AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The modified code is in drivers/media/platform/qcom/iris/iris_vpu_common.c, which belongs to the Qualcomm Iris V4L2 video decoder platform driver. This driver is specific to Qualcomm SoCs (depends on ARCH_QCOM || COMPILE_TEST) and requires Qualcomm SoC hardware, Device Tree bindings, and Qualcomm SCM/PAS firmware infrastructure. On the target architecture (amd64), this hardware is structurally absent and not emulated in standard virtualized fuzzing environments (QEMU/GCE), making the modified code unreachable for fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 78b6b506335a65deeb275d2a00e149081871377a\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sat Sep 26 19:30:27 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/media/platform/qcom/iris/iris_vpu_common.c b/drivers/media/platform/qcom/iris/iris_vpu_common.c\nindex e4847c1077097..2ef8004e976e3 100644\n--- a/drivers/media/platform/qcom/iris/iris_vpu_common.c\n+++ b/drivers/media/platform/qcom/iris/iris_vpu_common.c\n@@ -311,6 +311,11 @@ int iris_vpu_power_on_hw(struct iris_core *core)\n \n int iris_vpu_set_hwmode(struct iris_core *core)\n {\n+\twritel(CORE_BRIDGE_SW_RESET | CORE_BRIDGE_HW_RESET_DISABLE,\n+\t       core-\u003ereg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);\n+\twritel(CORE_BRIDGE_HW_RESET_DISABLE, core-\u003ereg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);\n+\twritel(0x0, core-\u003ereg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);\n+\n \treturn dev_pm_genpd_set_hwmode(core-\u003epmdomain_tbl-\u003epd_devs[IRIS_HW_POWER_DOMAIN], true);\n }\n \n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The modified code is in drivers/media/platform/qcom/iris/iris_vpu_common.c, which belongs to the Qualcomm Iris V4L2 video decoder platform driver. This driver is specific to Qualcomm SoCs (depends on ARCH_QCOM || COMPILE_TEST) and requires Qualcomm SoC hardware, Device Tree bindings, and Qualcomm SCM/PAS firmware infrastructure. On the target architecture (amd64), this hardware is structurally absent and not emulated in standard virtualized fuzzing environments (QEMU/GCE), making the modified code unreachable for fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 78b6b506335a65deeb275d2a00e149081871377a
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Sep 26 19:30:27 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/media/platform/qcom/iris/iris_vpu_common.c b/drivers/media/platform/qcom/iris/iris_vpu_common.c
index e4847c1077097..2ef8004e976e3 100644
--- a/drivers/media/platform/qcom/iris/iris_vpu_common.c
+++ b/drivers/media/platform/qcom/iris/iris_vpu_common.c
@@ -311,6 +311,11 @@ int iris_vpu_power_on_hw(struct iris_core *core)
 
 int iris_vpu_set_hwmode(struct iris_core *core)
 {
+	writel(CORE_BRIDGE_SW_RESET | CORE_BRIDGE_HW_RESET_DISABLE,
+	       core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
+	writel(CORE_BRIDGE_HW_RESET_DISABLE, core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
+	writel(0x0, core->reg_base + CPU_CS_AHB_BRIDGE_SYNC_RESET);
+
 	return dev_pm_genpd_set_hwmode(core->pmdomain_tbl->pd_devs[IRIS_HW_POWER_DOMAIN], true);
 }
 

gemini-3.8-flash

null

null

							input: 3004
							output: 31
							thoughts: 117
						

Okay, let's break this down.

**Analyzing a Commit and Related Files**

Alright, a new commit has landed. My first instinct is to zero in on the changes. The diff indicates a modification within `drivers/media/platform/qcom/iris/iris_vpu_common.c`, specifically impacting the `iris_vpu_set_hwmode` function. That's my starting point.

Now, I need to get a broader understanding. Time to dive into the driver itself. I'll need to check the Kconfig files associated with the `iris` driver. This will illuminate the driver's purpose, potential architecture dependencies, and any hardware it relies on. I'm focusing on an amd64 architecture, so I'll keep that in mind as I investigate.

Next, I'll leverage my tooling, probably `grepper` or `read-file`, to explore the `drivers/media/platform/qcom/iris/` directory more thoroughly. This will give me further context and uncover other potential related components or dependencies that might influence how these changes will impact the larger system. I need to understand this change within its ecosystem.

