PD#SWPL-7006
Problem:
TL1 cave video 1080i 60hz have drawing.
Solution:
dark scenes don't into pulldown32 by vlsi yanling
Verify:
TL1
Signed
Change-Id: Ib77c0f99940c416943baa9b9a8a02a059b274e5b
Signed-off-by: Wenfeng Guo <wenfeng.guo@amlogic.com>
PD#SWPL-5205
Problem:
Now vdin support afbc+interlace format
Solution:
In vpp, add case to support vdin afbc with interlace
Verify:
tl1_x301, verify pass
Change-Id: I6540b03a6cb5308fc2bc202069aa87234fd35df6
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
a6973fc di: small window bottom of the screen no video [1/1]
fed45cd di: small window bottom of the screen is blank [1/1]
fb34727 deinterlace: fix tl1 in 1080i has small sawtooth [1/1]
66bdbe7 di: bringup for tm2 [1/1]
13ebe46 di: monkey test di cause crash [1/1]
2c8ed09 di: "DI: di_init_buf vmap fail" is seen when power on [1/1]
7ba6477 di: av to dtv , black screen [1/1]
5970920 di: The last frame of the video flash garbage [1/1]
8c3e98d di: flash green when play 265 SD video [1/1]
975c0ee di: exit play local 4k video flashing [1/1]
edc1970 di: pretect reg unreg flow [1/1]
030872b di: 1080p,the screen display anormal [1/1]
3f4854e di: support the interlace format from vdin afbc [2/2]
89a190a vpp: support the interlace format from vdin afbc [1/2]
di: support the interlace format from vdin afbc [2/2]
PD#SWPL-5205
Problem:
support afbc from vdin and decoder on tl1
Solution:
1.add this function
2.support from vdin and decoder
Verify:
tl1
Change-Id: I258d40ad5706f4a9a5749298dd9a33a9b4bbafa2
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
di: 1080p,the screen display anormal [1/1]
PD#SWPL-5874
Problem:
1080p the screen display anormal
Solution:
compress mode, modify vdin frame type.
Verify:
tl1
Change-Id: Ic1ee1472105861c8debce2a1645f70ed617fd132
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
di: pretect reg unreg flow [1/1]
PD#SWPL-4918
Problem:
when reg unreg event called too fast, di cause system crash
Solution:
pretect reg and unreg flow
Verify:
tl1
Change-Id: I9b3e28c2b0b709d4f53f60b1f044a390933117ce
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
di: exit play local 4k video flashing [1/1]
PD#SWPL-5877
Problem:
1.afbc mode, play h.265 local video, when exit playing,
screen will flashing sometimes.
2.when exit playing, there cost 5s time.
Solution:
4k video di bypass, afbc hw module used by vpp, when
DI unreg, needn't to disable AFBC moudule.
Verify:
tl1
Change-Id: I2ac66a145a009042d286dda50e7259657f4bfc8e
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
di: flash green when play 265 SD video [1/1]
PD#SWPL-6097
Problem:
flash green garbages when play h.265 SD video
Solution:
afbc input not enable
Verify:
tl1
Change-Id: I310eeb6d922ab8b9035c815afc4e967c0e5390ff
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
di: The last frame of the video flash garbage [1/1]
PD#SWPL-6070
Problem:
flash garbages when unreg process.
Solution:
can't speed down the clkb rate, there is a mirror mode
Verify:
tl1
Change-Id: I5fcc29a1cda196992a457f40fee31992f4bc1528
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
di: av to dtv , black screen [1/1]
PD#SWPL-6096
Problem:
from local av switch to dtv，black screen,then search channel
Solution:
revert the modification "62617"
Verify:
tl1
Change-Id: I49ae627b9f0b1f6a776e5cbffc723a43e85cee72
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
di: "DI: di_init_buf vmap fail" is seen when power on [1/1]
PD#SWPL-5908
Problem:
execute vmap when di reserved memory is disable
Solution:
skip memory calculation in init buf while using cma
Verify:
verified by t962x2_x301
Change-Id: Ib0c2e422f61f2b4182109cb7bbb3107029363ce0
Signed-off-by: zhiwei.yuan <zhiwei.yuan@amlogic.com>
di: monkey test di cause crash [1/1]
PD#SWPL-6133
Problem:
monkey test di cause crash,when is di reg processing, unreg event
attach, and released the di buffer, so cause crash.
