* [PATCH v9 01/14] dt-bindings: media: qcom,glymur-iris: Add glymur video codec
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
@ 2026-07-15 14:09 ` Vishnu Reddy
2026-07-15 14:22 ` sashiko-bot
2026-07-15 14:09 ` [PATCH v9 02/14] media: iris: Add hooks to initialize and tear down context banks Vishnu Reddy
` (12 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:09 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy, Krzysztof Kozlowski
Add device tree binding for the Qualcomm Glymur Iris video codec. Glymur
is a new generation of video IP that introduces a dual-core architecture.
The second core brings its own power domain, clocks, and reset lines,
requiring additional power domains and clocks in the power sequence.
The current maxItems constraints for clocks and power-domains in the
common venus schema were sized for platforms available at the time of
authoring. The glymur platform introduces a dual core architecture
that requires more clocks and power domains, exceeding these limits.
Raise maxItems for clocks, clock-names, power-domains and
power-domain-names to accommodate the glymur platform.
The glymur platform-specific schema have fixed constraints for these
properties, so the common schema only acts as an upper bound.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
---
.../bindings/media/qcom,glymur-iris.yaml | 255 +++++++++++++++++++++
.../bindings/media/qcom,venus-common.yaml | 8 +-
2 files changed, 259 insertions(+), 4 deletions(-)
diff --git a/Documentation/devicetree/bindings/media/qcom,glymur-iris.yaml b/Documentation/devicetree/bindings/media/qcom,glymur-iris.yaml
new file mode 100644
index 000000000000..4db6c58e4a88
--- /dev/null
+++ b/Documentation/devicetree/bindings/media/qcom,glymur-iris.yaml
@@ -0,0 +1,255 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/media/qcom,glymur-iris.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm Glymur SoC Iris video encoder and decoder
+
+maintainers:
+ - Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
+
+description:
+ The Iris video processing unit on Qualcomm Glymur SoC is a video encode and
+ decode accelerator.
+
+properties:
+ compatible:
+ const: qcom,glymur-iris
+
+ clocks:
+ maxItems: 9
+
+ clock-names:
+ items:
+ - const: core_iface
+ - const: core
+ - const: vcodec0_core
+ - const: vcodec0_iface
+ - const: core_freerun
+ - const: vcodec0_core_freerun
+ - const: vcodec1_iface
+ - const: vcodec1_core
+ - const: vcodec1_core_freerun
+
+ dma-coherent: true
+
+ interconnects:
+ maxItems: 2
+
+ interconnect-names:
+ items:
+ - const: cpu-cfg
+ - const: video-mem
+
+ '#address-cells':
+ const: 2
+
+ '#size-cells':
+ const: 2
+
+ non-pixel:
+ type: object
+ description:
+ Context bank for VPU non-pixel buffers, including compressed and internal buffers.
+ properties:
+ iommus:
+ maxItems: 3
+ memory-region:
+ maxItems: 1
+ required:
+ - iommus
+ - memory-region
+ additionalProperties: false
+
+ pixel:
+ type: object
+ description:
+ Context bank for VPU pixel buffers containing uncompressed video data.
+ properties:
+ iommus:
+ maxItems: 1
+ required:
+ - iommus
+ additionalProperties: false
+
+ firmware:
+ type: object
+ description:
+ Context bank for the VPU firmware processing domain.
+ properties:
+ iommus:
+ maxItems: 1
+ required:
+ - iommus
+ additionalProperties: false
+
+ operating-points-v2: true
+ opp-table:
+ type: object
+
+ power-domains:
+ maxItems: 5
+
+ power-domain-names:
+ items:
+ - const: venus
+ - const: vcodec0
+ - const: mxc
+ - const: mmcx
+ - const: vcodec1
+
+ resets:
+ maxItems: 6
+
+ reset-names:
+ items:
+ - const: core_bus
+ - const: vcodec0_bus
+ - const: core
+ - const: vcodec0_core
+ - const: vcodec1_bus
+ - const: vcodec1_core
+
+required:
+ - clocks
+ - clock-names
+ - compatible
+ - dma-coherent
+ - interconnects
+ - interconnect-names
+ - non-pixel
+ - pixel
+ - power-domains
+ - power-domain-names
+ - resets
+ - reset-names
+
+allOf:
+ - $ref: qcom,venus-common.yaml#
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+ #include <dt-bindings/power/qcom,rpmhpd.h>
+
+ video-codec@aa00000 {
+ compatible = "qcom,glymur-iris";
+ reg = <0x0aa00000 0xf0000>;
+
+ clocks = <&gcc_video_axi0c_clk>,
+ <&videocc_mvs0c_clk>,
+ <&videocc_mvs0_clk>,
+ <&gcc_video_axi0_clk>,
+ <&videocc_mvs0c_freerun_clk>,
+ <&videocc_mvs0_freerun_clk>,
+ <&gcc_video_axi1_clk>,
+ <&videocc_mvs1_clk>,
+ <&videocc_mvs1_freerun_clk>;
+ clock-names = "core_iface",
+ "core",
+ "vcodec0_core",
+ "vcodec0_iface",
+ "core_freerun",
+ "vcodec0_core_freerun",
+ "vcodec1_iface",
+ "vcodec1_core",
+ "vcodec1_core_freerun";
+
+ dma-coherent;
+
+ interconnects = <&hsc_noc_master_appss_proc &config_noc_slave_venus_cfg>,
+ <&mmss_noc_master_video &mc_virt_slave_ebi1>;
+ interconnect-names = "cpu-cfg",
+ "video-mem";
+
+ interrupts = <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>;
+
+ memory-region = <&video_mem>;
+
+ operating-points-v2 = <&iris_opp_table>;
+
+ power-domains = <&videocc_mvs0c_gdsc>,
+ <&videocc_mvs0_gdsc>,
+ <&rpmhpd RPMHPD_MXC>,
+ <&rpmhpd RPMHPD_MMCX>,
+ <&videocc_mvs1_gdsc>;
+ power-domain-names = "venus",
+ "vcodec0",
+ "mxc",
+ "mmcx",
+ "vcodec1";
+
+ resets = <&gcc_video_axi0c_clk_ares>,
+ <&gcc_video_axi0_clk_ares>,
+ <&videocc_mvs0c_freerun_clk_ares>,
+ <&videocc_mvs0_freerun_clk_ares>,
+ <&gcc_video_axi1_clk_ares>,
+ <&videocc_mvs1_freerun_clk_ares>;
+ reset-names = "core_bus",
+ "vcodec0_bus",
+ "core",
+ "vcodec0_core",
+ "vcodec1_bus",
+ "vcodec1_core";
+
+ #address-cells = <2>;
+ #size-cells = <2>;
+
+ non-pixel {
+ iommus = <&apps_smmu 0x1940 0x0000>,
+ <&apps_smmu 0x1944 0x0000>,
+ <&apps_smmu 0x19e0 0x0000>;
+ memory-region = <&iris_resv>;
+ };
+
+ pixel {
+ iommus = <&apps_smmu 0x1943 0x0000>;
+ };
+
+ firmware {
+ iommus = <&apps_smmu 0x19e2 0x0000>;
+ };
+
+ iris_opp_table: opp-table {
+ compatible = "operating-points-v2";
+
+ opp-240000000 {
+ opp-hz = /bits/ 64 <240000000 240000000 360000000>;
+ required-opps = <&rpmhpd_opp_svs>,
+ <&rpmhpd_opp_low_svs>;
+ };
+
+ opp-338000000 {
+ opp-hz = /bits/ 64 <338000000 338000000 507000000>;
+ required-opps = <&rpmhpd_opp_svs>,
+ <&rpmhpd_opp_svs>;
+ };
+
+ opp-366000000 {
+ opp-hz = /bits/ 64 <366000000 366000000 549000000>;
+ required-opps = <&rpmhpd_opp_svs_l1>,
+ <&rpmhpd_opp_svs_l1>;
+ };
+
+ opp-444000000 {
+ opp-hz = /bits/ 64 <444000000 444000000 666000000>;
+ required-opps = <&rpmhpd_opp_svs_l1>,
+ <&rpmhpd_opp_nom>;
+ };
+
+ opp-533333334 {
+ opp-hz = /bits/ 64 <533333334 533333334 800000000>;
+ required-opps = <&rpmhpd_opp_svs_l1>,
+ <&rpmhpd_opp_turbo>;
+ };
+
+ opp-655000000 {
+ opp-hz = /bits/ 64 <655000000 655000000 982000000>;
+ required-opps = <&rpmhpd_opp_nom>,
+ <&rpmhpd_opp_turbo_l1>;
+ };
+ };
+ };
diff --git a/Documentation/devicetree/bindings/media/qcom,venus-common.yaml b/Documentation/devicetree/bindings/media/qcom,venus-common.yaml
index 59a3fde846d2..10716a93dd35 100644
--- a/Documentation/devicetree/bindings/media/qcom,venus-common.yaml
+++ b/Documentation/devicetree/bindings/media/qcom,venus-common.yaml
@@ -20,11 +20,11 @@ properties:
clocks:
minItems: 3
- maxItems: 7
+ maxItems: 9
clock-names:
minItems: 3
- maxItems: 7
+ maxItems: 9
firmware-name:
maxItems: 1
@@ -41,11 +41,11 @@ properties:
power-domains:
minItems: 1
- maxItems: 4
+ maxItems: 5
power-domain-names:
minItems: 1
- maxItems: 4
+ maxItems: 5
required:
- reg
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* Re: [PATCH v9 01/14] dt-bindings: media: qcom,glymur-iris: Add glymur video codec
2026-07-15 14:09 ` [PATCH v9 01/14] dt-bindings: media: qcom,glymur-iris: Add glymur video codec Vishnu Reddy
@ 2026-07-15 14:22 ` sashiko-bot
0 siblings, 0 replies; 26+ messages in thread
From: sashiko-bot @ 2026-07-15 14:22 UTC (permalink / raw)
To: Vishnu Reddy; +Cc: conor+dt, devicetree, robh
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Unnecessary `#address-cells` and `#size-cells` properties on a node without addressable children.
--
--- Patch [1]: [PATCH v9 01/14] dt-bindings: media: qcom,glymur-iris: Add glymur video codec ---
commit 8ca344fa9395fcf1d13bd1ea93de8bee21a5c176
Author: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
dt-bindings: media: qcom,glymur-iris: Add glymur video codec
This commit adds the device tree binding for the Qualcomm Glymur Iris video
codec. It introduces a new dual-core architecture requiring additional
power domains and clocks, and updates the maxItems limits in the common
venus schema to accommodate these changes.
> diff --git a/Documentation/devicetree/bindings/media/qcom,glymur-iris.yaml b/Documentation/devicetree/bindings/media/qcom,glymur-iris.yaml
> new file mode 100644
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/media/qcom,glymur-iris.yaml
> @@ -0,0 +1,255 @@
[ ... ]
> + interconnect-names:
> + items:
> + - const: cpu-cfg
> + - const: video-mem
> +
> + '#address-cells':
> + const: 2
> +
> + '#size-cells':
> + const: 2
[Severity: Low]
Are these properties necessary here? The schema strictly enforces const: 2
for #address-cells and #size-cells at the root node, but none of the child
nodes (non-pixel, pixel, firmware) define a reg property, and the parent
does not define a ranges property.
Will this cause the DeviceTree compiler (dtc) to emit an
avoid_unnecessary_addr_size warning when compiling device trees using this
node?
> +
> + non-pixel:
> + type: object
[ ... ]
> + resets = <&gcc_video_axi0c_clk_ares>,
> + <&gcc_video_axi0_clk_ares>,
> + <&videocc_mvs0c_freerun_clk_ares>,
> + <&videocc_mvs0_freerun_clk_ares>,
> + <&gcc_video_axi1_clk_ares>,
> + <&videocc_mvs1_freerun_clk_ares>;
> + reset-names = "core_bus",
> + "vcodec0_bus",
> + "core",
> + "vcodec0_core",
> + "vcodec1_bus",
> + "vcodec1_core";
> +
> + #address-cells = <2>;
> + #size-cells = <2>;
[Severity: Low]
Does the example need #address-cells and #size-cells? It demonstrates their
use without any child nodes containing reg properties, which directly causes a
dtc warning during dt_binding_check validation.
> +
> + non-pixel {
> + iommus = <&apps_smmu 0x1940 0x0000>,
> + <&apps_smmu 0x1944 0x0000>,
> + <&apps_smmu 0x19e0 0x0000>;
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=1
^ permalink raw reply [flat|nested] 26+ messages in thread
* [PATCH v9 02/14] media: iris: Add hooks to initialize and tear down context banks
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
2026-07-15 14:09 ` [PATCH v9 01/14] dt-bindings: media: qcom,glymur-iris: Add glymur video codec Vishnu Reddy
@ 2026-07-15 14:09 ` Vishnu Reddy
2026-07-15 14:23 ` sashiko-bot
2026-07-15 14:09 ` [PATCH v9 03/14] media: iris: Add helper to create a context bank device Vishnu Reddy
` (11 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:09 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy, Daniel J Blueman
From: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Add platform hooks to set up and tear down context bank devices.
Different iris platforms may require different context bank setup, so
let platform data provide the required operations via vpu_ops.
Co-developed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Tested-by: Daniel J Blueman <daniel@quora.org>
---
drivers/media/platform/qcom/iris/iris_probe.c | 25 +++++++++++++++++++++-
drivers/media/platform/qcom/iris/iris_vpu_common.h | 2 ++
2 files changed, 26 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c
index c2dcb50a2782..2594f5a67378 100644
--- a/drivers/media/platform/qcom/iris/iris_probe.c
+++ b/drivers/media/platform/qcom/iris/iris_probe.c
@@ -15,6 +15,7 @@
#include "iris_core.h"
#include "iris_ctrls.h"
#include "iris_vidc.h"
+#include "iris_vpu_common.h"
static int iris_init_icc(struct iris_core *core)
{
@@ -150,6 +151,20 @@ static int iris_init_resources(struct iris_core *core)
return iris_init_resets(core);
}
+static int iris_init_cb_devs(struct iris_core *core)
+{
+ if (core->iris_platform_data->vpu_ops->init_cb_devs)
+ return core->iris_platform_data->vpu_ops->init_cb_devs(core);
+
+ return 0;
+}
+
+static void iris_deinit_cb_devs(struct iris_core *core)
+{
+ if (core->iris_platform_data->vpu_ops->deinit_cb_devs)
+ core->iris_platform_data->vpu_ops->deinit_cb_devs(core);
+}
+
static int iris_register_video_device(struct iris_core *core, enum domain_type type)
{
struct video_device *vdev;
@@ -207,6 +222,8 @@ static void iris_remove(struct platform_device *pdev)
v4l2_device_unregister(&core->v4l2_dev);
+ iris_deinit_cb_devs(core);
+
mutex_destroy(&core->lock);
}
@@ -273,10 +290,14 @@ static int iris_probe(struct platform_device *pdev)
iris_session_init_caps(core);
- ret = v4l2_device_register(dev, &core->v4l2_dev);
+ ret = iris_init_cb_devs(core);
if (ret)
return ret;
+ ret = v4l2_device_register(dev, &core->v4l2_dev);
+ if (ret)
+ goto err_cb_deinit;
+
ret = iris_register_video_device(core, DECODER);
if (ret)
goto err_v4l2_unreg;
@@ -310,6 +331,8 @@ static int iris_probe(struct platform_device *pdev)
video_unregister_device(core->vdev_dec);
err_v4l2_unreg:
v4l2_device_unregister(&core->v4l2_dev);
+err_cb_deinit:
+ iris_deinit_cb_devs(core);
return ret;
}
diff --git a/drivers/media/platform/qcom/iris/iris_vpu_common.h b/drivers/media/platform/qcom/iris/iris_vpu_common.h
index 09799a375c14..a8df9af0d3da 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu_common.h
+++ b/drivers/media/platform/qcom/iris/iris_vpu_common.h
@@ -22,6 +22,8 @@ struct vpu_ops {
void (*program_bootup_registers)(struct iris_core *core);
u64 (*calc_freq)(struct iris_inst *inst, size_t data_size);
int (*set_hwmode)(struct iris_core *core);
+ int (*init_cb_devs)(struct iris_core *core);
+ void (*deinit_cb_devs)(struct iris_core *core);
};
int iris_vpu_boot_firmware(struct iris_core *core);
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* Re: [PATCH v9 02/14] media: iris: Add hooks to initialize and tear down context banks
2026-07-15 14:09 ` [PATCH v9 02/14] media: iris: Add hooks to initialize and tear down context banks Vishnu Reddy
@ 2026-07-15 14:23 ` sashiko-bot
0 siblings, 0 replies; 26+ messages in thread
From: sashiko-bot @ 2026-07-15 14:23 UTC (permalink / raw)
To: Vishnu Reddy; +Cc: conor+dt, robh, devicetree
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] Missing cancellation of the delayed work `sys_error_handler` during driver removal, leading to a Use-After-Free if the timer fires after `iris_remove` completes.
- [High] Devres lifetime mismatch with video_device causing Use-After-Free on file operations if V4L2 file descriptors are kept open after driver unbind.
--
--- Patch [2]: [PATCH v9 02/14] media: iris: Add hooks to initialize and tear down context banks ---
commit 5c638b17a5df1cce5bd95764cd52706cb2e251b6
Author: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
media: iris: Add hooks to initialize and tear down context banks
Add platform hooks to set up and tear down context bank devices.
Different iris platforms may require different context bank setup, so
let platform data provide the required operations via vpu_ops.
> diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c
> index c2dcb50a27824..2594f5a67378a 100644
> --- a/drivers/media/platform/qcom/iris/iris_probe.c
> +++ b/drivers/media/platform/qcom/iris/iris_probe.c
[ ... ]
> @@ -207,6 +222,8 @@ static void iris_remove(struct platform_device *pdev)
>
> v4l2_device_unregister(&core->v4l2_dev);
>
> + iris_deinit_cb_devs(core);
> +
> mutex_destroy(&core->lock);
> }
[Severity: High]
This is a pre-existing issue, but does this function need to cancel the
delayed work core->sys_error_handler before returning?
If the device triggers a hardware error, core->sys_error_handler is scheduled
with a delay. If the device is concurrently unbound (e.g., via sysfs) before
the timer expires, iris_remove() and iris_core_deinit() execute but fail to
cancel the delayed work.
Since the core structure is allocated using devm_kzalloc(), it is freed
automatically after iris_remove() returns. When the delayed work timer
eventually fires, iris_sys_error_handler() will dereference the freed core
pointer.
[Severity: High]
This is also a pre-existing issue, but is there a devres lifetime mismatch
with the video_device?
The core structure is allocated using devm_kzalloc() during probe, binding
its lifetime to the platform device bind/unbind lifecycle. However, userspace
can open the V4L2 character device and hold the file descriptor open
indefinitely.
If the driver is unbound while the file descriptor is open, iris_remove()
executes and returns, causing devres to free core.
When userspace later closes the file descriptor, the V4L2 core invokes
iris_close(), which attempts to dereference inst->core:
drivers/media/platform/qcom/iris/iris_vidc.c:iris_close() {
...
struct iris_inst *inst = iris_get_inst(filp);
iris_remove_session(inst);
...
}
Inside iris_remove_session(), this leads to a use-after-free when it locks
inst->core->lock.
Could the allocation of core be managed without devres, or its lifetime tied
to the V4L2 device's release callback?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=2
^ permalink raw reply [flat|nested] 26+ messages in thread
* [PATCH v9 03/14] media: iris: Add helper to create a context bank device
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
2026-07-15 14:09 ` [PATCH v9 01/14] dt-bindings: media: qcom,glymur-iris: Add glymur video codec Vishnu Reddy
2026-07-15 14:09 ` [PATCH v9 02/14] media: iris: Add hooks to initialize and tear down context banks Vishnu Reddy
@ 2026-07-15 14:09 ` Vishnu Reddy
2026-07-15 14:09 ` [PATCH v9 04/14] media: iris: Add helper to select relevant " Vishnu Reddy
` (10 subsequent siblings)
13 siblings, 0 replies; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:09 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy, Daniel J Blueman
From: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
The subnode in the device tree is registered as a separate device so
that it gets its own IOMMU context. Pixel/non-pixel buffers are mapped
into these iommu domain, to ensure they are within the addressable range.
Co-developed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Tested-by: Daniel J Blueman <daniel@quora.org>
---
drivers/media/platform/qcom/iris/iris_resources.c | 28 +++++++++++++++++++++++
drivers/media/platform/qcom/iris/iris_resources.h | 1 +
2 files changed, 29 insertions(+)
diff --git a/drivers/media/platform/qcom/iris/iris_resources.c b/drivers/media/platform/qcom/iris/iris_resources.c
index 773f6548370a..a685915a19e9 100644
--- a/drivers/media/platform/qcom/iris/iris_resources.c
+++ b/drivers/media/platform/qcom/iris/iris_resources.c
@@ -5,6 +5,7 @@
#include <linux/clk.h>
#include <linux/devfreq.h>
+#include <linux/dma-mapping.h>
#include <linux/interconnect.h>
#include <linux/pm_domain.h>
#include <linux/pm_opp.h>
@@ -141,3 +142,30 @@ int iris_disable_unprepare_clock(struct iris_core *core, enum platform_clk_type
return 0;
}
+
+struct device *iris_create_cb_dev(struct iris_core *core, const char *name)
+{
+ struct platform_device_info plat_dev_info = {};
+ struct device_node *child_of_node;
+ struct platform_device *pdev;
+
+ child_of_node = of_get_child_by_name(core->dev->of_node, name);
+ if (!child_of_node)
+ return NULL;
+
+ plat_dev_info.dma_mask = core->iris_platform_data->dma_mask;
+ plat_dev_info.fwnode = &child_of_node->fwnode;
+ plat_dev_info.name = child_of_node->name;
+ plat_dev_info.id = PLATFORM_DEVID_AUTO;
+ plat_dev_info.parent = core->dev;
+
+ pdev = platform_device_register_full(&plat_dev_info);
+ of_node_put(child_of_node);
+ if (IS_ERR(pdev))
+ return ERR_CAST(pdev);
+
+ dma_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
+ dma_set_seg_boundary(&pdev->dev, DMA_BIT_MASK(32));
+
+ return &pdev->dev;
+}
diff --git a/drivers/media/platform/qcom/iris/iris_resources.h b/drivers/media/platform/qcom/iris/iris_resources.h
index 6bfbd2dc6db0..ca53c01f60ae 100644
--- a/drivers/media/platform/qcom/iris/iris_resources.h
+++ b/drivers/media/platform/qcom/iris/iris_resources.h
@@ -15,5 +15,6 @@ int iris_unset_icc_bw(struct iris_core *core);
int iris_set_icc_bw(struct iris_core *core, unsigned long icc_bw);
int iris_disable_unprepare_clock(struct iris_core *core, enum platform_clk_type clk_type);
int iris_prepare_enable_clock(struct iris_core *core, enum platform_clk_type clk_type);
+struct device *iris_create_cb_dev(struct iris_core *core, const char *name);
#endif
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* [PATCH v9 04/14] media: iris: Add helper to select relevant context bank device
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
` (2 preceding siblings ...)
2026-07-15 14:09 ` [PATCH v9 03/14] media: iris: Add helper to create a context bank device Vishnu Reddy
@ 2026-07-15 14:09 ` Vishnu Reddy
2026-07-15 14:29 ` sashiko-bot
2026-07-15 14:09 ` [PATCH v9 05/14] media: iris: Skip DMA mask setting to core device when IOMMU is not mapped Vishnu Reddy
` (9 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:09 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy, Daniel J Blueman
From: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Associate the context bank device with the respective buffers. Fall back
to core->dev when the platform still describes the IOMMU on the parent
iris node instead of using subnodes. Those platforms would be migrated
gradually.