{
  "Expression": "IRIS",
  "PathPrefix": "drivers/media/platform/qcom/iris"
}

{
  "Output": "\nFull output is too long, showing 500 out of 1443 lines.\nUse more precise expression if possible.\n\ndrivers/media/platform/qcom/iris/Kconfig:1:config VIDEO_QCOM_IRIS\ndrivers/media/platform/qcom/iris/Kconfig-2-\ttristate \"Qualcomm iris V4L2 decoder driver\"\n--\ndrivers/media/platform/qcom/iris/Makefile=1=qcom-iris-objs += iris_buffer.o \\\n--\ndrivers/media/platform/qcom/iris/Makefile-31-\ndrivers/media/platform/qcom/iris/Makefile:32:obj-$(CONFIG_VIDEO_QCOM_IRIS) += qcom-iris.o\n--\ndrivers/media/platform/qcom/iris/iris_buffer.c=621=int iris_queue_internal_buffers(struct iris_inst *inst, u32 plane)\n--\ndrivers/media/platform/qcom/iris/iris_buffer.c-637-\t\t\t\tcontinue;\ndrivers/media/platform/qcom/iris/iris_buffer.c:638:\t\t\tif (buffer-\u003etype == BUF_DPB \u0026\u0026 inst-\u003estate != IRIS_INST_STREAMING) {\ndrivers/media/platform/qcom/iris/iris_buffer.c-639-\t\t\t\tbuffer-\u003eattr |= BUF_ATTR_DEFERRED;\n--\ndrivers/media/platform/qcom/iris/iris_buffer.h-5-\ndrivers/media/platform/qcom/iris/iris_buffer.h:6:#ifndef __IRIS_BUFFER_H__\ndrivers/media/platform/qcom/iris/iris_buffer.h:7:#define __IRIS_BUFFER_H__\ndrivers/media/platform/qcom/iris/iris_buffer.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_common.c=49=int iris_process_streamon_input(struct iris_inst *inst)\n--\ndrivers/media/platform/qcom/iris/iris_common.c-60-\ndrivers/media/platform/qcom/iris/iris_common.c:61:\tif (inst-\u003esub_state \u0026 IRIS_INST_SUB_INPUT_PAUSE) {\ndrivers/media/platform/qcom/iris/iris_common.c:62:\t\tret = iris_inst_change_sub_state(inst, IRIS_INST_SUB_INPUT_PAUSE, 0);\ndrivers/media/platform/qcom/iris/iris_common.c-63-\t\tif (ret)\n--\ndrivers/media/platform/qcom/iris/iris_common.c-67-\tif (inst-\u003edomain == DECODER \u0026\u0026\ndrivers/media/platform/qcom/iris/iris_common.c:68:\t    (inst-\u003esub_state \u0026 IRIS_INST_SUB_DRC ||\ndrivers/media/platform/qcom/iris/iris_common.c:69:\t     inst-\u003esub_state \u0026 IRIS_INST_SUB_DRAIN ||\ndrivers/media/platform/qcom/iris/iris_common.c:70:\t     inst-\u003esub_state \u0026 IRIS_INST_SUB_FIRST_IPSC)) {\ndrivers/media/platform/qcom/iris/iris_common.c:71:\t\tif (!(inst-\u003esub_state \u0026 IRIS_INST_SUB_INPUT_PAUSE)) {\ndrivers/media/platform/qcom/iris/iris_common.c-72-\t\t\tif (hfi_ops-\u003esession_pause) {\n--\ndrivers/media/platform/qcom/iris/iris_common.c-77-\t\t\t}\ndrivers/media/platform/qcom/iris/iris_common.c:78:\t\t\tset_sub_state = IRIS_INST_SUB_INPUT_PAUSE;\ndrivers/media/platform/qcom/iris/iris_common.c-79-\t\t}\n--\ndrivers/media/platform/qcom/iris/iris_common.c=91=int iris_process_streamon_output(struct iris_inst *inst)\n--\ndrivers/media/platform/qcom/iris/iris_common.c-99-\ndrivers/media/platform/qcom/iris/iris_common.c:100:\tfirst_ipsc = inst-\u003esub_state \u0026 IRIS_INST_SUB_FIRST_IPSC;\ndrivers/media/platform/qcom/iris/iris_common.c-101-\ndrivers/media/platform/qcom/iris/iris_common.c:102:\tdrain_active = inst-\u003esub_state \u0026 IRIS_INST_SUB_DRAIN \u0026\u0026\ndrivers/media/platform/qcom/iris/iris_common.c:103:\t\tinst-\u003esub_state \u0026 IRIS_INST_SUB_DRAIN_LAST;\ndrivers/media/platform/qcom/iris/iris_common.c-104-\ndrivers/media/platform/qcom/iris/iris_common.c:105:\tdrc_active = inst-\u003esub_state \u0026 IRIS_INST_SUB_DRC \u0026\u0026\ndrivers/media/platform/qcom/iris/iris_common.c:106:\t\tinst-\u003esub_state \u0026 IRIS_INST_SUB_DRC_LAST;\ndrivers/media/platform/qcom/iris/iris_common.c-107-\ndrivers/media/platform/qcom/iris/iris_common.c-108-\tif (drc_active)\ndrivers/media/platform/qcom/iris/iris_common.c:109:\t\tclear_sub_state = IRIS_INST_SUB_DRC | IRIS_INST_SUB_DRC_LAST;\ndrivers/media/platform/qcom/iris/iris_common.c-110-\telse if (drain_active)\ndrivers/media/platform/qcom/iris/iris_common.c:111:\t\tclear_sub_state = IRIS_INST_SUB_DRAIN | IRIS_INST_SUB_DRAIN_LAST;\ndrivers/media/platform/qcom/iris/iris_common.c-112-\n--\ndrivers/media/platform/qcom/iris/iris_common.c-125-\ndrivers/media/platform/qcom/iris/iris_common.c:126:\tif (inst-\u003estate == IRIS_INST_INPUT_STREAMING \u0026\u0026\ndrivers/media/platform/qcom/iris/iris_common.c:127:\t    inst-\u003esub_state \u0026 IRIS_INST_SUB_INPUT_PAUSE) {\ndrivers/media/platform/qcom/iris/iris_common.c-128-\t\tif (!drain_active)\n--\ndrivers/media/platform/qcom/iris/iris_common.c-135-\t\t\treturn ret;\ndrivers/media/platform/qcom/iris/iris_common.c:136:\t\tclear_sub_state |= IRIS_INST_SUB_INPUT_PAUSE;\ndrivers/media/platform/qcom/iris/iris_common.c-137-\t}\ndrivers/media/platform/qcom/iris/iris_common.c-138-\ndrivers/media/platform/qcom/iris/iris_common.c:139:\tif (inst-\u003esub_state \u0026 IRIS_INST_SUB_FIRST_IPSC)\ndrivers/media/platform/qcom/iris/iris_common.c:140:\t\tclear_sub_state |= IRIS_INST_SUB_FIRST_IPSC;\ndrivers/media/platform/qcom/iris/iris_common.c-141-\n--\ndrivers/media/platform/qcom/iris/iris_common.c-145-\ndrivers/media/platform/qcom/iris/iris_common.c:146:\tif (inst-\u003esub_state \u0026 IRIS_INST_SUB_OUTPUT_PAUSE)\ndrivers/media/platform/qcom/iris/iris_common.c:147:\t\tclear_sub_state |= IRIS_INST_SUB_OUTPUT_PAUSE;\ndrivers/media/platform/qcom/iris/iris_common.c-148-\n--\ndrivers/media/platform/qcom/iris/iris_common.c=190=static void iris_kill_session(struct iris_inst *inst)\n--\ndrivers/media/platform/qcom/iris/iris_common.c-197-\thfi_ops-\u003esession_close(inst);\ndrivers/media/platform/qcom/iris/iris_common.c:198:\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_common.c-199-}\n--\ndrivers/media/platform/qcom/iris/iris_common.h-5-\ndrivers/media/platform/qcom/iris/iris_common.h:6:#ifndef __IRIS_COMMON_H__\ndrivers/media/platform/qcom/iris/iris_common.h:7:#define __IRIS_COMMON_H__\ndrivers/media/platform/qcom/iris/iris_common.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_core.c=13=void iris_core_deinit(struct iris_core *core)\n--\ndrivers/media/platform/qcom/iris/iris_core.c-19-\tmutex_lock(\u0026core-\u003elock);\ndrivers/media/platform/qcom/iris/iris_core.c:20:\tif (core-\u003estate != IRIS_CORE_DEINIT) {\ndrivers/media/platform/qcom/iris/iris_core.c-21-\t\tiris_fw_unload(core);\n--\ndrivers/media/platform/qcom/iris/iris_core.c-26-\t\tiris_hfi_queues_deinit(core);\ndrivers/media/platform/qcom/iris/iris_core.c:27:\t\tcore-\u003estate = IRIS_CORE_DEINIT;\ndrivers/media/platform/qcom/iris/iris_core.c-28-\t}\n--\ndrivers/media/platform/qcom/iris/iris_core.c=35=static int iris_wait_for_system_response(struct iris_core *core)\n--\ndrivers/media/platform/qcom/iris/iris_core.c-38-\ndrivers/media/platform/qcom/iris/iris_core.c:39:\tif (core-\u003estate == IRIS_CORE_ERROR)\ndrivers/media/platform/qcom/iris/iris_core.c-40-\t\treturn -EIO;\n--\ndrivers/media/platform/qcom/iris/iris_core.c-44-\tif (!ret) {\ndrivers/media/platform/qcom/iris/iris_core.c:45:\t\tcore-\u003estate = IRIS_CORE_ERROR;\ndrivers/media/platform/qcom/iris/iris_core.c-46-\t\treturn -ETIMEDOUT;\n--\ndrivers/media/platform/qcom/iris/iris_core.c=52=int iris_core_init(struct iris_core *core)\n--\ndrivers/media/platform/qcom/iris/iris_core.c-56-\tmutex_lock(\u0026core-\u003elock);\ndrivers/media/platform/qcom/iris/iris_core.c:57:\tif (core-\u003estate == IRIS_CORE_INIT) {\ndrivers/media/platform/qcom/iris/iris_core.c-58-\t\tret = 0;\ndrivers/media/platform/qcom/iris/iris_core.c-59-\t\tgoto exit;\ndrivers/media/platform/qcom/iris/iris_core.c:60:\t} else if (core-\u003estate == IRIS_CORE_ERROR) {\ndrivers/media/platform/qcom/iris/iris_core.c-61-\t\tret = -EINVAL;\n--\ndrivers/media/platform/qcom/iris/iris_core.c-64-\ndrivers/media/platform/qcom/iris/iris_core.c:65:\tcore-\u003estate = IRIS_CORE_INIT;\ndrivers/media/platform/qcom/iris/iris_core.c-66-\n--\ndrivers/media/platform/qcom/iris/iris_core.c-103-error:\ndrivers/media/platform/qcom/iris/iris_core.c:104:\tcore-\u003estate = IRIS_CORE_DEINIT;\ndrivers/media/platform/qcom/iris/iris_core.c-105-exit:\n--\ndrivers/media/platform/qcom/iris/iris_core.h-5-\ndrivers/media/platform/qcom/iris/iris_core.h:6:#ifndef __IRIS_CORE_H__\ndrivers/media/platform/qcom/iris/iris_core.h:7:#define __IRIS_CORE_H__\ndrivers/media/platform/qcom/iris/iris_core.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_core.h=19=struct icc_info {\n--\ndrivers/media/platform/qcom/iris/iris_core.h-24-\ndrivers/media/platform/qcom/iris/iris_core.h:25:#define IRIS_FW_VERSION_LENGTH\t\t128\ndrivers/media/platform/qcom/iris/iris_core.h-26-#define IFACEQ_CORE_PKT_SIZE\t\t(1024 * 4)\n--\ndrivers/media/platform/qcom/iris/iris_ctrls.h-5-\ndrivers/media/platform/qcom/iris/iris_ctrls.h:6:#ifndef __IRIS_CTRLS_H__\ndrivers/media/platform/qcom/iris/iris_ctrls.h:7:#define __IRIS_CTRLS_H__\ndrivers/media/platform/qcom/iris/iris_ctrls.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_firmware.c-15-\ndrivers/media/platform/qcom/iris/iris_firmware.c:16:#define IRIS_PAS_ID\t\t\t\t9\ndrivers/media/platform/qcom/iris/iris_firmware.c-17-\n--\ndrivers/media/platform/qcom/iris/iris_firmware.c=111=static int iris_load_fw_to_memory(struct iris_core *core)\n--\ndrivers/media/platform/qcom/iris/iris_firmware.c-148-\tret = qcom_mdt_load(dev, firmware, fw_name,\ndrivers/media/platform/qcom/iris/iris_firmware.c:149:\t\t\t    IRIS_PAS_ID, mem_virt, mem_phys, res_size, NULL);\ndrivers/media/platform/qcom/iris/iris_firmware.c-150-\n--\ndrivers/media/platform/qcom/iris/iris_firmware.c=158=int iris_fw_load(struct iris_core *core)\n--\ndrivers/media/platform/qcom/iris/iris_firmware.c-168-\ndrivers/media/platform/qcom/iris/iris_firmware.c:169:\tret = qcom_pas_auth_and_reset(IRIS_PAS_ID);\ndrivers/media/platform/qcom/iris/iris_firmware.c-170-\tif (ret)  {\n--\ndrivers/media/platform/qcom/iris/iris_firmware.c-182-\t\t\tdev_err(core-\u003edev, \"qcom_scm_mem_protect_video_var failed: %d\\n\", ret);\ndrivers/media/platform/qcom/iris/iris_firmware.c:183:\t\t\tqcom_pas_shutdown(IRIS_PAS_ID);\ndrivers/media/platform/qcom/iris/iris_firmware.c-184-\t\t\treturn ret;\n--\ndrivers/media/platform/qcom/iris/iris_firmware.c=191=int iris_fw_unload(struct iris_core *core)\ndrivers/media/platform/qcom/iris/iris_firmware.c-192-{\ndrivers/media/platform/qcom/iris/iris_firmware.c:193:\treturn qcom_pas_shutdown(IRIS_PAS_ID);\ndrivers/media/platform/qcom/iris/iris_firmware.c-194-}\n--\ndrivers/media/platform/qcom/iris/iris_firmware.h-5-\ndrivers/media/platform/qcom/iris/iris_firmware.h:6:#ifndef __IRIS_FIRMWARE_H__\ndrivers/media/platform/qcom/iris/iris_firmware.h:7:#define __IRIS_FIRMWARE_H__\ndrivers/media/platform/qcom/iris/iris_firmware.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_common.h-5-\ndrivers/media/platform/qcom/iris/iris_hfi_common.h:6:#ifndef __IRIS_HFI_COMMON_H__\ndrivers/media/platform/qcom/iris/iris_hfi_common.h:7:#define __IRIS_HFI_COMMON_H__\ndrivers/media/platform/qcom/iris/iris_hfi_common.