Phase 8.6: dmabuf + AV1 + H.264 + stateless controls

Removes the Phase 8.5 64 KiB frame-size cap by exporting CAPTURE
buffers as dmabuf-fds the daemon mmaps and writes pixels into
directly. Adds AV1 + H.264 codec support, V4L2 stateless control
registration, and the compliance polish that brings the driver
to 47/48 v4l2-compliance pass.

Protocol (include/daedalus_v4l2_proto.h):
- struct daedalus_req_decode grew capture-buffer metadata
  (width/height/pix_fmt/num_planes + per-plane size+stride).
- New DAEDALUS_IOC_GET_DMABUF ioctl on the chardev: daemon
  asks for a per-plane dmabuf fd, kernel calls vb2_core_expbuf
  in daemon task context so the fd lands in the daemon's table.

Kernel m2m driver (kernel/daedalus_v4l2_main.c):
- Both queues switched to vb2_dma_contig_memops. OUTPUT was
  vmalloc in 8.5; the switch is needed because vmalloc doesn't
  honour V4L2_MEMORY_FLAG_NON_COHERENT and v4l2-compliance's
  REQBUFS test rejected the driver because of it. We still
  read bitstream via vb2_plane_vaddr (dma_contig gives a
  kernel virtual address just like vmalloc did).
- dma_coerce_mask_and_coherent(DMA_BIT_MASK(32)) in probe.
- queue_setup populates alloc_devs[plane] = &pdev->dev for
  both queues; allow_cache_hints=1 on both.
- daedalus_export_capture_dmabuf(cookie, plane, flags, *fd):
  walks inflight list, calls vb2_core_expbuf on the CAPTURE
  buffer in the caller's (daemon's) task context.
- device_run fills the new REQ_DECODE capture fields from
  ctx->dst_fmt and maps ctx->src_fmt.pixelformat to
  DAEDALUS_CODEC_VP9 / _AV1 / _H264 (was hard-wired to VP9).
- daedalus_complete_resp_frame handles both the 8.5 inline
  path (kept for debugging) and the 8.6 dmabuf path (pixels
  already in CAPTURE buffer, just set payload from metadata).
- enum_fmt advertises all 3 OUTPUT formats (VP9F, AV1F, S264).
- try_fmt preserves userspace colorspace fields instead of
  overwriting with REC709 defaults (fixes 8.5 compliance fail).
- s_fmt propagates OUTPUT colorspace → CAPTURE (stateless
  decoder round-trip test at v4l2-test-formats.cpp:958).
- 12 V4L2 stateless controls registered per open (VP9_FRAME,
  VP9_COMPRESSED_HDR, H264_SPS/PPS/SCALING/PRED_WEIGHTS/
  SLICE_PARAMS/DECODE_PARAMS, AV1_FRAME/SEQUENCE/
  TILE_GROUP_ENTRY/FILM_GRAIN). Daemon ignores values (FFmpeg
  re-parses); registration is what makes libva-v4l2-request
  see us.

Kernel chardev (kernel/daedalus_v4l2_chardev.c):
- New unlocked_ioctl dispatching DAEDALUS_IOC_GET_DMABUF to
  daedalus_export_capture_dmabuf.
- debugfs test_decode cookies unified with the m2m cookie
  allocator via shared daedalus_next_cookie() — kills the
  Phase 8.5 namespace collision.

Daemon (daemon/src/...):
- New dmabuf_capture.{c,h}: GET_DMABUF + mmap each plane on
  REQ_DECODE; munmap + close on completion. O_RDWR | O_CLOEXEC
  is essential — vb2_core_expbuf extracts O_ACCMODE from flags
  and exports read-only by default (caught on first run; mmap
  -EACCES on PROT_WRITE).
- decoder.{c,h}: lazily opens AV1 + H.264 AVCodecContexts in
  addition to VP9 (dropped the -ENOSYS stubs). pack_nv12_to_planes
  writes Y line-by-line into planes[0] with planes[0].stride;
  interleaves Cb/Cr into planes[1] with planes[1].stride.
- chardev_client.c handle_req_decode: opens dmabuf planes,
  runs decode (pixels land in CAPTURE buffer directly), closes
  planes, sends metadata-only RESP_FRAME. No wire-pixel
  allocation.

Test harness (tools/test_m2m_decode.c):
- Optional 5th arg `codec` (vp9 | av1 | h264). Same client
  drives all three codecs.

Verification on hertz (Pi 5, 6.12.75+rpt-rpi-2712):

Bit-exact end-to-end vs `ffmpeg -pix_fmt nv12`:
  VP9   1920x1080  3,110,400 bytes  MATCH
  AV1     128x96      18,432 bytes  MATCH
  H.264   128x96      18,432 bytes  MATCH

VP9 1080p went through the full dmabuf path with no chardev
payload bloat — the same chardev that capped at 64 KiB in 8.5
now ferries metadata only and lets the daemon mmap+write a
3.1 MB frame directly into the V4L2 client's buffer.

v4l2-compliance:
  Phase 8.1: 44/48
  Phase 8.5: 44/48 (different fails after m2m landed)
  Phase 8.6: 47/48
  Only remaining: VIDIOC_(TRY_)DECODER_CMD (needs media
  controller — explicitly Phase 8.7 work).