Co-developed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Tested-by: Daniel J Blueman <daniel@quora.org>
---
drivers/media/platform/qcom/iris/iris_buffer.c | 8 ++---
drivers/media/platform/qcom/iris/iris_core.h | 4 +++
drivers/media/platform/qcom/iris/iris_hfi_queue.c | 16 +++++----
drivers/media/platform/qcom/iris/iris_resources.c | 41 +++++++++++++++++++++++
drivers/media/platform/qcom/iris/iris_resources.h | 1 +
drivers/media/platform/qcom/iris/iris_vidc.c | 4 +--
6 files changed, 61 insertions(+), 13 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
index 246ad0abbac3..249c9f1d0d5d 100644
--- a/drivers/media/platform/qcom/iris/iris_buffer.c
+++ b/drivers/media/platform/qcom/iris/iris_buffer.c
@@ -529,7 +529,7 @@ static int iris_create_internal_buffer(struct iris_inst *inst,
enum iris_buffer_type buffer_type, u32 index)
{
struct iris_buffers *buffers = &inst->buffers[buffer_type];
- struct iris_core *core = inst->core;
+ struct device *dev = iris_get_cb_dev(inst, buffer_type);
struct iris_buffer *buffer;
if (!buffers->size)
@@ -545,7 +545,7 @@ static int iris_create_internal_buffer(struct iris_inst *inst,
buffer->buffer_size = buffers->size;
buffer->dma_attrs = DMA_ATTR_WRITE_COMBINE | DMA_ATTR_NO_KERNEL_MAPPING;
- buffer->kvaddr = dma_alloc_attrs(core->dev, buffer->buffer_size,
+ buffer->kvaddr = dma_alloc_attrs(dev, buffer->buffer_size,
&buffer->device_addr, GFP_KERNEL, buffer->dma_attrs);
if (!buffer->kvaddr) {
kfree(buffer);
@@ -682,10 +682,10 @@ int iris_queue_internal_buffers(struct iris_inst *inst, u32 plane)
int iris_destroy_internal_buffer(struct iris_inst *inst, struct iris_buffer *buffer)
{
- struct iris_core *core = inst->core;
+ struct device *dev = iris_get_cb_dev(inst, buffer->type);
list_del(&buffer->list);
- dma_free_attrs(core->dev, buffer->buffer_size, buffer->kvaddr,
+ dma_free_attrs(dev, buffer->buffer_size, buffer->kvaddr,
buffer->device_addr, buffer->dma_attrs);
kfree(buffer);
diff --git a/drivers/media/platform/qcom/iris/iris_core.h b/drivers/media/platform/qcom/iris/iris_core.h
index 24da60448cf2..3c96f46cf567 100644
--- a/drivers/media/platform/qcom/iris/iris_core.h
+++ b/drivers/media/platform/qcom/iris/iris_core.h
@@ -36,6 +36,8 @@ struct qcom_ubwc_cfg_data;
* struct iris_core - holds core parameters valid for all instances
*
* @dev: reference to device structure
+ * @np_dev: reference to non-pixel device structure
+ * @p_dev: reference to pixel device structure
* @reg_base: IO memory base address
* @irq: iris irq
* @v4l2_dev: a holder for v4l2 device structure
@@ -81,6 +83,8 @@ struct qcom_ubwc_cfg_data;
struct iris_core {
struct device *dev;
+ struct device *np_dev;
+ struct device *p_dev;
void __iomem *reg_base;
int irq;
struct v4l2_device v4l2_dev;
diff --git a/drivers/media/platform/qcom/iris/iris_hfi_queue.c b/drivers/media/platform/qcom/iris/iris_hfi_queue.c
index bf6db23b53e2..ce6a682b0f9a 100644
--- a/drivers/media/platform/qcom/iris/iris_hfi_queue.c
+++ b/drivers/media/platform/qcom/iris/iris_hfi_queue.c
@@ -245,25 +245,26 @@ static void iris_hfi_queue_deinit(struct iris_iface_q_info *iface_q)
int iris_hfi_queues_init(struct iris_core *core)
{
+ struct device *dev = core->np_dev ? core->np_dev : core->dev;
struct iris_hfi_queue_table_header *q_tbl_hdr;
u32 queue_size;
/* Iris hardware requires 4K queue alignment */
queue_size = ALIGN((sizeof(*q_tbl_hdr) + (IFACEQ_QUEUE_SIZE * IFACEQ_NUMQ)), SZ_4K);
- core->iface_q_table_vaddr = dma_alloc_attrs(core->dev, queue_size,
+ core->iface_q_table_vaddr = dma_alloc_attrs(dev, queue_size,
&core->iface_q_table_daddr,
GFP_KERNEL, DMA_ATTR_WRITE_COMBINE);
if (!core->iface_q_table_vaddr) {
- dev_err(core->dev, "queues alloc and map failed\n");
+ dev_err(dev, "queues alloc and map failed\n");
return -ENOMEM;
}
- core->sfr_vaddr = dma_alloc_attrs(core->dev, SFR_SIZE,
+ core->sfr_vaddr = dma_alloc_attrs(dev, SFR_SIZE,
&core->sfr_daddr,
GFP_KERNEL, DMA_ATTR_WRITE_COMBINE);
if (!core->sfr_vaddr) {
- dev_err(core->dev, "sfr alloc and map failed\n");
- dma_free_attrs(core->dev, queue_size, core->iface_q_table_vaddr,
+ dev_err(dev, "sfr alloc and map failed\n");
+ dma_free_attrs(dev, queue_size, core->iface_q_table_vaddr,
core->iface_q_table_daddr, DMA_ATTR_WRITE_COMBINE);
return -ENOMEM;
}
@@ -291,6 +292,7 @@ int iris_hfi_queues_init(struct iris_core *core)
void iris_hfi_queues_deinit(struct iris_core *core)
{
+ struct device *dev = core->np_dev ? core->np_dev : core->dev;
u32 queue_size;
if (!core->iface_q_table_vaddr)
@@ -300,7 +302,7 @@ void iris_hfi_queues_deinit(struct iris_core *core)
iris_hfi_queue_deinit(&core->message_queue);
iris_hfi_queue_deinit(&core->command_queue);
- dma_free_attrs(core->dev, SFR_SIZE, core->sfr_vaddr,
+ dma_free_attrs(dev, SFR_SIZE, core->sfr_vaddr,
core->sfr_daddr, DMA_ATTR_WRITE_COMBINE);
core->sfr_vaddr = NULL;
@@ -309,7 +311,7 @@ void iris_hfi_queues_deinit(struct iris_core *core)
queue_size = ALIGN(sizeof(struct iris_hfi_queue_table_header) +
(IFACEQ_QUEUE_SIZE * IFACEQ_NUMQ), SZ_4K);
- dma_free_attrs(core->dev, queue_size, core->iface_q_table_vaddr,
+ dma_free_attrs(dev, queue_size, core->iface_q_table_vaddr,
core->iface_q_table_daddr, DMA_ATTR_WRITE_COMBINE);
core->iface_q_table_vaddr = NULL;
diff --git a/drivers/media/platform/qcom/iris/iris_resources.c b/drivers/media/platform/qcom/iris/iris_resources.c
index a685915a19e9..309a593d755b 100644
--- a/drivers/media/platform/qcom/iris/iris_resources.c
+++ b/drivers/media/platform/qcom/iris/iris_resources.c
@@ -13,6 +13,7 @@
#include <linux/reset.h>
#include "iris_core.h"
+#include "iris_instance.h"
#include "iris_resources.h"
#define BW_THRESHOLD 50000
@@ -169,3 +170,43 @@ struct device *iris_create_cb_dev(struct iris_core *core, const char *name)
return &pdev->dev;
}
+
+struct device *iris_get_cb_dev(struct iris_inst *inst, enum iris_buffer_type buffer_type)
+{
+ struct iris_core *core = inst->core;
+ struct device *dev = NULL;
+
+ switch (buffer_type) {
+ case BUF_INPUT:
+ if (inst->domain == DECODER)
+ dev = core->np_dev;
+ else
+ dev = core->p_dev;
+ break;
+ case BUF_OUTPUT:
+ if (inst->domain == DECODER)
+ dev = core->p_dev;
+ else
+ dev = core->np_dev;
+ break;
+ case BUF_DPB:
+ case BUF_PARTIAL:
+ case BUF_SCRATCH_1:
+ case BUF_SCRATCH_2:
+ case BUF_VPSS:
+ dev = core->p_dev;
+ break;
+ case BUF_BIN:
+ case BUF_ARP:
+ case BUF_COMV:
+ case BUF_LINE:
+ case BUF_NON_COMV:
+ case BUF_PERSIST:
+ dev = core->np_dev;
+ break;
+ default:
+ dev_err(core->dev, "invalid buffer type: %d\n", buffer_type);
+ }
+
+ return dev ? dev : core->dev;
+}
diff --git a/drivers/media/platform/qcom/iris/iris_resources.h b/drivers/media/platform/qcom/iris/iris_resources.h
index ca53c01f60ae..2eef0676a146 100644
--- a/drivers/media/platform/qcom/iris/iris_resources.h
+++ b/drivers/media/platform/qcom/iris/iris_resources.h
@@ -16,5 +16,6 @@ int iris_set_icc_bw(struct iris_core *core, unsigned long icc_bw);
int iris_disable_unprepare_clock(struct iris_core *core, enum platform_clk_type clk_type);
int iris_prepare_enable_clock(struct iris_core *core, enum platform_clk_type clk_type);
struct device *iris_create_cb_dev(struct iris_core *core, const char *name);
+struct device *iris_get_cb_dev(struct iris_inst *inst, enum iris_buffer_type buffer_type);
#endif
diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
index 14d63dc76c9b..26df872fb4fa 100644
--- a/drivers/media/platform/qcom/iris/iris_vidc.c
+++ b/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -107,7 +107,7 @@ iris_m2m_queue_init(void *priv, struct vb2_queue *src_vq, struct vb2_queue *dst_
src_vq->drv_priv = inst;
src_vq->buf_struct_size = sizeof(struct iris_buffer);
src_vq->min_reqbufs_allocation = MIN_BUFFERS;
- src_vq->dev = inst->core->dev;
+ src_vq->dev = iris_get_cb_dev(inst, BUF_INPUT);
src_vq->lock = &inst->ctx_q_lock;
ret = vb2_queue_init(src_vq);
if (ret)
@@ -121,7 +121,7 @@ iris_m2m_queue_init(void *priv, struct vb2_queue *src_vq, struct vb2_queue *dst_
dst_vq->drv_priv = inst;
dst_vq->buf_struct_size = sizeof(struct iris_buffer);
dst_vq->min_reqbufs_allocation = MIN_BUFFERS;
- dst_vq->dev = inst->core->dev;
+ dst_vq->dev = iris_get_cb_dev(inst, BUF_OUTPUT);
dst_vq->lock = &inst->ctx_q_lock;
return vb2_queue_init(dst_vq);
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* Re: [PATCH v9 04/14] media: iris: Add helper to select relevant context bank device
2026-07-15 14:09 ` [PATCH v9 04/14] media: iris: Add helper to select relevant " Vishnu Reddy
@ 2026-07-15 14:29 ` sashiko-bot
0 siblings, 0 replies; 26+ messages in thread
From: sashiko-bot @ 2026-07-15 14:29 UTC (permalink / raw)
To: Vishnu Reddy; +Cc: robh, conor+dt, devicetree
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
New issues:
- [High] Using dynamically created context bank devices without taking a reference via get_device() creates a Use-After-Free risk when file descriptors outlive device unbind.
Pre-existing issues:
- [High] The `struct iris_core` is allocated via devres but is accessed in V4L2 deferred release paths, causing a Use-After-Free if a file descriptor is closed after driver unbind.
--
--- Patch [4]: [PATCH v9 04/14] media: iris: Add helper to select relevant context bank device ---
commit ff67c19893e13d3ddb40ea541f363dbf54e13228
Author: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
media: iris: Add helper to select relevant context bank device
This commit introduces a helper to associate the appropriate context bank
device with different buffer types. It updates the internal buffer allocation
and queue initialization to use this dynamically selected device instead of
always defaulting to the main core device.
> diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c
> index 246ad0abbac35..249c9f1d0d5da 100644
> --- a/drivers/media/platform/qcom/iris/iris_buffer.c
> +++ b/drivers/media/platform/qcom/iris/iris_buffer.c
> @@ -545,7 +545,7 @@ static int iris_create_internal_buffer(struct iris_inst *inst,
> buffer->buffer_size = buffers->size;
> buffer->dma_attrs = DMA_ATTR_WRITE_COMBINE | DMA_ATTR_NO_KERNEL_MAPPING;
>
> - buffer->kvaddr = dma_alloc_attrs(core->dev, buffer->buffer_size,
> + buffer->kvaddr = dma_alloc_attrs(dev, buffer->buffer_size,
> &buffer->device_addr, GFP_KERNEL, buffer->dma_attrs);
[Severity: High]
Could this lead to a Use-After-Free of the context bank device?
When a userspace application opens the video device file descriptor,
iris_create_internal_buffer() allocates internal buffers using the context
bank device. If the driver is subsequently unbound (e.g., via sysfs) and the
context bank devices are unregistered and freed, the application could later
close the file descriptor.
Should a reference be taken on the context bank device pointer via
get_device() to ensure it outlives deferred file operations cleanup?
> if (!buffer->kvaddr) {
> kfree(buffer);
[ ... ]
> @@ -682,10 +682,10 @@ int iris_queue_internal_buffers(struct iris_inst *inst, u32 plane)
>
> int iris_destroy_internal_buffer(struct iris_inst *inst, struct iris_buffer *buffer)
> {
> - struct iris_core *core = inst->core;
> + struct device *dev = iris_get_cb_dev(inst, buffer->type);
[Severity: High]
This is a pre-existing issue, but is it possible for inst->core to be freed
before this deferred cleanup is called?
In drivers/media/platform/qcom/iris/iris_probe.c, the core structure is
allocated via devm_kzalloc(). If the driver is unbound while a file
descriptor is open, devres will free the iris_core structure. When the file
descriptor is later closed, deferred release paths (such as
iris_check_num_queued_internal_buffers() in iris_vidc.c, or here calling
iris_get_cb_dev()) will dereference inst->core, resulting in a Use-After-Free.
>
> list_del(&buffer->list);
> - dma_free_attrs(core->dev, buffer->buffer_size, buffer->kvaddr,
> + dma_free_attrs(dev, buffer->buffer_size, buffer->kvaddr,
> buffer->device_addr, buffer->dma_attrs);
[Severity: High]
If the context bank device was freed during driver unbind, will passing the
unpinned device pointer to dma_free_attrs() during deferred fops release
cause a Use-After-Free?
> kfree(buffer);
>
> diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
> index 14d63dc76c9ba..26df872fb4fa1 100644
> --- a/drivers/media/platform/qcom/iris/iris_vidc.c
> +++ b/drivers/media/platform/qcom/iris/iris_vidc.c
> @@ -107,7 +107,7 @@ iris_m2m_queue_init(void *priv, struct vb2_queue *src_vq, struct vb2_queue *dst_
> src_vq->drv_priv = inst;
> src_vq->buf_struct_size = sizeof(struct iris_buffer);
> src_vq->min_reqbufs_allocation = MIN_BUFFERS;
> - src_vq->dev = inst->core->dev;
> + src_vq->dev = iris_get_cb_dev(inst, BUF_INPUT);
> src_vq->lock = &inst->ctx_q_lock;
> ret = vb2_queue_init(src_vq);
> if (ret)
> @@ -121,7 +121,7 @@ iris_m2m_queue_init(void *priv, struct vb2_queue *src_vq, struct vb2_queue *dst_
> dst_vq->drv_priv = inst;
> dst_vq->buf_struct_size = sizeof(struct iris_buffer);
> dst_vq->min_reqbufs_allocation = MIN_BUFFERS;
> - dst_vq->dev = inst->core->dev;
> + dst_vq->dev = iris_get_cb_dev(inst, BUF_OUTPUT);
> dst_vq->lock = &inst->ctx_q_lock;
[Severity: High]
Does assigning the dynamically created context bank device to the vb2_queue
without taking a reference create a Use-After-Free risk?
If the driver unbinds and the device is freed, the vb2_queue could still be
accessed during deferred cleanup when the file descriptor is finally closed.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=4
^ permalink raw reply [flat|nested] 26+ messages in thread
* [PATCH v9 05/14] media: iris: Skip DMA mask setting to core device when IOMMU is not mapped
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
` (3 preceding siblings ...)
2026-07-15 14:09 ` [PATCH v9 04/14] media: iris: Add helper to select relevant " Vishnu Reddy
@ 2026-07-15 14:09 ` Vishnu Reddy
2026-07-15 14:22 ` sashiko-bot
2026-07-15 14:10 ` [PATCH v9 06/14] media: iris: Enable Secure PAS support with IOMMU managed by Linux Vishnu Reddy
` (8 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:09 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy, Daniel J Blueman
From: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
The non-pixel and pixel subnodes move the IOMMU streams away from the
iris parent device. As a result, the core device may not have an IOMMU
mapping, and setting its DMA mask is unnecessary.
Legacy platforms that have not migrated to subnodes still associate the
streams with the parent device and still need the DMA mask setup. Call
dma_set_mask_and_coherent() only when an IOMMU is mapped to the iris
core device.
Co-developed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Tested-by: Daniel J Blueman <daniel@quora.org>
---
drivers/media/platform/qcom/iris/iris_probe.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c
index 2594f5a67378..c40c4ec44e83 100644
--- a/drivers/media/platform/qcom/iris/iris_probe.c
+++ b/drivers/media/platform/qcom/iris/iris_probe.c
@@ -310,9 +310,11 @@ static int iris_probe(struct platform_device *pdev)
dma_mask = core->iris_platform_data->dma_mask;
- ret = dma_set_mask_and_coherent(dev, dma_mask);
- if (ret)
- goto err_vdev_unreg_enc;
+ if (device_iommu_mapped(dev)) {
+ ret = dma_set_mask_and_coherent(dev, dma_mask);
+ if (ret)
+ goto err_vdev_unreg_enc;
+ }
dma_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
dma_set_seg_boundary(&pdev->dev, DMA_BIT_MASK(32));
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* Re: [PATCH v9 05/14] media: iris: Skip DMA mask setting to core device when IOMMU is not mapped
2026-07-15 14:09 ` [PATCH v9 05/14] media: iris: Skip DMA mask setting to core device when IOMMU is not mapped Vishnu Reddy
@ 2026-07-15 14:22 ` sashiko-bot
0 siblings, 0 replies; 26+ messages in thread
From: sashiko-bot @ 2026-07-15 14:22 UTC (permalink / raw)
To: Vishnu Reddy; +Cc: robh, conor+dt, devicetree
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] V4L2 video devices are registered before probe is complete, and the main `core` structure is tied to the device lifetime via `devm_kzalloc()`, leading to race conditions and Use-After-Free vulnerabilities upon probe failure or unbind.
--
--- Patch [5]: [PATCH v9 05/14] media: iris: Skip DMA mask setting to core device when IOMMU is not mapped ---
commit 9521732c3739228afd507693479032190d343a3f
Author: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
media: iris: Skip DMA mask setting to core device when IOMMU is not mapped
The non-pixel and pixel subnodes move the IOMMU streams away from the
iris parent device. As a result, the core device may not have an IOMMU
mapping, and setting its DMA mask is unnecessary.
> diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c
> index 2594f5a67378a..c40c4ec44e83e 100644
> --- a/drivers/media/platform/qcom/iris/iris_probe.c
> +++ b/drivers/media/platform/qcom/iris/iris_probe.c
> @@ -310,9 +310,11 @@ static int iris_probe(struct platform_device *pdev)
>
> dma_mask = core->iris_platform_data->dma_mask;
>
> - ret = dma_set_mask_and_coherent(dev, dma_mask);
> - if (ret)
> - goto err_vdev_unreg_enc;
> + if (device_iommu_mapped(dev)) {
> + ret = dma_set_mask_and_coherent(dev, dma_mask);
> + if (ret)
> + goto err_vdev_unreg_enc;
> + }
[Severity: High]
This is a pre-existing issue, but does this probe sequence expose a
use-after-free regression if probe fails?
In iris_probe(), the core structure is allocated with devm_kzalloc(). Later,
video devices are registered before the hardware and PM runtime are fully
initialized.
If userspace opens the newly created video node during this window, it
obtains a file descriptor referencing the core structure:
iris_vidc.c:iris_open() {
...
ret = pm_runtime_resume_and_get(core->dev);
...
}
If a subsequent step in iris_probe() fails (such as returning an error
after dma_set_mask_and_coherent), the driver returns an error and devres
automatically frees the core structure.
However, the userspace file descriptor remains open. When the process later
calls close(), the driver attempts to access the freed core structure:
iris_vidc.c:iris_close() {
...
iris_check_num_queued_internal_buffers(inst, ...);
...
}
Could this be fixed by moving video device registration to the very end of
probe, or by managing the core structure lifetime via the v4l2 device
release callback instead of devres?
>
> dma_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32));
> dma_set_seg_boundary(&pdev->dev, DMA_BIT_MASK(32));
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=5
^ permalink raw reply [flat|nested] 26+ messages in thread
* [PATCH v9 06/14] media: iris: Enable Secure PAS support with IOMMU managed by Linux
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
` (4 preceding siblings ...)
2026-07-15 14:09 ` [PATCH v9 05/14] media: iris: Skip DMA mask setting to core device when IOMMU is not mapped Vishnu Reddy
@ 2026-07-15 14:10 ` Vishnu Reddy
2026-07-15 14:37 ` sashiko-bot
2026-07-15 14:10 ` [PATCH v9 07/14] media: iris: Replace enum-indexed clock and power domain tables with per-block structures Vishnu Reddy
` (7 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:10 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy, Mukesh Ojha
From: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
On platforms where a hypervisor is present, all Secure Monitor Calls
(SMC) are intercepted. For qcom_scm_pas_auth_and_reset(), the hypervisor
registers a Shared Memory (SHM) bridge over the Peripheral Image Loader
(PIL) memory region so that TrustZone (TZ) can access it, forwards the
authentication SMC to TZ, and upon return maps the PIL region and
triggers the co-processor bring-up sequence:
HLOS -> Hypervisor(SHM setup) -> TZ(auth) -> Hypervisor(map+reset) -> IRIS
On platforms without a hypervisor, Linux drives these steps directly.
The SHM bridge infrastructure required for this is already upstream [1].
To isolate firmware memory in its own Input-Output Memory Management
Unit (IOMMU) context, a dedicated stream ID (SID) is required, tied to
the firmware function ID. This SID is specified via the iommu-map
property in the device tree using the firmware function ID as the lookup
key. A firmware device is created and mapped to this SID.
The presence of a SID mapped to the firmware device via iommu-map is
used to detect whether a hypervisor is absent: when the firmware device
has a SID mapped, Linux manages the IOMMU directly; when no SID is
mapped, a hypervisor is assumed to be present and these steps are
skipped.
Extend the Iris driver to support Secure Peripheral Authentication
Service (PAS) on platforms where Linux manages the IOMMU, by creating
the firmware context device and performing the necessary IOMMU mapping
when the firmware device SID is present.
