wireguard-linux/drivers/media/platform/rockchip, branch stable

media: rkvdec: bound HEVC tile loops and PPS id to the array capacity

2026-09-07T07:01:05Z

compute_tiles_uniform() and compute_tiles_non_uniform() loop over num_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and assemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile and indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from the untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of assemble_hw_pps() before indexing priv_tbl->param_set[] with an out-of-range pic_parameter_set_id, so the writes stay within the hardware tables. Fixes: 3595375c2301 ("media: rkvdec: Add HEVC backend") Fixes: c9a59dc2acc7 ("media: rkvdec: Add HEVC support for the VDPU381 variant") Assisted-by: Claude:claude-opus-4-8 Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito Signed-off-by: Hans Verkuil

media: rkvdec: use DIV_ROUND_UP() for CTB counts

2026-07-17T10:36:48Z

Use DIV_ROUND_UP() when computing HEVC coding tree block counts instead of open-coding the same rounding expression. This keeps the rounding intent explicit without changing behavior. Found using a Coccinelle rule generated from the DIV_ROUND_UP() macro definition. Signed-off-by: Hiroki Nakajima <3na7nanana@gmail.com> Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

media: rkvdec: Propagate platform_get_irq() errors

2026-07-17T10:36:48Z

platform_get_irq() returns a positive IRQ number on success and a negative error code on failure. It no longer returns zero. The driver currently returns -ENXIO for all failures, which loses useful errors such as -EPROBE_DEFER. Return the error from platform_get_irq() directly. Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver") Cc: stable@vger.kernel.org Signed-off-by: Narasimharao Vadlamudi Reviewed-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow

2026-07-17T10:36:48Z

st_ref_pic_set_prediction() computes the reference RPS index as st_rps_idx - (delta_idx_minus1 + 1) per HEVC spec equation 7-59. Both operands are u8, so when delta_idx_minus1 + 1 exceeds the current index the subtraction wraps and the subsequent array access at calculated_rps_st_sets[ref_rps_idx] reads far out of bounds. A userspace V4L2 client that can open the RKVDEC m2m decoder can submit an EXT_SPS_ST_RPS control with INTER_REF_PIC_SET_PRED set and delta_idx_minus1 crafted to trigger the underflow. Reject the entry early when the reference index would underflow. Fixes: c9a59dc2acc7 ("media: rkvdec: Add HEVC support for the VDPU381 variant") Cc: stable@vger.kernel.org Suggested-by: Detlev Casanova Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

media: rkvdec: hevc: tighten EXT SPS RPS control dimensions

2026-07-17T10:36:48Z

The VDPU381 HEVC driver registers V4L2_CID_STATELESS_HEVC_EXT_SPS_ST_RPS and V4L2_CID_STATELESS_HEVC_EXT_SPS_LT_RPS with .cfg.dims = { 65 }, but the HEVC spec caps num_short_term_ref_pic_sets at 64 (ITU-T H.265 7.4.8) and num_long_term_ref_pics_sps at 32 (7.4.3.2.1). The hardware descriptor table (struct rkvdec_rps) sizes match those spec limits: refs[32] and short_term_ref_sets[64]. Reduce the dims to { 64 } and { 32 } respectively so the V4L2 control framework rejects oversized payloads before any driver code runs. Fixes: c9a59dc2acc7 ("media: rkvdec: Add HEVC support for the VDPU381 variant") Cc: stable@vger.kernel.org Suggested-by: Detlev Casanova Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

media: rockchip: rga: don't change RGB quantization

2026-07-17T10:36:15Z

Don't change the quantization of an RGB format when converting between RGB and YUV with the RGA3. As the RGA3 only supports doing conversions to full range YUV with BT601, it wants to announce it through try_fmt/s_fmt. As it is only relevant, when converting between RGB and YUV, it's guarded by a given condition. But the condition also causes the RGB format quantization to be adjusted to limited range, which is incorrect. Therefore simplify the condition to only apply when the current format is a YUV format. Also document the reason for checking if the other format is an RGB format. Fixes: 24a63d4c9d3c ("media: rockchip: rga: add rga3 support") Cc: stable@vger.kernel.org Signed-off-by: Sven Püschel Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

media: rockchip: rkcif: add support for rk3588 vicap mipi capture

2026-05-28T19:10:02Z

The RK3588 Video Capture (VICAP) unit features a Digital Video Port (DVP) and six MIPI CSI-2 capture interfaces. Add initial support for this variant to the rkcif driver and enable the MIPI CSI-2 capture interfaces. Reviewed-by: Mehdi Djait Signed-off-by: Michael Riesch Signed-off-by: Sakari Ailus

media: rockchip: rga: add rga3 support

2026-05-21T10:32:21Z

Add support for the RGA3 unit contained in the RK3588. Only a basic feature set consisting of scaling and color conversion is implemented. Currently unimplemented features include: - Advanced formats like 10bit YUV, FBCE mode and Tile8x8 mode - Background color (V4L2_CID_BG_COLOR) - Configurable alpha value (V4L2_CID_ALPHA_COMPONENT) - Image flipping (V4L2_CID_HFLIP and V4L2_CID_VFLIP) - Image rotation (V4L2_CID_ROTATE) - Image cropping/composing (VIDIOC_S_SELECTION) - Only very basic output cropping for 1088 -> 1080 cases is implemented The register address defines were copied from the vendor Rockchip kernel sources and slightly adjusted to not start at 0 again for the cmd registers. During testing it has been noted that the scaling of the hardware is slightly incorrect. A test conversion of 128x128 RGBA to 256x256 RGBA causes a slightly larger scaling. The scaling is suddle, as it seems that the image is scaled to a 2px larger version and then cropped to it's final size. Trying to use the RGA2 scaling factor calculation didn't work. As the calculation matches the vendor kernel driver, no further research has been utilized to check if there may be some kind of better scaling factor calculation. Furthermore comparing the RGA3 conversion with the GStreamer videoconvertscale element, the chroma-site is different. A quick testing didn't reveal a chroma-site that creates the same image with the GStreamer Element. Also when converting from YUV to RGB the RGB values differ by 1 or 2. This doesn't seem to be a colorspace conversion issue but rather a slightly different precision on the calculation. Reviewed-by: Nicolas Dufresne Signed-off-by: Sven Püschel Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

media: rockchip: rga: disable multi-core support

2026-05-21T10:32:21Z

Disable multi-core support in preparation of the RGA3 addition. The RK3588 SoC features two equal RGA3 cores. This allows scheduling of the work between both cores, which is not yet implemented. Until it is implemented avoid exposing both cores as independent video devices to prevent an ABI breakage when multi-core support is added. This patch is copied from the Hantro driver patch to disable multi core support by Sebastian Reichel. See commit ccdeb8d57f7f ("media: hantro: Disable multicore support") Link: https://lore.kernel.org/all/20240618183816.77597-4-sebastian.reichel@collabora.com/ Reviewed-by: Nicolas Dufresne Signed-off-by: Sven Püschel Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil

media: rockchip: rga: add feature flags

2026-05-21T10:32:21Z

In preparation to the RGA3 addition add feature flags, which can limit the exposed feature set of the video device, like rotating or selection support. This is necessary as the RGA3 doesn't initially implement the full feature set currently exposed by the driver. Reviewed-by: Nicolas Dufresne Signed-off-by: Sven Püschel Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil