Phase 8.6: dmabuf + AV1 + H.264 + stateless controls

Removes the Phase 8.5 64 KiB frame-size cap by exporting CAPTURE
buffers as dmabuf-fds the daemon mmaps and writes pixels into
directly. Adds AV1 + H.264 codec support, V4L2 stateless control
registration, and the compliance polish that brings the driver
to 47/48 v4l2-compliance pass.

Protocol (include/daedalus_v4l2_proto.h):
- struct daedalus_req_decode grew capture-buffer metadata
  (width/height/pix_fmt/num_planes + per-plane size+stride).
- New DAEDALUS_IOC_GET_DMABUF ioctl on the chardev: daemon
  asks for a per-plane dmabuf fd, kernel calls vb2_core_expbuf
  in daemon task context so the fd lands in the daemon's table.

Kernel m2m driver (kernel/daedalus_v4l2_main.c):
- Both queues switched to vb2_dma_contig_memops. OUTPUT was
  vmalloc in 8.5; the switch is needed because vmalloc doesn't
  honour V4L2_MEMORY_FLAG_NON_COHERENT and v4l2-compliance's
  REQBUFS test rejected the driver because of it. We still
  read bitstream via vb2_plane_vaddr (dma_contig gives a
  kernel virtual address just like vmalloc did).
- dma_coerce_mask_and_coherent(DMA_BIT_MASK(32)) in probe.
- queue_setup populates alloc_devs[plane] = &pdev->dev for
  both queues; allow_cache_hints=1 on both.
- daedalus_export_capture_dmabuf(cookie, plane, flags, *fd):
  walks inflight list, calls vb2_core_expbuf on the CAPTURE
  buffer in the caller's (daemon's) task context.
- device_run fills the new REQ_DECODE capture fields from
  ctx->dst_fmt and maps ctx->src_fmt.pixelformat to
  DAEDALUS_CODEC_VP9 / _AV1 / _H264 (was hard-wired to VP9).
- daedalus_complete_resp_frame handles both the 8.5 inline
  path (kept for debugging) and the 8.6 dmabuf path (pixels
  already in CAPTURE buffer, just set payload from metadata).
- enum_fmt advertises all 3 OUTPUT formats (VP9F, AV1F, S264).
- try_fmt preserves userspace colorspace fields instead of
  overwriting with REC709 defaults (fixes 8.5 compliance fail).
- s_fmt propagates OUTPUT colorspace → CAPTURE (stateless
  decoder round-trip test at v4l2-test-formats.cpp:958).
- 12 V4L2 stateless controls registered per open (VP9_FRAME,
  VP9_COMPRESSED_HDR, H264_SPS/PPS/SCALING/PRED_WEIGHTS/
  SLICE_PARAMS/DECODE_PARAMS, AV1_FRAME/SEQUENCE/
  TILE_GROUP_ENTRY/FILM_GRAIN). Daemon ignores values (FFmpeg
  re-parses); registration is what makes libva-v4l2-request
  see us.

Kernel chardev (kernel/daedalus_v4l2_chardev.c):
- New unlocked_ioctl dispatching DAEDALUS_IOC_GET_DMABUF to
  daedalus_export_capture_dmabuf.
- debugfs test_decode cookies unified with the m2m cookie
  allocator via shared daedalus_next_cookie() — kills the
  Phase 8.5 namespace collision.

Daemon (daemon/src/...):
- New dmabuf_capture.{c,h}: GET_DMABUF + mmap each plane on
  REQ_DECODE; munmap + close on completion. O_RDWR | O_CLOEXEC
  is essential — vb2_core_expbuf extracts O_ACCMODE from flags
  and exports read-only by default (caught on first run; mmap
  -EACCES on PROT_WRITE).
- decoder.{c,h}: lazily opens AV1 + H.264 AVCodecContexts in
  addition to VP9 (dropped the -ENOSYS stubs). pack_nv12_to_planes
  writes Y line-by-line into planes[0] with planes[0].stride;
  interleaves Cb/Cr into planes[1] with planes[1].stride.
- chardev_client.c handle_req_decode: opens dmabuf planes,
  runs decode (pixels land in CAPTURE buffer directly), closes
  planes, sends metadata-only RESP_FRAME. No wire-pixel
  allocation.

Test harness (tools/test_m2m_decode.c):
- Optional 5th arg `codec` (vp9 | av1 | h264). Same client
  drives all three codecs.