[1] https://lore.kernel.org/lkml/20260105-kvmrprocv10-v10-0-022e96815380
@oss.qualcomm.com/
Reviewed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Co-developed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Signed-off-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/lkml/20260105-kvmrprocv10-v10-0-022e96815380@oss.qualcomm.com/
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
---
drivers/media/platform/qcom/iris/iris_core.h | 4 ++
drivers/media/platform/qcom/iris/iris_firmware.c | 73 ++++++++++++++++++++----
2 files changed, 65 insertions(+), 12 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_core.h b/drivers/media/platform/qcom/iris/iris_core.h
index 3c96f46cf567..5ed2ec0b97ec 100644
--- a/drivers/media/platform/qcom/iris/iris_core.h
+++ b/drivers/media/platform/qcom/iris/iris_core.h
@@ -38,6 +38,8 @@ struct qcom_ubwc_cfg_data;
* @dev: reference to device structure
* @np_dev: reference to non-pixel device structure
* @p_dev: reference to pixel device structure
+ * @fw_dev: reference to firmware device structure
+ * @pas_ctx: PAS context for authenticated firmware load and shutdown
* @reg_base: IO memory base address
* @irq: iris irq
* @v4l2_dev: a holder for v4l2 device structure
@@ -85,6 +87,8 @@ struct iris_core {
struct device *dev;
struct device *np_dev;
struct device *p_dev;
+ struct device *fw_dev;
+ struct qcom_pas_context *pas_ctx;
void __iomem *reg_base;
int irq;
struct v4l2_device v4l2_dev;
diff --git a/drivers/media/platform/qcom/iris/iris_firmware.c b/drivers/media/platform/qcom/iris/iris_firmware.c
index 1a476146d758..56c477b36b61 100644
--- a/drivers/media/platform/qcom/iris/iris_firmware.c
+++ b/drivers/media/platform/qcom/iris/iris_firmware.c
@@ -4,7 +4,9 @@
*/
#include <linux/firmware.h>
+#include <linux/firmware/qcom/qcom_pas.h>
#include <linux/firmware/qcom/qcom_scm.h>
+#include <linux/iommu.h>
#include <linux/of_address.h>
#include <linux/of_reserved_mem.h>
#include <linux/soc/qcom/mdt_loader.h>
@@ -15,11 +17,14 @@
#define IRIS_PAS_ID 9
#define MAX_FIRMWARE_NAME_SIZE 128
+#define IRIS_FW_START_ADDR 0
static int iris_load_fw_to_memory(struct iris_core *core, const char *fw_name)
{
+ struct device *fw_dev = core->fw_dev ? core->fw_dev : core->dev;
const struct firmware *firmware = NULL;
- struct device *dev = core->dev;
+ struct qcom_pas_context *ctx;
+ struct iommu_domain *domain;
struct resource res;
phys_addr_t mem_phys;
size_t res_size;
@@ -30,14 +35,21 @@ static int iris_load_fw_to_memory(struct iris_core *core, const char *fw_name)
if (strlen(fw_name) >= MAX_FIRMWARE_NAME_SIZE - 4)
return -EINVAL;
- ret = of_reserved_mem_region_to_resource(dev->of_node, 0, &res);
+ ret = of_reserved_mem_region_to_resource(core->dev->of_node, 0, &res);
if (ret)
return ret;
mem_phys = res.start;
res_size = resource_size(&res);
- ret = request_firmware(&firmware, fw_name, dev);
+ if (!core->pas_ctx) {
+ ctx = devm_qcom_pas_context_alloc(core->dev, IRIS_PAS_ID, mem_phys, res_size);
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
+ core->pas_ctx = ctx;
+ }
+
+ ret = request_firmware(&firmware, fw_name, fw_dev);
if (ret)
return ret;
@@ -53,9 +65,23 @@ static int iris_load_fw_to_memory(struct iris_core *core, const char *fw_name)
goto err_release_fw;
}
- ret = qcom_mdt_load(dev, firmware, fw_name,
- IRIS_PAS_ID, mem_virt, mem_phys, res_size, NULL);
+ core->pas_ctx->use_tzmem = !!core->fw_dev;
+ ret = qcom_mdt_pas_load(core->pas_ctx, firmware, fw_name, mem_virt, NULL);
+ if (ret)
+ goto err_mem_unmap;
+
+ if (core->pas_ctx->use_tzmem) {
+ domain = iommu_get_domain_for_dev(fw_dev);
+ if (!domain) {
+ ret = -ENODEV;
+ goto err_mem_unmap;
+ }
+
+ ret = iommu_map(domain, IRIS_FW_START_ADDR, mem_phys, res_size,
+ IOMMU_READ | IOMMU_WRITE | IOMMU_PRIV, GFP_KERNEL);
+ }
+err_mem_unmap:
memunmap(mem_virt);
err_release_fw:
release_firmware(firmware);
@@ -63,6 +89,18 @@ static int iris_load_fw_to_memory(struct iris_core *core, const char *fw_name)
return ret;
}
+static void iris_fw_iommu_unmap(struct iris_core *core)
+{
+ struct iommu_domain *domain;
+
+ if (!core->fw_dev)
+ return;
+
+ domain = iommu_get_domain_for_dev(core->fw_dev);
+ if (domain)
+ iommu_unmap(domain, IRIS_FW_START_ADDR, core->pas_ctx->mem_size);
+}
+
int iris_fw_load(struct iris_core *core)
{
const struct tz_cp_config *cp_config;
@@ -77,13 +115,13 @@ int iris_fw_load(struct iris_core *core)
ret = iris_load_fw_to_memory(core, fwpath);
if (ret) {
dev_err(core->dev, "firmware download failed\n");
- return -ENOMEM;
+ return ret;
}
- ret = qcom_scm_pas_auth_and_reset(IRIS_PAS_ID);
+ ret = qcom_pas_prepare_and_auth_reset(core->pas_ctx);
if (ret) {
dev_err(core->dev, "auth and reset failed: %d\n", ret);
- return ret;
+ goto err_unmap;
}
for (i = 0; i < core->iris_platform_data->tz_cp_config_data_size; i++) {
@@ -94,20 +132,31 @@ int iris_fw_load(struct iris_core *core)
cp_config->cp_nonpixel_size);
if (ret) {
dev_err(core->dev, "qcom_scm_mem_protect_video_var failed: %d\n", ret);
- qcom_scm_pas_shutdown(IRIS_PAS_ID);
- return ret;
+ goto err_pas_shutdown;
}
}
+ return 0;
+
+err_pas_shutdown:
+ qcom_pas_shutdown(IRIS_PAS_ID);
+err_unmap:
+ iris_fw_iommu_unmap(core);
+
return ret;
}
int iris_fw_unload(struct iris_core *core)
{
- return qcom_scm_pas_shutdown(IRIS_PAS_ID);
+ int ret;
+
+ ret = qcom_pas_shutdown(IRIS_PAS_ID);
+ iris_fw_iommu_unmap(core);
+
+ return ret;
}
int iris_set_hw_state(struct iris_core *core, bool resume)
{
- return qcom_scm_set_remote_state(resume, 0);
+ return qcom_pas_set_remote_state(resume, 0);
}
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* Re: [PATCH v9 06/14] media: iris: Enable Secure PAS support with IOMMU managed by Linux
2026-07-15 14:10 ` [PATCH v9 06/14] media: iris: Enable Secure PAS support with IOMMU managed by Linux Vishnu Reddy
@ 2026-07-15 14:37 ` sashiko-bot
0 siblings, 0 replies; 26+ messages in thread
From: sashiko-bot @ 2026-07-15 14:37 UTC (permalink / raw)
To: Vishnu Reddy; +Cc: conor+dt, devicetree, robh
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
New issues:
- [High] Missing cleanup of PAS metadata DMA allocation introduces a memory leak on every firmware load/unload and load error.
- [High] The `core->fw_dev` pointer is added to support Linux-managed IOMMU mapping for the firmware context device, but it is never initialized anywhere in the driver.
Pre-existing issues:
- [High] Missing cancel_delayed_work_sync() for sys_error_handler in driver remove path leads to Use-After-Free.
--
--- Patch [6]: [PATCH v9 06/14] media: iris: Enable Secure PAS support with IOMMU managed by Linux ---
commit d784ba63809fa89007c5ca51f86bf7421bf5d466
Author: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
media: iris: Enable Secure PAS support with IOMMU managed by Linux
On platforms where a hypervisor is present, all Secure Monitor Calls
(SMC) are intercepted. For qcom_scm_pas_auth_and_reset(), the hypervisor
registers a Shared Memory (SHM) bridge over the Peripheral Image Loader
(PIL) memory region so that TrustZone (TZ) can access it, forwards the
authentication SMC to TZ, and upon return maps the PIL region and
triggers the co-processor bring-up sequence.
Link: https://lore.kernel.org/lkml/20260105-kvmrprocv10-v10-0-022e96815380@oss.qualcomm.com/
> diff --git a/drivers/media/platform/qcom/iris/iris_firmware.c b/drivers/media/platform/qcom/iris/iris_firmware.c
> index 1a476146d7580..56c477b36b619 100644
> --- a/drivers/media/platform/qcom/iris/iris_firmware.c
> +++ b/drivers/media/platform/qcom/iris/iris_firmware.c
[ ... ]
> @@ -15,11 +17,14 @@
> #define IRIS_PAS_ID 9
>
> #define MAX_FIRMWARE_NAME_SIZE 128
> +#define IRIS_FW_START_ADDR 0
>
> static int iris_load_fw_to_memory(struct iris_core *core, const char *fw_name)
> {
> + struct device *fw_dev = core->fw_dev ? core->fw_dev : core->dev;
[Severity: High]
Is core->fw_dev initialized anywhere before this point? It appears to be
allocated as part of struct iris_core using devm_kzalloc(), but never
assigned a value in the driver, meaning it will always be NULL and this will
always fall back to core->dev.
> const struct firmware *firmware = NULL;
> - struct device *dev = core->dev;
> + struct qcom_pas_context *ctx;
> + struct iommu_domain *domain;
> struct resource res;
[ ... ]
> @@ -53,9 +65,23 @@ static int iris_load_fw_to_memory(struct iris_core *core, const char *fw_name)
> goto err_release_fw;
> }
>
> - ret = qcom_mdt_load(dev, firmware, fw_name,
> - IRIS_PAS_ID, mem_virt, mem_phys, res_size, NULL);
> + core->pas_ctx->use_tzmem = !!core->fw_dev;
[Severity: High]
Since core->fw_dev is never initialized, will use_tzmem always be false,
causing the entire iommu_map() block below to become dead code?
> + ret = qcom_mdt_pas_load(core->pas_ctx, firmware, fw_name, mem_virt, NULL);
> + if (ret)
> + goto err_mem_unmap;
> +
> + if (core->pas_ctx->use_tzmem) {
> + domain = iommu_get_domain_for_dev(fw_dev);
> + if (!domain) {
> + ret = -ENODEV;
> + goto err_mem_unmap;
[Severity: High]
If this error path is taken, will it leak the PAS metadata DMA allocation?
It seems the caller is required to free the metadata allocated by
qcom_mdt_pas_load() using qcom_pas_metadata_release(), but this call
is omitted during cleanup and error handling.
> + }
> +
> + ret = iommu_map(domain, IRIS_FW_START_ADDR, mem_phys, res_size,
> + IOMMU_READ | IOMMU_WRITE | IOMMU_PRIV, GFP_KERNEL);
> + }
>
> +err_mem_unmap:
> memunmap(mem_virt);
> err_release_fw:
> release_firmware(firmware);
> @@ -77,13 +115,13 @@ int iris_fw_load(struct iris_core *core)
> ret = iris_load_fw_to_memory(core, fwpath);
> if (ret) {
> dev_err(core->dev, "firmware download failed\n");
> - return -ENOMEM;
> + return ret;
> }
>
> - ret = qcom_scm_pas_auth_and_reset(IRIS_PAS_ID);
> + ret = qcom_pas_prepare_and_auth_reset(core->pas_ctx);
> if (ret) {
> dev_err(core->dev, "auth and reset failed: %d\n", ret);
> - return ret;
> + goto err_unmap;
[Severity: High]
Does this error path also need to call qcom_pas_metadata_release()? The
metadata does not appear to be released here or in the normal success path.
> }
>
> for (i = 0; i < core->iris_platform_data->tz_cp_config_data_size; i++) {
> @@ -94,20 +132,31 @@ int iris_fw_load(struct iris_core *core)
> cp_config->cp_nonpixel_size);
> if (ret) {
> dev_err(core->dev, "qcom_scm_mem_protect_video_var failed: %d\n", ret);
> - qcom_scm_pas_shutdown(IRIS_PAS_ID);
> - return ret;
> + goto err_pas_shutdown;
> }
> }
>
> + return 0;
> +
> +err_pas_shutdown:
> + qcom_pas_shutdown(IRIS_PAS_ID);
> +err_unmap:
> + iris_fw_iommu_unmap(core);
> +
> return ret;
> }
>
> int iris_fw_unload(struct iris_core *core)
> {
> - return qcom_scm_pas_shutdown(IRIS_PAS_ID);
> + int ret;
> +
> + ret = qcom_pas_shutdown(IRIS_PAS_ID);
> + iris_fw_iommu_unmap(core);
> +
> + return ret;
> }
[Severity: High]
Does iris_fw_unload() also need to call qcom_pas_metadata_release()?
If the PAS metadata context is not released, won't it cause a memory leak
on every firmware load/unload cycle?
[Severity: High]
This is a pre-existing issue, but does iris_remove() need to cancel the
sys_error_handler delayed work before destroying resources?
If a hardware fatal error interrupt schedules the work, and the driver is
unbound before the delay expires, it looks like iris_remove() will destroy
the mutex and free the core struct without calling cancel_delayed_work_sync().
Could this lead to a use-after-free when the delayed work eventually executes?
drivers/media/platform/qcom/iris/iris_probe.c:iris_remove() {
...
iris_core_deinit(core);
...
iris_deinit_cb_devs(core);
mutex_destroy(&core->lock);
}
drivers/media/platform/qcom/iris/iris_probe.c:iris_sys_error_handler() {
struct iris_core *core =
container_of(work, struct iris_core, sys_error_handler.work);
iris_core_deinit(core);
iris_core_init(core);
}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=6
^ permalink raw reply [flat|nested] 26+ messages in thread
* [PATCH v9 07/14] media: iris: Replace enum-indexed clock and power domain tables with per-block structures
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
` (5 preceding siblings ...)
2026-07-15 14:10 ` [PATCH v9 06/14] media: iris: Enable Secure PAS support with IOMMU managed by Linux Vishnu Reddy
@ 2026-07-15 14:10 ` Vishnu Reddy
2026-07-15 14:39 ` sashiko-bot
2026-07-15 14:10 ` [PATCH v9 08/14] media: iris: Add power sequence for glymur Vishnu Reddy
` (6 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:10 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy
As new platforms are added, the platform_clk_type and
platform_pm_domain_type enums keep growing. Every new clock or
power domain requires a new enum entry, and every enable/disable
path has to loop through the clock table to find the right clock
by enum value, adding overhead and boilerplate on each path.
The enum index space is also shared across all hardware blocks.
On the Glymur platform, the VPP0 index for VPU4x and the VCODEC1
index clash, making it error-prone to extend support without
breaking existing platforms.
Replace the flat tables and enum-based lookups with
iris_power_domain, which bundles a power domain device and its
associated clocks together per hardware block. Platform data
describes each block via iris_power_domain_data, and the enable
and disable helpers operate directly on an iris_power_domain
instance, removing the need for any index lookup at runtime.
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
---
drivers/media/platform/qcom/iris/iris_core.h | 23 +++-
.../platform/qcom/iris/iris_platform_common.h | 41 ++----
.../platform/qcom/iris/iris_platform_sc7280.h | 28 ++++-
.../platform/qcom/iris/iris_platform_sm8250.h | 26 +++-
.../platform/qcom/iris/iris_platform_sm8550.h | 26 +++-
.../platform/qcom/iris/iris_platform_sm8750.h | 29 +++--
.../media/platform/qcom/iris/iris_platform_vpu2.c | 14 +--
.../media/platform/qcom/iris/iris_platform_vpu3x.c | 32 ++---
.../platform/qcom/iris/iris_platform_x1p42100.h | 27 +++-
drivers/media/platform/qcom/iris/iris_probe.c | 134 ++++++++++++++++++--
drivers/media/platform/qcom/iris/iris_resources.c | 82 +++++-------
drivers/media/platform/qcom/iris/iris_resources.h | 8 +-
drivers/media/platform/qcom/iris/iris_vpu3x.c | 37 +-----
drivers/media/platform/qcom/iris/iris_vpu4x.c | 137 +++------------------
drivers/media/platform/qcom/iris/iris_vpu_common.c | 98 ++-------------
15 files changed, 341 insertions(+), 401 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_core.h b/drivers/media/platform/qcom/iris/iris_core.h
index 5ed2ec0b97ec..f528f53f20fc 100644
--- a/drivers/media/platform/qcom/iris/iris_core.h
+++ b/drivers/media/platform/qcom/iris/iris_core.h
@@ -16,6 +16,13 @@
#include "iris_resources.h"
#include "iris_state.h"
+struct iris_power_domain {
+ struct device **dev;
+ unsigned int pd_cnt;
+ struct clk_bulk_data *clocks;
+ unsigned int clk_cnt;
+};
+
struct icc_info {
const char *name;
u32 bw_min_kbps;
@@ -51,10 +58,12 @@ struct qcom_ubwc_cfg_data;
* @iris_vb2_ops: iris vb2 ops
* @icc_tbl: table of iris interconnects
* @icc_count: count of iris interconnects
- * @pmdomain_tbl: table of iris power domains
+ * @ctrl: power domain and clocks for the controller
+ * @vcodec: power domain and clocks for the vcodec
+ * @vcodec_vpp0: power domain and clocks for the vcodec VPP0
+ * @vcodec_vpp1: power domain and clocks for the vcodec VPP1
+ * @apv: power domain and clocks for the APV hardware block
* @opp_pmdomain_tbl: table of opp power domains
- * @clock_tbl: table of iris clocks
- * @clk_count: count of iris clocks
* @resets: table of iris reset clocks
* @controller_resets: table of controller reset clocks
* @iris_platform_data: a structure for platform data
@@ -100,10 +109,12 @@ struct iris_core {
const struct vb2_ops *iris_vb2_ops;
struct icc_bulk_data *icc_tbl;
u32 icc_count;
- struct dev_pm_domain_list *pmdomain_tbl;
+ struct iris_power_domain *ctrl;
+ struct iris_power_domain *vcodec;
+ struct iris_power_domain *vcodec_vpp0;
+ struct iris_power_domain *vcodec_vpp1;
+ struct iris_power_domain *apv;
struct dev_pm_domain_list *opp_pmdomain_tbl;
- struct clk_bulk_data *clock_tbl;
- u32 clk_count;
struct reset_control_bulk_data *resets;
struct reset_control_bulk_data *controller_resets;
const struct iris_platform_data *iris_platform_data;
diff --git a/drivers/media/platform/qcom/iris/iris_platform_common.h b/drivers/media/platform/qcom/iris/iris_platform_common.h
index c9256f2323dc..99f59b64f853 100644
--- a/drivers/media/platform/qcom/iris/iris_platform_common.h
+++ b/drivers/media/platform/qcom/iris/iris_platform_common.h
@@ -61,26 +61,6 @@ extern const struct iris_platform_data sm8650_data;
extern const struct iris_platform_data sm8750_data;
extern const struct iris_platform_data x1p42100_data;
-enum platform_clk_type {
- IRIS_AXI_CLK, /* AXI0 in case of platforms with multiple AXI clocks */
- IRIS_CTRL_CLK,
- IRIS_AHB_CLK,
- IRIS_HW_CLK,
- IRIS_HW_AHB_CLK,
- IRIS_AXI1_CLK,
- IRIS_CTRL_FREERUN_CLK,
- IRIS_HW_FREERUN_CLK,
- IRIS_BSE_HW_CLK,
- IRIS_VPP0_HW_CLK,
- IRIS_VPP1_HW_CLK,
- IRIS_APV_HW_CLK,
-};
-
-struct platform_clk_data {
- enum platform_clk_type clk_type;
- const char *clk_name;
-};
-
struct tz_cp_config {
u32 cp_start;
u32 cp_size;
@@ -228,12 +208,11 @@ struct icc_vote_data {
u32 fps;
};
-enum platform_pm_domain_type {
- IRIS_CTRL_POWER_DOMAIN,
- IRIS_HW_POWER_DOMAIN,
- IRIS_VPP0_HW_POWER_DOMAIN,
- IRIS_VPP1_HW_POWER_DOMAIN,
- IRIS_APV_HW_POWER_DOMAIN,
+struct iris_power_domain_data {
+ const char * const *pd_names;
+ unsigned int pd_cnt;
+ const char * const *clk_names;
+ unsigned int clk_cnt;
};
struct iris_firmware_data {
@@ -300,13 +279,14 @@ struct iris_platform_data {
unsigned int icc_tbl_size;
const struct bw_info *bw_tbl_dec;
unsigned int bw_tbl_dec_size;
- const char * const *pmdomain_tbl;
- unsigned int pmdomain_tbl_size;
+ const struct iris_power_domain_data *ctrl_data;
+ const struct iris_power_domain_data *vcodec_data;
+ const struct iris_power_domain_data *vcodec_vpp0_data;
+ const struct iris_power_domain_data *vcodec_vpp1_data;
+ const struct iris_power_domain_data *apv_data;
const char * const *opp_pd_tbl;
unsigned int opp_pd_tbl_size;
- const struct platform_clk_data *clk_tbl;
const char * const *opp_clk_tbl;
- unsigned int clk_tbl_size;
const char * const *clk_rst_tbl;
unsigned int clk_rst_tbl_size;
const char * const *controller_rst_tbl;
@@ -320,6 +300,7 @@ struct iris_platform_data {
u32 num_vpp_pipe;
bool no_aon;
u32 max_session_count;
+ u32 num_cores;
/* max number of macroblocks per frame supported */
u32 max_core_mbpf;
/* max number of macroblocks per second supported */
diff --git a/drivers/media/platform/qcom/iris/iris_platform_sc7280.h b/drivers/media/platform/qcom/iris/iris_platform_sc7280.h
index 0ec8f334df67..f19547a8a51d 100644
--- a/drivers/media/platform/qcom/iris/iris_platform_sc7280.h
+++ b/drivers/media/platform/qcom/iris/iris_platform_sc7280.h
@@ -15,12 +15,28 @@ static const struct bw_info sc7280_bw_table_dec[] = {
static const char * const sc7280_opp_pd_table[] = { "cx" };
-static const struct platform_clk_data sc7280_clk_table[] = {
- {IRIS_CTRL_CLK, "core" },
- {IRIS_AXI_CLK, "iface" },
- {IRIS_AHB_CLK, "bus" },
- {IRIS_HW_CLK, "vcodec_core" },
- {IRIS_HW_AHB_CLK, "vcodec_bus" },
+static const struct iris_power_domain_data sc7280_ctrl_data = {
+ .pd_names = (const char *[]) {
+ "venus",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "iface", "core", "bus",
+ },
+ .clk_cnt = 3,
+};
+
+static const struct iris_power_domain_data sc7280_vcodec_data[] = {
+ {
+ .pd_names = (const char *[]) {
