Re: [PATCH v6 15/18] media: iris: Introduce buffer size calculations for AR50LT

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] VP9 AR50LT line buffer calculation is missing size_vpxd_lb_fe_top_ctrl, size_vpxd_lb_recon_dma_metadata_wr, and size_vp9d_qp.
- [High] Missing SIZE_SEI_USERDATA allocation in hfi_buffer_persist_h264d_ar50lt.
--

--- Patch [15]: [PATCH v6 15/18] media: iris: Introduce buffer size calculations for AR50LT ---
commit 21a2756943f587f0146e1fc640977667f461e12f
Author: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>

media: iris: Introduce buffer size calculations for AR50LT

This commit introduces AR50LT buffer size calculations for both the encoder
and decoder. It reuses the buffer size calculations which are common, while
adding the AR50LT specific ones separately.

> diff --git a/drivers/media/platform/qcom/iris/iris_vpu_buffer.c b/drivers/media/platform/qcom/iris/iris_vpu_buffer.c
> index 511502d4ea6c3..00dbb091c54ef 100644
> --- a/drivers/media/platform/qcom/iris/iris_vpu_buffer.c
> +++ b/drivers/media/platform/qcom/iris/iris_vpu_buffer.c
[ ... ]
> @@ -230,6 +328,11 @@ static u32 hfi_buffer_persist_h264d(void)
>  		    DMA_ALIGNMENT);
>  }
>  
> +static u32 hfi_buffer_persist_h264d_ar50lt(void)
> +{
> +	return ALIGN((SIZE_SLIST_BUF_H264 * NUM_SLIST_BUF_H264), DMA_ALIGNMENT);
> +}
> +

[Severity: High]
Does this code omit the NUM_HW_PIC_BUF * SIZE_SEI_USERDATA allocation?

The original hfi_buffer_persist_h264d() includes this allocation for SEI
metadata, and the HEVC equivalent for AR50LT retains it as well.

Could omitting this cause the firmware to write out of bounds when parsing
H.264 bitstreams with SEI messages?

[ ... ]
> @@ -492,6 +689,17 @@ u32 hfi_iris3_vp9d_lb_size(u32 frame_width, u32 frame_height, u32 num_vpp_pipes)
>  		ALIGN(size_vp9d_qp(frame_width, frame_height), DMA_ALIGNMENT);
>  }
>  
> +static inline
> +u32 hfi_buffer_line_vp9d_ar50lt(u32 frame_width, u32 frame_height, u32 _yuv_bufcount_min)
> +{
> +	return ALIGN(size_vpxd_lb_fe_left_ctrl(frame_width, frame_height), DMA_ALIGNMENT) +
> +		ALIGN(size_vpxd_lb_se_left_ctrl_ar50lt(frame_width, frame_height), DMA_ALIGNMENT) +
> +		ALIGN(size_vp9d_lb_vsp_top(frame_width, frame_height), DMA_ALIGNMENT) +
> +		ALIGN(size_vpxd_lb_se_top_ctrl(frame_width, frame_height), DMA_ALIGNMENT) +
> +		ALIGN(size_vp9d_lb_pe_top_data(frame_width, frame_height), DMA_ALIGNMENT) +
> +		ALIGN(size_vp9d_lb_fe_top_data(frame_width, frame_height), DMA_ALIGNMENT);
> +}
> +

[Severity: High]
Is this calculation missing size_vpxd_lb_fe_top_ctrl(),
size_vpxd_lb_recon_dma_metadata_wr(), and size_vp9d_qp()?

These sizes were included in the previous generation's VP9 line buffer
calculation in hfi_iris3_vp9d_lb_size(). The AR50LT versions for H.264
and HEVC also retain their direct equivalents.

Could omitting them result in an undersized DMA allocation, leading to memory
corruption when the firmware writes past the end of the line buffer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-iris-ar50lt-v6-0-374f0a46c23b@oss.qualcomm.com?part=15