drain handling by ensuring the LAST flag is attached to final +capture buffer when drain response is received from the firmware. + +Previously, the driver failed to attach the V4L2_BUF_FLAG_LAST flag when +a drain response was received from the firmware, relying on userspace to +mark the next queued buffer as LAST. This update fixes the issue by +checking the pending drain status, attaching the LAST flag to the +capture buffer received from the firmware (with EOS attached), and +returning it to the V4L2 layer correctly. + +Fixes: d09100763bed ("media: iris: add support for drain sequence") +Cc: stable@vger.kernel.org +Reviewed-by: Vikash Garodia +Tested-by: Vikash Garodia # X1E80100 +Reviewed-by: Bryan O'Donoghue +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Bryan O'Donoghue # x1e80100-crd +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c | 4 +--- + drivers/media/platform/qcom/iris/iris_state.c | 2 +- + drivers/media/platform/qcom/iris/iris_state.h | 1 + + 3 files changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c +index 8d1ce8a19a45..2a9645883383 100644 +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_response.c +@@ -416,8 +416,6 @@ static void iris_hfi_gen1_session_ftb_done(struct iris_inst *inst, void *packet) + inst->flush_responses_pending++; + + iris_inst_sub_state_change_drain_last(inst); +- +- return; + } + + if (iris_split_mode_enabled(inst) && pkt->stream_id == 0) { +@@ -462,7 +460,7 @@ static void iris_hfi_gen1_session_ftb_done(struct iris_inst *inst, void *packet) + timestamp_us = (timestamp_us << 32) | timestamp_lo; + } else { + if (pkt->stream_id == 1 && !inst->last_buffer_dequeued) { +- if (iris_drc_pending(inst)) { ++ if (iris_drc_pending(inst) || iris_drain_pending(inst)) { + flags |= V4L2_BUF_FLAG_LAST; + inst->last_buffer_dequeued = true; + } +diff --git a/drivers/media/platform/qcom/iris/iris_state.c b/drivers/media/platform/qcom/iris/iris_state.c +index a21238d2818f..d1dc1a863da0 100644 +--- a/drivers/media/platform/qcom/iris/iris_state.c ++++ b/drivers/media/platform/qcom/iris/iris_state.c +@@ -252,7 +252,7 @@ bool iris_drc_pending(struct iris_inst *inst) + inst->sub_state & IRIS_INST_SUB_DRC_LAST; + } + +-static inline bool iris_drain_pending(struct iris_inst *inst) ++bool iris_drain_pending(struct iris_inst *inst) + { + return inst->sub_state & IRIS_INST_SUB_DRAIN && + inst->sub_state & IRIS_INST_SUB_DRAIN_LAST; +diff --git a/drivers/media/platform/qcom/iris/iris_state.h b/drivers/media/platform/qcom/iris/iris_state.h +index e718386dbe04..b09fa54cf17e 100644 +--- a/drivers/media/platform/qcom/iris/iris_state.h ++++ b/drivers/media/platform/qcom/iris/iris_state.h +@@ -141,5 +141,6 @@ int iris_inst_sub_state_change_drc_last(struct iris_inst *inst); + int iris_inst_sub_state_change_pause(struct iris_inst *inst, u32 plane); + bool iris_allow_cmd(struct iris_inst *inst, u32 cmd); + bool iris_drc_pending(struct iris_inst *inst); ++bool iris_drain_pending(struct iris_inst *inst); + + #endif +-- +2.51.0 + diff --git a/queue-6.17/media-iris-fix-module-removal-if-firmware-download-failed.patch b/queue-6.17/media-iris-fix-module-removal-if-firmware-download-failed.patch new file mode 100644 index 0000000000..6c0e9b92d0 --- /dev/null +++ b/queue-6.17/media-iris-fix-module-removal-if-firmware-download-failed.patch @@ -0,0 +1,138 @@ +From fde38008fc4f43db8c17869491870df24b501543 Mon Sep 17 00:00:00 2001 +From: Neil Armstrong +Date: Fri, 22 Aug 2025 11:20:01 +0200 +Subject: media: iris: fix module removal if firmware download failed + +From: Neil Armstrong + +commit fde38008fc4f43db8c17869491870df24b501543 