CHROMIUM: [media] rockchip-vpu: Fix inactive reference frame configuration
If we assign 0 to the inactive DPB position in RPS packet,
HW will treat that as a true reference frame with pic_num 0
when frame pic_num 0 is in the reference list and cause
output picture corruption.
To fix it, this patch changes the code to assign an invalid
pic_num to RPS packet to prevent HW from referring to an
invalid reference frame.
BUG=b:36768258
TEST=Play the videos mentioned in the bug on Kevin
Change-Id: I5bb080cdb04e9f63db3c70fc47dc293333a7ac73
Signed-off-by: Alpha Lin <alpha.lin@rock-chips.com>
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/512426
Commit-Ready: Douglas Anderson <dianders@chromium.org>
Tested-by: Alpha Lin <Alpha.Lin@rock-chips.com>
(cherry picked from commit 16ad027ee63b6d210a52974cdb32e8b277e281e9)
Reviewed-on: https://chromium-review.googlesource.com/573561
Commit-Queue: Owen Lin <owenlin@chromium.org>
Tested-by: Owen Lin <owenlin@chromium.org>
Reviewed-by: Owen Lin <owenlin@chromium.org>
diff --git a/drivers/media/platform/rockchip-vpu/rk3399_vdec_hw_h264d.c b/drivers/media/platform/rockchip-vpu/rk3399_vdec_hw_h264d.c
index 6d5b29a..692492b 100644
--- a/drivers/media/platform/rockchip-vpu/rk3399_vdec_hw_h264d.c
+++ b/drivers/media/platform/rockchip-vpu/rk3399_vdec_hw_h264d.c
@@ -302,8 +302,15 @@
memset(hw_rps, 0, RKV_RPS_SIZE);
+ /*
+ * Assign an invalid pic_num if DPB entry at that position is inactive.
+ * If we assign 0 in that position hardware will treat that as a real
+ * reference picture with pic_num 0, triggering output picture
+ * corruption.
+ */
for (i = 0; i < 16; i++)
- p[i] = dpb[i].pic_num;
+ p[i] = (dpb[i].flags & V4L2_H264_DPB_ENTRY_FLAG_ACTIVE) ?
+ dpb[i].pic_num : 0xff;
for (j = 0; j < 3; j++) {
for (i = 0; i < 32; i++) {
