DAEMON-PPS: synthesise H.264 SPS/PPS NAL units from V4L2 controls

libva-v4l2-request-fourier (and any V4L2-stateless-API consumer)
passes H.264 SPS/PPS as separate V4L2_CID_STATELESS_H264_{SPS,PPS}
controls; only the slice NAL goes into the OUTPUT buffer.  This is
correct per the V4L2 stateless contract.  But libavcodec — which
the daedalus daemon uses for actual decode (Option γ) — wants a
self-contained AnnexB stream including SPS+PPS before any slice.
Result on higgs: "non-existing PPS 0 referenced" + decode_slice_
header errors on every H.264 frame, even after LIBVA-1 and -2
routing correctly delivered the request to the daemon.

Fix splits across kernel + daemon, keeping the kernel module as a
thin transport and putting the actual NAL encoding in userspace:

  include/daedalus_v4l2_proto.h:
    Add struct daedalus_h264_meta (the four v4l2_ctrl_h264_*
    structs the kernel collects) and DAEDALUS_REQ_FLAG_H264_META
    (set in req.flags when the meta block is present between the
    daedalus_req_decode prefix and the slice bitstream).

  kernel/daedalus_v4l2_main.c:
    Add daedalus_collect_h264_meta() — reads the H.264 ctrl values
    from the bound media_request via v4l2_ctrl_find +
    ctrl->p_cur.p_h264_*.  device_run() calls it on H.264 codec_id,
    copies the structs into the REQ_DECODE payload between the
    prefix and bitstream, and sets the flag.  Payload size is
    bounds-checked against DAEDALUS_PROTO_MAX_PAYLOAD so an over-
    sized slice + meta fails loud instead of truncating.

  daemon/src/bitstream_writer.{c,h}:
    New module — MSB-first bit packer with H.264 Exp-Golomb ue(v)
    and se(v) coding + rbsp_trailing_bits alignment.  Sticky
    overflow flag so callers can verify the output buffer wasn't
    truncated.

  daemon/src/h264_nal_synth.{c,h}:
    New module — turns v4l2_ctrl_h264_sps / v4l2_ctrl_h264_pps
    into AnnexB-framed NAL units per ITU-T H.264 7.3.2.1 / 7.3.2.2.
    Emits emulation prevention bytes (0x03 after every 00 00 in the
    EBSP) and the 4-byte start code (0x00000001).  Coverage matches
    what V4L2 stateless surface gives us: VUI parameters and full
    scaling matrices are NOT emitted (V4L2 doesn't carry them — the
    seq_scaling_matrix_present_flag is set to 0 and libavcodec uses
    flat defaults, which matches the de-facto behaviour of most
    H.264 streams libva-v4l2-request drives).

  daemon/src/decoder.c:
    daedalus_decoder_run_request() now takes an optional
    h264_meta parameter.  For codec_id == H264 with meta != NULL,
    synthesises SPS+PPS NAL units, allocates a combined
    [SPS][PPS][slice] buffer (+ AV_INPUT_BUFFER_PADDING_SIZE), and
    feeds that to avcodec_send_packet instead of the raw slice.
    VP9/AV1 path unchanged (frames are self-contained).  Cleanup
    now goes through a unified `out:` label so the assembled
    buffer is always freed on every exit (including the existing
    decoder_open_codec / no-frame / receive_frame failure paths).

  daemon/src/chardev_client.c:
    handle_req_decode() peels off the optional meta block when the
    flag is set, passes it through to the decoder, and updates
    the payload-length consistency check (now allows for an extra
    sizeof(daedalus_h264_meta) when the flag is on).

Build (boltzmann aarch64): clean compile of all daemon sources,
including bitstream_writer + h264_nal_synth + the refactored
decoder.c.  Kernel module compile to be verified via DKMS rebuild
on higgs in the marfrit-packages bump that follows.

Test plan: with this commit + a marfrit-packages daedalus pin
bump, higgs's ffmpeg -hwaccel vaapi -i h264_test.mp4 should
produce a successful decode (vs. the previous "non-existing PPS 0
referenced" failure).  The daemon log should show:
  decoder: opened h264 context
  decoder: h264 prepended SPS=NB PPS=MB slice=KB
  decoder: OK 320x240 fmt=0 (yuv420p) fnv1a=0x...

