From: carpalis Date: Sun, 20 May 2018 12:27:46 +0000 (+0200) Subject: genX_mfd: fix out-of-bounds reference pixel replication X-Git-Tag: android-x86-8.1-r1~27 X-Git-Url: http://git.osdn.net/view?p=android-x86%2Fhardware-intel-common-vaapi.git;a=commitdiff_plain;h=3c851c4e8e76ab0c8c5d83f904d4fd089ad540d3 genX_mfd: fix out-of-bounds reference pixel replication Out-of-bounds reference pixel replication should take into account the frame coding mode of the reference frame(s), not the frame coding mode of the current frame. Signed-off-by: Jerome Borsboom --- diff --git a/src/gen75_mfd.c b/src/gen75_mfd.c index bd461a8..fc979e3 100644 --- a/src/gen75_mfd.c +++ b/src/gen75_mfd.c @@ -1891,6 +1891,7 @@ gen75_mfd_vc1_pic_state(VADriverContextP ctx, assert(decode_state->pic_param && decode_state->pic_param->buffer); pic_param = (VAPictureParameterBufferVC1 *)decode_state->pic_param->buffer; + gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (!pic_param->sequence_fields.bits.interlace || (pic_param->picture_fields.bits.frame_coding_mode < 2)) { /* Progressive or Frame-Interlace */ @@ -1964,8 +1965,6 @@ gen75_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->sequence_fields.bits.rangered) { obj_surface = decode_state->reference_objects[0]; - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); - if (pic_param->forward_reference_picture != VA_INVALID_ID && obj_surface) gen7_vc1_reference_surface = (struct gen7_vc1_surface *)(obj_surface->private_data); @@ -2079,6 +2078,7 @@ gen75_mfd_vc1_pic_state(VADriverContextP ctx, assert(pic_param->picture_fields.bits.frame_coding_mode < 3); + gen7_vc1_current_surface->frame_coding_mode = pic_param->picture_fields.bits.frame_coding_mode; if (pic_param->sequence_fields.bits.interlace) { if (pic_param->picture_fields.bits.frame_coding_mode < 2) fcm = pic_param->picture_fields.bits.frame_coding_mode; @@ -2092,7 +2092,6 @@ gen75_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->picture_fields.bits.frame_coding_mode == 2) { /* Field-Interlace */ if (picture_type == GEN7_VC1_I_PICTURE || picture_type == GEN7_VC1_P_PICTURE) { - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (is_first_field) gen7_vc1_current_surface->reference_distance = pic_param->reference_fields.bits.reference_distance; @@ -2268,6 +2267,7 @@ gen75_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale1_double_fwd = gen7_vc1_top_surface->luma_scale_top[1]; lumshift1_double_fwd = gen7_vc1_top_surface->luma_shift_top[1]; } + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode; } if (pic_param->sequence_fields.bits.interlace && @@ -2286,6 +2286,7 @@ gen75_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale2_double_fwd = gen7_vc1_bottom_surface->luma_scale_bottom[1]; lumshift2_double_fwd = gen7_vc1_bottom_surface->luma_shift_bottom[1]; } + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 2; } } } @@ -2300,6 +2301,7 @@ gen75_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd = !!gen7_vc1_top_surface->intensity_compensation_top; lumscale1_single_bwd = gen7_vc1_top_surface->luma_scale_top[0]; lumshift1_single_bwd = gen7_vc1_top_surface->luma_shift_top[0]; + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode << 1; } if (pic_param->sequence_fields.bits.interlace && @@ -2313,18 +2315,11 @@ gen75_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd |= !!gen7_vc1_bottom_surface->intensity_compensation_bottom << 1; lumscale2_single_bwd = gen7_vc1_bottom_surface->luma_scale_bottom[0]; lumshift2_single_bwd = gen7_vc1_bottom_surface->luma_shift_bottom[0]; + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 3; } } } - if (pic_param->sequence_fields.bits.interlace && - pic_param->picture_fields.bits.frame_coding_mode > 0) { /* Frame-Interlace