On Thu, 2025-12-11 at 15:29 -0500, Nicolas Dufresne wrote:

Hi,

Le mardi 02 décembre 2025 à 15:40 +0800, Kyrie Wu a écrit :

quoted

Previously, calling vdec_vp9_slice_setup_single_from_src_to_dst
with v4l2_m2m_next_src_buf to obtain both buffers resulted in
-EINVAL,
interrupting the decoding process. To resolve this,
the interface should be updated to set both src and dst buffers
for metadata configuration.

I'm haven't figure-out why this happens, perhaps you can add more
details ?

quoted

Signed-off-by: Kyrie Wu <redacted>
---
 .../vcodec/decoder/vdec/vdec_vp9_req_lat_if.c | 21 ++++++++++-----
----
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git
a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
lat_if.c
b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
lat_if.c
index fa0f406f7726..9513ddde7c7c 100644
---
a/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
lat_if.c
+++
b/drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_vp9_req_
lat_if.c

@@ -696,21 +696,22 @@ static int vdec_vp9_slice_tile_offset(int

idx, int mi_num, int tile_log2)
 	return min(offset, mi_num);
 }
 
-static
-int vdec_vp9_slice_setup_single_from_src_to_dst(struct
vdec_vp9_slice_instance *instance)
+static int vdec_vp9_slice_setup_single_from_src_to_dst(struct
vdec_vp9_slice_instance *instance,
+						       struct
mtk_vcodec_mem *bs,
+						       struct vdec_fb
*fb)
 {
-	struct vb2_v4l2_buffer *src;
-	struct vb2_v4l2_buffer *dst;
+	struct mtk_video_dec_buf *src_buf_info;
+	struct mtk_video_dec_buf *dst_buf_info;
 
-	src = v4l2_m2m_next_src_buf(instance->ctx->m2m_ctx);

My concern is that vdec_vp9_slice_setup_lat_from_src_buf() also
depends on the
tip of the OUTPUT queue, why it this problem with limited to single
core ?

Can you apply the manual completion fixes, and check if the problem
still
appear? Is that something you reproduce every time ? Perhaps it
should be kept
out of this serie ?

quoted

-	if (!src)
+	src_buf_info = container_of(bs, struct mtk_video_dec_buf,
bs_buffer);
+	if (!src_buf_info)
 		return -EINVAL;

Its a bit of a concern in term of memory lifetime / possible use
after free.
Who's holding on the buffer if its not in the queue ?

Nicolas

Dear Nicolas,

Thanks for your reminding, I think this patch could abandon.
I will update the patch set in the next version.

Thanks.

Kyrie.

quoted

 
-	dst = v4l2_m2m_next_dst_buf(instance->ctx->m2m_ctx);
-	if (!dst)
+	dst_buf_info = container_of(fb, struct mtk_video_dec_buf,
frame_buffer);
+	if (!dst_buf_info)
 		return -EINVAL;
 
-	v4l2_m2m_buf_copy_metadata(src, dst, true);
+	v4l2_m2m_buf_copy_metadata(&src_buf_info->m2m_buf.vb,
&dst_buf_info->m2m_buf.vb, true);
 
 	return 0;
 }

@@ -1800,7 +1801,7 @@ static int vdec_vp9_slice_setup_single(struct

vdec_vp9_slice_instance *instance,
 	struct vdec_vp9_slice_vsi *vsi = &pfc->vsi;
 	int ret;
 
-	ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance);
+	ret = vdec_vp9_slice_setup_single_from_src_to_dst(instance, bs,
fb);
 	if (ret)
 		goto err;