VP9 / AV1 behaviour unchanged — they don't carry meta and the
existing per-frame self-describing path still applies.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

daemon/CMakeLists.txt

@@ -36,6 +36,8 @@ add_executable(daedalus_v4l2_daemon
 	src/decoder.c
 	src/chardev_client.c
 	src/dmabuf_capture.c
+	src/bitstream_writer.c
+	src/h264_nal_synth.c
 )
 
 target_include_directories(daedalus_v4l2_daemon

daemon/src/bitstream_writer.c

@@ -0,0 +1,101 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+#include "bitstream_writer.h"
+
+#include <string.h>
+
+void bsw_init(struct bs_writer *bs, uint8_t *buf, size_t cap)
+{
+	bs->buf = buf;
+	bs->cap = cap;
+	bs->pos_bytes = 0;
+	bs->pos_bit = 0;
+	bs->overflow = false;
+	if (buf && cap)
+		buf[0] = 0;
+}
+
+void bsw_put_u(struct bs_writer *bs, uint32_t v, int n)
+{
+	int i;
+
+	if (n <= 0 || n > 32)
+		return;
+
+	for (i = n - 1; i >= 0; i--) {
+		uint8_t bit = (uint8_t) ((v >> i) & 1u);
+
+		if (bs->pos_bytes >= bs->cap) {
+			bs->overflow = true;
+			return;
+		}
+
+		if (bs->pos_bit == 0)
+			bs->buf[bs->pos_bytes] = 0;
+
+		bs->buf[bs->pos_bytes] |= (uint8_t) (bit << (7 - bs->pos_bit));
+		bs->pos_bit++;
+		if (bs->pos_bit == 8) {
+			bs->pos_bit = 0;
+			bs->pos_bytes++;
+		}
+	}
+}
+
+/*
+ * Exp-Golomb ue(v) — H.264 9.1 / 9.1.1.
+ * For an unsigned value v:
+ *   codeNum = v
+ *   leadingZeroBits = floor(log2(codeNum + 1))
+ *   code = leadingZeroBits zeros, then '1', then leadingZeroBits bits
+ *          of (codeNum + 1 - 2^leadingZeroBits)
+ *
+ * Total length = 2 * leadingZeroBits + 1 bits.  For v = 0 the
+ * code is just "1" (1 bit).  For v in [1,2] the code is 3 bits, etc.
+ */
+void bsw_put_ue(struct bs_writer *bs, uint32_t v)
+{
+	uint32_t code_num = v;
+	uint32_t code_num_plus_1 = code_num + 1u;
+	int leading_zeros = 0;
+	uint32_t tmp;
+
+	tmp = code_num_plus_1 >> 1;
+	while (tmp) {
+		leading_zeros++;
+		tmp >>= 1;
+	}
+
+	/* leading_zeros zero bits */
+	bsw_put_u(bs, 0u, leading_zeros);
+	/* one '1' bit + the (leading_zeros) low bits of code_num_plus_1 */
+	bsw_put_u(bs, code_num_plus_1, leading_zeros + 1);
+}
+
+/*
+ * Exp-Golomb se(v) — H.264 9.1.1: signed mapping is interleaved:
+ *   0 -> 0, 1 -> 1, -1 -> 2, 2 -> 3, -2 -> 4, ...
+ * i.e. codeNum = 2 * |v| - (v > 0 ? 1 : 0).
+ */
+void bsw_put_se(struct bs_writer *bs, int32_t v)
+{
+	uint32_t code_num;
+
+	if (v > 0)
+		code_num = (uint32_t) (2 * v - 1);
+	else
+		code_num = (uint32_t) (-2 * v);
+	bsw_put_ue(bs, code_num);
+}
+
+void bsw_align_rbsp(struct bs_writer *bs)
+{
+	/* rbsp_stop_one_bit + zero-fill to byte boundary */
+	bsw_put_u(bs, 1u, 1);
+	while (bs->pos_bit != 0)
+		bsw_put_u(bs, 0u, 1);
+}
+
+size_t bsw_bytes(const struct bs_writer *bs)
+{
+	return bs->pos_bytes;
+}