Solution:
every unreg event received, need waitting reg process had done.
Verify:
tl1
Change-Id: I2f2bb068ed65ab14ab4f09de96b64d7290da5914
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
di: bringup for tm2 [1/1]
PD#SWPL-6575
Problem:
chip bring up
Solution:
1.add tm2 chip id for tm2
2.add h scaling down function for tm2
Verify:
tm2
Change-Id: I364d7c07be331d81ef546357445225c6071f8e3c
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
deinterlace: fix tl1 in 1080i has small sawtooth [1/1]
PD#SWPL-4072
Problem:
tl1 1080i in some dark scenes and roller coasters
have small sawtooth
Solution:
adjust a set of registers with special motion
Verify:
tl1
Change-Id: Idbe62e823f1c6c683b67d000978de1862c8e3162
Signed-off-by: Wenfeng Guo <wenfeng.guo@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
di: small window bottom of the screen is blank [1/1]
PD#TV-4708
Problem:
small window, bottom of the screen is covered by
blank on the online video
Solution:
vline is odd, mif out is not right
Verify:
verify on TL1
Change-Id: I39eb0cdfd2f4b200a09a9c8b779f509caf6dea37
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
di: small window bottom of the screen no video [1/1]
PD#TV-4708
Problem:
small window,v scaling mode, bottom of the screen is no video.
Solution:
vline is odd, mif out is not more enouth
Verify:
verify on TL1
Change-Id: I2ac35af3632e8b14df5c773b322d4b2d64b050ba
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
PD#SWPL-6157
Problem:
TM2 bring up need to update chip version name and id
Solution:
add the chipid and chip version name at dts and help file
Verify:
on ptm board4
Change-Id: I37e44828db1821c7fd2921c3e4271a27bd715b88
Signed-off-by: pan yang <pan.yang@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
PD#SWPL-9254
Problem:
uncached display unexpectly.
Solution:
Technically, calling dma_buf_map_attachment should return a buffer
properly dma_mapped. Add calls to dma_map_sg to begin_cpu_access to
ensure this happens. As a side effect, this lets Ion buffers take
advantage of the dma_buf sync ioctls.
Verify:
galilei, franklin
Change-Id: Ib6ca06e59e81031d3c65c2df8824b46baaba6c9f
Signed-off-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiyu Yang <Jiyu.Yang@amlogic.com>
PD#SWPL-9254
Problem:
Ion currently returns a single sg_table on each dma_map call. This is
incorrect for later usage.
Solution:
dup sg table on each dma_map call
Verify:
galilei, franklin
Change-Id: I6df2baa33bba9303b2ac25210ebaf56a337d56a2
Signed-off-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiyu Yang <Jiyu.Yang@amlogic.com>
PD#OTT-4262
Problem:
When disable video before unreg, cur_pipbuf will not set to NULL.
Next time playback will tog this buffer.
Solution:
Free cur_pipbuf when vd2 is closed in unreg.
Verify:
U212
Change-Id: Ie381ae9feda8a5d23a93b3a5974d9c0af87e6d6e
Signed-off-by: jintao xu <jintao.xu@amlogic.com>
PD#SWPL-6903
Problem:
pcr increase automatic after system reset
Solution:
in non-tunnel mode, only after video stop post will adjust pcr
in omx_secret_mode. Also clear pcr in video stop
Verify:
verify by nts
Change-Id: I528229e8121a99e50c7b8313bd8dc867e3710ad8
Signed-off-by: shuanglong.wang <shuanglong.wang@amlogic.com>
PD#SWPL-8250
Problem:
1 check my patch to Mingliang on trunk
2 980 check vsif and frame timing confirm if vsif is one frame ahead
or not
Solution:
The data is the same as the standard of SPEC.