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1.h-5-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1.h:6:#ifndef __IRIS_HFI_GEN1_H__\ndrivers/media/platform/qcom/iris/iris_hfi_gen1.h:7:#define __IRIS_HFI_GEN1_H__\ndrivers/media/platform/qcom/iris/iris_hfi_gen1.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c=92=static int iris_hfi_gen1_session_open(struct iris_inst *inst)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-97-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c:98:\tif (inst-\u003estate != IRIS_INST_DEINIT)\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-99-\t\treturn -EALREADY;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c=151=static int iris_hfi_gen1_session_start(struct iris_inst *inst, u32 plane)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-159-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c:160:\tif (inst-\u003esub_state \u0026 IRIS_INST_SUB_LOAD_RESOURCES)\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-161-\t\treturn 0;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-184-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c:185:\treturn iris_inst_change_sub_state(inst, 0, IRIS_INST_SUB_LOAD_RESOURCES);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-186-}\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c=188=static int iris_hfi_gen1_session_stop(struct iris_inst *inst, u32 plane)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-196-\tif (inst-\u003edomain == DECODER) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c:197:\t\tif (inst-\u003estate == IRIS_INST_STREAMING) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-198-\t\t\tif (V4L2_TYPE_IS_OUTPUT(plane))\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-214-\t\t\t}\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c:215:\t\t} else if (inst-\u003esub_state \u0026 IRIS_INST_SUB_LOAD_RESOURCES) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-216-\t\t\treinit_completion(\u0026inst-\u003ecompletion);\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-228-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c:229:\t\t\tiris_inst_change_sub_state(inst, IRIS_INST_SUB_LOAD_RESOURCES, 0);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-230-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-236-\t} else {\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c:237:\t\tif (inst-\u003estate == IRIS_INST_STREAMING ||\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c:238:\t\t    inst-\u003estate == IRIS_INST_INPUT_STREAMING ||\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c:239:\t\t    inst-\u003estate == IRIS_INST_ERROR) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-240-\t\t\treinit_completion(\u0026inst-\u003ecompletion);\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-252-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c:253:\t\t\tiris_inst_change_sub_state(inst, IRIS_INST_SUB_LOAD_RESOURCES, 0);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-254-\t\t}\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c=789=static int iris_hfi_gen1_set_resolution(struct iris_inst *inst, u32 plane)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-794-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c:795:\tif (!iris_drc_pending(inst) \u0026\u0026 !(inst-\u003esub_state \u0026 IRIS_INST_SUB_FIRST_IPSC)) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_command.c-796-\t\tfs.buffer_type = HFI_BUFFER_INPUT;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h-5-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h:6:#ifndef __IRIS_HFI_GEN1_DEFINES_H__\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h:7:#define __IRIS_HFI_GEN1_DEFINES_H__\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_defines.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c=15=static void iris_hfi_gen1_read_changed_params(struct iris_inst *inst,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-170-\t\t\tevent.bit_depth, event.pic_struct);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:171:\t\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-172-\t}\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c=175=static void iris_hfi_gen1_event_seq_changed(struct iris_inst *inst,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-190-\tdefault:\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:191:\t\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-192-\t\treturn;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-196-\tif (!num_properties_changed) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:197:\t\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-198-\t\treturn;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-202-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:203:\tif (inst-\u003estate != IRIS_INST_ERROR \u0026\u0026 !(inst-\u003esub_state \u0026 IRIS_INST_SUB_FIRST_IPSC)) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-204-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c=218=iris_hfi_gen1_sys_event_notify(struct iris_core *core, void *packet)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-227-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:228:\tcore-\u003estate = IRIS_CORE_ERROR;\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-229-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-231-\tlist_for_each_entry(instance, \u0026core-\u003einstances, list)\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:232:\t\tiris_inst_change_state(instance, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-233-\tmutex_unlock(\u0026core-\u003elock);\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c=239=iris_hfi_gen1_event_session_error(struct iris_inst *inst, struct hfi_msg_event_notify_pkt *pkt)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-260-\t\tiris_vb2_queue_error(inst);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:261:\t\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-262-\t\tbreak;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c=282=static void iris_hfi_gen1_sys_init_done(struct iris_core *core, void *packet)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-286-\tif (pkt-\u003eerror_type != HFI_ERR_NONE) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:287:\t\tcore-\u003estate = IRIS_CORE_ERROR;\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-288-\t\treturn;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c=295=iris_hfi_gen1_sys_get_prop_image_version(struct iris_core *core,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-298-\tint req_bytes = pkt-\u003ehdr.size - sizeof(*pkt);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:299:\tchar fw_version[IRIS_FW_VERSION_LENGTH];\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-300-\tu8 *str_image_version;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-302-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:303:\tif (req_bytes \u003c IRIS_FW_VERSION_LENGTH - 1 || !pkt-\u003edata[0] || pkt-\u003enum_properties \u003e 1) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-304-\t\tdev_err(core-\u003edev, \"bad packet\\n\");\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-313-\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:314:\tfor (i = 0; i \u003c IRIS_FW_VERSION_LENGTH - 1; i++) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-315-\t\tif (str_image_version[i] != '\\0')\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c=343=static void iris_hfi_gen1_session_etb_done(struct iris_inst *inst, void *packet)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-367-\t\tiris_vb2_queue_error(inst);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:368:\t\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-369-\t}\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-383-error:\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:384:\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-385-\tdev_err(inst-\u003ecore-\u003edev, \"error in etb done\\n\");\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c=388=static void iris_hfi_gen1_session_ftb_done(struct iris_inst *inst, void *packet)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-531-error:\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:532:\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-533-\tdev_err(core-\u003edev, \"error in ftb done\\n\");\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c=596=static void iris_hfi_gen1_handle_response(struct iris_core *core, void *response)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-659-\t\t\tif (shdr-\u003eerror_type != HFI_ERR_NONE)\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c:660:\t\t\t\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen1_response.c-661-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2.h-5-\ndrivers/media/platform/qcom/iris/iris_hfi_gen2.h:6:#ifndef __IRIS_HFI_GEN2_H__\ndrivers/media/platform/qcom/iris/iris_hfi_gen2.h:7:#define __IRIS_HFI_GEN2_H__\ndrivers/media/platform/qcom/iris/iris_hfi_gen2.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_command.c=799=static int iris_hfi_gen2_session_open(struct iris_inst *inst)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_command.c-803-\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_command.c:804:\tif (inst-\u003estate != IRIS_INST_DEINIT)\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_command.c-805-\t\treturn -EALREADY;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_defines.h-5-\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_defines.h:6:#ifndef __IRIS_HFI_GEN2_DEFINES_H__\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_defines.h:7:#define __IRIS_HFI_GEN2_DEFINES_H__\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_defines.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_packet.h-5-\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_packet.h:6:#ifndef __IRIS_HFI_GEN2_PACKET_H__\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_packet.h:7:#define __IRIS_HFI_GEN2_PACKET_H__\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_packet.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c=235=static int iris_hfi_gen2_handle_session_error(struct iris_inst *inst,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-269-\tiris_vb2_queue_error(inst);\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:270:\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-271-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c=275=static int iris_hfi_gen2_handle_system_error(struct iris_core *core,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-282-\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:283:\tcore-\u003estate = IRIS_CORE_ERROR;\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-284-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-286-\tlist_for_each_entry(instance, \u0026core-\u003einstances, list)\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:287:\t\tiris_inst_change_state(instance, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-288-\tmutex_unlock(\u0026core-\u003elock);\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c=295=static int iris_hfi_gen2_handle_system_init(struct iris_core *core,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-298-\tif (!