Phase 8.4: daemon ↔ kernel decode round-trip (VP9 end-to-end)

Wires the Phase 8.3 FFmpeg loader through the Phase 8.2 chardev
bridge: kernel injects REQ_DECODE carrying a raw VP9 access unit,
daemon hands the bitstream to libavcodec via dlopen, sends
RESP_FRAME back with a content-dependent FNV-1a digest of the
decoded YUV planes. Pure CPU decode for now — Phase 8.5 swaps in
dmabuf + QPU dispatch.

Protocol (include/daedalus_v4l2_proto.h):
- New REQ_DECODE (kernel→daemon) and RESP_FRAME (daemon→kernel)
  message types, with fixed-size payload structs.
- New DAEDALUS_CODEC_VP9/AV1/H264 enum (wire-stable so 8.6's
  AV1+H.264 work doesn't move existing values).
- New DAEDALUS_DECODE_* status enum (OK / NO_FRAME / ERR_OPEN /
  ERR_SEND / ERR_RECV / ERR_CODEC).
- Converted the prior `enum daedalus_msg_type` to #defines —
  high-bit values exceed INT_MAX and tripped -Wpedantic on
  userspace; kernel uABI headers use the same idiom.

Kernel (kernel/daedalus_v4l2_chardev.c):
- New debugfs entry /sys/kernel/debug/daedalus_v4l2/test_decode:
  writing raw bitstream bytes wraps them in a REQ_DECODE
  (codec=VP9 for Phase 8.4) and enqueues with an
  auto-incrementing cookie.
- daedalus_chardev_write learned RESP_FRAME: parses the payload
  and emits a single pr_info line with decode metadata. Keeps
  existing PONG handling on the default arm.

Daemon (daemon/src/...):
- chardev_client.{c,h} — opens /dev/daedalus-v4l2, blocking read
  loop, single-buffer write() responses (kernel chardev has only
  .write, not .write_iter, so writev lands as -EINVAL —
  discovered the hard way during first run).
- decoder.{c,h} — lazily-opened AVCodecContext per codec, shared
  AVPacket/AVFrame pair, descriptor-driven plane walker
  (av_pix_fmt_desc_get) so the same hash path covers YUV420P,
  YUV422P, YUV444P, GBRP and other 8-bit planar layouts.
  Generalised after first run decoded testsrc as GBRP (71)
  rather than the assumed YUV420P.
- `daemon` command in main.c opens the chardev and runs the loop
  until SIGINT/SIGTERM. Cookie correlation handled end-to-end.
- ffmpeg_loader gained av_pix_fmt_desc_get (23 symbols total).

Build:
- CMakeLists adds chardev_client.c + decoder.c; explicit
  -I../include for the shared protocol header.
- Still -Wall -Wextra -Wpedantic clean.

Verification on hertz (Pi 5, 6.12.75+rpt-rpi-2712):

  $ ffmpeg ... -pix_fmt yuv420p -c:v libvpx-vp9 -frames:v 1 \
           -y /tmp/vp9_test.ivf
  $ python3 ... strip IVF framing → vp9_keyframe.bin (3268 B)

  $ sudo insmod kernel/daedalus_v4l2.ko
  $ daedalus_v4l2_daemon -v daemon &
  $ sudo dd if=vp9_keyframe.bin \
         of=/sys/kernel/debug/daedalus_v4l2/test_decode

  daemon: REQ_DECODE cookie=2 → decoded yuv420p 320x240
          fnv1a=0x6ef10d71 luma=76800 chroma=38400
  kernel: RESP_FRAME cookie=2 status=0 320x240 pixfmt=0
          fnv1a=0x6ef10d71  ← matches daemon ✓

Hash properties verified:
  cookie=2  testsrc 3268 B → 0x6ef10d71  (first decode)
  cookie=3  red     44 B   → 0x7f6e5dc5  (content-dependent ✓)
  cookie=4  testsrc 3268 B → 0x6ef10d71  (deterministic ✓)
  cookie=5  64 B random    → status=101  (ERR_SEND, daemon alive)

Daemon survives bad input (FFmpeg "Invalid sync code" wrapped
into structured ERR_SEND response). Clean SIGTERM shutdown,
clean rmmod.

