linux-toradex.git/drivers/media/platform/qcom/iris, branch master

media: iris: fix 64-bit division in iris_set_slice_count()

2026-10-02T09:39:15+00:00

32-bit ARM builds fail at modpost:

  ERROR: modpost: drivers/media/platform/qcom/iris/qcom-iris.ko:
  symbol '__aeabi_ldivmod' undefined!

The maximum average slice size in MAX_BYTES mode is derived from the
BITRATE capability, whose value is an s64, so both the division by
the frame rate and the DIV_ROUND_UP() by the number of slices are
64-bit divisions. 32-bit ARM has no instruction for these and the
compiler emits calls to __aeabi_ldivmod(), which the kernel does not
provide.

The bitrate is always positive, so use div_u64() for the division by
the frame rate and DIV_ROUND_UP_ULL() for the rounding. Include
 for div_u64() instead of relying on it being pulled
in indirectly.

Reported-by: kernelci.org bot 
Closes: https://d.kernelci.org/i/maestro:4935f1aae20e7f957e60f8fde09c4e6d153c7909
Fixes: 5f21cd9a4ae4 ("media: iris: add support for multi_slice in iris encoder")
Assisted-by: LLM
Signed-off-by: Sasha Levin 
Reviewed-by: Bryan O'Donoghue 
Signed-off-by: Bryan O'Donoghue 
Signed-off-by: Hans Verkuil

media: iris: add support for multi_slice in iris encoder

2026-09-29T11:53:47+00:00

Add multi-slice encoding support with MAX_MB and MAX_BYTES modes.

Clients can enable slice mode using V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MODE
control and configure slice size via V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_MB
or V4L2_CID_MPEG_VIDEO_MULTI_SLICE_MAX_BYTES controls.

Reviewed-by: Vikash Garodia 
Signed-off-by: Sachin Kumar Garg 
Signed-off-by: Bryan O'Donoghue

media: iris: force stage 1 work mode for CBR RC on encoder

2026-09-29T11:53:47+00:00

iris_set_stage() currently always picks STAGE_2 for encoder sessions.
CBR rate control requires stage 1 operation, so force STAGE_1 when
BITRATE_MODE is set to CBR.

The BITRATE_MODE fw_cap value is used instead of inst->hfi_rc_type
since STAGE precedes BITRATE_MODE in enum platform_inst_fw_cap_type,
so iris_set_properties() would still see the previous hfi_rc_type
when iris_set_stage() runs during initial config

Reviewed-by: Vishnu Reddy 
Reviewed-by: Vikash Garodia 
Signed-off-by: Sachin Kumar Garg 
Signed-off-by: Bryan O'Donoghue

media: iris: cache work mode after computing it in iris_set_stage

2026-09-29T11:53:47+00:00

iris_set_stage() computes work_mode and sends it to firmware but
never updates inst->fw_caps[STAGE].value, leaving the cached STAGE
value stale. iris_vpu_enc_bin_size() and
iris_vpu3x_vpu4x_calculate_frequency() read this cached value, so a
stale default causes them to miscalculate buffer size and clock
frequency for sessions actually running in a different stage than
the cached one.

Update inst->fw_caps[cap_id].value with the computed work_mode
before sending it to firmware, keeping the cache consistent with
what is actually configured.

Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon")
Reviewed-by: Vikash Garodia 
Signed-off-by: Sachin Kumar Garg 
Signed-off-by: Bryan O'Donoghue

media: iris: reference count video instances

2026-09-29T11:53:47+00:00

iris_get_instance() looks up an instance on core->instances and returns
it after dropping core->lock, without taking any reference. The threaded
interrupt handler uses this to find the instance a firmware response
belongs to and then takes inst->lock. Meanwhile userspace may close the
same file descriptor: iris_close() removes the instance from the list,
destroys inst->lock and frees the instance. The interrupt handler then
operates on freed memory and a destroyed mutex, a use-after-free.