+ "vcodec0",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "vcodec_core", "vcodec_bus",
+ },
+ .clk_cnt = 2,
+ },
};
static const char * const sc7280_opp_clk_table[] = {
diff --git a/drivers/media/platform/qcom/iris/iris_platform_sm8250.h b/drivers/media/platform/qcom/iris/iris_platform_sm8250.h
index 50306043eb8e..7674cf9a330f 100644
--- a/drivers/media/platform/qcom/iris/iris_platform_sm8250.h
+++ b/drivers/media/platform/qcom/iris/iris_platform_sm8250.h
@@ -15,10 +15,28 @@ static const struct bw_info sm8250_bw_table_dec[] = {
static const char * const sm8250_opp_pd_table[] = { "mx", "mmcx" };
-static const struct platform_clk_data sm8250_clk_table[] = {
- {IRIS_AXI_CLK, "iface" },
- {IRIS_CTRL_CLK, "core" },
- {IRIS_HW_CLK, "vcodec0_core" },
+static const struct iris_power_domain_data sm8250_ctrl_data = {
+ .pd_names = (const char *[]) {
+ "venus",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "iface", "core",
+ },
+ .clk_cnt = 2,
+};
+
+static const struct iris_power_domain_data sm8250_vcodec_data[] = {
+ {
+ .pd_names = (const char *[]) {
+ "vcodec0",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "vcodec0_core",
+ },
+ .clk_cnt = 1,
+ },
};
static const char * const sm8250_opp_clk_table[] = {
diff --git a/drivers/media/platform/qcom/iris/iris_platform_sm8550.h b/drivers/media/platform/qcom/iris/iris_platform_sm8550.h
index 3c9dae995bb2..71de71a75e95 100644
--- a/drivers/media/platform/qcom/iris/iris_platform_sm8550.h
+++ b/drivers/media/platform/qcom/iris/iris_platform_sm8550.h
@@ -8,10 +8,28 @@
static const char * const sm8550_clk_reset_table[] = { "bus" };
-static const struct platform_clk_data sm8550_clk_table[] = {
- {IRIS_AXI_CLK, "iface" },
- {IRIS_CTRL_CLK, "core" },
- {IRIS_HW_CLK, "vcodec0_core" },
+static const struct iris_power_domain_data sm8550_ctrl_data = {
+ .pd_names = (const char *[]) {
+ "venus",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "iface", "core",
+ },
+ .clk_cnt = 2,
+};
+
+static const struct iris_power_domain_data sm8550_vcodec_data[] = {
+ {
+ .pd_names = (const char *[]) {
+ "vcodec0",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "vcodec0_core",
+ },
+ .clk_cnt = 1,
+ },
};
static struct platform_inst_caps platform_inst_cap_sm8550 = {
diff --git a/drivers/media/platform/qcom/iris/iris_platform_sm8750.h b/drivers/media/platform/qcom/iris/iris_platform_sm8750.h
index 719056656a5b..45ab78781f4a 100644
--- a/drivers/media/platform/qcom/iris/iris_platform_sm8750.h
+++ b/drivers/media/platform/qcom/iris/iris_platform_sm8750.h
@@ -10,13 +10,28 @@ static const char * const sm8750_clk_reset_table[] = {
"bus0", "bus1", "core", "vcodec0_core"
};
-static const struct platform_clk_data sm8750_clk_table[] = {
- {IRIS_AXI_CLK, "iface" },
- {IRIS_CTRL_CLK, "core" },
- {IRIS_HW_CLK, "vcodec0_core" },
- {IRIS_AXI1_CLK, "iface1" },
- {IRIS_CTRL_FREERUN_CLK, "core_freerun" },
- {IRIS_HW_FREERUN_CLK, "vcodec0_core_freerun" },
+static const struct iris_power_domain_data sm8750_ctrl_data = {
+ .pd_names = (const char *[]) {
+ "venus",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "iface1", "core_freerun", "core",
+ },
+ .clk_cnt = 3,
+};
+
+static const struct iris_power_domain_data sm8750_vcodec_data[] = {
+ {
+ .pd_names = (const char *[]) {
+ "vcodec0",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "iface", "vcodec0_core_freerun", "vcodec0_core",
+ },
+ .clk_cnt = 3,
+ },
};
#endif
diff --git a/drivers/media/platform/qcom/iris/iris_platform_vpu2.c b/drivers/media/platform/qcom/iris/iris_platform_vpu2.c
index 6e06a32822bb..c381a40da9ba 100644
--- a/drivers/media/platform/qcom/iris/iris_platform_vpu2.c
+++ b/drivers/media/platform/qcom/iris/iris_platform_vpu2.c
@@ -53,8 +53,6 @@ static const struct icc_info iris_icc_info_vpu2[] = {
static const char * const iris_clk_reset_table_vpu2[] = { "bus", "core" };
-static const char * const iris_pmdomain_table_vpu2[] = { "venus", "vcodec0" };
-
static const struct tz_cp_config tz_cp_config_vpu2[] = {
{
.cp_start = 0,
@@ -71,12 +69,10 @@ const struct iris_platform_data sc7280_data = {
.icc_tbl_size = ARRAY_SIZE(iris_icc_info_vpu2),
.bw_tbl_dec = sc7280_bw_table_dec,
.bw_tbl_dec_size = ARRAY_SIZE(sc7280_bw_table_dec),
- .pmdomain_tbl = iris_pmdomain_table_vpu2,
- .pmdomain_tbl_size = ARRAY_SIZE(iris_pmdomain_table_vpu2),
+ .ctrl_data = &sc7280_ctrl_data,
+ .vcodec_data = sc7280_vcodec_data,
.opp_pd_tbl = sc7280_opp_pd_table,
.opp_pd_tbl_size = ARRAY_SIZE(sc7280_opp_pd_table),
- .clk_tbl = sc7280_clk_table,
- .clk_tbl_size = ARRAY_SIZE(sc7280_clk_table),
.opp_clk_tbl = sc7280_opp_clk_table,
/* Upper bound of DMA address range */
.dma_mask = 0xe0000000 - 1,
@@ -102,12 +98,10 @@ const struct iris_platform_data sm8250_data = {
.clk_rst_tbl_size = ARRAY_SIZE(iris_clk_reset_table_vpu2),
.bw_tbl_dec = sm8250_bw_table_dec,
.bw_tbl_dec_size = ARRAY_SIZE(sm8250_bw_table_dec),
- .pmdomain_tbl = iris_pmdomain_table_vpu2,
- .pmdomain_tbl_size = ARRAY_SIZE(iris_pmdomain_table_vpu2),
+ .ctrl_data = &sm8250_ctrl_data,
+ .vcodec_data = sm8250_vcodec_data,
.opp_pd_tbl = sm8250_opp_pd_table,
.opp_pd_tbl_size = ARRAY_SIZE(sm8250_opp_pd_table),
- .clk_tbl = sm8250_clk_table,
- .clk_tbl_size = ARRAY_SIZE(sm8250_clk_table),
.opp_clk_tbl = sm8250_opp_clk_table,
/* Upper bound of DMA address range */
.dma_mask = 0xe0000000 - 1,
diff --git a/drivers/media/platform/qcom/iris/iris_platform_vpu3x.c b/drivers/media/platform/qcom/iris/iris_platform_vpu3x.c
index 2c63adbc5579..72dd23dbe02a 100644
--- a/drivers/media/platform/qcom/iris/iris_platform_vpu3x.c
+++ b/drivers/media/platform/qcom/iris/iris_platform_vpu3x.c
@@ -67,8 +67,6 @@ static const struct bw_info iris_bw_table_dec_vpu3x[] = {
{ ((1920 * 1080) / 256) * 30, 294000 },
};
-static const char * const iris_pmdomain_table_vpu3x[] = { "venus", "vcodec0" };
-
static const char * const iris_opp_pd_table_vpu3x[] = { "mxc", "mmcx" };
static const char * const iris_opp_clk_table_vpu3x[] = {
@@ -98,12 +96,10 @@ const struct iris_platform_data qcs8300_data = {
.clk_rst_tbl_size = ARRAY_SIZE(sm8550_clk_reset_table),
.bw_tbl_dec = iris_bw_table_dec_vpu3x,
.bw_tbl_dec_size = ARRAY_SIZE(iris_bw_table_dec_vpu3x),
- .pmdomain_tbl = iris_pmdomain_table_vpu3x,
- .pmdomain_tbl_size = ARRAY_SIZE(iris_pmdomain_table_vpu3x),
+ .ctrl_data = &sm8550_ctrl_data,
+ .vcodec_data = sm8550_vcodec_data,
.opp_pd_tbl = iris_opp_pd_table_vpu3x,
.opp_pd_tbl_size = ARRAY_SIZE(iris_opp_pd_table_vpu3x),
- .clk_tbl = sm8550_clk_table,
- .clk_tbl_size = ARRAY_SIZE(sm8550_clk_table),
.opp_clk_tbl = iris_opp_clk_table_vpu3x,
/* Upper bound of DMA address range */
.dma_mask = 0xe0000000 - 1,
@@ -127,12 +123,10 @@ const struct iris_platform_data sm8550_data = {
.clk_rst_tbl_size = ARRAY_SIZE(sm8550_clk_reset_table),
.bw_tbl_dec = iris_bw_table_dec_vpu3x,
.bw_tbl_dec_size = ARRAY_SIZE(iris_bw_table_dec_vpu3x),
- .pmdomain_tbl = iris_pmdomain_table_vpu3x,
- .pmdomain_tbl_size = ARRAY_SIZE(iris_pmdomain_table_vpu3x),
+ .ctrl_data = &sm8550_ctrl_data,
+ .vcodec_data = sm8550_vcodec_data,
.opp_pd_tbl = iris_opp_pd_table_vpu3x,
.opp_pd_tbl_size = ARRAY_SIZE(iris_opp_pd_table_vpu3x),
- .clk_tbl = sm8550_clk_table,
- .clk_tbl_size = ARRAY_SIZE(sm8550_clk_table),
.opp_clk_tbl = iris_opp_clk_table_vpu3x,
/* Upper bound of DMA address range */
.dma_mask = 0xe0000000 - 1,
@@ -164,12 +158,10 @@ const struct iris_platform_data sm8650_data = {
.controller_rst_tbl_size = ARRAY_SIZE(sm8650_controller_reset_table),
.bw_tbl_dec = iris_bw_table_dec_vpu3x,
.bw_tbl_dec_size = ARRAY_SIZE(iris_bw_table_dec_vpu3x),
- .pmdomain_tbl = iris_pmdomain_table_vpu3x,
- .pmdomain_tbl_size = ARRAY_SIZE(iris_pmdomain_table_vpu3x),
+ .ctrl_data = &sm8550_ctrl_data,
+ .vcodec_data = sm8550_vcodec_data,
.opp_pd_tbl = iris_opp_pd_table_vpu3x,
.opp_pd_tbl_size = ARRAY_SIZE(iris_opp_pd_table_vpu3x),
- .clk_tbl = sm8550_clk_table,
- .clk_tbl_size = ARRAY_SIZE(sm8550_clk_table),
.opp_clk_tbl = iris_opp_clk_table_vpu3x,
/* Upper bound of DMA address range */
.dma_mask = 0xe0000000 - 1,
@@ -193,12 +185,10 @@ const struct iris_platform_data sm8750_data = {
.clk_rst_tbl_size = ARRAY_SIZE(sm8750_clk_reset_table),
.bw_tbl_dec = iris_bw_table_dec_vpu3x,
.bw_tbl_dec_size = ARRAY_SIZE(iris_bw_table_dec_vpu3x),
- .pmdomain_tbl = iris_pmdomain_table_vpu3x,
- .pmdomain_tbl_size = ARRAY_SIZE(iris_pmdomain_table_vpu3x),
+ .ctrl_data = &sm8750_ctrl_data,
+ .vcodec_data = sm8750_vcodec_data,
.opp_pd_tbl = iris_opp_pd_table_vpu3x,
.opp_pd_tbl_size = ARRAY_SIZE(iris_opp_pd_table_vpu3x),
- .clk_tbl = sm8750_clk_table,
- .clk_tbl_size = ARRAY_SIZE(sm8750_clk_table),
.opp_clk_tbl = iris_opp_clk_table_vpu3x,
/* Upper bound of DMA address range */
.dma_mask = 0xe0000000 - 1,
@@ -228,12 +218,10 @@ const struct iris_platform_data x1p42100_data = {
.clk_rst_tbl_size = ARRAY_SIZE(sm8550_clk_reset_table),
.bw_tbl_dec = iris_bw_table_dec_vpu3x,
.bw_tbl_dec_size = ARRAY_SIZE(iris_bw_table_dec_vpu3x),
- .pmdomain_tbl = iris_pmdomain_table_vpu3x,
- .pmdomain_tbl_size = ARRAY_SIZE(iris_pmdomain_table_vpu3x),
+ .ctrl_data = &x1p42100_ctrl_data,
+ .vcodec_data = x1p42100_vcodec_data,
.opp_pd_tbl = iris_opp_pd_table_vpu3x,
.opp_pd_tbl_size = ARRAY_SIZE(iris_opp_pd_table_vpu3x),
- .clk_tbl = x1p42100_clk_table,
- .clk_tbl_size = ARRAY_SIZE(x1p42100_clk_table),
.opp_clk_tbl = x1p42100_opp_clk_table,
/* Upper bound of DMA address range */
.dma_mask = 0xe0000000 - 1,
diff --git a/drivers/media/platform/qcom/iris/iris_platform_x1p42100.h b/drivers/media/platform/qcom/iris/iris_platform_x1p42100.h
index d89acfbc1233..3444c1c3012b 100644
--- a/drivers/media/platform/qcom/iris/iris_platform_x1p42100.h
+++ b/drivers/media/platform/qcom/iris/iris_platform_x1p42100.h
@@ -6,11 +6,28 @@
#ifndef __IRIS_PLATFORM_X1P42100_H__
#define __IRIS_PLATFORM_X1P42100_H__
-static const struct platform_clk_data x1p42100_clk_table[] = {
- {IRIS_AXI_CLK, "iface" },
- {IRIS_CTRL_CLK, "core" },
- {IRIS_HW_CLK, "vcodec0_core" },
- {IRIS_BSE_HW_CLK, "vcodec0_bse" },
+static const struct iris_power_domain_data x1p42100_ctrl_data = {
+ .pd_names = (const char *[]) {
+ "venus",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "iface", "core",
+ },
+ .clk_cnt = 2,
+};
+
+static const struct iris_power_domain_data x1p42100_vcodec_data[] = {
+ {
+ .pd_names = (const char *[]) {
+ "vcodec0",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "vcodec0_core", "vcodec0_bse",
+ },
+ .clk_cnt = 2,
+ },
};
static const char *const x1p42100_opp_clk_table[] = {
diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c
index c40c4ec44e83..9e96fa218dea 100644
--- a/drivers/media/platform/qcom/iris/iris_probe.c
+++ b/drivers/media/platform/qcom/iris/iris_probe.c
@@ -40,15 +40,42 @@ static int iris_init_icc(struct iris_core *core)
return devm_of_icc_bulk_get(core->dev, core->icc_count, core->icc_tbl);
}
-static int iris_init_power_domains(struct iris_core *core)
+static int iris_init_power_domains_per_block(struct iris_core *core,
+ struct iris_power_domain *pd,
+ const struct iris_power_domain_data *pd_data)
{
- int ret;
+ struct dev_pm_domain_attach_data iris_pd_data = {};
+ struct dev_pm_domain_list *pmdomain_tbl;
+ int ret, i;
- struct dev_pm_domain_attach_data iris_pd_data = {
- .pd_names = core->iris_platform_data->pmdomain_tbl,
- .num_pd_names = core->iris_platform_data->pmdomain_tbl_size,
- .pd_flags = PD_FLAG_NO_DEV_LINK,
- };
+ if (!pd_data->pd_cnt)
+ return -EINVAL;
+
+ iris_pd_data.pd_names = pd_data->pd_names;
+ iris_pd_data.num_pd_names = pd_data->pd_cnt;
+ iris_pd_data.pd_flags = PD_FLAG_NO_DEV_LINK;
+
+ ret = devm_pm_domain_attach_list(core->dev, &iris_pd_data, &pmdomain_tbl);
+ if (ret < 0)
+ return ret;
+
+ pd->pd_cnt = ret;
+
+ pd->dev = devm_kzalloc(core->dev, pd->pd_cnt * sizeof(*pd->dev), GFP_KERNEL);
+ if (!pd->dev)
+ return -ENOMEM;
+
+ for (i = 0; i < pd->pd_cnt; i++)
+ pd->dev[i] = pmdomain_tbl->pd_devs[i];
+
+ return 0;
+}
+
+static int iris_init_power_domains(struct iris_core *core)
+{
+ const struct iris_platform_data *plat = core->iris_platform_data;
+ unsigned int num_cores = max(plat->num_cores, 1);
+ int i, ret;
struct dev_pm_domain_attach_data iris_opp_pd_data = {
.pd_names = core->iris_platform_data->opp_pd_tbl,
@@ -61,10 +88,57 @@ static int iris_init_power_domains(struct iris_core *core)
.config_clks = dev_pm_opp_config_clks_simple,
};
- ret = devm_pm_domain_attach_list(core->dev, &iris_pd_data, &core->pmdomain_tbl);
- if (ret < 0)
+ core->ctrl = devm_kzalloc(core->dev, sizeof(*core->ctrl), GFP_KERNEL);
+ if (!core->ctrl)
+ return -ENOMEM;
+
+ ret = iris_init_power_domains_per_block(core, core->ctrl, plat->ctrl_data);
+ if (ret)
return ret;
+ core->vcodec = devm_kzalloc(core->dev, num_cores * sizeof(*core->vcodec), GFP_KERNEL);
+ if (!core->vcodec)
+ return -ENOMEM;
+
+ for (i = 0; i < num_cores; i++) {
+ ret = iris_init_power_domains_per_block(core, &core->vcodec[i],
+ &plat->vcodec_data[i]);
+ if (ret)
+ return ret;
+ }
+
+ if (plat->vcodec_vpp0_data) {
+ core->vcodec_vpp0 = devm_kzalloc(core->dev, sizeof(*core->vcodec_vpp0), GFP_KERNEL);
+ if (!core->vcodec_vpp0)
+ return -ENOMEM;
+
+ ret = iris_init_power_domains_per_block(core, core->vcodec_vpp0,
+ plat->vcodec_vpp0_data);
+ if (ret)
+ return ret;
+ }
+
+ if (plat->vcodec_vpp1_data) {
+ core->vcodec_vpp1 = devm_kzalloc(core->dev, sizeof(*core->vcodec_vpp1), GFP_KERNEL);
+ if (!core->vcodec_vpp1)
+ return -ENOMEM;
+
+ ret = iris_init_power_domains_per_block(core, core->vcodec_vpp1,
+ plat->vcodec_vpp1_data);
+ if (ret)
+ return ret;
+ }
+
+ if (plat->apv_data) {
+ core->apv = devm_kzalloc(core->dev, sizeof(*core->apv), GFP_KERNEL);
+ if (!core->apv)
+ return -ENOMEM;
+
+ ret = iris_init_power_domains_per_block(core, core->apv, plat->apv_data);
+ if (ret)
+ return ret;
+ }
+
ret = devm_pm_domain_attach_list(core->dev, &iris_opp_pd_data, &core->opp_pmdomain_tbl);
/* backwards compatibility for incomplete ABI SM8250 */
if (ret == -ENODEV &&
@@ -83,17 +157,51 @@ static int iris_init_power_domains(struct iris_core *core)
return devm_pm_opp_of_add_table(core->dev);
}
+static int iris_init_clocks_per_block(struct iris_core *core, struct iris_power_domain *pd,
+ const struct iris_power_domain_data *pd_data)
+{
+ unsigned int i;
+
+ if (!pd_data)
+ return 0;
+
+ pd->clk_cnt = pd_data->clk_cnt;
+ pd->clocks = devm_kcalloc(core->dev, pd->clk_cnt, sizeof(*pd->clocks), GFP_KERNEL);
+ if (!pd->clocks)
+ return -ENOMEM;
+
+ for (i = 0; i < pd->clk_cnt; i++)
+ pd->clocks[i].id = pd_data->clk_names[i];
+
+ return devm_clk_bulk_get(core->dev, pd->clk_cnt, pd->clocks);
+}
+
static int iris_init_clocks(struct iris_core *core)
{
+ const struct iris_platform_data *plat = core->iris_platform_data;
+ unsigned int num_cores = max(plat->num_cores, 1);
+ unsigned int i;
int ret;
- ret = devm_clk_bulk_get_all(core->dev, &core->clock_tbl);
- if (ret < 0)
+ ret = iris_init_clocks_per_block(core, core->ctrl, plat->ctrl_data);
+ if (ret)
+ return ret;
+
+ for (i = 0; i < num_cores; i++) {
+ ret = iris_init_clocks_per_block(core, &core->vcodec[i], &plat->vcodec_data[i]);
+ if (ret)
+ return ret;
+ }
+
+ ret = iris_init_clocks_per_block(core, core->vcodec_vpp0, plat->vcodec_vpp0_data);
+ if (ret)
return ret;
- core->clk_count = ret;
+ ret = iris_init_clocks_per_block(core, core->vcodec_vpp1, plat->vcodec_vpp1_data);
+ if (ret)
+ return ret;
- return 0;
+ return iris_init_clocks_per_block(core, core->apv, plat->apv_data);
}
static int iris_init_reset_table(struct iris_core *core,
diff --git a/drivers/media/platform/qcom/iris/iris_resources.c b/drivers/media/platform/qcom/iris/iris_resources.c
index 309a593d755b..fd4dd0269223 100644
--- a/drivers/media/platform/qcom/iris/iris_resources.c
+++ b/drivers/media/platform/qcom/iris/iris_resources.c
@@ -10,7 +10,6 @@
#include <linux/pm_domain.h>
#include <linux/pm_opp.h>
#include <linux/pm_runtime.h>
-#include <linux/reset.h>
#include "iris_core.h"
#include "iris_instance.h"
@@ -72,76 +71,63 @@ int iris_opp_set_rate(struct device *dev, unsigned long freq)
return dev_pm_opp_set_opp(dev, opp);
}
-int iris_enable_power_domains(struct iris_core *core, struct device *pd_dev)
+int iris_enable_power_domain_and_clocks(struct iris_core *core, struct iris_power_domain *pd)
{
- int ret;
+ int ret, i;
ret = iris_opp_set_rate(core->dev, ULONG_MAX);
if (ret)
return ret;
- ret = pm_runtime_get_sync(pd_dev);
- if (ret < 0)
- return ret;
-
- return ret;
-}
-
-int iris_disable_power_domains(struct iris_core *core, struct device *pd_dev)
-{
- int ret;
+ for (i = 0; i < pd->pd_cnt; i++) {
+ ret = pm_runtime_resume_and_get(pd->dev[i]);
+ if (ret < 0)
+ goto error;
+ }
- ret = iris_opp_set_rate(core->dev, 0);
+ ret = clk_bulk_prepare_enable(pd->clk_cnt, pd->clocks);
if (ret)
- return ret;
-
- pm_runtime_put_sync(pd_dev);
+ goto error;
return 0;
-}
-static struct clk *iris_get_clk_by_type(struct iris_core *core, enum platform_clk_type clk_type)
-{
- const struct platform_clk_data *clk_tbl;
- u32 clk_cnt, i, j;
-
- clk_tbl = core->iris_platform_data->clk_tbl;
- clk_cnt = core->iris_platform_data->clk_tbl_size;
-
- for (i = 0; i < clk_cnt; i++) {
- if (clk_tbl[i].clk_type == clk_type) {
- for (j = 0; core->clock_tbl && j < core->clk_count; j++) {
- if (!strcmp(core->clock_tbl[j].id, clk_tbl[i].clk_name))
- return core->clock_tbl[j].clk;
- }
- }
- }
+error:
+ iris_opp_set_rate(core->dev, 0);
- return NULL;
+ while (--i >= 0)
+ pm_runtime_put_sync(pd->dev[i]);
+
+ return ret;
}
-int iris_prepare_enable_clock(struct iris_core *core, enum platform_clk_type clk_type)
+void iris_disable_power_domain_and_clocks(struct iris_core *core, struct iris_power_domain *pd)
{
- struct clk *clock;
+ int i;
- clock = iris_get_clk_by_type(core, clk_type);
- if (!clock)
- return -ENOENT;
+ clk_bulk_disable_unprepare(pd->clk_cnt, pd->clocks);
+ iris_opp_set_rate(core->dev, 0);
- return clk_prepare_enable(clock);
+ for (i = 0; i < pd->pd_cnt; i++)
+ pm_runtime_put_sync(pd->dev[i]);
}
-int iris_disable_unprepare_clock(struct iris_core *core, enum platform_clk_type clk_type)
+int iris_genpd_set_hwmode(struct iris_power_domain *pd, bool mode)
{
- struct clk *clock;
+ int i, ret;
- clock = iris_get_clk_by_type(core, clk_type);
- if (!clock)
- return -EINVAL;
-
- clk_disable_unprepare(clock);
+ for (i = 0; i < pd->pd_cnt; i++) {
+ ret = dev_pm_genpd_set_hwmode(pd->dev[i], mode);
+ if (ret)
+ goto error;
+ }
return 0;
+
+error:
+ while (--i >= 0)
+ dev_pm_genpd_set_hwmode(pd->dev[i], !mode);
+
+ return ret;
}
struct device *iris_create_cb_dev(struct iris_core *core, const char *name)
diff --git a/drivers/media/platform/qcom/iris/iris_resources.h b/drivers/media/platform/qcom/iris/iris_resources.h
index 2eef0676a146..36efa89f5d10 100644
--- a/drivers/media/platform/qcom/iris/iris_resources.h
+++ b/drivers/media/platform/qcom/iris/iris_resources.h
@@ -7,15 +7,15 @@
#define __IRIS_RESOURCES_H__
struct iris_core;
+struct iris_power_domain;
int iris_opp_set_rate(struct device *dev, unsigned long freq);
-int iris_enable_power_domains(struct iris_core *core, struct device *pd_dev);
-int iris_disable_power_domains(struct iris_core *core, struct device *pd_dev);
int iris_unset_icc_bw(struct iris_core *core);
int iris_set_icc_bw(struct iris_core *core, unsigned long icc_bw);
-int iris_disable_unprepare_clock(struct iris_core *core, enum platform_clk_type clk_type);
-int iris_prepare_enable_clock(struct iris_core *core, enum platform_clk_type clk_type);
struct device *iris_create_cb_dev(struct iris_core *core, const char *name);
struct device *iris_get_cb_dev(struct iris_inst *inst, enum iris_buffer_type buffer_type);