Phase 8.4 acceptance criteria met:
- ✓ end-to-end kernel→daemon→FFmpeg→kernel round-trip
- ✓ cookie correlation per request/response pair
- ✓ content-dependent + deterministic digest
- ✓ structured error responses (no daemon crash on bad input)
- ✓ clean teardown (SIGTERM + rmmod)
- ✓ builds clean on both kernel kbuild and daemon CMake

Per correctness-before-speed:
- Real chardev I/O (no shortcuts, no select-loop hacks)
- Real FFmpeg AVCodecContext lifecycle (lazily opened, properly
  freed on cleanup)
- Descriptor-driven plane walk (generalises across pix_fmts)
- Structured error path (not just log-and-continue)
- All resource paths cleaned up on every error branch
- Documented why FNV-1a digest, why write() not writev(), why
  pix_desc walk in docs/phase_8_4_closure.md

Phase 8.5 next: V4L2 m2m queue submits REQ_DECODE from
vidioc_qbuf; dmabuf carries actual pixel data so the chardev's
64 KiB cap doesn't gate frame size; begin substituting
daedalus_dispatch_* into the daemon's decode path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

daemon/src/chardev_client.c

@@ -0,0 +1,262 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * chardev_client.c — kernel-bridge client for the daedalus-v4l2 daemon.
+ */
+#include "chardev_client.h"
+#include "decoder.h"
+#include "ffmpeg_loader.h"
+#include "log.h"
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <poll.h>
+
+#define CHARDEV_PATH		"/dev/daedalus-v4l2"
+#define CHARDEV_READ_BUFSZ	(sizeof(struct daedalus_msg_hdr) + \
+				 DAEDALUS_PROTO_MAX_PAYLOAD)
+
+int chardev_client_open(struct chardev_client *cli,
+			struct ffmpeg_loader *loader,
+			volatile sig_atomic_t *stop_flag)
+{
+	int fd, rc;
+
+	memset(cli, 0, sizeof(*cli));
+	cli->fd		 = -1;
+	cli->loader	 = loader;
+	cli->stop_flag	 = stop_flag;
+
+	fd = open(CHARDEV_PATH, O_RDWR | O_CLOEXEC);
+	if (fd < 0) {
+		rc = -errno;
+		log_err("open(%s): %s", CHARDEV_PATH, strerror(errno));
+		return rc;
+	}
+
+	cli->decoder = calloc(1, sizeof(*cli->decoder));
+	if (!cli->decoder) {
+		close(fd);
+		return -ENOMEM;
+	}
+	rc = daedalus_decoder_init(cli->decoder, loader);
+	if (rc < 0) {
+		free(cli->decoder);
+		cli->decoder = NULL;
+		close(fd);
+		log_err("daedalus_decoder_init: %d", rc);
+		return rc;
+	}
+
+	cli->fd = fd;
+	log_info("chardev: opened %s (fd %d)", CHARDEV_PATH, fd);
+	return 0;
+}
+
+void chardev_client_close(struct chardev_client *cli)
+{
+	if (!cli)
+		return;
+	if (cli->decoder) {
+		daedalus_decoder_cleanup(cli->decoder);
+		free(cli->decoder);
+		cli->decoder = NULL;
+	}
+	if (cli->fd >= 0) {
+		close(cli->fd);
+		cli->fd = -1;
+	}
+}
+
+static int send_response(struct chardev_client *cli, uint32_t type,
+			 uint32_t cookie, const void *payload,
+			 size_t payload_len)
+{
+	struct daedalus_msg_hdr hdr;
+	int rc;
+
+	if (payload_len > DAEDALUS_PROTO_MAX_PAYLOAD)
+		return -EMSGSIZE;
+
+	hdr.magic	 = DAEDALUS_PROTO_MAGIC;
+	hdr.version	 = DAEDALUS_PROTO_VERSION;
+	hdr.type	 = type;
+	hdr.cookie	 = cookie;
+	hdr.payload_len	 = (uint32_t) payload_len;
+	hdr.reserved	 = 0;
+
+	/*
+	 * The kernel's write() path validates count == sizeof(hdr)
+	 * + hdr.payload_len in a single call, and only implements
+	 * .write (not .write_iter), so a writev() lands as -EINVAL.
+	 * Marshal the message into a single buffer and write() it.
+	 *
+	 * Response payloads are small (struct daedalus_resp_frame =
+	 * 36 bytes; PONG echoes <= 64 KiB).  A short-lived heap
+	 * allocation per response is fine; per-loop reuse can come
+	 * later if profiling demands it.
+	 */
+	{
+		size_t total = sizeof(hdr) + payload_len;
+		uint8_t *out = malloc(total);
+		ssize_t n;
+
+		if (!out)
+			return -ENOMEM;
+		memcpy(out, &hdr, sizeof(hdr));
+		if (payload_len)
+			memcpy(out + sizeof(hdr), payload, payload_len);
+
+		for (;;) {
+			n = write(cli->fd, out, total);
+			if (n >= 0) {
+				if ((size_t) n != total) {
+					log_err("chardev: short write %zd != %zu",