daemon/src/bitstream_writer.h

@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * bitstream_writer.h — MSB-first bit packer with Exp-Golomb coding.
+ *
+ * Used by h264_nal_synth to emit AnnexB SPS / PPS NAL units the
+ * daemon prepends to libva-provided slice data before feeding
+ * libavcodec.  The writer is the minimum primitives the H.264
+ * SPS/PPS RBSPs need:
+ *
+ *   put_u(v, n)   — n-bit unsigned, MSB first
+ *   put_ue(v)     — Exp-Golomb unsigned (CAVLC ue(v))
+ *   put_se(v)     — Exp-Golomb signed   (CAVLC se(v))
+ *   align()       — rbsp_trailing_bits: stop_one + zero-pad to byte
+ *
+ * No allocations — the caller hands in a fixed buffer and the writer
+ * tracks (byte, bit) cursor in it.  Overruns are detected and made
+ * sticky via an error flag; callers check bsw_overflowed at the end.
+ */
+#ifndef DAEDALUS_BITSTREAM_WRITER_H
+#define DAEDALUS_BITSTREAM_WRITER_H
+
+#include <stddef.h>
+#include <stdint.h>
+#include <stdbool.h>
+
+struct bs_writer {
+	uint8_t *buf;
+	size_t cap;
+	size_t pos_bytes;
+	int pos_bit;     /* 0..7, MSB-first within the current byte */
+	bool overflow;
+};
+
+void bsw_init(struct bs_writer *bs, uint8_t *buf, size_t cap);
+void bsw_put_u(struct bs_writer *bs, uint32_t v, int n);
+void bsw_put_ue(struct bs_writer *bs, uint32_t v);
+void bsw_put_se(struct bs_writer *bs, int32_t v);
+
+/* Align to next byte boundary by appending rbsp_trailing_bits:
+ * a single '1' followed by '0's up to the byte boundary.  After
+ * this call bsw_bytes is the RBSP length. */
+void bsw_align_rbsp(struct bs_writer *bs);
+
+/* Byte count of payload written so far.  If pos_bit != 0, returns
+ * pos_bytes (incomplete bits are not counted; finalise with
+ * bsw_align_rbsp first). */
+size_t bsw_bytes(const struct bs_writer *bs);
+
+static inline bool bsw_overflowed(const struct bs_writer *bs)
+{
+	return bs->overflow;
+}
+
+#endif /* DAEDALUS_BITSTREAM_WRITER_H */

daemon/src/chardev_client.c

@@ -140,6 +140,8 @@ static int handle_req_decode(struct chardev_client *cli,
 	struct daedalus_req_decode req;
 	struct daedalus_resp_frame resp;
 	struct daedalus_capture_planes planes;
+	const struct daedalus_h264_meta *h264_meta = NULL;
+	size_t meta_off, meta_len = 0;
 	int rc;
 	int decoded = 0;
 
@@ -152,17 +154,30 @@ static int handle_req_decode(struct chardev_client *cli,
 				     hdr->cookie, &resp, sizeof(resp));
 	}
 	memcpy(&req, payload, sizeof(req));
-	if ((size_t) req.bitstream_len + sizeof(req) != hdr->payload_len) {
-		log_err("REQ_DECODE cookie=%u: bitstream_len %u inconsistent with payload_len %u",
-			hdr->cookie, req.bitstream_len, hdr->payload_len);
+
+	/* Optional H.264 meta block follows req when the flag is set;
+	 * bitstream comes after meta. */
+	if (req.flags & DAEDALUS_REQ_FLAG_H264_META)
+		meta_len = sizeof(struct daedalus_h264_meta);
+	meta_off = sizeof(req);
+
+	if ((size_t) req.bitstream_len + sizeof(req) + meta_len !=
+	    hdr->payload_len) {
+		log_err("REQ_DECODE cookie=%u: bitstream_len %u + meta %zu inconsistent with payload_len %u",
+			hdr->cookie, req.bitstream_len, meta_len,
+			hdr->payload_len);
 		memset(&resp, 0, sizeof(resp));
 		resp.status = DAEDALUS_DECODE_ERR_RECV;
 		return send_response(cli, DAEDALUS_MSG_RESP_FRAME,
 				     hdr->cookie, &resp, sizeof(resp));
 	}
+	if (meta_len)
+		h264_meta = (const struct daedalus_h264_meta *)
+				(payload + meta_off);
 
-	log_info("REQ_DECODE cookie=%u codec=%u bitstream=%u bytes capture=%ux%u %u planes",
+	log_info("REQ_DECODE cookie=%u codec=%u bitstream=%u bytes meta=%s capture=%ux%u %u planes",
 		 hdr->cookie, req.codec_id, req.bitstream_len,
+		 h264_meta ? "h264" : "none",
 		 req.capture_width, req.capture_height,
 		 req.capture_num_planes);
 
@@ -181,7 +196,9 @@ static int handle_req_decode(struct chardev_client *cli,
 	}
 
 	rc = daedalus_decoder_run_request(cli->decoder, &req,
-					  payload + sizeof(req), &resp,
+					  payload + meta_off + meta_len,
+					  h264_meta,
+					  &resp,
 					  planes.nr ? &planes : NULL);
 	decoded = (rc >= 0);
 

daemon/src/decoder.c

@@ -4,6 +4,7 @@
  */
 #include "decoder.h"
 #include "ffmpeg_loader.h"
+#include "h264_nal_synth.h"
 #include "log.h"
 
