Previously, calling vdec_vp9_slice_setup_single_from_src_to_dst
with v4l2_m2m_next_src_buf to obtain both buffers resulted in -EINVAL,
interrupting the decoding process. To resolve this,
the interface should be updated to set both src and dst buffers
for metadata configuration.
Signed-off-by: Kyrie Wu <kyrie.wu@mediatek.com>
---
.../vcodec/decoder/vdec/vdec_vp9_req_lat_if.c | 21 ++++++++++---------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c
index fa0f406f7726..9513ddde7c7c 100644
--- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c
+++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c
@@ -696,21 +696,22 @@ static int vdec_vp9_slice_tile_offset(int idx, int mi_num, int tile_log2)
return min(offset, mi_num);
}
-static
-int vdec_vp9_slice_setup_single_from_src_to_dst(struct vdec_vp9_slice_instance *instance)
+static int vdec_vp9_slice_setup_single_from_src_to_dst(struct vdec_vp9_slice_instance *instance,
+ struct mtk_vcodec_mem *bs,
+ struct vdec_fb *fb)
{
- struct vb2_v4l2_buffer *src;
- struct vb2_v4l2_buffer *dst;
+ struct mtk_video_dec_buf *src_buf_info;
+ struct mtk_video_dec_buf *dst_buf_info;
- src = v4l2_m2m_next_src_buf(instance->ctx->m2m_ctx);
- if (!src)
+ src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
+ if (!src_buf_info)
return -EINVAL;
- dst = v4l2_m2m_next_dst_buf(instance->ctx->m2m_ctx);
- if (!dst)
+ dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
+ if (!dst_buf_info)
return -EINVAL;
- v4l2_m2m_buf_copy_metadata(src, dst, true);
+ v4l2_m2m_buf_copy_metadata(&src_buf_info->m2m_buf.vb, &dst_buf_info->m2m_buf.vb, true);
return 0;
}
@@ -1800,7 +1801,7 @@ static int vdec_vp9_slice_setup_single(struct vdec_vp9_slice_instance *instance,
struct vdec_vp9_slice_vsi *vsi = &pfc->vsi;
int ret;
- ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance);
+ ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance, bs, fb);
if (ret)
goto err;
--
2.45.2
Hi,
Le mardi 02 décembre 2025 à 15:40 +0800, Kyrie Wu a écrit :
> Previously, calling vdec_vp9_slice_setup_single_from_src_to_dst
> with v4l2_m2m_next_src_buf to obtain both buffers resulted in -EINVAL,
> interrupting the decoding process. To resolve this,
> the interface should be updated to set both src and dst buffers
> for metadata configuration.
I'm haven't figure-out why this happens, perhaps you can add more details ?
>
> Signed-off-by: Kyrie Wu <kyrie.wu@mediatek.com>
> ---
> .../vcodec/decoder/vdec/vdec_vp9_req_lat_if.c | 21 ++++++++++---------
> 1 file changed, 11 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c
> index fa0f406f7726..9513ddde7c7c 100644
> --- a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c
> +++ b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_lat_if.c
> @@ -696,21 +696,22 @@ static int vdec_vp9_slice_tile_offset(int idx, int mi_num, int tile_log2)
> return min(offset, mi_num);
> }
>
> -static
> -int vdec_vp9_slice_setup_single_from_src_to_dst(struct vdec_vp9_slice_instance *instance)
> +static int vdec_vp9_slice_setup_single_from_src_to_dst(struct vdec_vp9_slice_instance *instance,
> + struct mtk_vcodec_mem *bs,
> + struct vdec_fb *fb)
> {
> - struct vb2_v4l2_buffer *src;
> - struct vb2_v4l2_buffer *dst;
> + struct mtk_video_dec_buf *src_buf_info;
> + struct mtk_video_dec_buf *dst_buf_info;
>
> - src = v4l2_m2m_next_src_buf(instance->ctx->m2m_ctx);
My concern is that vdec_vp9_slice_setup_lat_from_src_buf() also depends on the
tip of the OUTPUT queue, why it this problem with limited to single core ?
Can you apply the manual completion fixes, and check if the problem still
appear? Is that something you reproduce every time ? Perhaps it should be kept
out of this serie ?
> - if (!src)
> + src_buf_info = container_of(bs, struct mtk_video_dec_buf, bs_buffer);
> + if (!src_buf_info)
> return -EINVAL;
Its a bit of a concern in term of memory lifetime / possible use after free.
Who's holding on the buffer if its not in the queue ?