Verify:
on x301
Change-Id: I39ea8cb5d84c8b5b15109ed65f2428a4ec2c6c68
Signed-off-by: chengwang <cheng.wang@amlogic.com>
PD#OTT-3711
Problem:
color parameters are wrong
while displaying images on NativeImagePlayer
Solution:
add a macro BT_STANDARD for 709 or 601
Verify:
verified on W400
Change-Id: I0703ef17748c8267b86e85a4366cac88d3e41ee1
Signed-off-by: Jian Cao <jian.cao@amlogic.com>
PD#SWPL-8799
Problem:
HDR-001-TC3 GXF is brighter than VID in LL mode
Solution:
dolby_vision_target_graphics_L for LL mode
Verify:
verified on u212
Change-Id: I3b39ec048bfff3d8ae797702c1c783356d59e604
Signed-off-by: yao liu <yao.liu@amlogic.com>
PD#SWPL-8159
Problem:
Default graphics is always 100nit,
need to set different nits for SDR/HDR/DV TV
Solution:
dolby_vision_target_graphics_max[] for DV/HDR/SDR;
dolby_vision_target_max[][] for video_max;
module param dolby_vision_target_max for force graphics max
when set it to non-zero;
Verify:
verified on sm1
Change-Id: If6f5ae4ffb37629b51d21764302689da776e9f7f
Signed-off-by: yao liu <yao.liu@amlogic.com>
PD#SWPL-7778
Problem:
black sreen when connecting dv TV
Solution:
close post matrix
open tm2 dv flag
Verify:
T962E2
Change-Id: I828b32d7bf2ef35c3f236ad9bf15964272d06dd2
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
PD#SWPL-6338
Problem:
error color when playing dv films with EL under tm2 platform
Solution:
bypass dv core
Verify:
tm2
Change-Id: I477ea5dbdcf2a0af3783aa62200809f2ed89be5e
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>
PD#SWPL-6338
Problem:
need to add dv interface in tm2
Solution:
choose dv in UI and play films, observe the video and
graphic
Verify:
ab301 verify ok
Change-Id: I5d85b195254a16bcc9046d258728bd41d8a809d5
Signed-off-by: Yi Zhou <yi.zhou@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
PD#OTT-3006
Problem:
The width and height of DOLBY_CORE2A reg are reversed
Solution:
Setting right width and height for DOLBY_CORE2A
Verify:
raven
Change-Id: I89d1a99d00122179bb35b5853a869819e5d62ac9
Signed-off-by: yao liu <yao.liu@amlogic.com>
PD#SWPL-8545
Problem:
AL1 slope problem
Solution:
for beginning playback, use small omx_pts_interval_upper and
omx_pts_dv_lower to let pcr adjust according to omxpts quickly. Also
omxpts compenstion use sched_clock instead of getimeofday.
Verify:
verify by nts
Change-Id: If9476a9793e3e5da691ea720de78f1c20f01a1e5
Signed-off-by: shuanglong.wang <shuanglong.wang@amlogic.com>
PD#SWPL-1505
PD#SWPL-8867
Problem:
Amlogic arm kernel text_offset is 0x208000,
ko start address to kernel text end address arrange is too big(>32M)
it can cause insmod ko failed.
Solution:
modify text_offset to 0x108000
first 0x100000 is invisibe to kernel.
Verify:
u200
Change-Id: I9684b108b57a15b03e4279146c1dc57667aa5d12
Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com>
PD#TV-5832
Problem:
when mmu scatter tail is freed. sometimes sao mmu is not
stopped or in idle. there is potential memory pollution
Solution:
before free unused scatter, to check hw statu idle and
diable sao mmu to avoid hevc back overwrite system memory
Verify:
X301
Change-Id: Ib784809a0946bd0a6c479a98678cb40edacc4118
Signed-off-by: Hui Zhang <hui.zhang@amlogic.com>
PD#SWPL-8878
Problem:
input secam signal colorbar scale line jitter
Solution:
setting some register for secam signal
Verify:
tl1
Change-Id: I59c370c2ab3f92c904b506d26022b165d521776c
Signed-off-by: Wenfeng Guo <wenfeng.guo@amlogic.com>
PD#SWPL-8878
Problem:
input secam signal colorbar scale line jitter
Solution:
setting some register for secam signal
Verify:
tl1
Change-Id: I0b5e1ea03581893a2b460afadcf682f3ce74b450
Signed-off-by: Wenfeng Guo <wenfeng.guo@amlogic.com>
PD#TV-3260
Problem:
Since the Super scaler on txlx has the latch function
and can not disable it. So need adjust the super scaler
on/off operation flow.