Add a kref to struct iris_inst. iris_get_instance() takes a reference
under core->lock, so an instance it returns cannot be freed until the
caller drops that reference with iris_inst_put(). The instance is
released (mutexes destroyed, memory freed) only when the last reference
goes away, whether that is held by the closing thread or the interrupt
handler.

Fixes: 38fc8beaba55 ("media: iris: implement reqbuf ioctl with vb2_queue_setup")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dmitry Baryshkov 
Signed-off-by: Bryan O'Donoghue

media: iris: reject open() when the session limit is reached

2026-09-29T11:53:47+00:00

iris_add_session() silently skips adding the instance to core->instances
once max_session_count is reached, but returns void, so iris_open()
continues as if it succeeded and hands a file descriptor back to
userspace. As the instance is not on core->instances, firmware responses
for it are dropped and every subsequent ioctl times out.

Make iris_add_session() return an error when the limit is reached and
fail iris_open() accordingly, freeing the partially initialised instance.

Fixes: 38fc8beaba55 ("media: iris: implement reqbuf ioctl with vb2_queue_setup")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dmitry Baryshkov 
Reviewed-by: Konrad Dybcio 
Signed-off-by: Bryan O'Donoghue

media: iris: guard against a NULL hfi_sys_ops in the interrupt handler

2026-09-29T11:53:46+00:00

core->hfi_sys_ops is populated only during core bring-up, once the
firmware generation has been detected. iris_vpu_power_on() enables
interrupts earlier than that, so an interrupt (for instance a spurious
one) that fires in this window makes iris_hfi_isr_handler()
unconditionally dereference a NULL core->hfi_sys_ops and panic.

Skip the response handler when hfi_sys_ops has not been set up yet; the
interrupt is still acknowledged and the line re-enabled.

Fixes: d8a6a63372b8 ("media: qcom: iris: merge hfi_response_ops and hfi_command_ops")
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Konrad Dybcio 
Signed-off-by: Dmitry Baryshkov 
Signed-off-by: Bryan O'Donoghue

media: iris: take core lock when scanning the instance list

2026-09-29T11:53:46+00:00

iris_check_session_supported() walks core->instances to confirm the
current instance is registered, but does so without holding core->lock.
A concurrent iris_close() takes core->lock and removes a (possibly
different) instance from the list via list_del_init() before freeing it,
so the lockless traversal can follow a freed pointer and dereference it,
resulting in a use-after-free.

Hold core->lock across the list traversal, matching the other iterators
over core->instances such as iris_check_core_mbpf(). The lock is dropped
before iris_check_core_mbpf() is called so the nesting is unchanged.

Fixes: bdbe1cac0c10 ("media: iris: add check whether the video session is supported or not")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dmitry Baryshkov 
Reviewed-by: Konrad Dybcio 
Signed-off-by: Bryan O'Donoghue

media: iris: fail firmware boot on invalid uc_region

2026-09-29T11:53:46+00:00

iris_vpu_boot_firmware() polls CTRL_STATUS while the firmware boots. When
the hardware reports an invalid uc_region setting, the poll loop breaks
early with count still below max_tries. The following timeout check
(count >= max_tries) is therefore false, so the function skips the error
return and falls through to return 0, reporting a successful boot. The
caller then enables host interrupts and proceeds to use firmware that
never came up, which can lead to unhandled timeouts or hardware hangs.

Return an error directly from the uc_region error path instead of breaking
out of the loop and reporting success.

Fixes: abf5bac63f68 ("media: iris: implement the boot sequence of the firmware")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Dmitry Baryshkov 
Reviewed-by: Konrad Dybcio 
Signed-off-by: Bryan O'Donoghue

media: iris: constify inst_fw_cap_sm8250_dec

2026-09-29T11:53:46+00:00

Mark inst_fw_cap_sm8250_dec as a const array, the data is read-only.

Suggested-by: Vishnu Reddy 
Reviewed-by: Vikash Garodia 
Signed-off-by: Dmitry Baryshkov 
Signed-off-by: Bryan O'Donoghue