(pkt-\u003eflags \u0026 HFI_FW_FLAGS_SUCCESS)) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:299:\t\tcore-\u003estate = IRIS_CORE_ERROR;\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-300-\t\treturn 0;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c=308=static void iris_hfi_gen2_handle_session_close(struct iris_inst *inst,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-311-\tif (!(pkt-\u003eflags \u0026 HFI_FW_FLAGS_SUCCESS)) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:312:\t\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-313-\t\treturn;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c=348=static int iris_hfi_gen2_handle_output_buffer(struct iris_inst *inst,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-392-\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:393:\tif (!buf-\u003edata_size \u0026\u0026 inst-\u003estate == IRIS_INST_STREAMING \u0026\u0026\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-394-\t    !(hfi_buffer-\u003eflags \u0026 HFI_BUF_FW_FLAG_LAST)) {\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c=470=static int iris_hfi_gen2_handle_session_buffer(struct iris_inst *inst,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-478-\tif (!iris_hfi_gen2_validate_packet_payload(pkt)) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:479:\t\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-480-\t\treturn 0;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c=508=static int iris_hfi_gen2_handle_session_drain(struct iris_inst *inst,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-513-\tif (!(pkt-\u003eflags \u0026 HFI_FW_FLAGS_SUCCESS)) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:514:\t\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-515-\t\treturn 0;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-517-\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:518:\tif (inst-\u003esub_state \u0026 IRIS_INST_SUB_DRAIN)\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:519:\t\tret = iris_inst_change_sub_state(inst, 0, IRIS_INST_SUB_INPUT_PAUSE);\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-520-\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c=524=static void iris_hfi_gen2_read_input_subcr_params(struct iris_inst *inst)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-647-\t\t\tsubsc_params.bit_depth, subsc_params.coded_frames);\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:648:\t\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-649-\t}\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c=775=static int iris_hfi_gen2_handle_image_version_property(struct iris_core *core,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-779-\tu32 req_bytes = pkt-\u003esize - sizeof(*pkt);\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:780:\tchar fw_version[IRIS_FW_VERSION_LENGTH];\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-781-\tu32 i;\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-782-\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:783:\tif (req_bytes \u003c IRIS_FW_VERSION_LENGTH - 1)\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-784-\t\treturn -EINVAL;\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-785-\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:786:\tfor (i = 0; i \u003c IRIS_FW_VERSION_LENGTH - 1; i++) {\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-787-\t\tif (str_image_version[i] != '\\0')\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c=910=static int iris_hfi_gen2_handle_session_response(struct iris_core *core,\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-961-\t\t\t\tif (ret)\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:962:\t\t\t\t\tiris_inst_change_state(inst, IRIS_INST_ERROR);\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-963-\t\t\t}\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c=1011=void iris_hfi_gen2_response_handler(struct iris_core *core)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-1016-\t\tdev_err(core-\u003edev, \"cpu watchdog error received\\n\");\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c:1017:\t\tcore-\u003estate = IRIS_CORE_ERROR;\ndrivers/media/platform/qcom/iris/iris_hfi_gen2_response.c-1018-\t\tiris_hfi_gen2_handle_system_error(core, \u0026pkt);\n--\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c=112=int iris_hfi_queue_cmd_write_locked(struct iris_core *core, void *pkt, u32 pkt_size)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c-115-\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c:116:\tif (core-\u003estate == IRIS_CORE_ERROR || core-\u003estate == IRIS_CORE_DEINIT)\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c-117-\t\treturn -EINVAL;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c=155=int iris_hfi_queue_msg_read(struct iris_core *core, void *pkt)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c-160-\tmutex_lock(\u0026core-\u003elock);\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c:161:\tif (core-\u003estate != IRIS_CORE_INIT) {\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c-162-\t\tret = -EINVAL;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c=177=int iris_hfi_queue_dbg_read(struct iris_core *core, void *pkt)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c-182-\tmutex_lock(\u0026core-\u003elock);\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c:183:\tif (core-\u003estate != IRIS_CORE_INIT) {\ndrivers/media/platform/qcom/iris/iris_hfi_queue.c-184-\t\tret = -EINVAL;\n--\ndrivers/media/platform/qcom/iris/iris_hfi_queue.h-5-\ndrivers/media/platform/qcom/iris/iris_hfi_queue.h:6:#ifndef __IRIS_HFI_QUEUE_H__\ndrivers/media/platform/qcom/iris/iris_hfi_queue.h:7:#define __IRIS_HFI_QUEUE_H__\ndrivers/media/platform/qcom/iris/iris_hfi_queue.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_instance.h-5-\ndrivers/media/platform/qcom/iris/iris_instance.h:6:#ifndef __IRIS_INSTANCE_H__\ndrivers/media/platform/qcom/iris/iris_instance.h:7:#define __IRIS_INSTANCE_H__\ndrivers/media/platform/qcom/iris/iris_instance.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_instance.h=20=enum iris_fmt_type_out {\ndrivers/media/platform/qcom/iris/iris_instance.h:21:\tIRIS_FMT_H264,\ndrivers/media/platform/qcom/iris/iris_instance.h:22:\tIRIS_FMT_HEVC,\ndrivers/media/platform/qcom/iris/iris_instance.h:23:\tIRIS_FMT_VP9,\ndrivers/media/platform/qcom/iris/iris_instance.h:24:\tIRIS_FMT_AV1,\ndrivers/media/platform/qcom/iris/iris_instance.h-25-};\n--\ndrivers/media/platform/qcom/iris/iris_instance.h=27=enum iris_fmt_type_cap {\ndrivers/media/platform/qcom/iris/iris_instance.h:28:\tIRIS_FMT_NV12,\ndrivers/media/platform/qcom/iris/iris_instance.h:29:\tIRIS_FMT_QC08C,\ndrivers/media/platform/qcom/iris/iris_instance.h:30:\tIRIS_FMT_TP10,\ndrivers/media/platform/qcom/iris/iris_instance.h:31:\tIRIS_FMT_QC10C,\ndrivers/media/platform/qcom/iris/iris_instance.h-32-};\n--\ndrivers/media/platform/qcom/iris/iris_platform_common.h-5-\ndrivers/media/platform/qcom/iris/iris_platform_common.h:6:#ifndef __IRIS_PLATFORM_COMMON_H__\ndrivers/media/platform/qcom/iris/iris_platform_common.h:7:#define __IRIS_PLATFORM_COMMON_H__\ndrivers/media/platform/qcom/iris/iris_platform_common.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_platform_common.h=66=enum platform_clk_type {\ndrivers/media/platform/qcom/iris/iris_platform_common.h:67:\tIRIS_AXI_CLK, /* AXI0 in case of platforms with multiple AXI clocks */\ndrivers/media/platform/qcom/iris/iris_platform_common.h:68:\tIRIS_CTRL_CLK,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:69:\tIRIS_AHB_CLK,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:70:\tIRIS_HW_CLK,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:71:\tIRIS_HW_AHB_CLK,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:72:\tIRIS_AXI1_CLK,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:73:\tIRIS_CTRL_FREERUN_CLK,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:74:\tIRIS_HW_FREERUN_CLK,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:75:\tIRIS_BSE_HW_CLK,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:76:\tIRIS_VPP0_HW_CLK,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:77:\tIRIS_VPP1_HW_CLK,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:78:\tIRIS_APV_HW_CLK,\ndrivers/media/platform/qcom/iris/iris_platform_common.h-79-};\n--\ndrivers/media/platform/qcom/iris/iris_platform_common.h=234=enum platform_pm_domain_type {\ndrivers/media/platform/qcom/iris/iris_platform_common.h:235:\tIRIS_CTRL_POWER_DOMAIN,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:236:\tIRIS_HW_POWER_DOMAIN,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:237:\tIRIS_VPP0_HW_POWER_DOMAIN,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:238:\tIRIS_VPP1_HW_POWER_DOMAIN,\ndrivers/media/platform/qcom/iris/iris_platform_common.h:239:\tIRIS_APV_HW_POWER_DOMAIN,\ndrivers/media/platform/qcom/iris/iris_platform_common.h-240-};\n--\ndrivers/media/platform/qcom/iris/iris_platform_milos.h-2-\ndrivers/media/platform/qcom/iris/iris_platform_milos.h:3:#ifndef __IRIS_PLATFORM_MILOS_H__\ndrivers/media/platform/qcom/iris/iris_platform_milos.h:4:#define __IRIS_PLATFORM_MILOS_H__\ndrivers/media/platform/qcom/iris/iris_platform_milos.h-5-\n--\ndrivers/media/platform/qcom/iris/iris_platform_qcs8300.h-5-\ndrivers/media/platform/qcom/iris/iris_platform_qcs8300.h:6:#ifndef __IRIS_PLATFORM_QCS8300_H__\ndrivers/media/platform/qcom/iris/iris_platform_qcs8300.h:7:#define __IRIS_PLATFORM_QCS8300_H__\ndrivers/media/platform/qcom/iris/iris_platform_qcs8300.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_platform_sc7280.h-5-\ndrivers/media/platform/qcom/iris/iris_platform_sc7280.h:6:#ifndef __IRIS_PLATFORM_SC7280_H__\ndrivers/media/platform/qcom/iris/iris_platform_sc7280.h:7:#define __IRIS_PLATFORM_SC7280_H__\ndrivers/media/platform/qcom/iris/iris_platform_sc7280.h-8-\n--\ndrivers/media/platform/qcom/iris/iris_platform_sc7280.h=18=static const struct platform_clk_data sc7280_clk_table[] = {\ndrivers/media/platform/qcom/iris/iris_platform_sc7280.h:19:\t{IRIS_CTRL_CLK,    \"core\"         },\ndrivers/media/platform/qcom/iris/iris_platform_sc7280.h:20:\t{IRIS_AXI_CLK,     \"iface\"        },\ndrivers/media/platform/qcom/iris/iris_platform_sc7280.h:21:\t{IRIS_AHB_CLK,     \"bus\"          },\ndrivers/media/platform/qcom/iris/iris_platform_sc7280.h:22:\t{IRIS_HW_CLK,      \"vcodec_core\"  },\ndrivers/media/platform/qcom/iris/iris_platform_sc7280.h:23:\t{IRIS_HW_AHB_CLK,  \"vcodec_bus\"   },\ndrivers/media/platform/qcom/iris/iris_platform_sc7280.h-24-};\n--\n\n"
}