 #include <errno.h>
@@ -350,11 +351,14 @@ static int pack_nv12_to_planes(struct AVFrame *fr,
 int daedalus_decoder_run_request(struct daedalus_decoder *dec,
 				 const struct daedalus_req_decode *req,
 				 const uint8_t *bitstream,
+				 const struct daedalus_h264_meta *h264_meta,
 				 struct daedalus_resp_frame *resp,
 				 const struct daedalus_capture_planes *planes)
 {
 	struct ffmpeg_loader *fm = dec->loader;
 	struct AVCodecContext *ctx = NULL;
+	uint8_t *assembled = NULL;
+	size_t assembled_len = 0;
 	int rc;
 
 	memset(resp, 0, sizeof(*resp));
@@ -363,32 +367,72 @@ int daedalus_decoder_run_request(struct daedalus_decoder *dec,
 	rc = decoder_open_codec(dec, req->codec_id, &ctx);
 	if (rc == -ENOSYS) {
 		resp->status = DAEDALUS_DECODE_ERR_CODEC;
-		return 0;
+		goto out;
 	}
 	if (rc < 0) {
 		resp->status = DAEDALUS_DECODE_ERR_OPEN;
-		return 0;
+		goto out;
 	}
 
 	fm->av_packet_unref(dec->pkt);
+
 	/*
-	 * The kernel's REQ_DECODE payload is borrowed memory we'll
-	 * free as soon as this function returns.  Pointing the
-	 * AVPacket at it directly is safe because avcodec_send_packet
-	 * either fully consumes the input or copies it internally —
-	 * by the time we return we no longer reference @bitstream.
-	 *
-	 * We cast away const because AVPacket->data is non-const in
-	 * the FFmpeg API; we promise not to mutate the buffer.
+	 * H.264 path: libavcodec needs SPS+PPS NAL units BEFORE the
+	 * slice can be decoded.  libva-v4l2-request passes those as
+	 * separate V4L2 controls (per the stateless API), so the
+	 * daedalus kernel module forwards them to us as struct
+	 * daedalus_h264_meta.  Synthesise AnnexB SPS+PPS NALs from
+	 * the structs and prepend them to @bitstream before feeding
+	 * libavcodec.
 	 */
-	dec->pkt->data = (uint8_t *) (uintptr_t) bitstream;
-	dec->pkt->size = (int) req->bitstream_len;
+	if (req->codec_id == DAEDALUS_CODEC_H264 && h264_meta) {
+		uint8_t sps_nal[256];
+		uint8_t pps_nal[128];
+		size_t sps_len, pps_len;
+
+		sps_len = h264_synth_sps(&h264_meta->sps,
+					 sps_nal, sizeof(sps_nal));
+		pps_len = h264_synth_pps(&h264_meta->pps,
+					 pps_nal, sizeof(pps_nal));
+		if (sps_len == 0 || pps_len == 0) {
+			log_err("decoder: SPS/PPS NAL synth failed (sps=%zu pps=%zu)",
+				sps_len, pps_len);
+			resp->status = DAEDALUS_DECODE_ERR_SEND;
+			goto out;
+		}
+
+		assembled_len = sps_len + pps_len + req->bitstream_len;
+		assembled = malloc(assembled_len + AV_INPUT_BUFFER_PADDING_SIZE);
+		if (!assembled) {
+			resp->status = DAEDALUS_DECODE_ERR_SEND;
+			goto out;
+		}
+		memcpy(assembled, sps_nal, sps_len);
+		memcpy(assembled + sps_len, pps_nal, pps_len);
+		memcpy(assembled + sps_len + pps_len,
+		       bitstream, req->bitstream_len);
+		memset(assembled + assembled_len, 0,
+		       AV_INPUT_BUFFER_PADDING_SIZE);
+
+		dec->pkt->data = assembled;
+		dec->pkt->size = (int) assembled_len;
+		log_debug("decoder: h264 prepended SPS=%zuB PPS=%zuB slice=%uB",
+			  sps_len, pps_len, req->bitstream_len);
+	} else {
+		/*
+		 * VP9/AV1: bitstream is self-contained per frame, point the
+		 * AVPacket at it directly.  Cast away const — AVPacket->data
+		 * is non-const but avcodec_send_packet doesn't mutate it.
+		 */
+		dec->pkt->data = (uint8_t *) (uintptr_t) bitstream;
+		dec->pkt->size = (int) req->bitstream_len;
+	}
 