or Field-Interlace */ - if (picture_type == GEN7_VC1_P_PICTURE) - replication_mode = 0x5; - else if (picture_type == GEN7_VC1_B_PICTURE) - replication_mode = 0xf; - } - BEGIN_BCS_BATCH(batch, 6); OUT_BCS_BATCH(batch, MFX_VC1_PRED_PIPE_STATE | (6 - 2)); OUT_BCS_BATCH(batch, diff --git a/src/gen7_mfd.c b/src/gen7_mfd.c index facdee5..effc958 100644 --- a/src/gen7_mfd.c +++ b/src/gen7_mfd.c @@ -1626,6 +1626,7 @@ gen7_mfd_vc1_pic_state(VADriverContextP ctx, assert(decode_state->pic_param && decode_state->pic_param->buffer); pic_param = (VAPictureParameterBufferVC1 *)decode_state->pic_param->buffer; + gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (!pic_param->sequence_fields.bits.interlace || (pic_param->picture_fields.bits.frame_coding_mode < 2)) { /* Progressive or Frame-Interlace */ @@ -1699,8 +1700,6 @@ gen7_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->sequence_fields.bits.rangered) { obj_surface = decode_state->reference_objects[0]; - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); - if (pic_param->forward_reference_picture != VA_INVALID_ID && obj_surface) gen7_vc1_reference_surface = (struct gen7_vc1_surface *)(obj_surface->private_data); @@ -1813,6 +1812,7 @@ gen7_mfd_vc1_pic_state(VADriverContextP ctx, assert(pic_param->picture_fields.bits.frame_coding_mode < 3); + gen7_vc1_current_surface->frame_coding_mode = pic_param->picture_fields.bits.frame_coding_mode; if (pic_param->sequence_fields.bits.interlace) { if (pic_param->picture_fields.bits.frame_coding_mode < 2) fcm = pic_param->picture_fields.bits.frame_coding_mode; @@ -1826,7 +1826,6 @@ gen7_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->picture_fields.bits.frame_coding_mode == 2) { /* Field-Interlace */ if (picture_type == GEN7_VC1_I_PICTURE || picture_type == GEN7_VC1_P_PICTURE) { - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (is_first_field) gen7_vc1_current_surface->reference_distance = pic_param->reference_fields.bits.reference_distance; @@ -2002,6 +2001,7 @@ gen7_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale1_double_fwd = gen7_vc1_top_surface->luma_scale_top[1]; lumshift1_double_fwd = gen7_vc1_top_surface->luma_shift_top[1]; } + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode; } if (pic_param->sequence_fields.bits.interlace && @@ -2020,6 +2020,7 @@ gen7_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale2_double_fwd = gen7_vc1_bottom_surface->luma_scale_bottom[1]; lumshift2_double_fwd = gen7_vc1_bottom_surface->luma_shift_bottom[1]; } + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 2; } } } @@ -2034,6 +2035,7 @@ gen7_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd = !!gen7_vc1_top_surface->intensity_compensation_top; lumscale1_single_bwd = gen7_vc1_top_surface->luma_scale_top[0]; lumshift1_single_bwd = gen7_vc1_top_surface->luma_shift_top[0]; + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode << 1; } if (pic_param->sequence_fields.bits.interlace && @@ -2047,18 +2049,11 @@ gen7_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd |= !!gen7_vc1_bottom_surface->intensity_compensation_bottom << 1; lumscale2_single_bwd = gen7_vc1_bottom_surface->luma_scale_bottom[0]; lumshift2_single_bwd = gen7_vc1_bottom_surface->luma_shift_bottom[0]; + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 3; } } } - if (pic_param->sequence_fields.bits.interlace && - pic_param->picture_fields.bits.frame_coding_mode > 0) { /* Frame-Interlace or Field-Interlace */ - if (picture_type == GEN7_VC1_P_PICTURE) - replication_mode = 0x5; - else if (picture_type == GEN7_VC1_B_PICTURE) - replication_mode = 0xf; - } - BEGIN_BCS_BATCH(batch, 6); OUT_BCS_BATCH(batch, MFX_VC1_PRED_PIPE_STATE | (6 - 2)); OUT_BCS_BATCH(batch, diff --git a/src/gen7_mfd.h b/src/gen7_mfd.h index 37c2b3d..883f134 100644 --- a/src/gen7_mfd.h +++ b/src/gen7_mfd.h @@ -58,6 +58,7 @@ struct gen7_vc1_surface { dri_bo *dmv_top; dri_bo *dmv_bottom; + int frame_coding_mode; int picture_type_top; int picture_type_bottom; int range_reduction_frame; diff --git a/src/gen8_mfd.c b/src/gen8_mfd.c index c9c0698..b3a7014 100644 --- a/src/gen8_mfd.c +++ b/src/gen8_mfd.c @@ -1670,6 +1670,7 @@ gen8_mfd_vc1_pic_state(VADriverContextP ctx, assert(decode_state->pic_param && decode_state->pic_param->buffer); pic_param = (VAPictureParameterBufferVC1 *)decode_state->pic_param->buffer; + gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (!pic_param->sequence_fields.bits.interlace || (pic_param->picture_fields.bits.frame_coding_mode < 2)) { /* Progressive or Frame-Interlace */ @@ -1743,8 +1744,6 @@ gen8_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->sequence_fields.bits.rangered) { obj_surface = decode_state->reference_objects[0]; - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); - if (pic_param->forward_reference_picture != VA_INVALID_ID && obj_surface) gen7_vc1_reference_surface = (struct gen7_vc1_surface *)(obj_surface->private_data); @@ -1858,6 +1857,7 @@ gen8_mfd_vc1_pic_state(VADriverContextP ctx, assert(pic_param->picture_fields.bits.frame_coding_mode < 3); + gen7_vc1_current_surface->frame_coding_mode = pic_param->picture_fields.bits.frame_coding_mode; if (pic_param->sequence_fields.bits.interlace) { if (pic_param->picture_fields.bits.frame_coding_mode < 2) fcm = pic_param->picture_fields.bits.frame_coding_mode; @@ -1871,7 +1871,6 @@ gen8_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->picture_fields.bits.frame_coding_mode == 2) { /* Field-Interlace */ if (picture_type == GEN7_VC1_I_PICTURE || picture_type == GEN7_VC1_P_PICTURE) { - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (is_first_field) gen7_vc1_current_surface->reference_distance = pic_param->reference_fields.bits.reference_distance; @@ -2047,6 +2046,7 @@ gen8_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale1_double_fwd = gen7_vc1_top_surface->luma_scale_top[1]; lumshift1_double_fwd = gen7_vc1_top_surface->luma_shift_top[1]; } + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode; } if (pic_param->sequence_fields.bits.interlace && @@ -2065,6 +2065,7 @@ gen8_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale2_double_fwd = gen7_vc1_bottom_surface->luma_scale_bottom[1]; lumshift2_double_fwd = gen7_vc1_bottom_surface->luma_shift_bottom[1]; } + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 2; } } } @@ -2079,6 +2080,7 @@ gen8_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd = !!gen7_vc1_top_surface->intensity_compensation_top; lumscale1_single_bwd = gen7_vc1_top_surface->luma_scale_top[0]; lumshift1_single_bwd = gen7_vc1_top_surface->luma_shift_top[0]; + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode << 1; } if (pic_param->sequence_fields.bits.interlace && @@ -2092,18 +2094,11 @@ gen8_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd |= !!gen7_vc1_bottom_surface->intensity_compensation_bottom << 1; lumscale2_single_bwd = gen7_vc1_bottom_surface->luma_scale_bottom[0]; lumshift2_single_bwd = gen7_vc1_bottom_surface->luma_shift_bottom[0]; + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 3; } } } - if (pic_param->sequence_fields.bits.interlace && - pic_param->picture_fields.bits.frame_coding_mode > 0) { /* Frame-Interlace or Field-Interlace */ - if (picture_type == GEN7_VC1_P_PICTURE) - replication_mode = 0x5; - else if (picture_type == GEN7_VC1_B_PICTURE) - replication_mode = 0xf; - } - BEGIN_BCS_BATCH(batch, 6); OUT_BCS_BATCH(batch, MFX_VC1_PRED_PIPE_STATE | (6 - 2)); OUT_BCS_BATCH(batch,