gemini-3.8-flash

null

null

							input: 17085
							output: 39
							thoughts: 25
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Diving into Iris Driver Configuration and Probe**

Right, let's get down to brass tacks. My initial thought is to immediately zero in on the core of the Iris driver's configuration and initial setup. I need to understand how the feature is enabled and how the platform knows it's present. Therefore, I'm directing my attention to two critical areas: `drivers/media/platform/qcom/iris/Kconfig` and `iris_probe`.

`Kconfig` is obviously where the feature's configuration options are defined. I need to verify its dependencies, the associated symbols, any conditional builds, and, crucially, how this feature's inclusion impacts the wider kernel build. I want to see how robust the configuration options are and if there are any obvious areas where misconfiguration could lead to issues.

Then, there's `iris_probe`. This is where the magic happens – or doesn't. This probe function is where the driver attempts to identify the Iris hardware on the system, initialize it, and register it with the framework. I'm looking for a few key things here: What detection methods are used? Are they reliable? How gracefully does it handle the case where Iris isn't present, or present but malfunctioning? I want to see the error handling; are the errors clear and informative? Also, I'm checking the resource allocation— how does the probe function request and manage the hardware resources? Any race conditions, potential conflicts? I'm already anticipating issues related to resource conflict if there are. The goal is to see how the system initially identifies the Iris component, how its initial steps are validated, and how it is activated at the lowest level.

{
  "File": "drivers/media/platform/qcom/iris/Kconfig",
  "FirstLine": 1,
  "LineCount": 50
}

{
  "Contents": "   1:\tconfig VIDEO_QCOM_IRIS\n   2:\t\ttristate \"Qualcomm iris V4L2 decoder driver\"\n   3:\t\tdepends on VIDEO_DEV\n   4:\t\tdepends on ARCH_QCOM || COMPILE_TEST\n   5:\t\tdepends on QCOM_SMEM || QCOM_SMEM=n\n   6:\t\tselect V4L2_MEM2MEM_DEV\n   7:\t\tselect QCOM_MDT_LOADER\n   8:\t\tselect QCOM_SCM\n   9:\t\tselect QCOM_PAS\n  10:\t\tselect QCOM_UBWC_CONFIG if ARCH_QCOM \u0026\u0026 QCOM_SMEM\n  11:\t\tselect VIDEOBUF2_DMA_CONTIG\n  12:\t\thelp\n  13:\t\t  This is a V4L2 driver for Qualcomm iris video accelerator\n  14:\t\t  hardware. It accelerates decoding operations on various\n  15:\t\t  Qualcomm SoCs.\n  16:\t\t  To compile this driver as a module choose m here.\n"
}

gemini-3.8-flash

null

null

							input: 17771
							output: 35
							thoughts: 72
						

Here's my understanding of the situation:

**Analyzing the Qualcomm Iris Decoder Driver**

Okay, so I'm looking at `VIDEO_QCOM_IRIS`, which I know is a Qualcomm iris V4L2 decoder driver. The dependency on `VIDEO_DEV` is straightforward, of course; a video device needs the core framework. And the `ARCH_QCOM || COMPILE_TEST` condition narrows down the target platforms or intended test environments. Now, the key question is how this thing actually *works*. I need to get a handle on the instantiation process. My immediate focus needs to be on the `iris_probe` function. That will tell me everything.

My guess is this driver is probably a platform driver, but I shouldn't take anything for granted. It’s also possible it's probing based on device tree information (`OF` – the Open Firmware mechanism). I need to check the code to see if it's using the standard platform driver registration functions, or if it's got some specific quirk for its hardware. Device tree usage would be common in the embedded space, so I'd need to confirm how it interacts with the device tree nodes. It's time to dig into the source and verify this.

{
  "Expression": "module_platform_driver",
  "PathPrefix": "drivers/media/platform/qcom/iris"
}

{
  "Output": "drivers/media/platform/qcom/iris/iris_probe.c=395=static struct platform_driver qcom_iris_driver = {\n--\ndrivers/media/platform/qcom/iris/iris_probe.c-404-\ndrivers/media/platform/qcom/iris/iris_probe.c:405:module_platform_driver(qcom_iris_driver);\ndrivers/media/platform/qcom/iris/iris_probe.c-406-MODULE_DESCRIPTION(\"Qualcomm iris video driver\");\n"
}

gemini-3.8-flash

null

null

							input: 18275
							output: 44
							thoughts: 22
						

Okay, let's dive in.

**Initial Examination: Iris Probe Code**

Right, I need to get a handle on this. The task is `drivers/media/platform/qcom/iris/iris_probe.c`. Sounds like it's a Qualcomm-specific camera probe function, likely related to the Iris sensor. Interesting, probably responsible for initializing and detecting the presence of the Iris sensor. I expect to see device initialization code, resource allocation, and maybe some interaction with the I2C or other control interfaces if it's external, or some internal device interface. I'll be looking for how the driver handles different Iris sensor revisions or configurations and how it interacts with the media framework. Let's see what we've got.

{
  "File": "drivers/media/platform/qcom/iris/iris_probe.c",
  "FirstLine": 350,
  "LineCount": 60
}

{
  "Contents": " 350:\t}\n 351:\t\n 352:\tstatic const struct dev_pm_ops iris_pm_ops = {\n 353:\t\tSET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,\n 354:\t\t\t\t\tpm_runtime_force_resume)\n 355:\t\tSET_RUNTIME_PM_OPS(iris_pm_suspend, iris_pm_resume, NULL)\n 356:\t};\n 357:\t\n 358:\tstatic const struct of_device_id iris_dt_match[] = {\n 359:\t\t{\n 360:\t\t\t.compatible = \"qcom,milos-iris\",\n 361:\t\t\t.data = \u0026milos_data,\n 362:\t\t},\n 363:\t\t{\n 364:\t\t\t.compatible = \"qcom,qcs8300-iris\",\n 365:\t\t\t.data = \u0026qcs8300_data,\n 366:\t\t},\n 367:\t\t{\n 368:\t\t\t.compatible = \"qcom,sc7280-venus\",\n 369:\t\t\t.data = \u0026sc7280_data,\n 370:\t\t},\n 371:\t\t{\n 372:\t\t\t.compatible = \"qcom,sm8250-venus\",\n 373:\t\t\t.data = \u0026sm8250_data,\n 374:\t\t},\n 375:\t\t{\n 376:\t\t\t.compatible = \"qcom,sm8550-iris\",\n 377:\t\t\t.data = \u0026sm8550_data,\n 378:\t\t},\n 379:\t\t{\n 380:\t\t\t.compatible = \"qcom,sm8650-iris\",\n 381:\t\t\t.data = \u0026sm8650_data,\n 382:\t\t},\n 383:\t\t{\n 384:\t\t\t.compatible = \"qcom,sm8750-iris\",\n 385:\t\t\t.data = \u0026sm8750_data,\n 386:\t\t},\n 387:\t\t{\n 388:\t\t\t.compatible = \"qcom,x1p42100-iris\",\n 389:\t\t\t.data = \u0026x1p42100_data,\n 390:\t\t},\n 391:\t\t{ },\n 392:\t};\n 393:\tMODULE_DEVICE_TABLE(of, iris_dt_match);\n 394:\t\n 395:\tstatic struct platform_driver qcom_iris_driver = {\n 396:\t\t.probe = iris_probe,\n 397:\t\t.remove = iris_remove,\n 398:\t\t.driver = {\n 399:\t\t\t.name = \"qcom-iris\",\n 400:\t\t\t.of_match_table = iris_dt_match,\n 401:\t\t\t.pm = \u0026iris_pm_ops,\n 402:\t\t},\n 403:\t};\n 404:\t\n 405:\tmodule_platform_driver(qcom_iris_driver);\n 406:\tMODULE_DESCRIPTION(\"Qualcomm iris video driver\");\n 407:\tMODULE_LICENSE(\"GPL\");\n"
}

gemini-3.8-flash

null

null

							input: 19347
							output: 44
							thoughts: 50
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Analyzing the Device Tree Matching in the Iris Driver**

Alright, so I'm looking at the `iris_dt_match` function, specifically how it handles Device Tree compatibles. I see it's designed to match strings like "qcom,sm8550-iris," which is standard practice for identifying hardware variations. Now, the key question that pops into my head is, *does this driver actually rely solely on the Device Tree node for initialization, or does it have the capability to probe even without one?* We've seen some of these drivers being a bit flexible on this front. To answer that question definitively, I need to dive deeper. My next step is to examine the `iris_probe` function. I'm going to look for any logic there that might account for cases where a Device Tree node isn't present, or perhaps some default initialization paths that don't depend on DT-provided properties. It's all about understanding the driver's fallback behavior and ensuring robust operation across various hardware configurations.

{
  "File": "drivers/media/platform/qcom/iris/iris_probe.c",
  "FirstLine": 295,
  "LineCount": 60
}

{
  "Contents": " 295:\t\tpm_runtime_set_autosuspend_delay(core-\u003edev, AUTOSUSPEND_DELAY_VALUE);\n 296:\t\tpm_runtime_use_autosuspend(core-\u003edev);\n 297:\t\tret = devm_pm_runtime_enable(core-\u003edev);\n 298:\t\tif (ret)\n 299:\t\t\tgoto err_vdev_unreg_enc;\n 300:\t\n 301:\t\treturn 0;\n 302:\t\n 303:\terr_vdev_unreg_enc:\n 304:\t\tvideo_unregister_device(core-\u003evdev_enc);\n 305:\terr_vdev_unreg_dec:\n 306:\t\tvideo_unregister_device(core-\u003evdev_dec);\n 307:\terr_v4l2_unreg:\n 308:\t\tv4l2_device_unregister(\u0026core-\u003ev4l2_dev);\n 309:\t\n 310:\t\treturn ret;\n 311:\t}\n 312:\t\n 313:\tstatic int __maybe_unused iris_pm_suspend(struct device *dev)\n 314:\t{\n 315:\t\tstruct iris_core *core;\n 316:\t\tint ret = 0;\n 317:\t\n 318:\t\tcore = dev_get_drvdata(dev);\n 319:\t\n 320:\t\tmutex_lock(\u0026core-\u003elock);\n 321:\t\tif (core-\u003estate != IRIS_CORE_INIT)\n 322:\t\t\tgoto exit;\n 323:\t\n 324:\t\tret = iris_hfi_pm_suspend(core);\n 325:\t\n 326:\texit:\n 327:\t\tmutex_unlock(\u0026core-\u003elock);\n 328:\t\n 329:\t\treturn ret;\n 330:\t}\n 331:\t\n 332:\tstatic int __maybe_unused iris_pm_resume(struct device *dev)\n 333:\t{\n 334:\t\tstruct iris_core *core;\n 335:\t\tint ret = 0;\n 336:\t\n 337:\t\tcore = dev_get_drvdata(dev);\n 338:\t\n 339:\t\tmutex_lock(\u0026core-\u003elock);\n 340:\t\tif (core-\u003estate != IRIS_CORE_INIT)\n 341:\t\t\tgoto exit;\n 342:\t\n 343:\t\tret = iris_hfi_pm_resume(core);\n 344:\t\tpm_runtime_mark_last_busy(core-\u003edev);\n 345:\t\n 346:\texit:\n 347:\t\tmutex_unlock(\u0026core-\u003elock);\n 348:\t\n 349:\t\treturn ret;\n 350:\t}\n 351:\t\n 352:\tstatic const struct dev_pm_ops iris_pm_ops = {\n 353:\t\tSET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,\n 354:\t\t\t\t\tpm_runtime_force_resume)\n"
}

gemini-3.8-flash

null

null

							input: 20511
							output: 44
							thoughts: 12
						

Okay, here's my take on those thoughts, tailored for an expert audience, and delivered as a first-person summary:

**Initial Assessment: Iris_Probe - The Starting Point**

Alright, let's dive into this `iris_probe`. My first instinct, as always, is to anchor myself in the basics. Where does this analysis begin? I need to immediately understand the initial setup of `iris_probe`. Is it loading data? Initializing variables? Defining the core measurement loop? The beginning holds the critical context. I need to understand what the starting assumptions are, any data pre-processing, and initial setup to properly understand what comes next. Understanding the initialization stage is always key to grasping the overall flow.

