Qualcomm UBWC layout documented; msm stops undersized buffers
Writing down the shared compression contract exposed a display path that treated compressed framebuffers as linear and could read past their end.
Dmitry Baryshkov has posted a seven-part series that finally defines the on-memory layout of Qualcomm Universal Bandwidth Compression (UBWC) buffers and hardens the msm display stack against undersized ones.
UBWC (DRM_FORMAT_MOD_QCOM_COMPRESSED, plus the V4L2 QC08C and QC10C pixel formats) is the lossless compression format that Qualcomm video decoders, the GPU, and the display controller pass among themselves. Until now the DRM modifier spoke only of macrotiles, and the V4L2 formats were documented as opaque multi-plane blobs. Each side reverse-engineered the other, which left no stable contract for userspace such as V4L2 plugins handing decoded frames to DRM.
Documenting the real layout also showed a concrete bug. Framebuffer creation in the msm driver validated UBWC buffers with the linear size check, so metadata, scanline padding, and the packed chroma arrangement were ignored. A 1080p NV12 UBWC buffer thousands of bytes short of the true layout could still be accepted; the display controller (DPU) then fetched past the end of the GEM object. For NV12 the DPU has always taken CbCr from after the Y data in the first buffer and ignored the second plane’s handle, offset, and pitch, behavior existing userspace (including turnip) already relies on.
The series moves the layout math out of the DPU-only path, checks new UBWC framebuffers against that layout, and writes the same rules into the DRM fourcc and V4L2 reserved-format docs: metadata ahead of data per plane, tile sizes, strides, alignments, and chroma sizing matching what DPU and vendor headers already do. Follow-on fixes make Venus report the real QC10C data stride and stop Iris from describing QC10C as compressed P010 (it is packed TP10-style, three 10-bit samples per 32-bit word).
A remaining tension is naming: DRM and Mesa still surface the 10-bit compressed path as P010 plus the Qualcomm modifier, while the media side treats QC10C as a distinct packed layout. Separately, Mesa 26.3-rc still rounds NV12 chroma size down for odd dimensions; that mismatch is being fixed on the Mesa side before the documented layout ships in a release.