 	rc = fm->avcodec_send_packet(ctx, dec->pkt);
 	if (rc < 0) {
 		log_err("decoder: avcodec_send_packet failed: %d", rc);
 		resp->status = DAEDALUS_DECODE_ERR_SEND;
-		return 0;
+		goto out;
 	}
 
 	fm->av_frame_unref(dec->frame);
@@ -396,12 +440,12 @@ int daedalus_decoder_run_request(struct daedalus_decoder *dec,
 	if (rc == AVERROR(EAGAIN) || rc == AVERROR_EOF) {
 		log_debug("decoder: no frame ready yet (rc=%d)", rc);
 		resp->status = DAEDALUS_DECODE_NO_FRAME;
-		return 0;
+		goto out;
 	}
 	if (rc < 0) {
 		log_err("decoder: avcodec_receive_frame failed: %d", rc);
 		resp->status = DAEDALUS_DECODE_ERR_RECV;
-		return 0;
+		goto out;
 	}
 
 	{
@@ -508,5 +552,9 @@ int daedalus_decoder_run_request(struct daedalus_decoder *dec,
 	}
 
 	fm->av_frame_unref(dec->frame);
+
+out:
+	free(assembled);
+	(void) assembled_len;
 	return 0;
 }

daemon/src/decoder.h

@@ -60,6 +60,12 @@ void daedalus_decoder_cleanup(struct daedalus_decoder *dec);
  * @dec:	initialised decoder
  * @req:	REQ_DECODE prefix (from the wire)
  * @bitstream:	bitstream blob (req->bitstream_len bytes)
+ * @h264_meta:	optional H.264 SPS/PPS metadata; non-NULL only when
+ *		codec_id == H264 and the kernel set DAEDALUS_REQ_FLAG_
+ *		H264_META.  Used to synthesise the AnnexB SPS+PPS NALs
+ *		libavcodec needs before any slice (libva-v4l2-request
+ *		passes only the slice in @bitstream per the V4L2
+ *		stateless API contract).  NULL for VP9/AV1 paths.
  * @resp:	caller-allocated RESP_FRAME output (zeroed by callee)
  * @planes:	mapped CAPTURE planes (Phase 8.6 dmabuf path).  If
  *		NULL or planes->nr == 0, the decoder runs but
@@ -75,6 +81,7 @@ void daedalus_decoder_cleanup(struct daedalus_decoder *dec);
 int  daedalus_decoder_run_request(struct daedalus_decoder *dec,
 				  const struct daedalus_req_decode *req,
 				  const uint8_t *bitstream,
+				  const struct daedalus_h264_meta *h264_meta,
 				  struct daedalus_resp_frame *resp,
 				  const struct daedalus_capture_planes *planes);
 