{
  "File": "drivers/media/platform/qcom/iris/iris_probe.c",
  "FirstLine": 180,
  "LineCount": 80
}

{
  "Contents": " 180:\t\n 181:\t\tret = video_register_device(vdev, VFL_TYPE_VIDEO, -1);\n 182:\t\tif (ret)\n 183:\t\t\tgoto err_vdev_release;\n 184:\t\n 185:\t\tvideo_set_drvdata(vdev, core);\n 186:\t\n 187:\t\treturn 0;\n 188:\t\n 189:\terr_vdev_release:\n 190:\t\tvideo_device_release(vdev);\n 191:\t\n 192:\t\treturn ret;\n 193:\t}\n 194:\t\n 195:\tstatic void iris_remove(struct platform_device *pdev)\n 196:\t{\n 197:\t\tstruct iris_core *core;\n 198:\t\n 199:\t\tcore = platform_get_drvdata(pdev);\n 200:\t\tif (!core)\n 201:\t\t\treturn;\n 202:\t\n 203:\t\tiris_core_deinit(core);\n 204:\t\n 205:\t\tvideo_unregister_device(core-\u003evdev_dec);\n 206:\t\tvideo_unregister_device(core-\u003evdev_enc);\n 207:\t\n 208:\t\tv4l2_device_unregister(\u0026core-\u003ev4l2_dev);\n 209:\t\n 210:\t\tmutex_destroy(\u0026core-\u003elock);\n 211:\t}\n 212:\t\n 213:\tstatic void iris_sys_error_handler(struct work_struct *work)\n 214:\t{\n 215:\t\tstruct iris_core *core =\n 216:\t\t\t\tcontainer_of(work, struct iris_core, sys_error_handler.work);\n 217:\t\n 218:\t\tiris_core_deinit(core);\n 219:\t\tiris_core_init(core);\n 220:\t}\n 221:\t\n 222:\tstatic int iris_probe(struct platform_device *pdev)\n 223:\t{\n 224:\t\tstruct device *dev = \u0026pdev-\u003edev;\n 225:\t\tstruct iris_core *core;\n 226:\t\tu64 dma_mask;\n 227:\t\tint ret;\n 228:\t\n 229:\t\tcore = devm_kzalloc(\u0026pdev-\u003edev, sizeof(*core), GFP_KERNEL);\n 230:\t\tif (!core)\n 231:\t\t\treturn -ENOMEM;\n 232:\t\tcore-\u003edev = dev;\n 233:\t\n 234:\t\tcore-\u003estate = IRIS_CORE_DEINIT;\n 235:\t\tmutex_init(\u0026core-\u003elock);\n 236:\t\tinit_completion(\u0026core-\u003ecore_init_done);\n 237:\t\n 238:\t\tcore-\u003eresponse_packet = devm_kzalloc(core-\u003edev, IFACEQ_CORE_PKT_SIZE, GFP_KERNEL);\n 239:\t\tif (!core-\u003eresponse_packet)\n 240:\t\t\treturn -ENOMEM;\n 241:\t\n 242:\t\tINIT_LIST_HEAD(\u0026core-\u003einstances);\n 243:\t\tINIT_DELAYED_WORK(\u0026core-\u003esys_error_handler, iris_sys_error_handler);\n 244:\t\n 245:\t\tcore-\u003ereg_base = devm_platform_ioremap_resource(pdev, 0);\n 246:\t\tif (IS_ERR(core-\u003ereg_base))\n 247:\t\t\treturn PTR_ERR(core-\u003ereg_base);\n 248:\t\n 249:\t\tcore-\u003eirq = platform_get_irq(pdev, 0);\n 250:\t\tif (core-\u003eirq \u003c 0)\n 251:\t\t\treturn core-\u003eirq;\n 252:\t\n 253:\t\tcore-\u003eiris_platform_data = of_device_get_match_data(core-\u003edev);\n 254:\t\n 255:\t\tcore-\u003eubwc_cfg = qcom_ubwc_config_get_data();\n 256:\t\tif (IS_ERR(core-\u003eubwc_cfg))\n 257:\t\t\treturn PTR_ERR(core-\u003eubwc_cfg);\n 258:\t\n 259:\t\tret = devm_request_threaded_irq(core-\u003edev, core-\u003eirq, iris_hfi_isr,\n"
}

gemini-3.8-flash

null

null

							input: 21887
							output: 39
							thoughts: 156
						

**Analyzing the Iris Probe Driver**

Okay, let's break this down. My initial assessment of `iris_probe` is that it's handling the initialization of the Qualcomm SoC Iris VPU hardware. First, it's mapping the register base using `devm_platform_ioremap_resource` from the platform device. That makes sense; we're dealing with hardware, so we need access to its memory-mapped registers. Then, it's getting the interrupt request number using `platform_get_irq`, which is critical for interrupt-driven operation. After that, `of_device_get_match_data` suggests that it's getting platform-specific data using device tree bindings. And I see a call to `qcom_ubwc_config_get_data()`. That's intriguing; UBWC suggests Ultra Bandwidth Compression - this driver likely supports video encoding or decoding, or at least relates to data transfer. Finally, a `devm_request_threaded_irq` call confirms that it's handling interrupts properly with a threaded handler.

Now, my next step is clear. I want to understand how the hardware mode is being set. It's imperative that I inspect the calls to `iris_vpu_set_hwmode`. I need to figure out how the hardware is being configured and how this driver interacts with the underlying Iris VPU.

{
  "Expression": "iris_vpu_set_hwmode",
  "PathPrefix": "drivers/media/platform/qcom/iris"
}

{
  "Output": "drivers/media/platform/qcom/iris/iris_vpu2.c=41=const struct vpu_ops iris_vpu2_ops = {\n--\ndrivers/media/platform/qcom/iris/iris_vpu2.c-46-\t.calc_freq = iris_vpu2_calc_freq,\ndrivers/media/platform/qcom/iris/iris_vpu2.c:47:\t.set_hwmode = iris_vpu_set_hwmode,\ndrivers/media/platform/qcom/iris/iris_vpu2.c-48-};\n--\ndrivers/media/platform/qcom/iris/iris_vpu3x.c=257=const struct vpu_ops iris_vpu3_ops = {\n--\ndrivers/media/platform/qcom/iris/iris_vpu3x.c-262-\t.calc_freq = iris_vpu3x_vpu4x_calculate_frequency,\ndrivers/media/platform/qcom/iris/iris_vpu3x.c:263:\t.set_hwmode = iris_vpu_set_hwmode,\ndrivers/media/platform/qcom/iris/iris_vpu3x.c-264-};\n--\ndrivers/media/platform/qcom/iris/iris_vpu3x.c=266=const struct vpu_ops iris_vpu33_ops = {\n--\ndrivers/media/platform/qcom/iris/iris_vpu3x.c-271-\t.calc_freq = iris_vpu3x_vpu4x_calculate_frequency,\ndrivers/media/platform/qcom/iris/iris_vpu3x.c:272:\t.set_hwmode = iris_vpu_set_hwmode,\ndrivers/media/platform/qcom/iris/iris_vpu3x.c-273-};\n--\ndrivers/media/platform/qcom/iris/iris_vpu3x.c=275=const struct vpu_ops iris_vpu35_ops = {\n--\ndrivers/media/platform/qcom/iris/iris_vpu3x.c-281-\t.calc_freq = iris_vpu3x_vpu4x_calculate_frequency,\ndrivers/media/platform/qcom/iris/iris_vpu3x.c:282:\t.set_hwmode = iris_vpu_set_hwmode,\ndrivers/media/platform/qcom/iris/iris_vpu3x.c-283-};\n--\ndrivers/media/platform/qcom/iris/iris_vpu_common.c=280=int iris_vpu_power_on_hw(struct iris_core *core)\n--\ndrivers/media/platform/qcom/iris/iris_vpu_common.c-311-\ndrivers/media/platform/qcom/iris/iris_vpu_common.c:312:int iris_vpu_set_hwmode(struct iris_core *core)\ndrivers/media/platform/qcom/iris/iris_vpu_common.c-313-{\n--\ndrivers/media/platform/qcom/iris/iris_vpu_common.h=33=int iris_vpu_power_on_hw(struct iris_core *core);\ndrivers/media/platform/qcom/iris/iris_vpu_common.h:34:int iris_vpu_set_hwmode(struct iris_core *core);\ndrivers/media/platform/qcom/iris/iris_vpu_common.h-35-int iris_vpu_switch_to_hwmode(struct iris_core *core);\n"
}

gemini-3.8-flash

null

null

							input: 23280
							output: 35
							thoughts: 14
						

Here's my take on those thoughts, tailored for an expert audience:

**Investigating the `.set_hwmode` Invocation**

Okay, so I'm diving into this `.set_hwmode` method. First things first, I need to understand its context. Knowing where it's being called from is key to figuring out its purpose and potential impact. My immediate thought is, "Where does this thing *actually* get used?". I need to trace its invocations throughout the codebase.  Are we talking about it only being used in this module, or does it cross boundaries. I need to understand its scope. I'll need to use my usual debugging tools - probably a global search through the project (or maybe even a more sophisticated static analysis tool, depending on the project's size and complexity) to pinpoint all instances where `.set_hwmode` is invoked. Once I have the list, I can start to build a mental map of its role and how it fits into the larger system architecture. This is where the real work begins: understanding the logic surrounding each call and how the hardware mode is being set (or potentially modified).