+int iris_enable_power_domain_and_clocks(struct iris_core *core, struct iris_power_domain *pd);
+void iris_disable_power_domain_and_clocks(struct iris_core *core, struct iris_power_domain *pd);
+int iris_genpd_set_hwmode(struct iris_power_domain *pd, bool mode);
#endif
diff --git a/drivers/media/platform/qcom/iris/iris_vpu3x.c b/drivers/media/platform/qcom/iris/iris_vpu3x.c
index 3dad47be78b5..7cda94601555 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu3x.c
+++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c
@@ -205,53 +205,20 @@ static int iris_vpu33_power_off_controller(struct iris_core *core)
val &= ~NOC_HALT;
writel(val, core->reg_base + AON_WRAPPER_MVP_NOC_CORE_CLK_CONTROL);
- iris_disable_unprepare_clock(core, IRIS_CTRL_CLK);
-
disable_power:
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_CTRL_POWER_DOMAIN]);
- iris_disable_unprepare_clock(core, IRIS_AXI_CLK);
+ iris_disable_power_domain_and_clocks(core, core->ctrl);
return 0;
}
static int iris_vpu35_power_on_hw(struct iris_core *core)
{
- int ret;
-
- ret = iris_enable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]);
- if (ret)
- return ret;
-
- ret = iris_prepare_enable_clock(core, IRIS_AXI_CLK);
- if (ret)
- goto err_disable_power;
-
- ret = iris_prepare_enable_clock(core, IRIS_HW_FREERUN_CLK);
- if (ret)
- goto err_disable_axi_clk;
-
- ret = iris_prepare_enable_clock(core, IRIS_HW_CLK);
- if (ret)
- goto err_disable_hw_free_clk;
-
- return 0;
-
-err_disable_hw_free_clk:
- iris_disable_unprepare_clock(core, IRIS_HW_FREERUN_CLK);
-err_disable_axi_clk:
- iris_disable_unprepare_clock(core, IRIS_AXI_CLK);
-err_disable_power:
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]);
-
- return ret;
+ return iris_enable_power_domain_and_clocks(core, core->vcodec);
}
static void iris_vpu35_power_off_hw(struct iris_core *core)
{
iris_vpu33_power_off_hardware(core);
-
- iris_disable_unprepare_clock(core, IRIS_HW_FREERUN_CLK);
- iris_disable_unprepare_clock(core, IRIS_AXI_CLK);
}
const struct vpu_ops iris_vpu3_ops = {
diff --git a/drivers/media/platform/qcom/iris/iris_vpu4x.c b/drivers/media/platform/qcom/iris/iris_vpu4x.c
index 02e100a4045f..caee9e4351db 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu4x.c
+++ b/drivers/media/platform/qcom/iris/iris_vpu4x.c
@@ -27,27 +27,24 @@ static int iris_vpu4x_genpd_set_hwmode(struct iris_core *core, bool hw_mode, u32
{
int ret;
- ret = dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], hw_mode);
+ ret = iris_genpd_set_hwmode(core->vcodec, hw_mode);
if (ret)
return ret;
if (!(efuse_value & DISABLE_VIDEO_VPP0_BIT)) {
- ret = dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs
- [IRIS_VPP0_HW_POWER_DOMAIN], hw_mode);
+ ret = iris_genpd_set_hwmode(core->vcodec_vpp0, hw_mode);
if (ret)
goto restore_hw_domain_mode;
}
if (!(efuse_value & DISABLE_VIDEO_VPP1_BIT)) {
- ret = dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs
- [IRIS_VPP1_HW_POWER_DOMAIN], hw_mode);
+ ret = iris_genpd_set_hwmode(core->vcodec_vpp1, hw_mode);
if (ret)
goto restore_vpp0_domain_mode;
}
if (!(efuse_value & DISABLE_VIDEO_APV_BIT)) {
- ret = dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs
- [IRIS_APV_HW_POWER_DOMAIN], hw_mode);
+ ret = iris_genpd_set_hwmode(core->apv, hw_mode);
if (ret)
goto restore_vpp1_domain_mode;
}
@@ -56,37 +53,19 @@ static int iris_vpu4x_genpd_set_hwmode(struct iris_core *core, bool hw_mode, u32
restore_vpp1_domain_mode:
if (!(efuse_value & DISABLE_VIDEO_VPP1_BIT))
- dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_VPP1_HW_POWER_DOMAIN],
- !hw_mode);
+ iris_genpd_set_hwmode(core->vcodec_vpp1, !hw_mode);
restore_vpp0_domain_mode:
if (!(efuse_value & DISABLE_VIDEO_VPP0_BIT))
- dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_VPP0_HW_POWER_DOMAIN],
- !hw_mode);
+ iris_genpd_set_hwmode(core->vcodec_vpp0, !hw_mode);
restore_hw_domain_mode:
- dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], !hw_mode);
+ iris_genpd_set_hwmode(core->vcodec, !hw_mode);
return ret;
}
static int iris_vpu4x_power_on_apv(struct iris_core *core)
{
- int ret;
-
- ret = iris_enable_power_domains(core,
- core->pmdomain_tbl->pd_devs[IRIS_APV_HW_POWER_DOMAIN]);
- if (ret)
- return ret;
-
- ret = iris_prepare_enable_clock(core, IRIS_APV_HW_CLK);
- if (ret)
- goto disable_apv_hw_power_domain;
-
- return 0;
-
-disable_apv_hw_power_domain:
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_APV_HW_POWER_DOMAIN]);
-
- return ret;
+ return iris_enable_power_domain_and_clocks(core, core->apv);
}
static void iris_vpu4x_power_off_apv(struct iris_core *core)
@@ -138,8 +117,7 @@ static void iris_vpu4x_power_off_apv(struct iris_core *core)
writel(0x0, core->reg_base + CPU_CS_APV_BRIDGE_SYNC_RESET);
disable_clocks_and_power:
- iris_disable_unprepare_clock(core, IRIS_APV_HW_CLK);
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_APV_HW_POWER_DOMAIN]);
+ iris_disable_power_domain_and_clocks(core, core->apv);
}
static void iris_vpu4x_ahb_sync_reset_apv(struct iris_core *core)
@@ -158,116 +136,43 @@ static void iris_vpu4x_ahb_sync_reset_hardware(struct iris_core *core)
writel(0x0, core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
}
-static int iris_vpu4x_enable_hardware_clocks(struct iris_core *core, u32 efuse_value)
-{
- int ret;
-
- ret = iris_prepare_enable_clock(core, IRIS_AXI_CLK);
- if (ret)
- return ret;
-
- ret = iris_prepare_enable_clock(core, IRIS_HW_FREERUN_CLK);
- if (ret)
- goto disable_axi_clock;
-
- ret = iris_prepare_enable_clock(core, IRIS_HW_CLK);
- if (ret)
- goto disable_hw_free_run_clock;
-
- ret = iris_prepare_enable_clock(core, IRIS_BSE_HW_CLK);
- if (ret)
- goto disable_hw_clock;
-
- if (!(efuse_value & DISABLE_VIDEO_VPP0_BIT)) {
- ret = iris_prepare_enable_clock(core, IRIS_VPP0_HW_CLK);
- if (ret)
- goto disable_bse_hw_clock;
- }
-
- if (!(efuse_value & DISABLE_VIDEO_VPP1_BIT)) {
- ret = iris_prepare_enable_clock(core, IRIS_VPP1_HW_CLK);
- if (ret)
- goto disable_vpp0_hw_clock;
- }
-
- return 0;
-
-disable_vpp0_hw_clock:
- if (!(efuse_value & DISABLE_VIDEO_VPP0_BIT))
- iris_disable_unprepare_clock(core, IRIS_VPP0_HW_CLK);
-disable_bse_hw_clock:
- iris_disable_unprepare_clock(core, IRIS_BSE_HW_CLK);
-disable_hw_clock:
- iris_disable_unprepare_clock(core, IRIS_HW_CLK);
-disable_hw_free_run_clock:
- iris_disable_unprepare_clock(core, IRIS_HW_FREERUN_CLK);
-disable_axi_clock:
- iris_disable_unprepare_clock(core, IRIS_AXI_CLK);
-
- return ret;
-}
-
-static void iris_vpu4x_disable_hardware_clocks(struct iris_core *core, u32 efuse_value)
-{
- if (!(efuse_value & DISABLE_VIDEO_VPP1_BIT))
- iris_disable_unprepare_clock(core, IRIS_VPP1_HW_CLK);
-
- if (!(efuse_value & DISABLE_VIDEO_VPP0_BIT))
- iris_disable_unprepare_clock(core, IRIS_VPP0_HW_CLK);
-
- iris_disable_unprepare_clock(core, IRIS_BSE_HW_CLK);
- iris_disable_unprepare_clock(core, IRIS_HW_CLK);
- iris_disable_unprepare_clock(core, IRIS_HW_FREERUN_CLK);
- iris_disable_unprepare_clock(core, IRIS_AXI_CLK);
-}
-
static int iris_vpu4x_power_on_hardware(struct iris_core *core)
{
u32 efuse_value = readl(core->reg_base + WRAPPER_EFUSE_MONITOR);
int ret;
- ret = iris_enable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]);
+ ret = iris_enable_power_domain_and_clocks(core, core->vcodec);
if (ret)
return ret;
if (!(efuse_value & DISABLE_VIDEO_VPP0_BIT)) {
- ret = iris_enable_power_domains(core, core->pmdomain_tbl->pd_devs
- [IRIS_VPP0_HW_POWER_DOMAIN]);
+ ret = iris_enable_power_domain_and_clocks(core, core->vcodec_vpp0);
if (ret)
goto disable_hw_power_domain;
}
if (!(efuse_value & DISABLE_VIDEO_VPP1_BIT)) {
- ret = iris_enable_power_domains(core, core->pmdomain_tbl->pd_devs
- [IRIS_VPP1_HW_POWER_DOMAIN]);
+ ret = iris_enable_power_domain_and_clocks(core, core->vcodec_vpp1);
if (ret)
goto disable_vpp0_power_domain;
}
- ret = iris_vpu4x_enable_hardware_clocks(core, efuse_value);
- if (ret)
- goto disable_vpp1_power_domain;
-
if (!(efuse_value & DISABLE_VIDEO_APV_BIT)) {
ret = iris_vpu4x_power_on_apv(core);
if (ret)
- goto disable_hw_clocks;
+ goto disable_vpp1_power_domain;
}
return 0;
-disable_hw_clocks:
- iris_vpu4x_disable_hardware_clocks(core, efuse_value);
disable_vpp1_power_domain:
if (!(efuse_value & DISABLE_VIDEO_VPP1_BIT))
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs
- [IRIS_VPP1_HW_POWER_DOMAIN]);
+ iris_disable_power_domain_and_clocks(core, core->vcodec_vpp1);
disable_vpp0_power_domain:
if (!(efuse_value & DISABLE_VIDEO_VPP0_BIT))
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs
- [IRIS_VPP0_HW_POWER_DOMAIN]);
+ iris_disable_power_domain_and_clocks(core, core->vcodec_vpp0);
disable_hw_power_domain:
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]);
+ iris_disable_power_domain_and_clocks(core, core->vcodec);
return ret;
}
@@ -335,17 +240,13 @@ static void iris_vpu4x_power_off_hardware(struct iris_core *core)
writel(0x0, core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
disable_clocks_and_power:
- iris_vpu4x_disable_hardware_clocks(core, efuse_value);
-
if (!(efuse_value & DISABLE_VIDEO_VPP1_BIT))
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs
- [IRIS_VPP1_HW_POWER_DOMAIN]);
+ iris_disable_power_domain_and_clocks(core, core->vcodec_vpp1);
if (!(efuse_value & DISABLE_VIDEO_VPP0_BIT))
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs
- [IRIS_VPP0_HW_POWER_DOMAIN]);
+ iris_disable_power_domain_and_clocks(core, core->vcodec_vpp0);
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]);
+ iris_disable_power_domain_and_clocks(core, core->vcodec);
}
static int iris_vpu4x_set_hwmode(struct iris_core *core)
diff --git a/drivers/media/platform/qcom/iris/iris_vpu_common.c b/drivers/media/platform/qcom/iris/iris_vpu_common.c
index ab41da1f47c8..e690c566c875 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu_common.c
+++ b/drivers/media/platform/qcom/iris/iris_vpu_common.c
@@ -212,21 +212,15 @@ int iris_vpu_power_off_controller(struct iris_core *core)
writel(0x0, core->reg_base + WRAPPER_TZ_CTL_AXI_CLOCK_CONFIG);
disable_power:
- iris_disable_unprepare_clock(core, IRIS_AHB_CLK);
- iris_disable_unprepare_clock(core, IRIS_CTRL_CLK);
- iris_disable_unprepare_clock(core, IRIS_AXI_CLK);
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_CTRL_POWER_DOMAIN]);
+ iris_disable_power_domain_and_clocks(core, core->ctrl);
return 0;
}
void iris_vpu_power_off_hw(struct iris_core *core)
{
- dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], false);
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]);
- iris_disable_unprepare_clock(core, IRIS_BSE_HW_CLK);
- iris_disable_unprepare_clock(core, IRIS_HW_AHB_CLK);
- iris_disable_unprepare_clock(core, IRIS_HW_CLK);
+ iris_genpd_set_hwmode(core->vcodec, false);
+ iris_disable_power_domain_and_clocks(core, core->vcodec);
}
void iris_vpu_power_off(struct iris_core *core)
@@ -245,7 +239,7 @@ int iris_vpu_power_on_controller(struct iris_core *core)
u32 rst_tbl_size = core->iris_platform_data->clk_rst_tbl_size;
int ret;
- ret = iris_enable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_CTRL_POWER_DOMAIN]);
+ ret = iris_enable_power_domain_and_clocks(core, core->ctrl);
if (ret)
return ret;
@@ -253,65 +247,22 @@ int iris_vpu_power_on_controller(struct iris_core *core)
if (ret)
goto err_disable_power;
- ret = iris_prepare_enable_clock(core, IRIS_AXI_CLK);
- if (ret)
- goto err_disable_power;
-
- ret = iris_prepare_enable_clock(core, IRIS_CTRL_CLK);
- if (ret)
- goto err_disable_axi_clock;
-
- ret = iris_prepare_enable_clock(core, IRIS_AHB_CLK);
- if (ret && ret != -ENOENT)
- goto err_disable_ctrl_clock;
-
return 0;
-err_disable_ctrl_clock:
- iris_disable_unprepare_clock(core, IRIS_CTRL_CLK);
-err_disable_axi_clock:
- iris_disable_unprepare_clock(core, IRIS_AXI_CLK);
err_disable_power:
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_CTRL_POWER_DOMAIN]);
+ iris_disable_power_domain_and_clocks(core, core->ctrl);
return ret;
}
int iris_vpu_power_on_hw(struct iris_core *core)
{
- int ret;
-
- ret = iris_enable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]);
- if (ret)
- return ret;
-
- ret = iris_prepare_enable_clock(core, IRIS_HW_CLK);
- if (ret)
- goto err_disable_power;
-
- ret = iris_prepare_enable_clock(core, IRIS_HW_AHB_CLK);
- if (ret && ret != -ENOENT)
- goto err_disable_hw_clock;
-
- ret = iris_prepare_enable_clock(core, IRIS_BSE_HW_CLK);
- if (ret && ret != -ENOENT)
- goto err_disable_hw_ahb_clock;
-
- return 0;
-
-err_disable_hw_ahb_clock:
- iris_disable_unprepare_clock(core, IRIS_HW_AHB_CLK);
-err_disable_hw_clock:
- iris_disable_unprepare_clock(core, IRIS_HW_CLK);
-err_disable_power:
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN]);
-
- return ret;
+ return iris_enable_power_domain_and_clocks(core, core->vcodec);
}
int iris_vpu_set_hwmode(struct iris_core *core)
{
- return dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], true);
+ return iris_genpd_set_hwmode(core->vcodec, true);
}
int iris_vpu_switch_to_hwmode(struct iris_core *core)
@@ -372,11 +323,7 @@ int iris_vpu35_vpu4x_power_off_controller(struct iris_core *core)
val, val == 0, 200, 2000);
disable_power:
- iris_disable_unprepare_clock(core, IRIS_CTRL_CLK);
- iris_disable_unprepare_clock(core, IRIS_CTRL_FREERUN_CLK);
- iris_disable_unprepare_clock(core, IRIS_AXI1_CLK);
-
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_CTRL_POWER_DOMAIN]);
+ iris_disable_power_domain_and_clocks(core, core->ctrl);
reset_control_bulk_reset(clk_rst_tbl_size, core->resets);
@@ -385,34 +332,7 @@ int iris_vpu35_vpu4x_power_off_controller(struct iris_core *core)
int iris_vpu35_vpu4x_power_on_controller(struct iris_core *core)
{
- int ret;
-
- ret = iris_enable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_CTRL_POWER_DOMAIN]);
- if (ret)
- return ret;
-
- ret = iris_prepare_enable_clock(core, IRIS_AXI1_CLK);
- if (ret)
- goto err_disable_power;
-
- ret = iris_prepare_enable_clock(core, IRIS_CTRL_FREERUN_CLK);
- if (ret)
- goto err_disable_axi1_clk;
-
- ret = iris_prepare_enable_clock(core, IRIS_CTRL_CLK);
- if (ret)
- goto err_disable_ctrl_free_clk;
-
- return 0;
-
-err_disable_ctrl_free_clk:
- iris_disable_unprepare_clock(core, IRIS_CTRL_FREERUN_CLK);
-err_disable_axi1_clk:
- iris_disable_unprepare_clock(core, IRIS_AXI1_CLK);
-err_disable_power:
- iris_disable_power_domains(core, core->pmdomain_tbl->pd_devs[IRIS_CTRL_POWER_DOMAIN]);
-
- return ret;
+ return iris_enable_power_domain_and_clocks(core, core->ctrl);
}
void iris_vpu35_vpu4x_program_bootup_registers(struct iris_core *core)
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* Re: [PATCH v9 07/14] media: iris: Replace enum-indexed clock and power domain tables with per-block structures
2026-07-15 14:10 ` [PATCH v9 07/14] media: iris: Replace enum-indexed clock and power domain tables with per-block structures Vishnu Reddy
@ 2026-07-15 14:39 ` sashiko-bot
0 siblings, 0 replies; 26+ messages in thread
From: sashiko-bot @ 2026-07-15 14:39 UTC (permalink / raw)
To: Vishnu Reddy; +Cc: devicetree, conor+dt, robh
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
New issues:
- [High] Bundling global device OPP rate adjustments into per-block helpers drops the global OPP rate to 0 on error paths, potentially crashing active hardware blocks.
- [Medium] Multi-core platforms will fail to power on/off secondary hardware cores due to implicit array-to-pointer decay.
- [Medium] Unconditional use of optional power domain structures in VPU4x hardware enable/disable paths leads to NULL pointer dereferences.
Pre-existing issues:
- [Critical] The `sys_error_handler` delayed work is not canceled during driver removal, leading to a Use-After-Free of the `core` structure.
--
--- Patch [7]: [PATCH v9 07/14] media: iris: Replace enum-indexed clock and power domain tables with per-block structures ---
Note: The format of this review is altered to provide a free-form summary
of the findings due to restrictions on quoting the original patch text.
Commit: 67736d0c8e0f502135f0c4a867f560515cee6311
Author: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Subject: media: iris: Replace enum-indexed clock and power domain tables...
This patch refactors the Iris driver to replace flat, enum-indexed arrays
with per-block data structures bundling power domains and clocks together.
It aims to simplify platform extension by operating directly on the block
instances during enable and disable paths.
[Severity: Medium]
In drivers/media/platform/qcom/iris/iris_vpu_common.c inside
iris_vpu_power_on_hw(), and in iris_vpu4x.c inside
iris_vpu4x_power_on_hardware(), the code passes the core->vcodec pointer
directly to iris_enable_power_domain_and_clocks(). Since core->vcodec is
allocated as an array based on plat->num_cores during initialization, does
passing it directly cause it to decay to a pointer to the first element?
If so, wouldn't this leave secondary hardware cores unpowered on multi-core
platforms?
[Severity: High]
Looking at iris_enable_power_domain_and_clocks() in iris_resources.c, the
error path calls iris_opp_set_rate(core->dev, 0). Because core->dev manages
the global OPP state for the entire Iris core, dropping the rate to 0 here
affects all blocks. If enabling a secondary domain like vcodec_vpp0 fails,
could this starve the already-enabled primary vcodec block of voltage while
its clocks are still running, potentially hanging or crashing the hardware?
[Severity: Medium]
In iris_vpu4x_power_on_hardware() in iris_vpu4x.c, the code checks the
hardware efuse to decide whether to enable vcodec_vpp0. It then passes
core->vcodec_vpp0 to the enable helper. If a platform omits the optional
vcodec_vpp0_data but the efuse still indicates it is present, the pointer
will be NULL. Since the helper immediately dereferences pd->pd_cnt without
any NULL checks, does this introduce a NULL pointer dereference?
[Severity: Critical]
This is a pre-existing issue, but looking at iris_remove() in iris_probe.c,
it seems the sys_error_handler delayed work is never canceled before the
driver is torn down. If driver unbind or module unload occurs right after a
fatal system error queues this work, the core structure will be freed by
devres upon returning. Could this result in a use-after-free when the
delayed work subsequently executes?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=7
^ permalink raw reply [flat|nested] 26+ messages in thread
* [PATCH v9 08/14] media: iris: Add power sequence for glymur
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
` (6 preceding siblings ...)
2026-07-15 14:10 ` [PATCH v9 07/14] media: iris: Replace enum-indexed clock and power domain tables with per-block structures Vishnu Reddy
@ 2026-07-15 14:10 ` Vishnu Reddy
2026-07-15 14:36 ` sashiko-bot
2026-07-15 14:10 ` [PATCH v9 09/14] media: iris: Handle CPU_CS_SCIACMDARG3 register write via program bootup registers hook Vishnu Reddy
` (5 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:10 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy
Glymur platform has two video codec cores: vcodec0 and vcodec1.
Both cores share a common clock source (video_cc_mvs0_clk_src) and the
same power rails. The clock dividers between the source and the branch
clocks are fixed. So when both cores are running, the source clock always
runs at the highest frequency requested by either core.
Since both cores share the same power rails, the power corner cannot be
voted independently. Scaling one core's power corner up or down would
directly affect the other, leading to under or over-voting.
For these reasons, both cores should voted the clock and power rail must
be based on the workload of both cores.