Verification on hertz (Pi 5, 6.12.75+rpt-rpi-2712):

Bit-exact end-to-end vs `ffmpeg -pix_fmt nv12`:
  VP9   1920x1080  3,110,400 bytes  MATCH
  AV1     128x96      18,432 bytes  MATCH
  H.264   128x96      18,432 bytes  MATCH

VP9 1080p went through the full dmabuf path with no chardev
payload bloat — the same chardev that capped at 64 KiB in 8.5
now ferries metadata only and lets the daemon mmap+write a
3.1 MB frame directly into the V4L2 client's buffer.

v4l2-compliance:
  Phase 8.1: 44/48
  Phase 8.5: 44/48 (different fails after m2m landed)
  Phase 8.6: 47/48
  Only remaining: VIDIOC_(TRY_)DECODER_CMD (needs media
  controller — explicitly Phase 8.7 work).

11 standard compound controls visible:
  vp9_frame_decode_parameters, vp9_probabilities_updates,
  h264_sequence_parameter_set, h264_picture_parameter_set,
  h264_scaling_matrix, h264_prediction_weight_table,
  h264_slice_parameters, h264_decode_parameters,
  av1_sequence_parameters, av1_frame_parameters,
  av1_film_grain (av1_tile_group_entry refused by hdl->error
  on this kernel — skipped silently).

Clean SIGTERM + rmmod, no oops/WARN.

Roadmap update (docs/roadmap.md):
- Phase 8.6 marked closed with the closure-doc reference.
- Phase 8.7 reshaped to (1) media controller, (2) perf +
  daedalus_dispatch_* substitution, (3) HDR/10-bit, (4)
  long-form multi-frame streaming.

Per correctness-before-speed:
- Real V4L2 dmabuf via vb2_core_expbuf (not a sideband
  fd-passing hack).
- O_RDWR access mode threaded through correctly.
- Strict pixel-byte comparison against ffmpeg, not "looks
  right" eyeballing.
- Each compliance edge documented with the underlying test
  source-line + the fix.
- All resource paths cleaned (munmap + close per plane on
  every exit, including error paths).

Phase 8.7 next: media controller binding (closes last
compliance fail), per-frame profiling, QPU dispatch
substitution targeting 30fps@1080p from
30fps-floor-is-fine memory.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kernel/daedalus_v4l2_main.h

@@ -49,6 +49,18 @@ struct daedalus_dev {
 /* Module-wide singleton accessor (chardev needs this for RESP_FRAME). */
 struct daedalus_dev *daedalus_get_dev(void);
 
+/**
+ * daedalus_next_cookie() - shared cookie allocator
+ *
+ * Returns the next monotonically increasing request cookie.
+ * Used by both the V4L2 m2m device_run path (for REQ_DECODE
+ * from real OUTPUT buffers) and the chardev debugfs
+ * test_decode path (for hand-crafted REQ_DECODE injection),
+ * so the two namespaces never collide and RESP_FRAME logs
+ * stay deterministic.
+ */
+u32 daedalus_next_cookie(void);
+
 /**
  * daedalus_complete_resp_frame() - chardev RESP_FRAME completion
  * @cookie:	cookie carried by the matching REQ_DECODE
@@ -59,12 +71,34 @@ struct daedalus_dev *daedalus_get_dev(void);
  *
  * Called from the chardev write() path on RESP_FRAME.  Looks up
  * the in-flight request, copies inline pixel data into the
- * CAPTURE vb2 buffer if available, then completes both src+dst
- * buffers and finishes the m2m job.  Silently drops responses
- * for unknown cookies (pr_warn_ratelimited).
+ * CAPTURE vb2 buffer if available (Phase 8.5 path; Phase 8.6
+ * skips the copy because the daemon decoded directly into the
+ * dmabuf), then completes both src+dst buffers and finishes
+ * the m2m job.  Silently drops responses for unknown cookies
+ * (pr_warn_ratelimited).
  */
 void daedalus_complete_resp_frame(u32 cookie,
 				  const struct daedalus_resp_frame *fr,
 				  const u8 *pixels, size_t pixels_len);
 
+/**
+ * daedalus_export_capture_dmabuf() - chardev GET_DMABUF backend
+ * @cookie:	cookie from the matching REQ_DECODE
+ * @plane:	plane index (0-based) within the CAPTURE buffer
+ * @flags:	flags for dma_buf_fd (O_CLOEXEC etc.)
+ * @out_fd:	out: installed dmabuf fd in the calling task's
+ *		fd table (only valid when return value == 0)
+ *
+ * Called from the chardev DAEDALUS_IOC_GET_DMABUF ioctl
+ * handler.  Looks up the in-flight V4L2 request by cookie,
+ * exports the CAPTURE vb2 buffer's plane as a dma_buf via
+ * vb2_core_expbuf in the daemon's task context.  Caller must
+ * NOT touch out_fd on non-zero return.
+ *
+ * Return: 0 on success, -EINVAL for unknown cookie or bad
+ * plane, propagated -errno from vb2_core_expbuf otherwise.
+ */
+int  daedalus_export_capture_dmabuf(u32 cookie, u32 plane, u32 flags,
+				    int *out_fd);
+
 #endif /* DAEDALUS_V4L2_MAIN_H */