{
  "Expression": "-\u003eset_hwmode",
  "PathPrefix": "drivers/media/platform/qcom/iris"
}

{
  "Output": "drivers/media/platform/qcom/iris/iris_vpu_common.c=322=int iris_vpu_switch_to_hwmode(struct iris_core *core)\ndrivers/media/platform/qcom/iris/iris_vpu_common.c-323-{\ndrivers/media/platform/qcom/iris/iris_vpu_common.c:324:\treturn core-\u003eiris_platform_data-\u003evpu_ops-\u003eset_hwmode(core);\ndrivers/media/platform/qcom/iris/iris_vpu_common.c-325-}\n"
}

gemini-3.8-flash

null

null

							input: 23721
							output: 41
							thoughts: 18
						

Okay, here's my attempt at summarizing that thought process, keeping in mind the user is an expert:

**Tracing the `iris_vpu_switch_to_hwmode` Call**

Alright, so the question immediately that pops into my head is, "where the heck is `iris_vpu_switch_to_hwmode` actually *called*?" It's a key function, obviously, likely managing the hardware context of the VPU. To understand its role, I need to know the call paths. Knowing where it's used will tell me what systems rely on it, and what that might inform about the likely purpose, and any possible areas to investigate. Is it triggered during initialization, when switching between power states, as part of a specific workload request, or is it more of a diagnostic helper? Understanding the contexts around the call will lead to greater insight into its intent, and therefore how to best analyze its implications. Time to start digging through the call graph.

{
  "Expression": "iris_vpu_switch_to_hwmode",
  "PathPrefix": "drivers/media/platform/qcom/iris"
}

{
  "Output": "drivers/media/platform/qcom/iris/iris_core.c=52=int iris_core_init(struct iris_core *core)\n--\ndrivers/media/platform/qcom/iris/iris_core.c-82-\ndrivers/media/platform/qcom/iris/iris_core.c:83:\tret = iris_vpu_switch_to_hwmode(core);\ndrivers/media/platform/qcom/iris/iris_core.c-84-\tif (ret)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_common.c=145=int iris_hfi_pm_resume(struct iris_core *core)\n--\ndrivers/media/platform/qcom/iris/iris_hfi_common.c-161-\ndrivers/media/platform/qcom/iris/iris_hfi_common.c:162:\tret = iris_vpu_switch_to_hwmode(core);\ndrivers/media/platform/qcom/iris/iris_hfi_common.c-163-\tif (ret)\n--\ndrivers/media/platform/qcom/iris/iris_vpu_common.c=312=int iris_vpu_set_hwmode(struct iris_core *core)\n--\ndrivers/media/platform/qcom/iris/iris_vpu_common.c-321-\ndrivers/media/platform/qcom/iris/iris_vpu_common.c:322:int iris_vpu_switch_to_hwmode(struct iris_core *core)\ndrivers/media/platform/qcom/iris/iris_vpu_common.c-323-{\n--\ndrivers/media/platform/qcom/iris/iris_vpu_common.h=34=int iris_vpu_set_hwmode(struct iris_core *core);\ndrivers/media/platform/qcom/iris/iris_vpu_common.h:35:int iris_vpu_switch_to_hwmode(struct iris_core *core);\ndrivers/media/platform/qcom/iris/iris_vpu_common.h-36-int iris_vpu_power_on(struct iris_core *core);\n"
}

gemini-3.8-flash

null

null

							input: 24533
							output: 153
							thoughts: 1911
						

**Reachability Analysis for the Qualcomm Iris Driver on amd64**

Okay, let's break this down systematically. My objective is to determine if this Qualcomm Iris V4L2 decoder driver, specifically the modified code, is reachable in a standard fuzzing environment, targeting amd64. First, the Kconfig confirms the driver's dependencies: it needs `VIDEO_DEV` and depends on either `ARCH_QCOM` or `COMPILE_TEST`. The question immediately arises: can this driver even *probe* in a typical QEMU or GCE setup on amd64? This is key.

My focus goes to the triage philosophy's reachability criteria. I know I should return `WorthFuzzing=false` if the changes fall into the "Structurally unreachable hardware" category, specifically if a driver requires hardware not emulated in standard QEMU. That's a red flag.

Diving into the code, it's quickly apparent this is a `module_platform_driver` for a Qualcomm platform, using a Device Tree (`iris_dt_match`) for device matching. The `iris_probe` function confirms the dependencies: it maps registers via `devm_platform_ioremap_resource`, gets an IRQ, retrieves platform data using `of_device_get_match_data`, and gets `qcom_ubwc_config_get_data`.  The crucial point is that this driver's probe path is triggered by specific Device Tree entries that are specific to *Qualcomm SoCs*. The `iris_dt_match` array confirms this: Milos, QCS8300, SC7280, SM8250, SM8550, SM8650, SM8750, and X1P42100.  All Qualcomm ARM SoCs, no x86_64 in sight.

Further analysis reveals that the driver also uses Qualcomm's PAS (Peripheral Authentication Service) via SCM (Secure Channel Manager/TrustZone) with `qcom_pas_auth_and_reset`. This requires Qualcomm's secure firmware and a TrustZone environment, which is not available in standard QEMU or GCE. Additionally, `devm_platform_ioremap_resource` relies on MMIO resources provided by the platform device and device tree.

The question then becomes: could one *create* a platform device by other means? Even if that were possible, the probe requires *specific* Device Tree data, MMIO resources, interrupts, clocks, power domains, and Qualcomm's SCM authentication.  None of this is emulated or present in standard virtualized environments.

This confirms the triage philosophy.  Reachability is the primary gate, and this driver, on amd64, is structurally unreachable. The modified code is within `drivers/media/platform/qcom/iris/`, specifically for the Qualcomm Iris V4L2 decoder. The driver is exclusive to Qualcomm SoCs and depends on hardware not available in standard virtualized environments.  The target architecture is amd64.  The driver can only be compiled via `COMPILE_TEST` on amd64, but will never probe or execute.

Therefore, WorthFuzzing is definitively `false`. There are no focus symbols, no enable configs, and my reasoning is complete: the patch is in the Qualcomm Iris driver, designed for their SoCs, requiring specific hardware and firmware components not emulated in QEMU/GCE on amd64, making the modified code structurally unreachable. I can confidently call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The modified code is in drivers/media/platform/qcom/iris/iris_vpu_common.c, which belongs to the Qualcomm Iris V4L2 video decoder platform driver. This driver is specific to Qualcomm SoCs (depends on ARCH_QCOM || COMPILE_TEST) and requires Qualcomm SoC hardware, Device Tree bindings, and Qualcomm SCM/PAS firmware infrastructure. On the target architecture (amd64), this hardware is structurally absent and not emulated in standard virtualized fuzzing environments (QEMU/GCE), making the modified code unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The modified code is in drivers/media/platform/qcom/iris/iris_vpu_common.c, which belongs to the Qualcomm Iris V4L2 video decoder platform driver. This driver is specific to Qualcomm SoCs (depends on ARCH_QCOM || COMPILE_TEST) and requires Qualcomm SoC hardware, Device Tree bindings, and Qualcomm SCM/PAS firmware infrastructure. On the target architecture (amd64), this hardware is structurally absent and not emulated in standard virtualized fuzzing environments (QEMU/GCE), making the modified code unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null