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
---
drivers/media/platform/qcom/iris/iris_vpu3x.c | 131 ++++++++++++++++++++-
drivers/media/platform/qcom/iris/iris_vpu_common.h | 1 +
.../platform/qcom/iris/iris_vpu_register_defines.h | 12 ++
3 files changed, 139 insertions(+), 5 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_vpu3x.c b/drivers/media/platform/qcom/iris/iris_vpu3x.c
index 7cda94601555..4894cba62677 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu3x.c
+++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c
@@ -17,14 +17,14 @@
#define NOC_HALT BIT(0)
#define AON_WRAPPER_SPARE (AON_BASE_OFFS + 0x28)
-static bool iris_vpu3x_hw_power_collapsed(struct iris_core *core)
+static bool iris_vpu3x_hw_power_collapsed(struct iris_core *core, u32 pwr_status_bit)
{
u32 value, pwr_status;
value = readl(core->reg_base + WRAPPER_CORE_POWER_STATUS);
- pwr_status = value & BIT(1);
+ pwr_status = value & pwr_status_bit;
- return pwr_status ? false : true;
+ return !pwr_status;
}
static void iris_vpu3_power_off_hardware(struct iris_core *core)
@@ -32,7 +32,7 @@ static void iris_vpu3_power_off_hardware(struct iris_core *core)
u32 reg_val = 0, value, i;
int ret;
- if (iris_vpu3x_hw_power_collapsed(core))
+ if (iris_vpu3x_hw_power_collapsed(core, VCODEC0_POWER_STATUS))
goto disable_power;
dev_err(core->dev, "video hw is power on\n");
@@ -78,7 +78,7 @@ static void iris_vpu33_power_off_hardware(struct iris_core *core)
u32 count = 0;
int ret;
- if (iris_vpu3x_hw_power_collapsed(core))
+ if (iris_vpu3x_hw_power_collapsed(core, VCODEC0_POWER_STATUS))
goto disable_power;
dev_err(core->dev, "video hw is power on\n");
@@ -221,6 +221,118 @@ static void iris_vpu35_power_off_hw(struct iris_core *core)
iris_vpu33_power_off_hardware(core);
}
+static void iris_vpu36_power_off_vcodec(struct iris_core *core, u32 core_id)
+{
+ u32 bridge_hw_reset[] = {CORE_BRIDGE_HW_RESET_DISABLE, VCODEC1_BRIDGE_HW_RESET_DISABLE};
+ u32 lpi_status_active[] = {NOC_LPI_STATUS_ACTIVE, NOC_LPI_VCODEC1_STATUS_ACTIVE};
+ u32 power_down_prep[] = {REQ_POWER_DOWN_PREP, REQ_VCODEC1_POWER_DOWN_PREP};
+ u32 lpi_status_done[] = {NOC_LPI_STATUS_DONE, NOC_LPI_VCODEC1_STATUS_DONE};
+ u32 lpi_status_deny[] = {NOC_LPI_STATUS_DENY, NOC_LPI_VCODEC1_STATUS_DENY};
+ u32 bridge_sw_reset[] = {CORE_BRIDGE_SW_RESET, VCODEC1_BRIDGE_SW_RESET};
+ u32 idle_status[] = {VCODEC_SS_IDLE_STATUSN, VCODEC1_SS_IDLE_STATUSN};
+ u32 power_status[] = {VCODEC0_POWER_STATUS, VCODEC1_POWER_STATUS};
+ bool handshake_done, handshake_busy;
+ u32 value, i, count = 0;
+ int ret;
+
+ if (iris_vpu3x_hw_power_collapsed(core, power_status[core_id]))
+ goto disable_power;
+
+ value = readl(core->reg_base + WRAPPER_CORE_CLOCK_CONFIG);
+ if (value)
+ writel(CORE_CLK_RUN, core->reg_base + WRAPPER_CORE_CLOCK_CONFIG);
+
+ for (i = 0; i < core->iris_platform_data->num_vpp_pipe; i++) {
+ ret = readl_poll_timeout(core->reg_base + idle_status[core_id] + 4 * i,
+ value, value & DMA_NOC_IDLE, 2000, 20000);
+ if (ret)
+ goto disable_power;
+ }
+
+ do {
+ writel(power_down_prep[core_id], core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL);
+ usleep_range(15, 20);
+ value = readl(core->reg_base + AON_WRAPPER_MVP_NOC_LPI_STATUS);
+
+ handshake_done = value & lpi_status_done[core_id];
+ handshake_busy = value & (lpi_status_deny[core_id] | lpi_status_active[core_id]);
+
+ if (handshake_done || !handshake_busy)
+ break;
+
+ writel(0, core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL);
+ usleep_range(15, 20);
+ } while (++count < 1000);
+
+ if (!handshake_done && handshake_busy)
+ goto disable_power;
+
+ ret = readl_poll_timeout(core->reg_base + AON_WRAPPER_MVP_NOC_LPI_STATUS, value,
+ value & lpi_status_done[core_id], 200, 2000);
+ if (ret)
+ goto disable_power;
+
+ writel(0, core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL);
+
+ writel(bridge_sw_reset[core_id] | bridge_hw_reset[core_id],
+ core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
+ writel(bridge_hw_reset[core_id], core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
+ writel(0x0, core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
+
+disable_power:
+ iris_genpd_set_hwmode(&core->vcodec[core_id], false);
+ iris_disable_power_domain_and_clocks(core, &core->vcodec[core_id]);
+}
+
+static void iris_vpu36_power_off_hw(struct iris_core *core)
+{
+ u32 num_cores = core->iris_platform_data->num_cores;
+ int i;
+
+ for (i = 0; i < num_cores; i++)
+ iris_vpu36_power_off_vcodec(core, i);
+}
+
+static int iris_vpu36_power_on_hw(struct iris_core *core)
+{
+ u32 num_cores = core->iris_platform_data->num_cores;
+ int i, ret;
+
+ for (i = 0; i < num_cores; i++) {
+ ret = iris_enable_power_domain_and_clocks(core, &core->vcodec[i]);
+ if (ret)
+ goto error;
+ }
+
+ return 0;
+
+error:
+ while (--i >= 0)
+ iris_vpu36_power_off_vcodec(core, i);
+
+ return ret;
+}
+
+static int iris_vpu36_set_hwmode(struct iris_core *core)
+{
+ u32 num_cores = core->iris_platform_data->num_cores;
+ int i, ret;
+
+ for (i = 0; i < num_cores; i++) {
+ ret = iris_genpd_set_hwmode(&core->vcodec[i], true);
+ if (ret)
+ goto error;
+ }
+
+ return 0;
+
+error:
+ while (--i >= 0)
+ iris_genpd_set_hwmode(&core->vcodec[i], false);
+
+ return ret;
+}
+
const struct vpu_ops iris_vpu3_ops = {
.power_off_hw = iris_vpu3_power_off_hardware,
.power_on_hw = iris_vpu_power_on_hw,
@@ -248,3 +360,12 @@ const struct vpu_ops iris_vpu35_ops = {
.calc_freq = iris_vpu3x_vpu4x_calculate_frequency,
.set_hwmode = iris_vpu_set_hwmode,
};
+
+const struct vpu_ops iris_vpu36_ops = {
+ .power_off_hw = iris_vpu36_power_off_hw,
+ .power_on_hw = iris_vpu36_power_on_hw,
+ .power_off_controller = iris_vpu35_vpu4x_power_off_controller,
+ .power_on_controller = iris_vpu35_vpu4x_power_on_controller,
+ .calc_freq = iris_vpu3x_vpu4x_calculate_frequency,
+ .set_hwmode = iris_vpu36_set_hwmode,
+};
diff --git a/drivers/media/platform/qcom/iris/iris_vpu_common.h b/drivers/media/platform/qcom/iris/iris_vpu_common.h
index a8df9af0d3da..34ecb18aefb3 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu_common.h
+++ b/drivers/media/platform/qcom/iris/iris_vpu_common.h
@@ -12,6 +12,7 @@ extern const struct vpu_ops iris_vpu2_ops;
extern const struct vpu_ops iris_vpu3_ops;
extern const struct vpu_ops iris_vpu33_ops;
extern const struct vpu_ops iris_vpu35_ops;
+extern const struct vpu_ops iris_vpu36_ops;
extern const struct vpu_ops iris_vpu4x_ops;
struct vpu_ops {
diff --git a/drivers/media/platform/qcom/iris/iris_vpu_register_defines.h b/drivers/media/platform/qcom/iris/iris_vpu_register_defines.h
index 72168b9ffa73..c44c85eac3b5 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu_register_defines.h
+++ b/drivers/media/platform/qcom/iris/iris_vpu_register_defines.h
@@ -7,6 +7,7 @@
#define __IRIS_VPU_REGISTER_DEFINES_H__
#define VCODEC_BASE_OFFS 0x00000000
+#define VCODEC1_BASE_OFFS 0x00040000
#define AON_MVP_NOC_RESET 0x0001F000
#define CPU_BASE_OFFS 0x000A0000
#define WRAPPER_BASE_OFFS 0x000B0000
@@ -14,6 +15,8 @@
#define AON_BASE_OFFS 0x000E0000
#define VCODEC_SS_IDLE_STATUSN (VCODEC_BASE_OFFS + 0x70)
+#define VCODEC1_SS_IDLE_STATUSN (VCODEC1_BASE_OFFS + 0x70)
+#define DMA_NOC_IDLE BIT(22)
#define AON_WRAPPER_MVP_NOC_RESET_REQ (AON_MVP_NOC_RESET + 0x000)
#define VIDEO_NOC_RESET_REQ (BIT(0) | BIT(1))
@@ -35,6 +38,8 @@
#define CPU_CS_AHB_BRIDGE_SYNC_RESET (CPU_CS_BASE_OFFS + 0x160)
#define CORE_BRIDGE_SW_RESET BIT(0)
#define CORE_BRIDGE_HW_RESET_DISABLE BIT(1)
+#define VCODEC1_BRIDGE_SW_RESET BIT(2)
+#define VCODEC1_BRIDGE_HW_RESET_DISABLE BIT(3)
#define CPU_CS_X2RPMH (CPU_CS_BASE_OFFS + 0x168)
#define MSK_SIGNAL_FROM_TENSILICA BIT(0)
@@ -52,14 +57,21 @@
#define WRAPPER_DEBUG_BRIDGE_LPI_STATUS (WRAPPER_BASE_OFFS + 0x58)
#define WRAPPER_IRIS_CPU_NOC_LPI_CONTROL (WRAPPER_BASE_OFFS + 0x5C)
#define REQ_POWER_DOWN_PREP BIT(0)
+#define REQ_VCODEC1_POWER_DOWN_PREP BIT(1)
#define WRAPPER_IRIS_CPU_NOC_LPI_STATUS (WRAPPER_BASE_OFFS + 0x60)
#define NOC_LPI_STATUS_DONE BIT(0) /* Indicates the NOC handshake is complete */
#define NOC_LPI_STATUS_DENY BIT(1) /* Indicates the NOC handshake is denied */
#define NOC_LPI_STATUS_ACTIVE BIT(2) /* Indicates the NOC is active */
+#define NOC_LPI_VCODEC1_STATUS_DONE BIT(8)
+#define NOC_LPI_VCODEC1_STATUS_DENY BIT(9)
+#define NOC_LPI_VCODEC1_STATUS_ACTIVE BIT(10)
#define WRAPPER_IRIS_VCODEC_VPU_WRAPPER_SPARE_0 (WRAPPER_BASE_OFFS + 0x78)
#define WRAPPER_CORE_POWER_STATUS (WRAPPER_BASE_OFFS + 0x80)
+#define VCODEC0_POWER_STATUS BIT(1)
+#define VCODEC1_POWER_STATUS BIT(4)
+
#define WRAPPER_CORE_CLOCK_CONFIG (WRAPPER_BASE_OFFS + 0x88)
#define CORE_CLK_RUN 0x0
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* Re: [PATCH v9 08/14] media: iris: Add power sequence for glymur
2026-07-15 14:10 ` [PATCH v9 08/14] media: iris: Add power sequence for glymur Vishnu Reddy
@ 2026-07-15 14:36 ` sashiko-bot
0 siblings, 0 replies; 26+ messages in thread
From: sashiko-bot @ 2026-07-15 14:36 UTC (permalink / raw)
To: Vishnu Reddy; +Cc: robh, conor+dt, devicetree
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] If the NOC LPI handshake times out during readl_poll_timeout, the PREP bit is left asserted in the AON register, permanently hanging the NOC on the next boot.
--
--- Patch [8]: [PATCH v9 08/14] media: iris: Add power sequence for glymur ---
commit d6ece601b7cdb53f3a84fa94a79400eb75a5853d
Author: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
media: iris: Add power sequence for glymur
This commit introduces power sequencing for the Glymur platform, which has
two video codec cores. It ensures that clock and power rail voting is
coordinated since both cores share the same power rails and clock source.
> diff --git a/drivers/media/platform/qcom/iris/iris_vpu3x.c b/drivers/media/platform/qcom/iris/iris_vpu3x.c
> --- a/drivers/media/platform/qcom/iris/iris_vpu3x.c
> +++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c
[ ... ]
> +static void iris_vpu36_power_off_vcodec(struct iris_core *core, u32 core_id)
> +{
[ ... ]
> + do {
> + writel(power_down_prep[core_id], core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL);
> + usleep_range(15, 20);
> + value = readl(core->reg_base + AON_WRAPPER_MVP_NOC_LPI_STATUS);
> +
> + handshake_done = value & lpi_status_done[core_id];
> + handshake_busy = value & (lpi_status_deny[core_id] | lpi_status_active[core_id]);
> +
> + if (handshake_done || !handshake_busy)
> + break;
> +
> + writel(0, core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL);
> + usleep_range(15, 20);
> + } while (++count < 1000);
> +
> + if (!handshake_done && handshake_busy)
> + goto disable_power;
> +
> + ret = readl_poll_timeout(core->reg_base + AON_WRAPPER_MVP_NOC_LPI_STATUS, value,
> + value & lpi_status_done[core_id], 200, 2000);
> + if (ret)
> + goto disable_power;
[Severity: High]
If this readl_poll_timeout() fails and returns an error, the code jumps
directly to disable_power, skipping the zeroing of the control register below.
Since the AON_WRAPPER_MVP_NOC_LPI_CONTROL register is in the Always-On (AON)
domain, won't this leave the power_down_prep bit asserted across power cycles
and permanently hang the NOC on the next boot?
Should writel(0, core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL) be called
before jumping to disable_power on timeout?
> +
> + writel(0, core->reg_base + AON_WRAPPER_MVP_NOC_LPI_CONTROL);
> +
> + writel(bridge_sw_reset[core_id] | bridge_hw_reset[core_id],
> + core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
> + writel(bridge_hw_reset[core_id], core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
> + writel(0x0, core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
> +
> +disable_power:
> + iris_genpd_set_hwmode(&core->vcodec[core_id], false);
> + iris_disable_power_domain_and_clocks(core, &core->vcodec[core_id]);
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=8
^ permalink raw reply [flat|nested] 26+ messages in thread
* [PATCH v9 09/14] media: iris: Handle CPU_CS_SCIACMDARG3 register write via program bootup registers hook
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
` (7 preceding siblings ...)
2026-07-15 14:10 ` [PATCH v9 08/14] media: iris: Add power sequence for glymur Vishnu Reddy
@ 2026-07-15 14:10 ` Vishnu Reddy
2026-07-15 14:10 ` [PATCH v9 10/14] media: iris: Add support to select core for dual core platforms Vishnu Reddy
` (4 subsequent siblings)
13 siblings, 0 replies; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:10 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy
On the Glymur platform, the firmware reads CPU_CS_SCIACMDARG3 during boot
to determine the VM count and increments it by 1. Writing the default 0x1
causes the firmware to treat the VM count as 2. To avoid that write 0x0 to
CPU_CS_SCIACMDARG3 as a Glymur platform specific.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
---
drivers/media/platform/qcom/iris/iris_vpu3x.c | 6 ++++++
drivers/media/platform/qcom/iris/iris_vpu_common.c | 4 ++--
drivers/media/platform/qcom/iris/iris_vpu_register_defines.h | 1 +
3 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_vpu3x.c b/drivers/media/platform/qcom/iris/iris_vpu3x.c
index 4894cba62677..7d5007abaded 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu3x.c
+++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c
@@ -333,6 +333,11 @@ static int iris_vpu36_set_hwmode(struct iris_core *core)
return ret;
}
+static void iris_vpu36_program_bootup_registers(struct iris_core *core)
+{
+ writel(0x0, core->reg_base + CPU_CS_SCIACMDARG3);
+}
+
const struct vpu_ops iris_vpu3_ops = {
.power_off_hw = iris_vpu3_power_off_hardware,
.power_on_hw = iris_vpu_power_on_hw,
@@ -366,6 +371,7 @@ const struct vpu_ops iris_vpu36_ops = {
.power_on_hw = iris_vpu36_power_on_hw,
.power_off_controller = iris_vpu35_vpu4x_power_off_controller,
.power_on_controller = iris_vpu35_vpu4x_power_on_controller,
+ .program_bootup_registers = iris_vpu36_program_bootup_registers,
.calc_freq = iris_vpu3x_vpu4x_calculate_frequency,
.set_hwmode = iris_vpu36_set_hwmode,
};
diff --git a/drivers/media/platform/qcom/iris/iris_vpu_common.c b/drivers/media/platform/qcom/iris/iris_vpu_common.c
index e690c566c875..72eb8f6240b7 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu_common.c
+++ b/drivers/media/platform/qcom/iris/iris_vpu_common.c
@@ -26,7 +26,6 @@
#define QTBL_ENABLE BIT(0)
#define QTBL_ADDR (CPU_CS_BASE_OFFS + 0x54)
-#define CPU_CS_SCIACMDARG3 (CPU_CS_BASE_OFFS + 0x58)
#define SFR_ADDR (CPU_CS_BASE_OFFS + 0x5C)
#define UC_REGION_ADDR (CPU_CS_BASE_OFFS + 0x64)
#define UC_REGION_SIZE (CPU_CS_BASE_OFFS + 0x68)
@@ -67,6 +66,8 @@ static void iris_vpu_setup_ucregion_memory_map(struct iris_core *core)
writel(value, core->reg_base + SFR_ADDR);
}
+ writel(0x1, core->reg_base + CPU_CS_SCIACMDARG3);
+
if (vpu_ops->program_bootup_registers)
vpu_ops->program_bootup_registers(core);
}
@@ -78,7 +79,6 @@ int iris_vpu_boot_firmware(struct iris_core *core)
iris_vpu_setup_ucregion_memory_map(core);
writel(ctrl_init, core->reg_base + CTRL_INIT);
- writel(0x1, core->reg_base + CPU_CS_SCIACMDARG3);
while (!ctrl_status && count < max_tries) {
ctrl_status = readl(core->reg_base + CTRL_STATUS);
diff --git a/drivers/media/platform/qcom/iris/iris_vpu_register_defines.h b/drivers/media/platform/qcom/iris/iris_vpu_register_defines.h
index c44c85eac3b5..3782454b7d06 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu_register_defines.h
+++ b/drivers/media/platform/qcom/iris/iris_vpu_register_defines.h
@@ -29,6 +29,7 @@
#define CPU_CS_A2HSOFTINTCLR (CPU_CS_BASE_OFFS + 0x1C)
#define CLEAR_XTENSA2HOST_INTR BIT(0)
+#define CPU_CS_SCIACMDARG3 (CPU_CS_BASE_OFFS + 0x58)
#define CPU_CS_H2XSOFTINTEN (CPU_CS_BASE_OFFS + 0x148)
#define HOST2XTENSA_INTR_ENABLE BIT(0)
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* [PATCH v9 10/14] media: iris: Add support to select core for dual core platforms
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
` (8 preceding siblings ...)
2026-07-15 14:10 ` [PATCH v9 09/14] media: iris: Handle CPU_CS_SCIACMDARG3 register write via program bootup registers hook Vishnu Reddy
@ 2026-07-15 14:10 ` Vishnu Reddy
2026-07-15 14:42 ` sashiko-bot
2026-07-15 14:10 ` [PATCH v9 11/14] media: iris: Add hooks for pixel and non-pixel context banks Vishnu Reddy
` (3 subsequent siblings)
13 siblings, 1 reply; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:10 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy
On platforms with two video codec cores, select the hardware core for
a new session based on the current Macroblocks Per Frame (MBPF) and
Macroblocks Per Second (MBPS) load on each core. The selected core is
communicated to the firmware via the HFI_PROP_CORE_ID property at
stream-on time.
Since both cores share the same clock source, the required clock
frequency is the maximum of the aggregated frequencies across both
cores.