+						n, total);
+					rc = -EIO;
+				} else {
+					rc = 0;
+				}
+				break;
+			}
+			if (errno == EINTR)
+				continue;
+			rc = -errno;
+			log_err("chardev: write: %s", strerror(errno));
+			break;
+		}
+		free(out);
+	}
+	return rc;
+}
+
+static int handle_req_decode(struct chardev_client *cli,
+			     const struct daedalus_msg_hdr *hdr,
+			     const uint8_t *payload)
+{
+	struct daedalus_req_decode req;
+	struct daedalus_resp_frame resp;
+	int rc;
+
+	if (hdr->payload_len < sizeof(req)) {
+		log_err("REQ_DECODE cookie=%u: payload too short %u < %zu",
+			hdr->cookie, hdr->payload_len, sizeof(req));
+		memset(&resp, 0, sizeof(resp));
+		resp.status = DAEDALUS_DECODE_ERR_RECV;
+		return send_response(cli, DAEDALUS_MSG_RESP_FRAME,
+				     hdr->cookie, &resp, sizeof(resp));
+	}
+	memcpy(&req, payload, sizeof(req));
+	if ((size_t) req.bitstream_len + sizeof(req) != hdr->payload_len) {
+		log_err("REQ_DECODE cookie=%u: bitstream_len %u inconsistent with payload_len %u",
+			hdr->cookie, req.bitstream_len, hdr->payload_len);
+		memset(&resp, 0, sizeof(resp));
+		resp.status = DAEDALUS_DECODE_ERR_RECV;
+		return send_response(cli, DAEDALUS_MSG_RESP_FRAME,
+				     hdr->cookie, &resp, sizeof(resp));
+	}
+
+	log_info("REQ_DECODE cookie=%u codec=%u bitstream=%u bytes",
+		 hdr->cookie, req.codec_id, req.bitstream_len);
+
+	rc = daedalus_decoder_run_request(cli->decoder, &req,
+					  payload + sizeof(req), &resp);
+	if (rc < 0)
+		return rc;
+
+	return send_response(cli, DAEDALUS_MSG_RESP_FRAME, hdr->cookie,
+			     &resp, sizeof(resp));
+}
+
+static int handle_ping(struct chardev_client *cli,
+		       const struct daedalus_msg_hdr *hdr,
+		       const uint8_t *payload)
+{
+	log_info("PING cookie=%u plen=%u — echoing PONG",
+		 hdr->cookie, hdr->payload_len);
+	return send_response(cli, DAEDALUS_MSG_PONG, hdr->cookie,
+			     payload, hdr->payload_len);
+}
+
+static int handle_one_message(struct chardev_client *cli, uint8_t *buf)
+{
+	struct daedalus_msg_hdr hdr;
+	ssize_t n;
+
+	/*
+	 * The kernel chardev delivers exactly one message per
+	 * read().  Pass a buffer that can hold any legal message.
+	 */
+	for (;;) {
+		n = read(cli->fd, buf, CHARDEV_READ_BUFSZ);
+		if (n >= 0)
+			break;
+		if (errno == EINTR) {
+			if (*cli->stop_flag)
+				return 0;
+			continue;
+		}
+		log_err("chardev: read: %s", strerror(errno));
+		return -errno;
+	}
+	if (n == 0)
+		return -EIO;	/* EOF / device unplugged */
+	if ((size_t) n < sizeof(hdr)) {
+		log_err("chardev: short read %zd < hdr", n);
+		return -EBADMSG;
+	}
+
+	memcpy(&hdr, buf, sizeof(hdr));
+	if (hdr.magic != DAEDALUS_PROTO_MAGIC) {
+		log_err("chardev: bad magic 0x%08x", hdr.magic);
+		return -EBADMSG;
+	}
+	if (hdr.version != DAEDALUS_PROTO_VERSION) {
+		log_err("chardev: unsupported version %u", hdr.version);
+		return -EPROTO;
+	}
+	if ((size_t) n != sizeof(hdr) + hdr.payload_len) {
+		log_err("chardev: framing mismatch n=%zd expected %zu",
+			n, sizeof(hdr) + hdr.payload_len);
+		return -EBADMSG;
+	}
+
+	switch (hdr.type) {
+	case DAEDALUS_MSG_PING:
+		return handle_ping(cli, &hdr, buf + sizeof(hdr));
+	case DAEDALUS_MSG_REQ_DECODE:
+		return handle_req_decode(cli, &hdr, buf + sizeof(hdr));
+	default:
+		log_warn("chardev: unknown request type 0x%08x cookie=%u",
+			 hdr.type, hdr.cookie);
+		return 0;	/* skip, don't bail the loop */
+	}
+}
+
+int chardev_client_run(struct chardev_client *cli)
+{
+	uint8_t *buf;
+	int rc = 0;
+
+	buf = malloc(CHARDEV_READ_BUFSZ);
+	if (!buf)
+		return -ENOMEM;
+
+	log_info("daemon loop started; waiting for kernel requests");
+
+	while (!*cli->stop_flag) {
+		rc = handle_one_message(cli, buf);
+		if (rc < 0) {
+			if (rc == -EINTR)
+				continue;
+			log_err("chardev: handle_one_message: %d", rc);
+			break;
+		}
+	}
+
+	log_info("daemon loop exiting (stop=%d rc=%d)", *cli->stop_flag, rc);
+	free(buf);
+	return rc;
+}