daemon/src/h264_nal_synth.c

@@ -0,0 +1,270 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * h264_nal_synth.c — encode SPS / PPS NAL units from the V4L2
+ * stateless control structs.  See header for design rationale.
+ *
+ * Spec references are to ITU-T H.264 (08/2021) section 7.3.2.
+ * The RBSP encodings here cover the common profiles libva-v4l2-
+ * request drives (Constrained Baseline, Main, High up to Hi10).
+ * VUI parameters and seq_scaling_list payloads are NOT emitted —
+ * we set the corresponding present flags to 0, which produces a
+ * valid SPS / PPS that libavcodec accepts (it just uses default
+ * scaling matrices and no VUI-derived timing).  That matches the
+ * V4L2 stateless control surface: the kernel controls don't carry
+ * VUI fields either, so synthesising them would require fabrication.
+ */
+#include "h264_nal_synth.h"
+#include "bitstream_writer.h"
+
+#include <string.h>
+
+#define NAL_SPS	7
+#define NAL_PPS	8
+#define NAL_REF_IDC_HIGHEST 3
+
+/*
+ * Profiles that carry the "chroma_format_idc and friends" extension
+ * block per H.264 7.3.2.1.1.  Any profile_idc not in this list skips
+ * the chroma_format_idc/bit_depth/scaling/transform_bypass fields.
+ */
+static bool sps_has_chroma_format_block(uint8_t profile_idc)
+{
+	switch (profile_idc) {
+	case 100: case 110: case 122: case 244:
+	case 44:  case 83:  case 86:
+	case 118: case 128: case 138: case 139:
+	case 134: case 135:
+		return true;
+	default:
+		return false;
+	}
+}
+
+/*
+ * Insert emulation prevention bytes into @rbsp[0..len) and copy the
+ * result into @out.  Returns the number of bytes written to @out.
+ * If the result would exceed @out_cap, returns 0.
+ *
+ * Rule (H.264 7.4.1.1):  in the byte stream, any subsequence
+ * 0x00 0x00 0x00, 0x00 0x00 0x01, 0x00 0x00 0x02, or 0x00 0x00 0x03
+ * inside the EBSP must be expanded to 0x00 0x00 0x03 <third_byte>.
+ * Practically: scan the RBSP, after every "0x00 0x00" output the
+ * 0x03 escape if the next byte is <= 0x03.
+ */
+static size_t emulation_prevent(const uint8_t *rbsp, size_t len,
+				uint8_t *out, size_t out_cap)
+{
+	size_t i, w = 0;
+	int zeros = 0;
+
+	for (i = 0; i < len; i++) {
+		uint8_t b = rbsp[i];
+
+		if (zeros >= 2 && b <= 0x03) {
+			if (w >= out_cap)
+				return 0;
+			out[w++] = 0x03;
+			zeros = 0;
+		}
+
+		if (w >= out_cap)
+			return 0;
+		out[w++] = b;
+
+		if (b == 0x00)
+			zeros++;
+		else
+			zeros = 0;
+	}
+
+	return w;
+}
+
+/*
+ * Emit AnnexB start code + nal_unit_header + EBSP into @out.
+ * @rbsp/@rbsp_len is the raw RBSP (already byte-aligned).
+ * Returns total bytes written, or 0 on overflow.
+ */
+static size_t wrap_nal_annexb(uint8_t nal_unit_type, uint8_t nal_ref_idc,
+			      const uint8_t *rbsp, size_t rbsp_len,
+			      uint8_t *out, size_t out_cap)
+{
+	uint8_t header;
+	size_t w = 0, ebsp_len;
+
+	if (out_cap < 5)
+		return 0;
+
+	/* start code: 0x00 0x00 0x00 0x01 (4-byte form — safe for any
+	 * concatenation with other NALs since 3-byte form would risk
+	 * confusion when the preceding NAL ends in 0x00). */
+	out[w++] = 0x00;
+	out[w++] = 0x00;
+	out[w++] = 0x00;
+	out[w++] = 0x01;
+
+	header = (uint8_t) (((nal_ref_idc & 0x3) << 5) |
+			    (nal_unit_type & 0x1f));
+	out[w++] = header;
+
+	ebsp_len = emulation_prevent(rbsp, rbsp_len, out + w, out_cap - w);
+	if (ebsp_len == 0 && rbsp_len > 0)
+		return 0;
+	w += ebsp_len;
+	return w;
+}
+
+size_t h264_synth_sps(const struct v4l2_ctrl_h264_sps *sps,
+		      uint8_t *out, size_t out_cap)
+{
+	uint8_t rbsp[512];
+	struct bs_writer bs;
+	uint32_t flags = sps->flags;
+	bool has_chroma_block = sps_has_chroma_format_block(sps->profile_idc);
+	bool frame_mbs_only = !!(flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY);
+
+	bsw_init(&bs, rbsp, sizeof(rbsp));
+
+	bsw_put_u(&bs, sps->profile_idc, 8);
+	bsw_put_u(&bs, sps->constraint_set_flags, 8);
+	bsw_put_u(&bs, sps->level_idc, 8);
+	bsw_put_ue(&bs, sps->seq_parameter_set_id);
+
+	if (has_chroma_block) {
+		bsw_put_ue(&bs, sps->chroma_format_idc);
+		if (sps->chroma_format_idc == 3) {
+			bsw_put_u(&bs,
+				  (flags & V4L2_H264_SPS_FLAG_SEPARATE_COLOUR_PLANE) ? 1 : 0,
+				  1);
+		}
+		bsw_put_ue(&bs, sps->bit_depth_luma_minus8);
+		bsw_put_ue(&bs, sps->bit_depth_chroma_minus8);
+		bsw_put_u(&bs,
+			  (flags & V4L2_H264_SPS_FLAG_QPPRIME_Y_ZERO_TRANSFORM_BYPASS) ? 1 : 0,
+			  1);
+		/* seq_scaling_matrix_present_flag = 0 — let libavcodec
+		 * use default scaling matrices.  V4L2 ships scaling