The total session count limit is scaled by the number of cores, since
each core independently supports sessions up to its own limit.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
---
drivers/media/platform/qcom/iris/iris_common.c | 10 ++++
drivers/media/platform/qcom/iris/iris_common.h | 1 +
drivers/media/platform/qcom/iris/iris_core.h | 5 ++
drivers/media/platform/qcom/iris/iris_hfi_common.h | 1 +
.../platform/qcom/iris/iris_hfi_gen2_command.c | 19 +++++++
.../platform/qcom/iris/iris_hfi_gen2_defines.h | 1 +
drivers/media/platform/qcom/iris/iris_instance.h | 2 +
drivers/media/platform/qcom/iris/iris_power.c | 20 +++++--
drivers/media/platform/qcom/iris/iris_utils.c | 58 +++++++++++++-------
drivers/media/platform/qcom/iris/iris_utils.h | 3 +-
drivers/media/platform/qcom/iris/iris_vb2.c | 4 ++
drivers/media/platform/qcom/iris/iris_vidc.c | 6 ++-
drivers/media/platform/qcom/iris/iris_vpu3x.c | 63 ++++++++++++++++++++++
drivers/media/platform/qcom/iris/iris_vpu_common.h | 2 +
14 files changed, 171 insertions(+), 24 deletions(-)
diff --git a/drivers/media/platform/qcom/iris/iris_common.c b/drivers/media/platform/qcom/iris/iris_common.c
index 25836561bcf3..abea6807a59e 100644
--- a/drivers/media/platform/qcom/iris/iris_common.c
+++ b/drivers/media/platform/qcom/iris/iris_common.c
@@ -46,6 +46,16 @@ void iris_set_ts_metadata(struct iris_inst *inst, struct vb2_v4l2_buffer *vbuf)
inst->metadata_idx++;
}
+int iris_set_core_id(struct iris_inst *inst)
+{
+ const struct iris_hfi_session_ops *hfi_ops = inst->hfi_session_ops;
+
+ if (!inst->core_id)
+ return 0;
+
+ return hfi_ops->session_set_core_id(inst, inst->core_id);
+}
+
int iris_process_streamon_input(struct iris_inst *inst)
{
const struct iris_hfi_session_ops *hfi_ops = inst->hfi_session_ops;
diff --git a/drivers/media/platform/qcom/iris/iris_common.h b/drivers/media/platform/qcom/iris/iris_common.h
index b2a27b781c9a..34e32c60f768 100644
--- a/drivers/media/platform/qcom/iris/iris_common.h
+++ b/drivers/media/platform/qcom/iris/iris_common.h
@@ -11,6 +11,7 @@ struct iris_buffer;
int iris_vb2_buffer_to_driver(struct vb2_buffer *vb2, struct iris_buffer *buf);
void iris_set_ts_metadata(struct iris_inst *inst, struct vb2_v4l2_buffer *vbuf);
+int iris_set_core_id(struct iris_inst *inst);
int iris_process_streamon_input(struct iris_inst *inst);
int iris_process_streamon_output(struct iris_inst *inst);
int iris_session_streamoff(struct iris_inst *inst, u32 plane);
diff --git a/drivers/media/platform/qcom/iris/iris_core.h b/drivers/media/platform/qcom/iris/iris_core.h
index f528f53f20fc..cf75e53524b0 100644
--- a/drivers/media/platform/qcom/iris/iris_core.h
+++ b/drivers/media/platform/qcom/iris/iris_core.h
@@ -37,6 +37,11 @@ enum domain_type {
DECODER = BIT(1),
};
+enum iris_vcodec_core_id {
+ IRIS_VCODEC0 = 1,
+ IRIS_VCODEC1,
+};
+
struct qcom_ubwc_cfg_data;
/**
diff --git a/drivers/media/platform/qcom/iris/iris_hfi_common.h b/drivers/media/platform/qcom/iris/iris_hfi_common.h
index a27447eb2519..47786529998d 100644
--- a/drivers/media/platform/qcom/iris/iris_hfi_common.h
+++ b/drivers/media/platform/qcom/iris/iris_hfi_common.h
@@ -131,6 +131,7 @@ struct iris_hfi_session_ops {
int (*session_drain)(struct iris_inst *inst, u32 plane);
int (*session_resume_drain)(struct iris_inst *inst, u32 plane);
int (*session_close)(struct iris_inst *inst);
+ int (*session_set_core_id)(struct iris_inst *inst, u32 core_id);
};
struct hfi_subscription_params {
diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c b/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
index ca2954f8bd3a..e73743a391e0 100644
--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
+++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_command.c
@@ -1360,6 +1360,24 @@ static int iris_hfi_gen2_session_release_buffer(struct iris_inst *inst, struct i
inst_hfi_gen2->packet->size);
}
+static int iris_hfi_gen2_set_core_id(struct iris_inst *inst, u32 core_id)
+{
+ struct iris_inst_hfi_gen2 *inst_hfi_gen2 = to_iris_inst_hfi_gen2(inst);
+ u32 payload = core_id;
+
+ iris_hfi_gen2_packet_session_command(inst,
+ HFI_PROP_CORE_ID,
+ HFI_HOST_FLAGS_NONE,
+ HFI_PORT_NONE,
+ inst->session_id,
+ HFI_PAYLOAD_U32,
+ &payload,
+ sizeof(u32));
+
+ return iris_hfi_queue_cmd_write(inst->core, inst_hfi_gen2->packet,
+ inst_hfi_gen2->packet->size);
+}
+
static const struct iris_hfi_session_ops iris_hfi_gen2_session_ops = {
.session_open = iris_hfi_gen2_session_open,
.session_set_config_params = iris_hfi_gen2_session_set_config_params,
@@ -1373,6 +1391,7 @@ static const struct iris_hfi_session_ops iris_hfi_gen2_session_ops = {
.session_drain = iris_hfi_gen2_session_drain,
.session_resume_drain = iris_hfi_gen2_session_resume_drain,
.session_close = iris_hfi_gen2_session_close,
+ .session_set_core_id = iris_hfi_gen2_set_core_id,
};
static struct iris_inst *iris_hfi_gen2_get_instance(void)
diff --git a/drivers/media/platform/qcom/iris/iris_hfi_gen2_defines.h b/drivers/media/platform/qcom/iris/iris_hfi_gen2_defines.h
index 776b21cd11b2..2e374c2005ef 100644
--- a/drivers/media/platform/qcom/iris/iris_hfi_gen2_defines.h
+++ b/drivers/media/platform/qcom/iris/iris_hfi_gen2_defines.h
@@ -56,6 +56,7 @@
#define HFI_PROP_BUFFER_HOST_MAX_COUNT 0x03000123
#define HFI_PROP_BUFFER_FW_MIN_OUTPUT_COUNT 0x03000124
#define HFI_PROP_PIC_ORDER_CNT_TYPE 0x03000128
+#define HFI_PROP_CORE_ID 0x030001a9
enum hfi_rate_control {
HFI_RC_VBR_CFR = 0x00000000,
diff --git a/drivers/media/platform/qcom/iris/iris_instance.h b/drivers/media/platform/qcom/iris/iris_instance.h
index a770331d1675..585aa7c51fb0 100644
--- a/drivers/media/platform/qcom/iris/iris_instance.h
+++ b/drivers/media/platform/qcom/iris/iris_instance.h
@@ -36,6 +36,7 @@ enum iris_fmt_type_cap {
*
* @list: used for attach an instance to the core
* @core: pointer to core structure
+ * @core_id: specifies the hardware core on which the session runs
* @session_id: id of current video session
* @hfi_session_ops: iris HFI session ops
* @ctx_q_lock: lock to serialize queues related ioctls
@@ -83,6 +84,7 @@ enum iris_fmt_type_cap {
struct iris_inst {
struct list_head list;
struct iris_core *core;
+ u32 core_id;
u32 session_id;
const struct iris_hfi_session_ops *hfi_session_ops;
struct mutex ctx_q_lock;/* lock to serialize queues related ioctls */
diff --git a/drivers/media/platform/qcom/iris/iris_power.c b/drivers/media/platform/qcom/iris/iris_power.c
index 91aa21d4070e..a875647b3162 100644
--- a/drivers/media/platform/qcom/iris/iris_power.c
+++ b/drivers/media/platform/qcom/iris/iris_power.c
@@ -75,14 +75,12 @@ static int iris_vote_interconnects(struct iris_inst *inst)
return iris_set_interconnects(inst);
}
-static int iris_set_clocks(struct iris_inst *inst)
+static u64 iris_get_required_freq(struct iris_inst *inst)
{
struct iris_core *core = inst->core;
struct iris_inst *instance;
u64 freq = 0;
- int ret;
- mutex_lock(&core->lock);
list_for_each_entry(instance, &core->instances, list) {
if (!instance->max_input_data_size)
continue;
@@ -90,6 +88,22 @@ static int iris_set_clocks(struct iris_inst *inst)
freq += instance->power.min_freq;
}
+ return freq;
+}
+
+static int iris_set_clocks(struct iris_inst *inst)
+{
+ const struct vpu_ops *vpu_ops = inst->core->iris_platform_data->vpu_ops;
+ struct iris_core *core = inst->core;
+ u64 freq;
+ int ret;
+
+ mutex_lock(&core->lock);
+ if (vpu_ops->get_required_freq)
+ freq = vpu_ops->get_required_freq(inst);
+ else
+ freq = iris_get_required_freq(inst);
+
core->power.clk_freq = freq;
ret = iris_opp_set_rate(core->dev, freq);
mutex_unlock(&core->lock);
diff --git a/drivers/media/platform/qcom/iris/iris_utils.c b/drivers/media/platform/qcom/iris/iris_utils.c
index ba5c8dc1280c..4608e3f28832 100644
--- a/drivers/media/platform/qcom/iris/iris_utils.c
+++ b/drivers/media/platform/qcom/iris/iris_utils.c
@@ -7,6 +7,7 @@
#include <media/v4l2-mem2mem.h>
#include "iris_instance.h"
+#include "iris_vpu_common.h"
#include "iris_utils.h"
bool iris_res_is_less_than(u32 width, u32 height,
@@ -23,7 +24,7 @@ bool iris_res_is_less_than(u32 width, u32 height,
return false;
}
-int iris_get_mbpf(struct iris_inst *inst)
+u32 iris_get_mbpf(struct iris_inst *inst)
{
struct v4l2_format *inp_f = inst->fmt_src;
u32 height = max(inp_f->fmt.pix_mp.height, inst->crop.height);
@@ -32,6 +33,13 @@ int iris_get_mbpf(struct iris_inst *inst)
return NUM_MBS_PER_FRAME(height, width);
}
+u32 iris_get_mbps(struct iris_inst *inst)
+{
+ u32 fps = max(inst->frame_rate, inst->operating_rate);
+
+ return iris_get_mbpf(inst) * fps;
+}
+
bool iris_split_mode_enabled(struct iris_inst *inst)
{
return inst->fmt_dst->fmt.pix_mp.pixelformat == V4L2_PIX_FMT_NV12 ||
@@ -101,40 +109,52 @@ struct iris_inst *iris_get_instance(struct iris_core *core, u32 session_id)
return NULL;
}
-int iris_check_core_mbpf(struct iris_inst *inst)
+static int iris_check_core_load(struct iris_inst *inst, bool mbpf)
{
- struct iris_core *core = inst->core;
+ const struct iris_platform_data *platform_data = inst->core->iris_platform_data;
+ u32 max_load = mbpf ? platform_data->max_core_mbpf : platform_data->max_core_mbps;
struct iris_inst *instance;
- u32 total_mbpf = 0;
+ u32 total_load = 0;
- mutex_lock(&core->lock);
- list_for_each_entry(instance, &core->instances, list)
- total_mbpf += iris_get_mbpf(instance);
- mutex_unlock(&core->lock);
+ list_for_each_entry(instance, &inst->core->instances, list)
+ total_load += mbpf ? iris_get_mbpf(instance) : iris_get_mbps(instance);
- if (total_mbpf > core->iris_platform_data->max_core_mbpf)
+ if (total_load > max_load)
return -ENOMEM;
return 0;
}
-int iris_check_core_mbps(struct iris_inst *inst)
+int iris_check_core_mbpf(struct iris_inst *inst)
{
+ const struct vpu_ops *vpu_ops = inst->core->iris_platform_data->vpu_ops;
struct iris_core *core = inst->core;
- struct iris_inst *instance;
- u32 total_mbps = 0, fps = 0;
+ int ret;
mutex_lock(&core->lock);
- list_for_each_entry(instance, &core->instances, list) {
- fps = max(instance->frame_rate, instance->operating_rate);
- total_mbps += iris_get_mbpf(instance) * fps;
- }
+ if (vpu_ops->check_core_load)
+ ret = vpu_ops->check_core_load(inst, true);
+ else
+ ret = iris_check_core_load(inst, true);
mutex_unlock(&core->lock);
- if (total_mbps > core->iris_platform_data->max_core_mbps)
- return -ENOMEM;
+ return ret;
+}
- return 0;
+int iris_check_core_mbps(struct iris_inst *inst)
+{
+ const struct vpu_ops *vpu_ops = inst->core->iris_platform_data->vpu_ops;
+ struct iris_core *core = inst->core;
+ int ret;
+
+ mutex_lock(&core->lock);
+ if (vpu_ops->check_core_load)
+ ret = vpu_ops->check_core_load(inst, false);
+ else
+ ret = iris_check_core_load(inst, false);
+ mutex_unlock(&core->lock);
+
+ return ret;
}
bool is_rotation_90_or_270(struct iris_inst *inst)
diff --git a/drivers/media/platform/qcom/iris/iris_utils.h b/drivers/media/platform/qcom/iris/iris_utils.h
index 228a5f963812..c36ac494f461 100644
--- a/drivers/media/platform/qcom/iris/iris_utils.h
+++ b/drivers/media/platform/qcom/iris/iris_utils.h
@@ -43,7 +43,8 @@ static inline enum iris_buffer_type iris_v4l2_type_to_driver(u32 type)
bool iris_res_is_less_than(u32 width, u32 height,
u32 ref_width, u32 ref_height);
-int iris_get_mbpf(struct iris_inst *inst);
+u32 iris_get_mbpf(struct iris_inst *inst);
+u32 iris_get_mbps(struct iris_inst *inst);
bool iris_split_mode_enabled(struct iris_inst *inst);
bool iris_fmt_is_8bit(u32 pixelformat);
bool iris_fmt_is_10bit(u32 pixelformat);
diff --git a/drivers/media/platform/qcom/iris/iris_vb2.c b/drivers/media/platform/qcom/iris/iris_vb2.c
index a2ea2d67f60d..dbb89396e651 100644
--- a/drivers/media/platform/qcom/iris/iris_vb2.c
+++ b/drivers/media/platform/qcom/iris/iris_vb2.c
@@ -176,6 +176,10 @@ int iris_vb2_start_streaming(struct vb2_queue *q, unsigned int count)
if (ret)
goto error;
+ ret = iris_set_core_id(inst);
+ if (ret)
+ goto error;
+
if (V4L2_TYPE_IS_OUTPUT(q->type)) {
if (inst->domain == DECODER)
ret = iris_vdec_streamon_input(inst);
diff --git a/drivers/media/platform/qcom/iris/iris_vidc.c b/drivers/media/platform/qcom/iris/iris_vidc.c
index 26df872fb4fa..52855f6c7dea 100644
--- a/drivers/media/platform/qcom/iris/iris_vidc.c
+++ b/drivers/media/platform/qcom/iris/iris_vidc.c
@@ -41,16 +41,20 @@ static void iris_v4l2_fh_deinit(struct iris_inst *inst, struct file *filp)
static void iris_add_session(struct iris_inst *inst)
{
+ const struct iris_platform_data *plat = inst->core->iris_platform_data;
+ u32 max_session_count = plat->max_session_count;
struct iris_core *core = inst->core;
struct iris_inst *iter;
u32 count = 0;
+ max_session_count *= max(plat->num_cores, 1);
+
mutex_lock(&core->lock);
list_for_each_entry(iter, &core->instances, list)
count++;
- if (count < core->iris_platform_data->max_session_count)
+ if (count < max_session_count)
list_add_tail(&inst->list, &core->instances);
mutex_unlock(&core->lock);
diff --git a/drivers/media/platform/qcom/iris/iris_vpu3x.c b/drivers/media/platform/qcom/iris/iris_vpu3x.c
index 7d5007abaded..97563bf89939 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu3x.c
+++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c
@@ -338,6 +338,67 @@ static void iris_vpu36_program_bootup_registers(struct iris_core *core)
writel(0x0, core->reg_base + CPU_CS_SCIACMDARG3);
}
+static int iris_vpu36_check_core_load(struct iris_inst *inst, bool mbpf)
+{
+ const struct iris_platform_data *platform_data = inst->core->iris_platform_data;
+ u32 max_load = mbpf ? platform_data->max_core_mbpf : platform_data->max_core_mbps;
+ u32 max_session_cnt = platform_data->max_session_count;
+ u32 core0_session_cnt = 0, core1_session_cnt = 0;
+ u32 core0_load = 0, core1_load = 0;
+ bool select_core0, select_core1;
+ struct iris_inst *instance;
+ u32 load, new_load;
+
+ inst->core_id = 0;
+
+ list_for_each_entry(instance, &inst->core->instances, list) {
+ load = mbpf ? iris_get_mbpf(instance) : iris_get_mbps(instance);
+
+ if (instance->core_id == IRIS_VCODEC0) {
+ core0_load += load;
+ core0_session_cnt++;
+ } else if (instance->core_id == IRIS_VCODEC1) {
+ core1_load += load;
+ core1_session_cnt++;
+ }
+ }
+
+ new_load = mbpf ? iris_get_mbpf(inst) : iris_get_mbps(inst);
+
+ select_core0 = core0_load + new_load <= max_load && core0_session_cnt < max_session_cnt;
+ select_core1 = core1_load + new_load <= max_load && core1_session_cnt < max_session_cnt;
+
+ if (select_core0 && select_core1)
+ inst->core_id = (core0_load <= core1_load) ? IRIS_VCODEC0 : IRIS_VCODEC1;
+ else if (select_core0)
+ inst->core_id = IRIS_VCODEC0;
+ else if (select_core1)
+ inst->core_id = IRIS_VCODEC1;
+ else
+ return -ENOMEM;
+
+ return 0;
+}
+
+static u64 iris_vpu36_get_required_freq(struct iris_inst *inst)
+{
+ u64 vcodec0_freq = 0, vcodec1_freq = 0;
+ struct iris_core *core = inst->core;
+ struct iris_inst *instance;
+
+ list_for_each_entry(instance, &core->instances, list) {
+ if (!instance->max_input_data_size)
+ continue;
+
+ if (instance->core_id == IRIS_VCODEC0)
+ vcodec0_freq += instance->power.min_freq;
+ else
+ vcodec1_freq += instance->power.min_freq;
+ }
+
+ return max(vcodec0_freq, vcodec1_freq);
+}
+
const struct vpu_ops iris_vpu3_ops = {
.power_off_hw = iris_vpu3_power_off_hardware,
.power_on_hw = iris_vpu_power_on_hw,
@@ -374,4 +435,6 @@ const struct vpu_ops iris_vpu36_ops = {
.program_bootup_registers = iris_vpu36_program_bootup_registers,
.calc_freq = iris_vpu3x_vpu4x_calculate_frequency,
.set_hwmode = iris_vpu36_set_hwmode,
+ .check_core_load = iris_vpu36_check_core_load,
+ .get_required_freq = iris_vpu36_get_required_freq,
};
diff --git a/drivers/media/platform/qcom/iris/iris_vpu_common.h b/drivers/media/platform/qcom/iris/iris_vpu_common.h
index 34ecb18aefb3..f3048b7cca21 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu_common.h
+++ b/drivers/media/platform/qcom/iris/iris_vpu_common.h
@@ -25,6 +25,8 @@ struct vpu_ops {
int (*set_hwmode)(struct iris_core *core);
int (*init_cb_devs)(struct iris_core *core);
void (*deinit_cb_devs)(struct iris_core *core);
+ int (*check_core_load)(struct iris_inst *inst, bool mbpf);
+ u64 (*get_required_freq)(struct iris_inst *inst);
};
int iris_vpu_boot_firmware(struct iris_core *core);
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* Re: [PATCH v9 10/14] media: iris: Add support to select core for dual core platforms
2026-07-15 14:10 ` [PATCH v9 10/14] media: iris: Add support to select core for dual core platforms Vishnu Reddy
@ 2026-07-15 14:42 ` sashiko-bot
0 siblings, 0 replies; 26+ messages in thread
From: sashiko-bot @ 2026-07-15 14:42 UTC (permalink / raw)
To: Vishnu Reddy; +Cc: devicetree, conor+dt, robh
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Dynamic core reassignment mid-session corrupts hardware state and bypasses capacity limits.
- [High] Misattribution of unassigned sessions incorrectly inflates Core 1 clock frequencies, leading to hardware underclocking.
--
--- Patch [10]: [PATCH v9 10/14] media: iris: Add support to select core for dual core platforms ---
commit 9f55933e77ce82b0c6d889a73f17c3f4e9da2a7a
Author: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Subject: media: iris: Add support to select core for dual core platforms
This commit adds support for dual video codec cores, selecting a core based
on MBPF and MBPS load and scaling limits and clock frequencies accordingly.
> diff --git a/drivers/media/platform/qcom/iris/iris_vb2.c b/drivers/media/platform/qcom/iris/iris_vb2.c
> index a2ea2d67f60d0..dbb89396e6514 100644
> --- a/drivers/media/platform/qcom/iris/iris_vb2.c
> +++ b/drivers/media/platform/qcom/iris/iris_vb2.c
> @@ -176,6 +176,10 @@ int iris_vb2_start_streaming(struct vb2_queue *q, unsigned int count)
> if (ret)
> goto error;
>
> + ret = iris_set_core_id(inst);
[Severity: High]
Does setting the core ID happen too late in the streaming initialization?
Looking at iris_vb2_start_streaming(), iris_scale_power() is called before
iris_check_session_supported() and iris_set_core_id():
iris_scale_power(inst);
ret = iris_check_session_supported(inst);
...
ret = iris_set_core_id(inst);
This means frequency calculations will run while the new session's core_id
is still unassigned (0), which appears to cause issues in the frequency
calculation logic below.
> + if (ret)
> + goto error;
> +
> if (V4L2_TYPE_IS_OUTPUT(q->type)) {
[ ... ]
> diff --git a/drivers/media/platform/qcom/iris/iris_vpu3x.c b/drivers/media/platform/qcom/iris/iris_vpu3x.c
> index 7d5007abaded8..97563bf899392 100644
> --- a/drivers/media/platform/qcom/iris/iris_vpu3x.c
> +++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c
[ ... ]
> @@ -338,6 +338,67 @@ static void iris_vpu36_program_bootup_registers(struct iris_core *core)
> writel(0x0, core->reg_base + CPU_CS_SCIACMDARG3);
> }
>
> +static int iris_vpu36_check_core_load(struct iris_inst *inst, bool mbpf)
> +{
> + const struct iris_platform_data *platform_data = inst->core->iris_platform_data;
> + u32 max_load = mbpf ? platform_data->max_core_mbpf : platform_data->max_core_mbps;
> + u32 max_session_cnt = platform_data->max_session_count;
> + u32 core0_session_cnt = 0, core1_session_cnt = 0;
> + u32 core0_load = 0, core1_load = 0;
> + bool select_core0, select_core1;
> + struct iris_inst *instance;
> + u32 load, new_load;
> +
> + inst->core_id = 0;
> +
> + list_for_each_entry(instance, &inst->core->instances, list) {
> + load = mbpf ? iris_get_mbpf(instance) : iris_get_mbps(instance);
> +
> + if (instance->core_id == IRIS_VCODEC0) {
> + core0_load += load;
> + core0_session_cnt++;
> + } else if (instance->core_id == IRIS_VCODEC1) {
> + core1_load += load;
> + core1_session_cnt++;
> + }
> + }
> +
> + new_load = mbpf ? iris_get_mbpf(inst) : iris_get_mbps(inst);
> +
> + select_core0 = core0_load + new_load <= max_load && core0_session_cnt < max_session_cnt;
> + select_core1 = core1_load + new_load <= max_load && core1_session_cnt < max_session_cnt;
> +
> + if (select_core0 && select_core1)
> + inst->core_id = (core0_load <= core1_load) ? IRIS_VCODEC0 : IRIS_VCODEC1;
> + else if (select_core0)
> + inst->core_id = IRIS_VCODEC0;
> + else if (select_core1)
> + inst->core_id = IRIS_VCODEC1;
> + else
> + return -ENOMEM;
> +
> + return 0;
> +}
[Severity: High]
Does unconditionally zeroing and reassigning core_id corrupt the session
state if called mid-session?
If parameters are dynamically updated during streaming (for example, via
iris_venc_s_parm()), iris_check_core_mbpf() and iris_check_core_mbps() are
invoked sequentially. Would the MBPS check overwrite the assignment made by
the MBPF check, ignoring whether the newly assigned core has sufficient
MBPF capacity?
Additionally, since the hardware is only notified of the core ID during
stream-on via HFI_PROP_CORE_ID, could dynamically changing inst->core_id
here leave the driver calculating power for one core while the firmware
continues executing the session on another?
> +
> +static u64 iris_vpu36_get_required_freq(struct iris_inst *inst)
> +{
> + u64 vcodec0_freq = 0, vcodec1_freq = 0;
> + struct iris_core *core = inst->core;
> + struct iris_inst *instance;
> +
> + list_for_each_entry(instance, &core->instances, list) {
> + if (!instance->max_input_data_size)
> + continue;
> +
> + if (instance->core_id == IRIS_VCODEC0)
> + vcodec0_freq += instance->power.min_freq;
> + else
> + vcodec1_freq += instance->power.min_freq;
[Severity: High]
Does this else block unintentionally include unassigned sessions?
As mentioned above, new sessions initially have an unassigned core_id (0)
when iris_scale_power() is called. Since 0 is not equal to IRIS_VCODEC0,
won't this falsely add the unassigned session's required frequency to
Core 1?
If a heavy session is misattributed to a lightly loaded Core 1 instead of
a heavily loaded Core 0, could the resulting maximum frequency be
artificially low and cause the hardware to underclock?
> + }
> +
> + return max(vcodec0_freq, vcodec1_freq);
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=10
^ permalink raw reply [flat|nested] 26+ messages in thread
* [PATCH v9 11/14] media: iris: Add hooks for pixel and non-pixel context banks
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
` (9 preceding siblings ...)
2026-07-15 14:10 ` [PATCH v9 10/14] media: iris: Add support to select core for dual core platforms Vishnu Reddy
@ 2026-07-15 14:10 ` Vishnu Reddy
2026-07-15 14:52 ` sashiko-bot
2026-07-15 15:27 ` Bryan O'Donoghue
2026-07-15 14:10 ` [PATCH v9 12/14] media: iris: Add platform data for glymur Vishnu Reddy
` (2 subsequent siblings)
13 siblings, 2 replies; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:10 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy, Daniel J Blueman
From: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Iris platforms use separate context-bank devices for the pixel, non-pixel
firmware domains. Add platform hooks to create and destroy those
subdevices, and wire them up for the affected platforms.
Co-developed-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
Signed-off-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Tested-by: Daniel J Blueman <daniel@quora.org>
---
drivers/media/platform/qcom/iris/iris_vpu3x.c | 48 +++++++++++++++++++++++++++
1 file changed, 48 insertions(+)
diff --git a/drivers/media/platform/qcom/iris/iris_vpu3x.c b/drivers/media/platform/qcom/iris/iris_vpu3x.c
index 97563bf89939..7d9d67baf22a 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu3x.c
+++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c
@@ -399,6 +399,52 @@ static u64 iris_vpu36_get_required_freq(struct iris_inst *inst)
return max(vcodec0_freq, vcodec1_freq);
}
+static int iris_vpu3x_init_cb_devs(struct iris_core *core)
+{
+ struct device *dev;
+
+ dev = iris_create_cb_dev(core, "non-pixel");
+ if (IS_ERR(dev))
+ return PTR_ERR(dev);
+
+ core->np_dev = dev;
+
+ dev = iris_create_cb_dev(core, "pixel");
+ if (IS_ERR(dev))
+ goto unreg_np_dev;
+
+ core->p_dev = dev;
+
+ dev = iris_create_cb_dev(core, "firmware");
+ if (IS_ERR(dev))
+ goto unreg_p_dev;
+
+ core->fw_dev = dev;
+
+ return 0;
+
+unreg_p_dev:
+ if (core->p_dev)
+ platform_device_unregister(to_platform_device(core->p_dev));
+ core->p_dev = NULL;
+unreg_np_dev:
+ if (core->np_dev)
+ platform_device_unregister(to_platform_device(core->np_dev));
+ core->np_dev = NULL;
+
+ return PTR_ERR(dev);
+}
+
+static void iris_vpu3x_deinit_cb_devs(struct iris_core *core)
+{
+ if (core->fw_dev)
+ platform_device_unregister(to_platform_device(core->fw_dev));
+ if (core->p_dev)
+ platform_device_unregister(to_platform_device(core->p_dev));
+ if (core->np_dev)
+ platform_device_unregister(to_platform_device(core->np_dev));
+}
+
const struct vpu_ops iris_vpu3_ops = {
.power_off_hw = iris_vpu3_power_off_hardware,
.power_on_hw = iris_vpu_power_on_hw,
@@ -437,4 +483,6 @@ const struct vpu_ops iris_vpu36_ops = {
.set_hwmode = iris_vpu36_set_hwmode,
.check_core_load = iris_vpu36_check_core_load,
.get_required_freq = iris_vpu36_get_required_freq,
+ .init_cb_devs = iris_vpu3x_init_cb_devs,
+ .deinit_cb_devs = iris_vpu3x_deinit_cb_devs,
};
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* Re: [PATCH v9 11/14] media: iris: Add hooks for pixel and non-pixel context banks
2026-07-15 14:10 ` [PATCH v9 11/14] media: iris: Add hooks for pixel and non-pixel context banks Vishnu Reddy
@ 2026-07-15 14:52 ` sashiko-bot
2026-07-15 15:27 ` Bryan O'Donoghue
1 sibling, 0 replies; 26+ messages in thread
From: sashiko-bot @ 2026-07-15 14:52 UTC (permalink / raw)
To: Vishnu Reddy; +Cc: devicetree, conor+dt, robh
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] V4L2 file release callback `iris_close()` accesses the `core` structure after it has been freed by `devres` during driver unbind.
--
--- Patch [11]: [PATCH v9 11/14] media: iris: Add hooks for pixel and non-pixel context banks ---
commit 8d8f4d5f3484b996ec8fcb46a6a17cb0805e77fa
Author: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
media: iris: Add hooks for pixel and non-pixel context banks
Iris platforms use separate context-bank devices for the pixel, non-pixel
firmware domains. Add platform hooks to create and destroy those
subdevices, and wire them up for the affected platforms.