upstream. + +Fix remove if firmware failed to load: +qcom-iris aa00000.video-codec: Direct firmware load for qcom/vpu/vpu33_p4.mbn failed with error -2 +qcom-iris aa00000.video-codec: firmware download failed +qcom-iris aa00000.video-codec: core init failed + +then: +$ echo aa00000.video-codec > /sys/bus/platform/drivers/qcom-iris/unbind + +Triggers: +genpd genpd:1:aa00000.video-codec: Runtime PM usage count underflow! +------------[ cut here ]------------ +video_cc_mvs0_clk already disabled +WARNING: drivers/clk/clk.c:1206 at clk_core_disable+0xa4/0xac, CPU#1: sh/542 + +pc : clk_core_disable+0xa4/0xac +lr : clk_core_disable+0xa4/0xac + +Call trace: + clk_core_disable+0xa4/0xac (P) + clk_disable+0x30/0x4c + iris_disable_unprepare_clock+0x20/0x48 [qcom_iris] + iris_vpu_power_off_hw+0x48/0x58 [qcom_iris] + iris_vpu33_power_off_hardware+0x44/0x230 [qcom_iris] + iris_vpu_power_off+0x34/0x84 [qcom_iris] + iris_core_deinit+0x44/0xc8 [qcom_iris] + iris_remove+0x20/0x48 [qcom_iris] + platform_remove+0x20/0x30 + device_remove+0x4c/0x80 + +---[ end trace 0000000000000000 ]--- +------------[ cut here ]------------ +video_cc_mvs0_clk already unprepared +WARNING: drivers/clk/clk.c:1065 at clk_core_unprepare+0xf0/0x110, CPU#2: sh/542 + +pc : clk_core_unprepare+0xf0/0x110 +lr : clk_core_unprepare+0xf0/0x110 + +Call trace: + clk_core_unprepare+0xf0/0x110 (P) + clk_unprepare+0x2c/0x44 + iris_disable_unprepare_clock+0x28/0x48 [qcom_iris] + iris_vpu_power_off_hw+0x48/0x58 [qcom_iris] + iris_vpu33_power_off_hardware+0x44/0x230 [qcom_iris] + iris_vpu_power_off+0x34/0x84 [qcom_iris] + iris_core_deinit+0x44/0xc8 [qcom_iris] + iris_remove+0x20/0x48 [qcom_iris] + platform_remove+0x20/0x30 + device_remove+0x4c/0x80 + +---[ end trace 0000000000000000 ]--- +genpd genpd:0:aa00000.video-codec: Runtime PM usage count underflow! +------------[ cut here ]------------ +gcc_video_axi0_clk already disabled +WARNING: drivers/clk/clk.c:1206 at clk_core_disable+0xa4/0xac, CPU#4: sh/542 + +pc : clk_core_disable+0xa4/0xac +lr : clk_core_disable+0xa4/0xac + +Call trace: + clk_core_disable+0xa4/0xac (P) + clk_disable+0x30/0x4c + iris_disable_unprepare_clock+0x20/0x48 [qcom_iris] + iris_vpu33_power_off_controller+0x17c/0x428 [qcom_iris] + iris_vpu_power_off+0x48/0x84 [qcom_iris] + iris_core_deinit+0x44/0xc8 [qcom_iris] + iris_remove+0x20/0x48 [qcom_iris] + platform_remove+0x20/0x30 + device_remove+0x4c/0x80 + +------------[ cut here ]------------ +gcc_video_axi0_clk already unprepared +WARNING: drivers/clk/clk.c:1065 at clk_core_unprepare+0xf0/0x110, CPU#4: sh/542 + +pc : clk_core_unprepare+0xf0/0x110 +lr : clk_core_unprepare+0xf0/0x110 + +Call trace: + clk_core_unprepare+0xf0/0x110 (P) + clk_unprepare+0x2c/0x44 + iris_disable_unprepare_clock+0x28/0x48 [qcom_iris] + iris_vpu33_power_off_controller+0x17c/0x428 [qcom_iris] + iris_vpu_power_off+0x48/0x84 [qcom_iris] + iris_core_deinit+0x44/0xc8 [qcom_iris] + iris_remove+0x20/0x48 [qcom_iris] + platform_remove+0x20/0x30 + device_remove+0x4c/0x80 + +---[ end trace 0000000000000000 ]--- + +Skip deinit if initialization never succeeded. + +Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues") +Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload") +Fixes: bb8a95aa038e ("media: iris: implement power management") +Cc: stable@vger.kernel.org +Reviewed-by: Dikshita Agarwal +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Neil Armstrong +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_core.