+		 * matrices via a separate control which we don't fold
+		 * into SPS here (the libavcodec decoder ignores them
+		 * for default-flat content anyway). */
+		bsw_put_u(&bs, 0u, 1);
+	}
+
+	bsw_put_ue(&bs, sps->log2_max_frame_num_minus4);
+	bsw_put_ue(&bs, sps->pic_order_cnt_type);
+
+	if (sps->pic_order_cnt_type == 0) {
+		bsw_put_ue(&bs, sps->log2_max_pic_order_cnt_lsb_minus4);
+	} else if (sps->pic_order_cnt_type == 1) {
+		uint32_t n = sps->num_ref_frames_in_pic_order_cnt_cycle;
+		uint32_t i;
+		bsw_put_u(&bs,
+			  (flags & V4L2_H264_SPS_FLAG_DELTA_PIC_ORDER_ALWAYS_ZERO) ? 1 : 0,
+			  1);
+		bsw_put_se(&bs, sps->offset_for_non_ref_pic);
+		bsw_put_se(&bs, sps->offset_for_top_to_bottom_field);
+		bsw_put_ue(&bs, n);
+		if (n > 255)
+			return 0;
+		for (i = 0; i < n; i++)
+			bsw_put_se(&bs, sps->offset_for_ref_frame[i]);
+	}
+
+	bsw_put_ue(&bs, sps->max_num_ref_frames);
+	bsw_put_u(&bs,
+		  (flags & V4L2_H264_SPS_FLAG_GAPS_IN_FRAME_NUM_VALUE_ALLOWED) ? 1 : 0,
+		  1);
+	bsw_put_ue(&bs, sps->pic_width_in_mbs_minus1);
+	bsw_put_ue(&bs, sps->pic_height_in_map_units_minus1);
+	bsw_put_u(&bs, frame_mbs_only ? 1u : 0u, 1);
+	if (!frame_mbs_only) {
+		bsw_put_u(&bs,
+			  (flags & V4L2_H264_SPS_FLAG_MB_ADAPTIVE_FRAME_FIELD) ? 1 : 0,
+			  1);
+	}
+	bsw_put_u(&bs,
+		  (flags & V4L2_H264_SPS_FLAG_DIRECT_8X8_INFERENCE) ? 1 : 0,
+		  1);
+
+	/* frame_cropping_flag = 0 — V4L2 SPS doesn't carry crop offsets.
+	 * libva/ffmpeg uses the surface dimensions from
+	 * VAPictureParameterBufferH264 directly so the SPS crop is
+	 * informational for libavcodec output sizing only; absent crop
+	 * means the daemon's output equals the encoded size, which
+	 * matches our wire protocol's capture_width/height. */
+	bsw_put_u(&bs, 0u, 1);
+	/* vui_parameters_present_flag = 0 */
+	bsw_put_u(&bs, 0u, 1);
+
+	bsw_align_rbsp(&bs);
+	if (bsw_overflowed(&bs))
+		return 0;
+
+	return wrap_nal_annexb(NAL_SPS, NAL_REF_IDC_HIGHEST,
+			       rbsp, bsw_bytes(&bs), out, out_cap);
+}
+
+size_t h264_synth_pps(const struct v4l2_ctrl_h264_pps *pps,
+		      uint8_t *out, size_t out_cap)
+{
+	uint8_t rbsp[128];
+	struct bs_writer bs;
+	uint16_t flags = pps->flags;
+	bool transform_8x8 = !!(flags & V4L2_H264_PPS_FLAG_TRANSFORM_8X8_MODE);
+
+	bsw_init(&bs, rbsp, sizeof(rbsp));
+
+	bsw_put_ue(&bs, pps->pic_parameter_set_id);
+	bsw_put_ue(&bs, pps->seq_parameter_set_id);
+	bsw_put_u(&bs,
+		  (flags & V4L2_H264_PPS_FLAG_ENTROPY_CODING_MODE) ? 1 : 0,
+		  1);
+	bsw_put_u(&bs,
+		  (flags & V4L2_H264_PPS_FLAG_BOTTOM_FIELD_PIC_ORDER_IN_FRAME_PRESENT) ? 1 : 0,
+		  1);
+	bsw_put_ue(&bs, pps->num_slice_groups_minus1);
+	/* Slice-group map types only meaningful when num_slice_groups_minus1 > 0;
+	 * V4L2 stateless decode path doesn't surface slice group maps, so we
+	 * assume single-slice-group (0) — this is the overwhelming common case. */
+	bsw_put_ue(&bs, pps->num_ref_idx_l0_default_active_minus1);
+	bsw_put_ue(&bs, pps->num_ref_idx_l1_default_active_minus1);
+	bsw_put_u(&bs,
+		  (flags & V4L2_H264_PPS_FLAG_WEIGHTED_PRED) ? 1 : 0,
+		  1);
+	bsw_put_u(&bs, pps->weighted_bipred_idc, 2);
+	bsw_put_se(&bs, pps->pic_init_qp_minus26);
+	bsw_put_se(&bs, pps->pic_init_qs_minus26);
+	bsw_put_se(&bs, pps->chroma_qp_index_offset);
+	bsw_put_u(&bs,
+		  (flags & V4L2_H264_PPS_FLAG_DEBLOCKING_FILTER_CONTROL_PRESENT) ? 1 : 0,
+		  1);
+	bsw_put_u(&bs,
+		  (flags & V4L2_H264_PPS_FLAG_CONSTRAINED_INTRA_PRED) ? 1 : 0,
+		  1);
+	bsw_put_u(&bs,
+		  (flags & V4L2_H264_PPS_FLAG_REDUNDANT_PIC_CNT_PRESENT) ? 1 : 0,
+		  1);
+
+	/* The "more_rbsp_data()" section: only emit when we actually have
+	 * something to say.  If transform_8x8 is set OR the second chroma
+	 * offset differs from the first, write the extended trailer;
+	 * otherwise stop here and let rbsp_trailing_bits close out.  This
+	 * matches what ffmpeg expects — too-short PPS with default values
+	 * is fine. */
+	if (transform_8x8 ||
+	    pps->second_chroma_qp_index_offset != pps->chroma_qp_index_offset) {
+		bsw_put_u(&bs, transform_8x8 ? 1u : 0u, 1);
+		/* pic_scaling_matrix_present_flag = 0 — let libavcodec
+		 * use defaults; we'd need full scaling list serialisation
+		 * to do better and it rarely matters for stateless decode. */
+		bsw_put_u(&bs, 0u, 1);
+		bsw_put_se(&bs, pps->second_chroma_qp_index_offset);
+	}
+
+	bsw_align_rbsp(&bs);
+	if (bsw_overflowed(&bs))
+		return 0;
+
+	return wrap_nal_annexb(NAL_PPS, NAL_REF_IDC_HIGHEST,
+			       rbsp, bsw_bytes(&bs), out, out_cap);
+}