Nicolas
>
> - dst = v4l2_m2m_next_dst_buf(instance->ctx->m2m_ctx);
> - if (!dst)
> + dst_buf_info = container_of(fb, struct mtk_video_dec_buf, frame_buffer);
> + if (!dst_buf_info)
> return -EINVAL;
>
> - v4l2_m2m_buf_copy_metadata(src, dst, true);
> + v4l2_m2m_buf_copy_metadata(&src_buf_info->m2m_buf.vb, &dst_buf_info->m2m_buf.vb, true);
>
> return 0;
> }
> @@ -1800,7 +1801,7 @@ static int vdec_vp9_slice_setup_single(struct vdec_vp9_slice_instance *instance,
> struct vdec_vp9_slice_vsi *vsi = &pfc->vsi;
> int ret;
>
> - ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance);
> + ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance, bs, fb);
> if (ret)
> goto err;
>
On Thu, 2025-12-11 at 15:29 -0500, Nicolas Dufresne wrote:
> Hi,
>
> Le mardi 02 décembre 2025 à 15:40 +0800, Kyrie Wu a écrit :
> > Previously, calling vdec_vp9_slice_setup_single_from_src_to_dst
> > with v4l2_m2m_next_src_buf to obtain both buffers resulted in
> > -EINVAL,
> > interrupting the decoding process. To resolve this,
> > the interface should be updated to set both src and dst buffers
> > for metadata configuration.
>
> I'm haven't figure-out why this happens, perhaps you can add more
> details ?
>
> >
> > Signed-off-by: Kyrie Wu <kyrie.wu@mediatek.com>
> > ---
> > .../vcodec/decoder/vdec/vdec_vp9_req_lat_if.c | 21 ++++++++++-----
> > ----
> > 1 file changed, 11 insertions(+), 10 deletions(-)
> >
> > diff --git
> > a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
> > lat_if.c
> > b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
> > lat_if.c
> > index fa0f406f7726..9513ddde7c7c 100644
> > ---
> > a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
> > lat_if.c
> > +++
> > b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
> > lat_if.c
> > @@ -696,21 +696,22 @@ static int vdec_vp9_slice_tile_offset(int
> > idx, int mi_num, int tile_log2)
> > return min(offset, mi_num);
> > }
> >
> > -static
> > -int vdec_vp9_slice_setup_single_from_src_to_dst(struct
> > vdec_vp9_slice_instance *instance)
> > +static int vdec_vp9_slice_setup_single_from_src_to_dst(struct
> > vdec_vp9_slice_instance *instance,
> > + struct
> > mtk_vcodec_mem *bs,
> > + struct vdec_fb
> > *fb)
> > {
> > - struct vb2_v4l2_buffer *src;
> > - struct vb2_v4l2_buffer *dst;
> > + struct mtk_video_dec_buf *src_buf_info;
> > + struct mtk_video_dec_buf *dst_buf_info;
> >
> > - src = v4l2_m2m_next_src_buf(instance->ctx->m2m_ctx);
>
> My concern is that vdec_vp9_slice_setup_lat_from_src_buf() also
> depends on the
> tip of the OUTPUT queue, why it this problem with limited to single
> core ?
>
> Can you apply the manual completion fixes, and check if the problem
> still
> appear? Is that something you reproduce every time ? Perhaps it
> should be kept
> out of this serie ?
>
>
> > - if (!src)
> > + src_buf_info = container_of(bs, struct mtk_video_dec_buf,
> > bs_buffer);
> > + if (!src_buf_info)
> > return -EINVAL;
>
> Its a bit of a concern in term of memory lifetime / possible use
> after free.
> Who's holding on the buffer if its not in the queue ?
>
> Nicolas
Dear Nicolas,
Thanks for your reminding, I think this patch could abandon.
I will update the patch set in the next version.
Thanks.
Kyrie.
>
> >
> > - dst = v4l2_m2m_next_dst_buf(instance->ctx->m2m_ctx);
> > - if (!dst)
> > + dst_buf_info = container_of(fb, struct mtk_video_dec_buf,
> > frame_buffer);
> > + if (!dst_buf_info)
> > return -EINVAL;
> >
> > - v4l2_m2m_buf_copy_metadata(src, dst, true);
> > + v4l2_m2m_buf_copy_metadata(&src_buf_info->m2m_buf.vb,
> > &dst_buf_info->m2m_buf.vb, true);
> >
> > return 0;
> > }
> > @@ -1800,7 +1801,7 @@ static int vdec_vp9_slice_setup_single(struct
> > vdec_vp9_slice_instance *instance,
> > struct vdec_vp9_slice_vsi *vsi = &pfc->vsi;
> > int ret;
> >
> > - ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance);
> > + ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance, bs,
> > fb);
> > if (ret)
> > goto err;
> >
© 2016 - 2026 Red Hat, Inc.