Re: [PATCH v6 10/18] media: iris: skip PIPE if it is not supported by the platform

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Omitting the PIPE capability from capability tables leaves `fw_caps[PIPE].value` initialized to 0, which triggers a division by zero in VPU3x/4x frequency calculation.
--

--- Patch [10]: [PATCH v6 10/18] media: iris: skip PIPE if it is not supported by the platform ---
commit edfcba3c56c71e16ef96daa3fb5e261b5fb5ef8c
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>

media: iris: skip PIPE if it is not supported by the platform

This commit allows iris_set_pipe() to silently skip programming the
property if the platform does not support it and omits it from the
capability tables.

> diff --git a/drivers/media/platform/qcom/iris/iris_ctrls.c b/drivers/media/platform/qcom/iris/iris_ctrls.c
> index 10e33b8a73f60..33a34573391a4 100644
> --- a/drivers/media/platform/qcom/iris/iris_ctrls.c
> +++ b/drivers/media/platform/qcom/iris/iris_ctrls.c
> @@ -534,6 +534,9 @@ int iris_set_pipe(struct iris_inst *inst, enum platform_inst_fw_cap_type cap_id)
>  	u32 work_route = inst->fw_caps[PIPE].value;
>  	u32 hfi_id = inst->fw_caps[cap_id].hfi_id;
>  
> +	if (!hfi_id)
> +		return 0;

[Severity: Critical]
This is a pre-existing issue, but permitting the PIPE capability to be
omitted seems to expose a division by zero elsewhere in the driver.

If a platform does not support the PIPE capability and omits it from the
capability table, won't inst->fw_caps[PIPE].value remain initialized to 0?

Looking at iris_session_init_caps(), the fallback that sets a default value
for PIPE is inside a loop that only iterates over present capabilities, so
it is skipped when PIPE is omitted:

drivers/media/platform/qcom/iris/iris_ctrls.c:iris_session_init_caps() {
    ...
    for (i = 0; i < core->inst_fw_caps_dec_size; i++) {
        cap_id = core->inst_fw_caps_dec[i].cap_id;
        ...
        if (cap_id == PIPE) {
            core->inst_fw_caps_dec[cap_id].value =
                core->iris_platform_data->num_vpp_pipe;
        ...
}

If inst->fw_caps[PIPE].value is 0, won't this cause a divide-by-zero panic
when calculating the VPU frequency?

drivers/media/platform/qcom/iris/iris_vpu_common.c:iris_vpu3x_vpu4x_calculate_frequency() {
    ...
    vpp_cycles = mult_frac(mbs_per_second, caps->mb_cycles_vpp,
                           (u32)inst->fw_caps[PIPE].value);
    ...
}

> +
>  	return hfi_ops->session_set_property(inst, hfi_id,
>  					     HFI_HOST_FLAGS_NONE,
>  					     iris_get_port_info(inst, cap_id),

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-iris-ar50lt-v6-0-374f0a46c23b@oss.qualcomm.com?part=10