> diff --git a/drivers/media/platform/qcom/iris/iris_vpu3x.c b/drivers/media/platform/qcom/iris/iris_vpu3x.c
> index 97563bf899392..7d9d67baf22a8 100644
> --- a/drivers/media/platform/qcom/iris/iris_vpu3x.c
> +++ b/drivers/media/platform/qcom/iris/iris_vpu3x.c
[ ... ]
[Severity: High]
This is a pre-existing issue, but while reviewing the driver's lifecycle
management I noticed a potential use-after-free in the V4L2 file release
flow.
If a userspace process opens the V4L2 device and the driver is subsequently
unbound (e.g., via sysfs), the driver core automatically frees all devres
allocations, including the iris_core structure.
When the userspace process later closes the file descriptor, iris_close()
is called. Can this trigger a use-after-free when it accesses the freed
core structure?
drivers/media/platform/qcom/iris/iris_vidc.c:iris_close() {
...
iris_check_num_queued_internal_buffers(inst, V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
iris_remove_session(inst);
...
}
Which then takes a mutex on the already freed core structure:
drivers/media/platform/qcom/iris/iris_vidc.c:iris_remove_session() {
struct iris_core *core = inst->core;
mutex_lock(&core->lock);
...
}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=11
^ permalink raw reply [flat|nested] 26+ messages in thread* Re: [PATCH v9 11/14] media: iris: Add hooks for pixel and non-pixel context banks
2026-07-15 14:10 ` [PATCH v9 11/14] media: iris: Add hooks for pixel and non-pixel context banks Vishnu Reddy
2026-07-15 14:52 ` sashiko-bot
@ 2026-07-15 15:27 ` Bryan O'Donoghue
1 sibling, 0 replies; 26+ messages in thread
From: Bryan O'Donoghue @ 2026-07-15 15:27 UTC (permalink / raw)
To: Vishnu Reddy, Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Dmitry Baryshkov, Mauro Carvalho Chehab, Joerg Roedel (AMD),
Will Deacon, Robin Murphy, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Stanimir Varbanov, Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Daniel J Blueman
On 15/07/2026 15:10, Vishnu Reddy wrote:
> Add platform hooks to create and destroy those
> subdevices, and wire them up for the affected platforms.
All platforms are affected no ?
---
bod
^ permalink raw reply [flat|nested] 26+ messages in thread
* [PATCH v9 12/14] media: iris: Add platform data for glymur
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
` (10 preceding siblings ...)
2026-07-15 14:10 ` [PATCH v9 11/14] media: iris: Add hooks for pixel and non-pixel context banks Vishnu Reddy
@ 2026-07-15 14:10 ` Vishnu Reddy
2026-07-15 14:10 ` [PATCH v9 13/14] arm64: dts: qcom: glymur: Add iris video node Vishnu Reddy
2026-07-15 14:10 ` [PATCH v9 14/14] arm64: dts: qcom: glymur-crd: Enable iris video codec node Vishnu Reddy
13 siblings, 0 replies; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:10 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy
On glymur platform, the iris core shares most properties with the
iris core on the SM8550 platform. The major difference is that glymur
integrates two codec cores (vcodec0 and vcodec1), while SM8550 has only
one. Add glymur specific platform data, reusing SM8550 definitions
wherever applicable.
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
---
drivers/media/platform/qcom/iris/Makefile | 1 +
.../platform/qcom/iris/iris_platform_common.h | 5 ++
.../platform/qcom/iris/iris_platform_glymur.c | 78 ++++++++++++++++++++++
.../platform/qcom/iris/iris_platform_glymur.h | 15 +++++
.../media/platform/qcom/iris/iris_platform_vpu3x.c | 35 ++++++++++
drivers/media/platform/qcom/iris/iris_probe.c | 4 ++
6 files changed, 138 insertions(+)
diff --git a/drivers/media/platform/qcom/iris/Makefile b/drivers/media/platform/qcom/iris/Makefile
index 48e415cbc439..48570da56aa0 100644
--- a/drivers/media/platform/qcom/iris/Makefile
+++ b/drivers/media/platform/qcom/iris/Makefile
@@ -12,6 +12,7 @@ qcom-iris-objs += iris_buffer.o \
iris_hfi_gen2_packet.o \
iris_hfi_gen2_response.o \
iris_hfi_queue.o \
+ iris_platform_glymur.o \
iris_platform_vpu2.o \
iris_platform_vpu3x.o \
iris_power.o \
diff --git a/drivers/media/platform/qcom/iris/iris_platform_common.h b/drivers/media/platform/qcom/iris/iris_platform_common.h
index 99f59b64f853..e182030bd537 100644
--- a/drivers/media/platform/qcom/iris/iris_platform_common.h
+++ b/drivers/media/platform/qcom/iris/iris_platform_common.h
@@ -39,6 +39,10 @@ struct iris_inst;
#define MAX_HEVC_VBR_LAYER_HP_SLIDING_WINDOW 5
#define MAX_HIER_CODING_LAYER_GEN1 6
+#define VIDEO_REGION_SECURE_FW_REGION_ID 0
+#define VIDEO_REGION_VM0_SECURE_NP_ID 1
+#define VIDEO_REGION_VM0_NONSECURE_NP_ID 5
+
enum stage_type {
STAGE_1 = 1,
STAGE_2 = 2,
@@ -53,6 +57,7 @@ enum pipe_type {
extern const struct iris_firmware_data iris_hfi_gen1_data;
extern const struct iris_firmware_data iris_hfi_gen2_data;
+extern const struct iris_platform_data glymur_data;
extern const struct iris_platform_data qcs8300_data;
extern const struct iris_platform_data sc7280_data;
extern const struct iris_platform_data sm8250_data;
diff --git a/drivers/media/platform/qcom/iris/iris_platform_glymur.c b/drivers/media/platform/qcom/iris/iris_platform_glymur.c
new file mode 100644
index 000000000000..49edae8120fe
--- /dev/null
+++ b/drivers/media/platform/qcom/iris/iris_platform_glymur.c
@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#include "iris_core.h"
+#include "iris_platform_common.h"
+
+const struct iris_power_domain_data iris_glymur_ctrl_data = {
+ .pd_names = (const char *[]) {
+ "venus",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "core_iface", "core_freerun", "core",
+ },
+ .clk_cnt = 3,
+};
+
+const struct iris_power_domain_data iris_glymur_vcodec_data[] = {
+ {
+ .pd_names = (const char *[]) {
+ "vcodec0",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "vcodec0_iface", "vcodec0_core_freerun", "vcodec0_core",
+ },
+ .clk_cnt = 3,
+ },
+ {
+ .pd_names = (const char *[]) {
+ "vcodec1",
+ },
+ .pd_cnt = 1,
+ .clk_names = (const char *[]) {
+ "vcodec1_iface", "vcodec1_core_freerun", "vcodec1_core",
+ },
+ .clk_cnt = 3,
+ },
+};
+
+const char * const iris_glymur_clk_reset_table[] = {
+ "core_bus",
+ "vcodec0_bus",
+ "core",
+ "vcodec0_core",
+ "vcodec1_bus",
+ "vcodec1_core",
+};
+
+const char * const iris_glymur_opp_clk_table[] = {
+ "vcodec0_core",
+ "vcodec1_core",
+ "core",
+ NULL,
+};
+
+const struct tz_cp_config iris_glymur_tz_cp_config[] = {
+ {
+ .cp_start = VIDEO_REGION_SECURE_FW_REGION_ID,
+ .cp_size = 0,
+ .cp_nonpixel_start = 0,
+ .cp_nonpixel_size = 0x1000000,
+ },
+ {
+ .cp_start = VIDEO_REGION_VM0_SECURE_NP_ID,
+ .cp_size = 0,
+ .cp_nonpixel_start = 0x1000000,
+ .cp_nonpixel_size = 0x24800000,
+ },
+ {
+ .cp_start = VIDEO_REGION_VM0_NONSECURE_NP_ID,
+ .cp_size = 0,
+ .cp_nonpixel_start = 0x25800000,
+ .cp_nonpixel_size = 0xda600000,
+ },
+};
diff --git a/drivers/media/platform/qcom/iris/iris_platform_glymur.h b/drivers/media/platform/qcom/iris/iris_platform_glymur.h
new file mode 100644
index 000000000000..9f2877ec9901
--- /dev/null
+++ b/drivers/media/platform/qcom/iris/iris_platform_glymur.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#ifndef __IRIS_PLATFORM_GLYMUR_H__
+#define __IRIS_PLATFORM_GLYMUR_H__
+
+extern const struct iris_power_domain_data iris_glymur_ctrl_data;
+extern const struct iris_power_domain_data iris_glymur_vcodec_data[2];
+extern const char * const iris_glymur_clk_reset_table[6];
+extern const char * const iris_glymur_opp_clk_table[4];
+extern const struct tz_cp_config iris_glymur_tz_cp_config[3];
+
+#endif /* __IRIS_PLATFORM_GLYMUR_H__ */
diff --git a/drivers/media/platform/qcom/iris/iris_platform_vpu3x.c b/drivers/media/platform/qcom/iris/iris_platform_vpu3x.c
index 72dd23dbe02a..4049e134c3f0 100644
--- a/drivers/media/platform/qcom/iris/iris_platform_vpu3x.c
+++ b/drivers/media/platform/qcom/iris/iris_platform_vpu3x.c
@@ -12,6 +12,7 @@
#include "iris_vpu_buffer.h"
#include "iris_vpu_common.h"
+#include "iris_platform_glymur.h"
#include "iris_platform_qcs8300.h"
#include "iris_platform_sm8550.h"
#include "iris_platform_sm8650.h"
@@ -48,6 +49,12 @@ static const struct iris_firmware_desc iris_vpu35_p4_gen2_desc = {
.fwname = "qcom/vpu/vpu35_p4.mbn",
};
+static const struct iris_firmware_desc iris_vpu36_p4_s7_gen2_desc = {
+ .firmware_data = &iris_hfi_gen2_data,
+ .get_vpu_buffer_size = iris_vpu_buf_size,
+ .fwname = "qcom/vpu/vpu36_p4_s7.mbn",
+};
+
static const u32 iris_fmts_vpu3x_dec[] = {
[IRIS_FMT_H264] = V4L2_PIX_FMT_H264,
[IRIS_FMT_HEVC] = V4L2_PIX_FMT_HEVC,
@@ -83,6 +90,34 @@ static const struct tz_cp_config tz_cp_config_vpu3[] = {
},
};
+const struct iris_platform_data glymur_data = {
+ .firmware_desc = &iris_vpu36_p4_s7_gen2_desc,
+ .vpu_ops = &iris_vpu36_ops,
+ .icc_tbl = iris_icc_info_vpu3x,
+ .icc_tbl_size = ARRAY_SIZE(iris_icc_info_vpu3x),
+ .clk_rst_tbl = iris_glymur_clk_reset_table,
+ .clk_rst_tbl_size = ARRAY_SIZE(iris_glymur_clk_reset_table),
+ .bw_tbl_dec = iris_bw_table_dec_vpu3x,
+ .bw_tbl_dec_size = ARRAY_SIZE(iris_bw_table_dec_vpu3x),
+ .ctrl_data = &iris_glymur_ctrl_data,
+ .vcodec_data = iris_glymur_vcodec_data,
+ .opp_pd_tbl = iris_opp_pd_table_vpu3x,
+ .opp_pd_tbl_size = ARRAY_SIZE(iris_opp_pd_table_vpu3x),
+ .opp_clk_tbl = iris_glymur_opp_clk_table,
+ /* Upper bound of DMA address range */
+ .dma_mask = 0xffe00000 - 1,
+ .inst_iris_fmts = iris_fmts_vpu3x_dec,
+ .inst_iris_fmts_size = ARRAY_SIZE(iris_fmts_vpu3x_dec),
+ .inst_caps = &platform_inst_cap_sm8550,
+ .tz_cp_config_data = iris_glymur_tz_cp_config,
+ .tz_cp_config_data_size = ARRAY_SIZE(iris_glymur_tz_cp_config),
+ .num_vpp_pipe = 4,
+ .max_session_count = 16,
+ .num_cores = 2,
+ .max_core_mbpf = NUM_MBS_8K * 2,
+ .max_core_mbps = ((8192 * 4320) / 256) * 60,
+};
+
/*
* Shares most of SM8550 data except:
* - inst_caps to platform_inst_cap_qcs8300
diff --git a/drivers/media/platform/qcom/iris/iris_probe.c b/drivers/media/platform/qcom/iris/iris_probe.c
index 9e96fa218dea..6ad553990c89 100644
--- a/drivers/media/platform/qcom/iris/iris_probe.c
+++ b/drivers/media/platform/qcom/iris/iris_probe.c
@@ -493,6 +493,10 @@ static const struct dev_pm_ops iris_pm_ops = {
};
static const struct of_device_id iris_dt_match[] = {
+ {
+ .compatible = "qcom,glymur-iris",
+ .data = &glymur_data,
+ },
{
.compatible = "qcom,qcs8300-iris",
.data = &qcs8300_data,
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* [PATCH v9 13/14] arm64: dts: qcom: glymur: Add iris video node
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
` (11 preceding siblings ...)
2026-07-15 14:10 ` [PATCH v9 12/14] media: iris: Add platform data for glymur Vishnu Reddy
@ 2026-07-15 14:10 ` Vishnu Reddy
2026-07-15 15:18 ` sashiko-bot
2026-07-15 14:10 ` [PATCH v9 14/14] arm64: dts: qcom: glymur-crd: Enable iris video codec node Vishnu Reddy
13 siblings, 1 reply; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:10 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy
Add iris video codec to glymur SoC, which comes with significantly
different powering up sequence than previous platforms, thus different
clocks and resets.
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
---
arch/arm64/boot/dts/qcom/glymur.dtsi | 128 +++++++++++++++++++++++++++++++++++
1 file changed, 128 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/glymur.dtsi b/arch/arm64/boot/dts/qcom/glymur.dtsi
index 55d91c696a3a..0c09e700f6b5 100644
--- a/arch/arm64/boot/dts/qcom/glymur.dtsi
+++ b/arch/arm64/boot/dts/qcom/glymur.dtsi
@@ -695,6 +695,10 @@ adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap {
alignment = <0x0 0x400000>;
size = <0x0 0x800000>;
};
+
+ iris_resv: reservation-iris {
+ iommu-addresses = <&iris_non_pixel 0x0 0x0 0x0 0x25800000>;
+ };
};
smp2p-adsp {
@@ -5321,6 +5325,130 @@ mdss_dp3_out: endpoint {
};
};
+ iris: video-codec@aa00000 {
+ compatible = "qcom,glymur-iris";
+ reg = <0x0 0x0aa00000 0x0 0xf0000>;
+
+ clocks = <&gcc GCC_VIDEO_AXI0C_CLK>,
+ <&videocc VIDEO_CC_MVS0C_CLK>,
+ <&videocc VIDEO_CC_MVS0_CLK>,
+ <&gcc GCC_VIDEO_AXI0_CLK>,
+ <&videocc VIDEO_CC_MVS0C_FREERUN_CLK>,
+ <&videocc VIDEO_CC_MVS0_FREERUN_CLK>,
+ <&gcc GCC_VIDEO_AXI1_CLK>,
+ <&videocc VIDEO_CC_MVS1_CLK>,
+ <&videocc VIDEO_CC_MVS1_FREERUN_CLK>;
+ clock-names = "core_iface",
+ "core",
+ "vcodec0_core",
+ "vcodec0_iface",
+ "core_freerun",
+ "vcodec0_core_freerun",
+ "vcodec1_iface",
+ "vcodec1_core",
+ "vcodec1_core_freerun";
+
+ dma-coherent;
+
+ interconnects = <&hsc_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
+ &config_noc SLAVE_VENUS_CFG QCOM_ICC_TAG_ACTIVE_ONLY>,
+ <&mmss_noc MASTER_VIDEO QCOM_ICC_TAG_ALWAYS
+ &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>;
+ interconnect-names = "cpu-cfg",
+ "video-mem";
+
+ interrupts = <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>;
+
+ memory-region = <&video_mem>;
+
+ operating-points-v2 = <&iris_opp_table>;
+
+ power-domains = <&videocc VIDEO_CC_MVS0C_GDSC>,
+ <&videocc VIDEO_CC_MVS0_GDSC>,
+ <&rpmhpd RPMHPD_MXC>,
+ <&rpmhpd RPMHPD_MMCX>,
+ <&videocc VIDEO_CC_MVS1_GDSC>;
+ power-domain-names = "venus",
+ "vcodec0",
+ "mxc",
+ "mmcx",
+ "vcodec1";
+
+ resets = <&gcc GCC_VIDEO_AXI0C_CLK_ARES>,
+ <&gcc GCC_VIDEO_AXI0_CLK_ARES>,
+ <&videocc VIDEO_CC_MVS0C_FREERUN_CLK_ARES>,
+ <&videocc VIDEO_CC_MVS0_FREERUN_CLK_ARES>,
+ <&gcc GCC_VIDEO_AXI1_CLK_ARES>,
+ <&videocc VIDEO_CC_MVS1_FREERUN_CLK_ARES>;
+ reset-names = "core_bus",
+ "vcodec0_bus",
+ "core",
+ "vcodec0_core",
+ "vcodec1_bus",
+ "vcodec1_core";
+
+ #address-cells = <2>;
+ #size-cells = <2>;
+
+ /*
+ * IRIS firmware is signed by vendors, only
+ * enable on boards where the proper signed firmware
+ * is available.
+ */
+ status = "disabled";
+
+ iris_non_pixel: non-pixel {
+ iommus = <&apps_smmu 0x1940 0x0>,
+ <&apps_smmu 0x1944 0x0>,
+ <&apps_smmu 0x19e0 0x0>;
+ memory-region = <&iris_resv>;
+ };
+
+ pixel {
+ iommus = <&apps_smmu 0x1943 0x0>;
+ };
+
+ iris_opp_table: opp-table {
+ compatible = "operating-points-v2";
+
+ opp-240000000 {
+ opp-hz = /bits/ 64 <240000000 240000000 360000000>;
+ required-opps = <&rpmhpd_opp_svs>,
+ <&rpmhpd_opp_low_svs>;
+ };
+
+ opp-338000000 {
+ opp-hz = /bits/ 64 <338000000 338000000 507000000>;
+ required-opps = <&rpmhpd_opp_svs>,
+ <&rpmhpd_opp_svs>;
+ };
+
+ opp-366000000 {
+ opp-hz = /bits/ 64 <366000000 366000000 549000000>;
+ required-opps = <&rpmhpd_opp_svs_l1>,
+ <&rpmhpd_opp_svs_l1>;
+ };
+
+ opp-444000000 {
+ opp-hz = /bits/ 64 <444000000 444000000 666000000>;
+ required-opps = <&rpmhpd_opp_svs_l1>,
+ <&rpmhpd_opp_nom>;
+ };
+
+ opp-533333334 {
+ opp-hz = /bits/ 64 <533333334 533333334 800000000>;
+ required-opps = <&rpmhpd_opp_svs_l1>,
+ <&rpmhpd_opp_turbo>;
+ };
+
+ opp-655000000 {
+ opp-hz = /bits/ 64 <655000000 655000000 982000000>;
+ required-opps = <&rpmhpd_opp_nom>,
+ <&rpmhpd_opp_turbo_l1>;
+ };
+ };
+ };
+
videocc: clock-controller@aaf0000 {
compatible = "qcom,glymur-videocc";
reg = <0x0 0x0aaf0000 0x0 0x10000>;
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread* Re: [PATCH v9 13/14] arm64: dts: qcom: glymur: Add iris video node
2026-07-15 14:10 ` [PATCH v9 13/14] arm64: dts: qcom: glymur: Add iris video node Vishnu Reddy
@ 2026-07-15 15:18 ` sashiko-bot
0 siblings, 0 replies; 26+ messages in thread
From: sashiko-bot @ 2026-07-15 15:18 UTC (permalink / raw)
To: Vishnu Reddy; +Cc: conor+dt, devicetree, robh
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] The use of the `iommu-addresses` property triggers a severe preexisting parsing bug and memory leak in `of_iommu_get_resv_regions`.
--
--- Patch [13]: [PATCH v9 13/14] arm64: dts: qcom: glymur: Add iris video node ---
commit 973017069435379c05db5988e8245460d2e68365
Author: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
arm64: dts: qcom: glymur: Add iris video node
This commit adds the iris video codec to the glymur SoC. It introduces a
new reservation node and configures clocks, interconnects, interrupts, and
power domains for the video-codec.
> diff --git a/arch/arm64/boot/dts/qcom/glymur.dtsi b/arch/arm64/boot/dts/qcom/glymur.dtsi
> index 55d91c696a3a3..0c09e700f6b59 100644
> --- a/arch/arm64/boot/dts/qcom/glymur.dtsi
> +++ b/arch/arm64/boot/dts/qcom/glymur.dtsi
> @@ -695,6 +695,10 @@ adsp_rpc_remote_heap_mem: adsp-rpc-remote-heap {
> alignment = <0x0 0x400000>;
> size = <0x0 0x800000>;
> };
> +
> + iris_resv: reservation-iris {
> + iommu-addresses = <&iris_non_pixel 0x0 0x0 0x0 0x25800000>;
[Severity: High]
This isn't a bug introduced by this patch, but using the iommu-addresses
property triggers severe parsing flaws and a memory leak in
of_iommu_get_resv_regions().
First, does the parser leak a device node reference on every loop iteration?
It acquires the node reference but fails to release it:
drivers/iommu/of_iommu.c:of_iommu_get_resv_regions() {
...
np = of_find_node_by_phandle(phandle);
...
}
Without a corresponding of_node_put(np) inside or after the loop, this leaks
memory.
Second, if the iommu-addresses array contains entries for multiple devices,
the loop fails to advance the maps pointer past the address and size cells
when np != dev->of_node. This causes subsequent iterations to erroneously
interpret IOVA address and size values as phandles.
Finally, could this code cause a kernel panic if translation fails?
drivers/iommu/of_iommu.c:of_iommu_get_resv_regions() {
...
maps = of_translate_dma_region(np, maps, &iova, &length);
...
}
If of_translate_dma_region() returns NULL, it is assigned to maps without
checking. This will lead to an immediate NULL pointer dereference in
be32_to_cpup(maps++) on the next loop iteration.
While this specific dtsi patch only provides a single entry and avoids the
incorrect cell shift, should these underlying driver bugs be addressed
upstream before adopting this property here?
> + };
> };
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-glymur-v9-0-8cf2cbe12a07@oss.qualcomm.com?part=13
^ permalink raw reply [flat|nested] 26+ messages in thread
* [PATCH v9 14/14] arm64: dts: qcom: glymur-crd: Enable iris video codec node
2026-07-15 14:09 [PATCH v9 00/14] media: iris: Add support for glymur platform Vishnu Reddy
` (12 preceding siblings ...)
2026-07-15 14:10 ` [PATCH v9 13/14] arm64: dts: qcom: glymur: Add iris video node Vishnu Reddy
@ 2026-07-15 14:10 ` Vishnu Reddy
13 siblings, 0 replies; 26+ messages in thread
From: Vishnu Reddy @ 2026-07-15 14:10 UTC (permalink / raw)
To: Vikash Garodia, Dikshita Agarwal, Abhinav Kumar,
Bryan O'Donoghue, Dmitry Baryshkov, Mauro Carvalho Chehab,
Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Stanimir Varbanov,
Bjorn Andersson, Konrad Dybcio
Cc: linux-kernel, linux-media, linux-arm-msm, iommu, devicetree,
Vishnu Reddy
The iris hardware block is described in the glymur SoC DTSI, and enabling
it here allows the media iris driver to probe and use the video codec
functionality.
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Vishnu Reddy <busanna.reddy@oss.qualcomm.com>
---
arch/arm64/boot/dts/qcom/glymur-crd.dtsi | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/glymur-crd.dtsi b/arch/arm64/boot/dts/qcom/glymur-crd.dtsi
index b314c6dd423c..3ade94220667 100644
--- a/arch/arm64/boot/dts/qcom/glymur-crd.dtsi
+++ b/arch/arm64/boot/dts/qcom/glymur-crd.dtsi
@@ -695,6 +695,16 @@ touchscreen@38 {
};
};
+&iris {
+ firmware-name = "qcom/vpu/vpu36_p4_s7.mbn";
+
+ status = "okay";
+
+ firmware {
+ iommus = <&apps_smmu 0x19e2 0x0>;
+ };
+};
+
&lpass_vamacro {
pinctrl-0 = <&dmic01_default>, <&dmic23_default>;
pinctrl-names = "default";
--
2.34.1
^ permalink raw reply related [flat|nested] 26+ messages in thread