daemon/src/h264_nal_synth.h

@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: BSD-2-Clause */
+/*
+ * h264_nal_synth.h — synthesise AnnexB SPS + PPS NAL units from the
+ * v4l2_ctrl_h264_sps / v4l2_ctrl_h264_pps structures the libva driver
+ * sets via V4L2 stateless controls and the daedalus kernel module
+ * forwards over the chardev as struct daedalus_h264_meta.
+ *
+ * libavcodec needs SPS+PPS NAL units BEFORE any slice NAL to bind
+ * the slice's pic_parameter_set_id reference; libva-v4l2-request
+ * passes only the slice in the OUTPUT buffer (per the V4L2 stateless
+ * H.264 contract).  The daemon bridges by reconstructing SPS+PPS
+ * NAL bytes from the structured controls and prepending them to the
+ * bitstream the daemon hands libavcodec.
+ *
+ * Output is AnnexB-framed: 0x00 0x00 0x00 0x01 start code + NAL.
+ * Emulation prevention (insert 0x03 after any 0x00 0x00 in the RBSP)
+ * is handled by this module so the consumer can concatenate raw.
+ */
+#ifndef DAEDALUS_H264_NAL_SYNTH_H
+#define DAEDALUS_H264_NAL_SYNTH_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <linux/v4l2-controls.h>
+
+/*
+ * Encode an AnnexB SPS NAL into out[].  Returns the number of bytes
+ * written, or 0 on overflow / malformed input.  out_cap must be at
+ * least 256 bytes to handle worst-case SPS with full offset_for_ref_
+ * frame[] cycle.
+ */
+size_t h264_synth_sps(const struct v4l2_ctrl_h264_sps *sps,
+		      uint8_t *out, size_t out_cap);
+
+/*
+ * Encode an AnnexB PPS NAL into out[].  Returns the number of bytes
+ * written, or 0 on overflow.  out_cap should be at least 64 bytes;
+ * PPS NALs are small.
+ */
+size_t h264_synth_pps(const struct v4l2_ctrl_h264_pps *pps,
+		      uint8_t *out, size_t out_cap);
+
+#endif /* DAEDALUS_H264_NAL_SYNTH_H */