11 standard compound controls visible:
  vp9_frame_decode_parameters, vp9_probabilities_updates,
  h264_sequence_parameter_set, h264_picture_parameter_set,
  h264_scaling_matrix, h264_prediction_weight_table,
  h264_slice_parameters, h264_decode_parameters,
  av1_sequence_parameters, av1_frame_parameters,
  av1_film_grain (av1_tile_group_entry refused by hdl->error
  on this kernel — skipped silently).

Clean SIGTERM + rmmod, no oops/WARN.

Roadmap update (docs/roadmap.md):
- Phase 8.6 marked closed with the closure-doc reference.
- Phase 8.7 reshaped to (1) media controller, (2) perf +
  daedalus_dispatch_* substitution, (3) HDR/10-bit, (4)
  long-form multi-frame streaming.

Per correctness-before-speed:
- Real V4L2 dmabuf via vb2_core_expbuf (not a sideband
  fd-passing hack).
- O_RDWR access mode threaded through correctly.
- Strict pixel-byte comparison against ffmpeg, not "looks
  right" eyeballing.
- Each compliance edge documented with the underlying test
  source-line + the fix.
- All resource paths cleaned (munmap + close per plane on
  every exit, including error paths).

Phase 8.7 next: media controller binding (closes last
compliance fail), per-frame profiling, QPU dispatch
substitution targeting 30fps@1080p from
30fps-floor-is-fine memory.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/test_m2m_decode.c

@@ -17,8 +17,9 @@
  * wiring works end-to-end against a real bitstream.
  *
  * Usage:
- *   test_m2m_decode <vp9_keyframe.bin> <out.nv12> [w] [h]
- *     defaults: w=128 h=96
+ *   test_m2m_decode <keyframe.bin> <out.nv12> [w] [h] [codec]
+ *     defaults: w=128 h=96 codec=vp9
+ *     codec: vp9 | av1 | h264
  */
 #include <stdint.h>
 #include <stdio.h>
@@ -68,6 +69,8 @@ static void *read_file(const char *path, size_t *out_len)
 int main(int argc, char **argv)
 {
 	const char *bitstream_path, *out_path;
+	const char *codec_name = "vp9";
+	uint32_t output_fourcc = V4L2_PIX_FMT_VP9_FRAME;
 	void *bitstream;
 	size_t bs_len;
 	uint32_t w = 128, h = 96;
@@ -87,7 +90,8 @@ int main(int argc, char **argv)
 
 	if (argc < 3) {
 		fprintf(stderr,
-			"usage: %s <vp9_keyframe.bin> <out.nv12> [w] [h]\n",
+			"usage: %s <keyframe.bin> <out.nv12> [w] [h] [codec]\n"
+			"  codec: vp9 | av1 | h264 (default vp9)\n",
 			argv[0]);
 		return 2;
 	}
@@ -97,6 +101,22 @@ int main(int argc, char **argv)
 		w = (uint32_t) atoi(argv[3]);
 		h = (uint32_t) atoi(argv[4]);
 	}
+	if (argc >= 6) {
+		codec_name = argv[5];
+		if (!strcmp(codec_name, "vp9"))
+			output_fourcc = V4L2_PIX_FMT_VP9_FRAME;
+		else if (!strcmp(codec_name, "av1"))
+			output_fourcc = V4L2_PIX_FMT_AV1_FRAME;
+		else if (!strcmp(codec_name, "h264"))
+			output_fourcc = V4L2_PIX_FMT_H264_SLICE;
+		else {
+			fprintf(stderr, "unknown codec '%s'\n", codec_name);
+			return 2;
+		}
+	}
+	printf("codec=%s fourcc='%c%c%c%c'\n", codec_name,
+	       output_fourcc & 0xff, (output_fourcc >> 8) & 0xff,
+	       (output_fourcc >> 16) & 0xff, (output_fourcc >> 24) & 0xff);
 
 	bitstream = read_file(bitstream_path, &bs_len);
 	printf("loaded bitstream: %zu bytes\n", bs_len);
@@ -110,7 +130,7 @@ int main(int argc, char **argv)
 	fmt.type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE;
 	fmt.fmt.pix_mp.width	   = w;
 	fmt.fmt.pix_mp.height	   = h;
-	fmt.fmt.pix_mp.pixelformat = V4L2_PIX_FMT_VP9_FRAME;
+	fmt.fmt.pix_mp.pixelformat = output_fourcc;
 	if (ioctl(fd, VIDIOC_S_FMT, &fmt) < 0)
 		die("S_FMT OUTPUT");
 	printf("OUTPUT sizeimage = %u\n", fmt.fmt.pix_mp.plane_fmt[0].sizeimage);