diff options
author | carpalis <jerome.borsboom@carpalis.nl> | 2018-05-20 14:27:46 +0200 |
---|---|---|
committer | Xiang, Haihao <haihao.xiang@intel.com> | 2018-05-31 13:47:37 +0800 |
commit | 3c851c4e8e76ab0c8c5d83f904d4fd089ad540d3 (patch) | |
tree | 26d8b6253555cf1596fd5985d96936af258908db | |
parent | 6125c2c94a304ffc90c0f15a27925c9ff9ad9c32 (diff) | |
download | libva-intel-driver-3c851c4e8e76ab0c8c5d83f904d4fd089ad540d3.tar.gz |
genX_mfd: fix out-of-bounds reference pixel replication
Out-of-bounds reference pixel replication should take into account the frame
coding mode of the reference frame(s), not the frame coding mode of the
current frame.
Signed-off-by: Jerome Borsboom <jerome.borsboom@carpalis.nl>
-rw-r--r-- | src/gen75_mfd.c | 17 | ||||
-rw-r--r-- | src/gen7_mfd.c | 17 | ||||
-rw-r--r-- | src/gen7_mfd.h | 1 | ||||
-rw-r--r-- | src/gen8_mfd.c | 17 |
4 files changed, 19 insertions, 33 deletions
diff --git a/src/gen75_mfd.c b/src/gen75_mfd.c index bd461a85..fc979e38 100644 --- a/src/gen75_mfd.c +++ b/src/gen75_mfd.c @@ -1891,6 +1891,7 @@ gen75_mfd_vc1_pic_state(VADriverContextP ctx, assert(decode_state->pic_param && decode_state->pic_param->buffer); pic_param = (VAPictureParameterBufferVC1 *)decode_state->pic_param->buffer; + gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (!pic_param->sequence_fields.bits.interlace || (pic_param->picture_fields.bits.frame_coding_mode < 2)) { /* Progressive or Frame-Interlace */ @@ -1964,8 +1965,6 @@ gen75_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->sequence_fields.bits.rangered) { obj_surface = decode_state->reference_objects[0]; - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); - if (pic_param->forward_reference_picture != VA_INVALID_ID && obj_surface) gen7_vc1_reference_surface = (struct gen7_vc1_surface *)(obj_surface->private_data); @@ -2079,6 +2078,7 @@ gen75_mfd_vc1_pic_state(VADriverContextP ctx, assert(pic_param->picture_fields.bits.frame_coding_mode < 3); + gen7_vc1_current_surface->frame_coding_mode = pic_param->picture_fields.bits.frame_coding_mode; if (pic_param->sequence_fields.bits.interlace) { if (pic_param->picture_fields.bits.frame_coding_mode < 2) fcm = pic_param->picture_fields.bits.frame_coding_mode; @@ -2092,7 +2092,6 @@ gen75_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->picture_fields.bits.frame_coding_mode == 2) { /* Field-Interlace */ if (picture_type == GEN7_VC1_I_PICTURE || picture_type == GEN7_VC1_P_PICTURE) { - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (is_first_field) gen7_vc1_current_surface->reference_distance = pic_param->reference_fields.bits.reference_distance; @@ -2268,6 +2267,7 @@ gen75_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale1_double_fwd = gen7_vc1_top_surface->luma_scale_top[1]; lumshift1_double_fwd = gen7_vc1_top_surface->luma_shift_top[1]; } + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode; } if (pic_param->sequence_fields.bits.interlace && @@ -2286,6 +2286,7 @@ gen75_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale2_double_fwd = gen7_vc1_bottom_surface->luma_scale_bottom[1]; lumshift2_double_fwd = gen7_vc1_bottom_surface->luma_shift_bottom[1]; } + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 2; } } } @@ -2300,6 +2301,7 @@ gen75_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd = !!gen7_vc1_top_surface->intensity_compensation_top; lumscale1_single_bwd = gen7_vc1_top_surface->luma_scale_top[0]; lumshift1_single_bwd = gen7_vc1_top_surface->luma_shift_top[0]; + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode << 1; } if (pic_param->sequence_fields.bits.interlace && @@ -2313,18 +2315,11 @@ gen75_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd |= !!gen7_vc1_bottom_surface->intensity_compensation_bottom << 1; lumscale2_single_bwd = gen7_vc1_bottom_surface->luma_scale_bottom[0]; lumshift2_single_bwd = gen7_vc1_bottom_surface->luma_shift_bottom[0]; + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 3; } } } - if (pic_param->sequence_fields.bits.interlace && - pic_param->picture_fields.bits.frame_coding_mode > 0) { /* Frame-Interlace or Field-Interlace */ - if (picture_type == GEN7_VC1_P_PICTURE) - replication_mode = 0x5; - else if (picture_type == GEN7_VC1_B_PICTURE) - replication_mode = 0xf; - } - BEGIN_BCS_BATCH(batch, 6); OUT_BCS_BATCH(batch, MFX_VC1_PRED_PIPE_STATE | (6 - 2)); OUT_BCS_BATCH(batch, diff --git a/src/gen7_mfd.c b/src/gen7_mfd.c index facdee5b..effc9582 100644 --- a/src/gen7_mfd.c +++ b/src/gen7_mfd.c @@ -1626,6 +1626,7 @@ gen7_mfd_vc1_pic_state(VADriverContextP ctx, assert(decode_state->pic_param && decode_state->pic_param->buffer); pic_param = (VAPictureParameterBufferVC1 *)decode_state->pic_param->buffer; + gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (!pic_param->sequence_fields.bits.interlace || (pic_param->picture_fields.bits.frame_coding_mode < 2)) { /* Progressive or Frame-Interlace */ @@ -1699,8 +1700,6 @@ gen7_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->sequence_fields.bits.rangered) { obj_surface = decode_state->reference_objects[0]; - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); - if (pic_param->forward_reference_picture != VA_INVALID_ID && obj_surface) gen7_vc1_reference_surface = (struct gen7_vc1_surface *)(obj_surface->private_data); @@ -1813,6 +1812,7 @@ gen7_mfd_vc1_pic_state(VADriverContextP ctx, assert(pic_param->picture_fields.bits.frame_coding_mode < 3); + gen7_vc1_current_surface->frame_coding_mode = pic_param->picture_fields.bits.frame_coding_mode; if (pic_param->sequence_fields.bits.interlace) { if (pic_param->picture_fields.bits.frame_coding_mode < 2) fcm = pic_param->picture_fields.bits.frame_coding_mode; @@ -1826,7 +1826,6 @@ gen7_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->picture_fields.bits.frame_coding_mode == 2) { /* Field-Interlace */ if (picture_type == GEN7_VC1_I_PICTURE || picture_type == GEN7_VC1_P_PICTURE) { - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (is_first_field) gen7_vc1_current_surface->reference_distance = pic_param->reference_fields.bits.reference_distance; @@ -2002,6 +2001,7 @@ gen7_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale1_double_fwd = gen7_vc1_top_surface->luma_scale_top[1]; lumshift1_double_fwd = gen7_vc1_top_surface->luma_shift_top[1]; } + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode; } if (pic_param->sequence_fields.bits.interlace && @@ -2020,6 +2020,7 @@ gen7_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale2_double_fwd = gen7_vc1_bottom_surface->luma_scale_bottom[1]; lumshift2_double_fwd = gen7_vc1_bottom_surface->luma_shift_bottom[1]; } + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 2; } } } @@ -2034,6 +2035,7 @@ gen7_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd = !!gen7_vc1_top_surface->intensity_compensation_top; lumscale1_single_bwd = gen7_vc1_top_surface->luma_scale_top[0]; lumshift1_single_bwd = gen7_vc1_top_surface->luma_shift_top[0]; + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode << 1; } if (pic_param->sequence_fields.bits.interlace && @@ -2047,18 +2049,11 @@ gen7_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd |= !!gen7_vc1_bottom_surface->intensity_compensation_bottom << 1; lumscale2_single_bwd = gen7_vc1_bottom_surface->luma_scale_bottom[0]; lumshift2_single_bwd = gen7_vc1_bottom_surface->luma_shift_bottom[0]; + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 3; } } } - if (pic_param->sequence_fields.bits.interlace && - pic_param->picture_fields.bits.frame_coding_mode > 0) { /* Frame-Interlace or Field-Interlace */ - if (picture_type == GEN7_VC1_P_PICTURE) - replication_mode = 0x5; - else if (picture_type == GEN7_VC1_B_PICTURE) - replication_mode = 0xf; - } - BEGIN_BCS_BATCH(batch, 6); OUT_BCS_BATCH(batch, MFX_VC1_PRED_PIPE_STATE | (6 - 2)); OUT_BCS_BATCH(batch, diff --git a/src/gen7_mfd.h b/src/gen7_mfd.h index 37c2b3d0..883f134f 100644 --- a/src/gen7_mfd.h +++ b/src/gen7_mfd.h @@ -58,6 +58,7 @@ struct gen7_vc1_surface { dri_bo *dmv_top; dri_bo *dmv_bottom; + int frame_coding_mode; int picture_type_top; int picture_type_bottom; int range_reduction_frame; diff --git a/src/gen8_mfd.c b/src/gen8_mfd.c index c9c06987..b3a7014a 100644 --- a/src/gen8_mfd.c +++ b/src/gen8_mfd.c @@ -1670,6 +1670,7 @@ gen8_mfd_vc1_pic_state(VADriverContextP ctx, assert(decode_state->pic_param && decode_state->pic_param->buffer); pic_param = (VAPictureParameterBufferVC1 *)decode_state->pic_param->buffer; + gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (!pic_param->sequence_fields.bits.interlace || (pic_param->picture_fields.bits.frame_coding_mode < 2)) { /* Progressive or Frame-Interlace */ @@ -1743,8 +1744,6 @@ gen8_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->sequence_fields.bits.rangered) { obj_surface = decode_state->reference_objects[0]; - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); - if (pic_param->forward_reference_picture != VA_INVALID_ID && obj_surface) gen7_vc1_reference_surface = (struct gen7_vc1_surface *)(obj_surface->private_data); @@ -1858,6 +1857,7 @@ gen8_mfd_vc1_pic_state(VADriverContextP ctx, assert(pic_param->picture_fields.bits.frame_coding_mode < 3); + gen7_vc1_current_surface->frame_coding_mode = pic_param->picture_fields.bits.frame_coding_mode; if (pic_param->sequence_fields.bits.interlace) { if (pic_param->picture_fields.bits.frame_coding_mode < 2) fcm = pic_param->picture_fields.bits.frame_coding_mode; @@ -1871,7 +1871,6 @@ gen8_mfd_vc1_pic_state(VADriverContextP ctx, pic_param->picture_fields.bits.frame_coding_mode == 2) { /* Field-Interlace */ if (picture_type == GEN7_VC1_I_PICTURE || picture_type == GEN7_VC1_P_PICTURE) { - gen7_vc1_current_surface = (struct gen7_vc1_surface *)(decode_state->render_object->private_data); if (is_first_field) gen7_vc1_current_surface->reference_distance = pic_param->reference_fields.bits.reference_distance; @@ -2047,6 +2046,7 @@ gen8_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale1_double_fwd = gen7_vc1_top_surface->luma_scale_top[1]; lumshift1_double_fwd = gen7_vc1_top_surface->luma_shift_top[1]; } + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode; } if (pic_param->sequence_fields.bits.interlace && @@ -2065,6 +2065,7 @@ gen8_mfd_vc1_pred_pipe_state(VADriverContextP ctx, lumscale2_double_fwd = gen7_vc1_bottom_surface->luma_scale_bottom[1]; lumshift2_double_fwd = gen7_vc1_bottom_surface->luma_shift_bottom[1]; } + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 2; } } } @@ -2079,6 +2080,7 @@ gen8_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd = !!gen7_vc1_top_surface->intensity_compensation_top; lumscale1_single_bwd = gen7_vc1_top_surface->luma_scale_top[0]; lumshift1_single_bwd = gen7_vc1_top_surface->luma_shift_top[0]; + replication_mode |= !!gen7_vc1_top_surface->frame_coding_mode << 1; } if (pic_param->sequence_fields.bits.interlace && @@ -2092,18 +2094,11 @@ gen8_mfd_vc1_pred_pipe_state(VADriverContextP ctx, intensitycomp_single_bwd |= !!gen7_vc1_bottom_surface->intensity_compensation_bottom << 1; lumscale2_single_bwd = gen7_vc1_bottom_surface->luma_scale_bottom[0]; lumshift2_single_bwd = gen7_vc1_bottom_surface->luma_shift_bottom[0]; + replication_mode |= !!gen7_vc1_bottom_surface->frame_coding_mode << 3; } } } - if (pic_param->sequence_fields.bits.interlace && - pic_param->picture_fields.bits.frame_coding_mode > 0) { /* Frame-Interlace or Field-Interlace */ - if (picture_type == GEN7_VC1_P_PICTURE) - replication_mode = 0x5; - else if (picture_type == GEN7_VC1_B_PICTURE) - replication_mode = 0xf; - } - BEGIN_BCS_BATCH(batch, 6); OUT_BCS_BATCH(batch, MFX_VC1_PRED_PIPE_STATE | (6 - 2)); OUT_BCS_BATCH(batch, |