Camera dead after every S4 hibernate (Dell Pro Max 14, Synaptics SVP7500 usbio): sensor probe defers on missing ipu_bridge fwnode endpoint; isys_notifier_init crash on rebuild

[akhkifc-cyber]

Camera dead after every S4 hibernate (Dell Pro Max 14, Synaptics SVP7500 usbio bridge) — sensor probe defers on missing ipu_bridge fwnode endpoint; ipu6 stack rebuild crashes

Same symptom class as #407 (camera works after suspend, dead after hibernate), but on the usbio/Synaptics SVP7500 path instead of LJCA/mei — with the failure chain traced to specific kernel components.

Hardware / software

• Laptop: Dell Pro Max 14 Premium MA14250, BIOS 1.9.0, Fedora 44
• Bridge: Synaptics SVP7500 USBIO (06cb:0701) on xhci port 3-8, hosting i2c clients: INTC10E0 (intel_cvs), OVTI08F4 (ov08x40 sensor), HIMX1092
• Sensor: OV08x40 (OVTI08F4:00) behind usbio.usbio-i2c.1 / i2c-3
• Kernels tested: 7.1.13-200.fc44 and 7.2.4-200.fc44 (in-tree intel_ipu6* is what is loaded; the akmod in extra/ is shadowed)
• Userspace: ipu6-camera-hal / v4l2-relayd (icamerasrc → v4l2loopback)

Symptom

After every S4 hibernate/resume the camera is dead (0 frames from the relay device). Suspend-to-idle is fine. Only a full reboot recovers it. The in-userspace HAL then reports No attached camera shared memory / camera open num couldn't be 0, i.e. zero cameras enumerated.

Root-cause chain (all reproducible)

1. S4 resume destroys and re-creates the usbio i2c clients. cvs_common_remove + re-probe of INTC10E0 is visible every resume; the OVTI08F4:00 client also gets deleted/re-created.
2. ov08x40 probe then defers forever — /sys/kernel/debug/devices_deferred:

   i2c-OVTI08F4:00  ov08x40: waiting for fwnode graph endpoint
   i2c-INTC10E0:00  Intel CVS driver: Do deferred probing as request gpiod failed   (7.2.4)
   

   i.e. the ipu_bridge fwnode graph endpoint for the sensor is not restored when the usbio client is re-created after S4. Cold boot works fine (Found supported sensor OVTI08F4:00, Connected 1 cameras).
3. Rebuilding the ipu6 stack to re-register the notifier crashes deterministically:
   • 7.1.13: kernel oops in isys_notifier_init+0xc0/0x1c0 (isys_register_devices+0x3ec, isys_probe+0x3a3), reproducible on every modprobe intel_ipu6_isys after teardown (with or without the sensor bound).
   • 7.2.4: soft lockup — watchdog: BUG: soft lockup - CPU#14 stuck for 26s! [(udev-worker)] at the same modprobe intel_ipu6_isys step.
4. The media graph keeps the isys entities but loses the sensor entity when the client dies; a bound-but-deferred ov08x40 never registers its subdev, so nothing re-links without the crashing rebuild.

On 7.1.13 additionally (fixed in 7.2.4)

usbio-bridge 3-8:1.0: USB control out failed: -71 → probe with driver usbio-bridge failed with error -71 → disconnect/re-enumerate cycles at every resume; stuck bulk-in URBs (Bulk in error -108 on teardown). These went away on 7.2.4 — the recent usbio fixes (disconnect UAF in client teardown, bulk-IN length bounds) work; the bridge no longer flaps. The graph/defer/rebuild-crash part remains.

Workarounds tried (none recovers the camera without reboot)

v4l2-relayd restart; HAL SysV IPC cleanup; intel_cvs reload; intel_vpu reload; ov08x40 sysfs rebind (probe defers or -EIO while the bridge is wedged); USB unbind/bind of the bridge (restores bridge health, sensor binds, but media graph still never re-links); power/persist=1 (already set); USB autosuspend off (already); power/wakeup=enabled (doesn't survive the disconnect); module reload of the ipu6 stack (crashes, see above).

Expected

Sensor/graph/HAL state restored after S4 resume, like after S3. As a minimum, no defer forever and no crash when re-registering the isys notifier.

Notes for maintainers

• The deferral (waiting for fwnode graph endpoint) suggests the ipu_bridge graph built at boot is not re-created for usbio-recreated clients; possibly its endpoint software-node is tied to the original client device.
• The rebuild crash is 100% reproducible and separate from the hibernate path: after unloading intel_ipu6_isys/psys/intel_ipu6/ipu_bridge once, any re-probe of isys dies in isys_notifier_init — also on 7.2.4 with abb1f808 included, so the notifier re-probe path is still unsafe.
• Related: IPU6 Camera doesn't work after a resume from hibernation (but does after a suspend) #407 (same symptom, LJCA path) and the S4 workaround overlay in LP#2166564 (mei-vsc path), which shows the resume path needs explicit power-loss handling.
• Full journals (kernel log for boot, hibernate entry, resume, hook, both crash traces) available on request; happy to test patches.

Reporter: owner of the affected machine; analysis assisted by an AI debugging session (all claims verified against live sysfs/journal).