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_core.c b/drivers/media/platform/qcom/iris/iris_core.c +index 0fa0a3b549a2..8406c48d635b 100644 +--- a/drivers/media/platform/qcom/iris/iris_core.c ++++ b/drivers/media/platform/qcom/iris/iris_core.c +@@ -15,10 +15,12 @@ void iris_core_deinit(struct iris_core *core) + pm_runtime_resume_and_get(core->dev); + + mutex_lock(&core->lock); +- iris_fw_unload(core); +- iris_vpu_power_off(core); +- iris_hfi_queues_deinit(core); +- core->state = IRIS_CORE_DEINIT; ++ if (core->state != IRIS_CORE_DEINIT) { ++ iris_fw_unload(core); ++ iris_vpu_power_off(core); ++ iris_hfi_queues_deinit(core); ++ core->state = IRIS_CORE_DEINIT; ++ } + mutex_unlock(&core->lock); + + pm_runtime_put_sync(core->dev); +-- +2.51.0 + diff --git a/queue-6.17/media-iris-fix-port-streaming-handling.patch b/queue-6.17/media-iris-fix-port-streaming-handling.patch new file mode 100644 index 0000000000..2df7d1e734 --- /dev/null +++ b/queue-6.17/media-iris-fix-port-streaming-handling.patch @@ -0,0 +1,123 @@ +From 4b67ef9b333ed645879b4b1a11e35e019ff4cfea Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Mon, 25 Aug 2025 12:30:28 +0530 +Subject: media: iris: Fix port streaming handling + +From: Dikshita Agarwal + +commit 4b67ef9b333ed645879b4b1a11e35e019ff4cfea upstream. + +The previous check to block capture port streaming before output port +was incorrect and caused some valid usecase to fail. While removing that +check allows capture port to enter streaming independently, it also +introduced firmware errors due to premature queuing of DPB buffers +before the firmware session was fully started which happens only when +streamon is called on output port. + +Fix this by deferring DPB buffer queuing to the firmware until both +capture and output are streaming and state is 'STREAMING'. + +Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops") +Cc: stable@vger.kernel.org +Reviewed-by: Vikash Garodia +Tested-by: Vikash Garodia # X1E80100 +Reviewed-by: Bryan O'Donoghue +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Bryan O'Donoghue # x1e80100-crd +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + .../media/platform/qcom/iris/iris_buffer.c | 27 +++++++++++++++++++ + .../media/platform/qcom/iris/iris_buffer.h | 1 + + drivers/media/platform/qcom/iris/iris_vb2.c | 8 +++--- + 3 files changed, 32 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c +index 9f664c241149..23cac5d13129 100644 +--- a/drivers/media/platform/qcom/iris/iris_buffer.c ++++ b/drivers/media/platform/qcom/iris/iris_buffer.c +@@ -334,6 +334,29 @@ int iris_queue_buffer(struct iris_inst *inst, struct iris_buffer *buf) + return 0; + } + ++int iris_queue_internal_deferred_buffers(struct iris_inst *inst, enum iris_buffer_type buffer_type) ++{ ++ struct iris_buffer *buffer, *next; ++ struct iris_buffers *buffers; ++ int ret = 0; ++ ++ buffers = &inst->buffers[buffer_type]; ++ list_for_each_entry_safe(buffer, next, &buffers->list, list) { ++ if (buffer->attr & BUF_ATTR_PENDING_RELEASE) ++ continue; ++ if (buffer->attr & BUF_ATTR_QUEUED) ++ continue; ++ ++ if (buffer->attr & BUF_ATTR_DEFERRED) { ++ ret = iris_queue_buffer(inst, buffer); ++ if (ret) ++ return ret; ++ } ++ } ++ ++ return ret; ++} ++ + int iris_queue_internal_buffers(struct iris_inst *inst, u32 plane) + { + const struct iris_platform_data *platform_data = inst->core->iris_platform_data; +@@ -358,6 +381,10 @@ int iris_queue_internal_buffers(struct iris_inst *inst, u32 plane) + continue; + if (buffer->attr & BUF_ATTR_QUEUED) + continue; ++ if (buffer->type == BUF_DPB && inst->state != IRIS_INST_STREAMING) { ++ buffer->attr |= BUF_ATTR_DEFERRED; ++ continue; ++ } + ret = iris_queue_buffer(inst, buffer); + if (ret) + return ret; +diff --git a/drivers/media/platform/qcom/iris/iris_buffer.h b/drivers/media/platform/qcom/iris/iris_buffer.h +index 00825ad2dc3a..b9b011faa13a 100644 +--- a/drivers/media/platform/qcom/iris/iris_buffer.h ++++ b/drivers/media/platform/qcom/iris/iris_buffer.h +@@ -105,6 +105,7 @@ int iris_get_buffer_size(struct iris_inst *inst, enum iris_buffer_type buffer_ty + void iris_get_internal_buffers(struct iris_inst *inst, u32 plane); + int iris_create_internal_buffers(struct iris_inst *inst, u32 plane); + int iris_queue_internal_buffers(struct iris_inst *inst, u32 plane); ++int iris_queue_internal_deferred_buffers(struct iris_inst *inst, enum iris_buffer_type buffer_type); + int iris_destroy_internal_buffer(struct iris_inst *inst, struct iris_buffer *buffer); + int iris_destroy_all_internal_buffers(struct iris_inst *inst, u32 plane); + int iris_destroy_dequeued_internal_buffers(struct iris_inst *inst, u32 plane); +diff --git a/drivers/media/platform/qcom/iris/iris_vb2.c b/drivers/media/platform/qcom/iris/iris_vb2.c +index 8b17c7c39487..e62ed7a57df2 100644 +--- a/drivers/media/platform/qcom/iris/iris_vb2.c ++++ b/drivers/media/platform/qcom/iris/iris_vb2.c +@@ -173,9 +173,6 @@ int iris_vb2_start_streaming(struct vb2_queue *q, unsigned int count) + + inst = vb2_get_drv_priv(q); + +- if (V4L2_TYPE_IS_CAPTURE(q->type) && inst->state == IRIS_INST_INIT) +- return 0; +- + mutex_lock(&inst->lock); + if (inst->state == IRIS_INST_ERROR) { + ret = -EBUSY; +@@ -203,7 +200,10 @@ int iris_vb2_start_streaming(struct vb2_queue *q, unsigned int count) + + buf_type = iris_v4l2_type_to_driver(q->type); + +- ret = iris_queue_deferred_buffers(inst, buf_type); ++ if (inst->state == IRIS_INST_STREAMING) ++ ret = iris_queue_internal_deferred_buffers(inst, BUF_DPB); ++ if (!ret) ++ ret = iris_queue_deferred_buffers(inst, buf_type); + if (ret) + goto error; + +-- +2.51.0 + diff --git a/queue-6.17/media-iris-send-dummy-buffer-address-for-all-codecs-during-drain.patch b/queue-6.17/media-iris-send-dummy-buffer-address-for-all-codecs-during-drain.patch new file mode 100644 index 0000000000..39733bf78f --- /dev/null +++ b/queue-6.17/media-iris-send-dummy-buffer-address-for-all-codecs-during-drain.patch @@ -0,0 +1,44 @@ +From dec073dd8452e174a69db8444e0932e6b4f31c99 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Mon, 25 Aug 2025 12:30:34 +0530 +Subject: media: iris: Send dummy buffer address for all codecs during drain + +From: Dikshita Agarwal + +commit dec073dd8452e174a69db8444e0932e6b4f31c99 upstream. + +Firmware can handle a dummy address for buffers with the EOS flag. To +ensure consistent behavior across all codecs, update the drain +command to always send a dummy buffer address. + +This makes the drain handling uniform and avoids any codec specific +assumptions. + +Fixes: 478c4478610d ("media: iris: Add codec specific check for VP9 decoder drain handling") +Cc: stable@vger.kernel.org +Reviewed-by: Vikash Garodia +Tested-by: Vikash Garodia # X1E80100 +Reviewed-by: Bryan O'Donoghue +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Bryan O'Donoghue # x1e80100-crd +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c +@@ -397,8 +397,7 @@ static int iris_hfi_gen1_session_drain(s + ip_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_EMPTY_BUFFER; + ip_pkt.shdr.session_id = inst->session_id; + ip_pkt.flags = HFI_BUFFERFLAG_EOS; +- if (inst->codec == V4L2_PIX_FMT_VP9) +- ip_pkt.packet_buffer = 0xdeadb000; ++ ip_pkt.packet_buffer = 0xdeadb000; + + return iris_hfi_queue_cmd_write(inst->core, &ip_pkt, ip_pkt.shdr.hdr.size); + } diff --git a/queue-6.17/media-iris-simplify-session-stop-logic-by-relying-on-vb2-checks.patch b/queue-6.17/media-iris-simplify-session-stop-logic-by-relying-on-vb2-checks.patch new file mode 100644 index 0000000000..cfe8ec6557 --- /dev/null +++ b/queue-6.17/media-iris-simplify-session-stop-logic-by-relying-on-vb2-checks.patch @@ -0,0 +1,93 @@ +From 0fe10666d3b4d0757b7f4671892523855ee68cc8 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Mon, 25 Aug 2025 12:30:32 +0530 +Subject: media: iris: Simplify session stop logic by relying on vb2 checks + +From: Dikshita Agarwal + +commit 0fe10666d3b4d0757b7f4671892523855ee68cc8 upstream. + +Remove earlier complex conditional checks in the non-streaming path that +attempted to verify if stop was called on a plane that was previously +started. These explicit checks are redundant, as vb2 already ensures +that stop is only called on ports that have been started, maintaining +correct buffer state management. + +Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops") +Cc: stable@vger.kernel.org +Reviewed-by: Vikash Garodia +Tested-by: Vikash Garodia # X1E80100 +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Bryan O'Donoghue # x1e80100-crd +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + .../qcom/iris/iris_hfi_gen1_command.c | 42 +++++++++---------- + 1 file changed, 19 insertions(+), 23 deletions(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c +index 5fc30d54af4d..3e41c8cb620e 100644 +--- a/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c ++++ b/drivers/media/platform/qcom/iris/iris_hfi_gen1_command.c +@@ -184,11 +184,25 @@ static int iris_hfi_gen1_session_stop(struct iris_inst *inst, u32 plane) + u32 flush_type = 0; + int ret = 0; + +- if ((V4L2_TYPE_IS_OUTPUT(plane) && +- inst->state == IRIS_INST_INPUT_STREAMING) || +- (V4L2_TYPE_IS_CAPTURE(plane) && +- inst->state == IRIS_INST_OUTPUT_STREAMING) || +- inst->state == IRIS_INST_ERROR) { ++ if (inst->state == IRIS_INST_STREAMING) { ++ if (V4L2_TYPE_IS_OUTPUT(plane)) ++ flush_type = HFI_FLUSH_ALL; ++ else if (V4L2_TYPE_IS_CAPTURE(plane)) ++ flush_type = HFI_FLUSH_OUTPUT; ++ ++ reinit_completion(&inst->flush_completion); ++ ++ flush_pkt.shdr.hdr.size = sizeof(struct hfi_session_flush_pkt); ++ flush_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_FLUSH; ++ flush_pkt.shdr.session_id = inst->session_id; ++ flush_pkt.flush_type = flush_type; ++ ++ ret = iris_hfi_queue_cmd_write(core, &flush_pkt, flush_pkt.shdr.hdr.size); ++ if (!ret) { ++ inst->flush_responses_pending++; ++ ret = iris_wait_for_session_response(inst, true); ++ } ++ } else { + reinit_completion(&inst->completion); + iris_hfi_gen1_packet_session_cmd(inst, &pkt, HFI_CMD_SESSION_STOP); + ret = iris_hfi_queue_cmd_write(core, &pkt, pkt.shdr.hdr.size); +@@ -207,24 +221,6 @@ static int iris_hfi_gen1_session_stop(struct iris_inst *inst, u32 plane) + VB2_BUF_STATE_ERROR); + iris_helper_buffers_done(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE, + VB2_BUF_STATE_ERROR); +- } else if (inst->state == IRIS_INST_STREAMING) { +- if (V4L2_TYPE_IS_OUTPUT(plane)) +- flush_type = HFI_FLUSH_ALL; +- else if (V4L2_TYPE_IS_CAPTURE(plane)) +- flush_type = HFI_FLUSH_OUTPUT; +- +- reinit_completion(&inst->flush_completion); +- +- flush_pkt.shdr.hdr.size = sizeof(struct hfi_session_flush_pkt); +- flush_pkt.shdr.hdr.pkt_type = HFI_CMD_SESSION_FLUSH; +- flush_pkt.shdr.session_id = inst->session_id; +- flush_pkt.flush_type = flush_type; +- +- ret = iris_hfi_queue_cmd_write(core, &flush_pkt, flush_pkt.shdr.hdr.size); +- if (!ret) { +- inst->flush_responses_pending++; +- ret = iris_wait_for_session_response(inst, true); +- } + } + + return ret; +-- +2.51.0 + diff --git a/queue-6.17/media-iris-update-vbuf-flags-before-v4l2_m2m_buf_done.patch b/queue-6.17/media-iris-update-vbuf-flags-before-v4l2_m2m_buf_done.patch new file mode 100644 index 0000000000..f15c12334b --- /dev/null +++ b/queue-6.17/media-iris-update-vbuf-flags-before-v4l2_m2m_buf_done.patch @@ -0,0 +1,54 @@ +From 8a432174ac263fb9dd93d232b99c84e430e6d6b5 Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Mon, 25 Aug 2025 12:30:31 +0530 +Subject: media: iris: Update vbuf flags before v4l2_m2m_buf_done + +From: Dikshita Agarwal + +commit 8a432174ac263fb9dd93d232b99c84e430e6d6b5 upstream. + +Update the vbuf flags appropriately in error cases before calling +v4l2_m2m_buf_done(). Previously, the flag update was skippied in error +scenario, which could result in incorrect state reporting for buffers. + +Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response") +Cc: stable@vger.kernel.org +Reviewed-by: Vikash Garodia +Tested-by: Vikash Garodia # X1E80100 +Reviewed-by: Bryan O'Donoghue +Tested-by: Neil Armstrong # on SM8550-HDK +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Dikshita Agarwal +Tested-by: Bryan O'Donoghue # x1e80100-crd +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_buffer.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c +index 23cac5d13129..38548ee4749e 100644 +--- a/drivers/media/platform/qcom/iris/iris_buffer.c ++++ b/drivers/media/platform/qcom/iris/iris_buffer.c +@@ -651,6 +651,8 @@ int iris_vb2_buffer_done(struct iris_inst *inst, struct iris_buffer *buf) + + vb2 = &vbuf->vb2_buf; + ++ vbuf->flags |= buf->flags; ++ + if (buf->flags & V4L2_BUF_FLAG_ERROR) { + state = VB2_BUF_STATE_ERROR; + vb2_set_plane_payload(vb2, 0, 0); +@@ -659,8 +661,6 @@ int iris_vb2_buffer_done(struct iris_inst *inst, struct iris_buffer *buf) + return 0; + } + +- vbuf->flags |= buf->flags; +- + if (V4L2_TYPE_IS_CAPTURE(type)) { + vb2_set_plane_payload(vb2, 0, buf->data_size); + vbuf->sequence = inst->sequence_cap++; +-- +2.51.0 + diff --git a/queue-6.17/media-iris-vpu3x-add-mnoc-low-power-handshake-during-hardware-power-off.patch b/queue-6.17/media-iris-vpu3x-add-mnoc-low-power-handshake-during-hardware-power-off.patch new file mode 100644 index 0000000000..23b722f181 --- /dev/null +++ b/queue-6.17/media-iris-vpu3x-add-mnoc-low-power-handshake-during-hardware-power-off.patch @@ -0,0 +1,93 @@ +From 93fad55aa996eef17a837ed95b1d621ef05d967b Mon Sep 17 00:00:00 2001 +From: Dikshita Agarwal +Date: Fri, 22 Aug 2025 11:23:30 +0530 +Subject: media: iris: vpu3x: Add MNoC low power handshake during hardware power-off + +From: Dikshita Agarwal + +commit 93fad55aa996eef17a837ed95b1d621ef05d967b upstream. + +Add the missing write to AON_WRAPPER_MVP_NOC_LPI_CONTROL before +reading the LPI status register. Introduce a handshake loop to ensure +MNoC enters low power mode reliably during VPU3 hardware power-off with +timeout handling. + +Fixes: 02083a1e00ae ("media: platform: qcom/iris: add support for vpu33") +Cc: stable@vger.kernel.org +Tested-by: Neil Armstrong # on SM8650-QRD +Tested-by: Neil Armstrong # on SM8650-HDK +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Dikshita Agarwal +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/iris/iris_vpu3x.c | 32 +++++++++++++++++-- + 1 file changed, 30 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/iris/iris_vpu3x.c b/drivers/media/platform/qcom/iris/iris_vpu3x.c +index 9b7c9a1495ee..bfc52eb04ed0 100644 +--- a/drivers/media/platform/qcom/iris/iris_vpu3x.c ++++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c +@@ -19,6 +19,9 @@ + #define WRAPPER_IRIS_CPU_NOC_LPI_CONTROL (WRAPPER_BASE_OFFS + 0x5C) + #define REQ_POWER_DOWN_PREP BIT(0) + #define WRAPPER_IRIS_CPU_NOC_LPI_STATUS (WRAPPER_BASE_OFFS + 0x60) ++#define NOC_LPI_STATUS_DONE BIT(0) /* Indicates the NOC handshake is complete */ ++#define NOC_LPI_STATUS_DENY BIT(1) /* Indicates the NOC handshake is denied */ ++#define NOC_LPI_STATUS_ACTIVE BIT(2) /* Indicates the NOC is active */ + #define WRAPPER_CORE_CLOCK_CONFIG (WRAPPER_BASE_OFFS + 0x88) + #define CORE_CLK_RUN 0x0 + +@@ -109,7 +112,9 @@ static void iris_vpu3_power_off_hardware(struct iris_core *core) + + static void iris_vpu33_power_off_hardware(struct iris_core *core) + { ++ bool handshake_done = false, handshake_busy = false; + u32 reg_val = 0, value, i; ++ u32 count = 0; + int ret; + + if (iris_vpu3x_hw_power_collapsed(core)) +@@ -128,13 +133,36 @@ static void iris_vpu33_power_off_hardware(struct iris_core *core) + goto disable_power; + } + ++ /* Retry up to 1000 times as recommended by hardware documentation */ ++ do { ++ /* set MNoC to low power */ ++ writel(REQ_POWER_DOWN_PREP, core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL); ++ ++ udelay(15); ++ ++ value = readl(core->reg_base + AON_WRAPPER_MVP_NOC_LPI_STATUS); ++ ++ handshake_done = value & NOC_LPI_STATUS_DONE; ++ handshake_busy = value & (NOC_LPI_STATUS_DENY | NOC_LPI_STATUS_ACTIVE); ++ ++ if (handshake_done || !handshake_busy) ++ break; ++ ++ writel(0, core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL); ++ ++ udelay(15); ++ ++ } while (++count < 1000); ++ ++ if (!handshake_done && handshake_busy) ++ dev_err(core->dev, "LPI handshake timeout\n"); ++ + ret = readl_poll_timeout(core->reg_base + AON_WRAPPER_MVP_NOC_LPI_STATUS, + reg_val, reg_val & BIT(0), 200, 2000); + if (ret) + goto disable_power; + +- /* set MNoC to low power, set PD_NOC_QREQ (bit 0) */ +- writel(BIT(0), core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL); ++ writel(0, core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL); + + writel(CORE_BRIDGE_SW_RESET | CORE_BRIDGE_HW_RESET_DISABLE, + core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET); +-- +2.51.0 + diff --git a/queue-6.17/series b/queue-6.17/series index d886da2235..9bd0610dd6 100644 --- a/queue-6.17/series +++ b/queue-6.17/series @@ -321,3 +321,17 @@ mm-damon-lru_sort-use-param_ctx-for-damon_attrs-staging.patch nfsd-decouple-the-xprtsec-policy-check-from-check_nfsd_access.patch nfsd-fix-destination-buffer-size-in-nfsd4_ssc_setup_dul.patch nfsd-nfserr_jukebox-in-nlm_fopen-should-lead-to-a-retry.patch +media-iris-call-correct-power-off-callback-in-cleanup-path.patch +media-iris-fix-firmware-reference-leak-and-unmap-memory-after-load.patch +media-iris-fix-module-removal-if-firmware-download-failed.patch +media-iris-vpu3x-add-mnoc-low-power-handshake-during-hardware-power-off.patch +media-iris-fix-port-streaming-handling.patch +media-iris-fix-buffer-count-reporting-in-internal-buffer-check.patch +media-iris-allow-substate-transition-to-load-resources-during-output-streaming.patch +media-iris-always-destroy-internal-buffers-on-firmware-release-response.patch +media-iris-simplify-session-stop-logic-by-relying-on-vb2-checks.patch +media-iris-update-vbuf-flags-before-v4l2_m2m_buf_done.patch +media-iris-send-dummy-buffer-address-for-all-codecs-during-drain.patch +media-iris-fix-missing-last-flag-handling-during-drain.patch +media-iris-fix-format-check-for-capture-plane-in-try_fmt.patch +media-iris-allow-stop-on-firmware-only-if-start-was-issued.patch