Solution:
write the enable bit of sr core0 directly, not rdma write.
Verify:
r311, verify pass
Change-Id: If1b27205cbb1c49dd6a3ad65a08e2ca1e3f04b62
Signed-off-by: Brian Zhu <brian.zhu@amlogic.com>
PD#OTT-2068
Problem:
When playing 1280x128 video under normal screen mode, the aspect ratio from
decodec is not accurate enough by multipling 0x100. (128x256/1280=25.6).
Dropping 0.6 will cause height losing 9 lines.
Solution:
Using new interface to pass real ar width and height following steps:
1.Set old ar variable to 0x3ff as a trigger flag.
2.set the original ar value into sar_width and sar_height of vframe
Verify:
verified on franklin
Change-Id: I8a794edd968a76f198ee9cb168a7cfb858c858f8
Signed-off-by: Brian Zhu <brian.zhu@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
PD#SWPL-8338
Problem:
video of 4k playback caton.
Solution:
4k video does not do tb detection.
Verify:
on x301
Change-Id: Idf10ca33e7ba2d26d759c6e5c21bc465cad0992e
Signed-off-by: renjiang.han <renjiang.han@amlogic.com>
PD#SWPL-7379
Problem:
Decoding stream with no audio pid freezes video
Solution:
Reply the stream with no audio after loop play
Verify:
Verified by R314
Change-Id: I8782271fbf40398c639346c960f0e61911ffc1ee
Signed-off-by: Yinming Ding <yinming.ding@amlogic.com>
PD#TV-5393
Problem:
when pcr and vpts distance is far,
use the vpts as system time for
cache video to avoid video underrun
solution:
use vpts as system time for some
special ts stream
Verify:
x301
Change-Id: I2f151c526bb0113d4f0cf8bbd1a4772312857606
Signed-off-by: live.li <live.li@amlogic.com>
PD#TV-5777
Problem:
[CVTE][T972][9.0][System]: PT190004-1300: Appear auto reboot exception
during downloading Facebook app.
get_user_pfn() may caused unmatched pte_offset_map/pte_unmap call, then
may cause bad task preempt_count and subsequently panic.
Solution:
add matched pte_offset_map/pte_unmap
Verify:
tl1
Change-Id: I98240b443b8a0fae89d0ee93701eb1bfdce51b82
Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com>
PD#SWPL-8310
Problem:
DTV, a/v is out of sync
Solution:
add i2s and spdif fine clk tuning interface
Verify:
verify on R311.
Change-Id: I8219774bd5fe334fa21227d427ce4dbb06177dc8
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
PD#OTT-3616
Problem:
when HDMI output is 30HZ, video is 60fps, pipvideo only can display 30fps,
need drop 30fps.
Solution:
drop frames when there is no time to display
Verify:
U212
Change-Id: I3c946aa49ccc40b8e69e6e7c5031df0b5af34454
Signed-off-by: jintao xu <jintao.xu@amlogic.com>
PD#OTT-3500
Problem:
Grey-scale graph image on video layer performance worse.
Solution:
correct YUV limit/full range config to set ge2d,
when converting RGB to YUV.
Verify:
G12B_W400 board.
Change-Id: I304298a0a6942482196fe5d56a0f356fb30cbe61
Signed-off-by: Jian Cao <jian.cao@amlogic.com>
PD#SWPL-8155
Problem:
support el is disabled for default on 2.4.2 ko
Solution:
For mel video, set el flag to ko, to make support el
enable
Verify:
T962E2, Ves_L2DM_23976_3840x2160_10000kbps_hevc
_dvhe_dtr___dt.mp4 display normal
Change-Id: I6e92c012fedb460c373e6e4c0312542564b6ced3
Signed-off-by: yao liu <yao.liu@amlogic.com>
PD#SWPL-8572
Problem:
In change http://scgit.amlogic.com:8080/#/c/73995/ we have changed
memory layout of vmalloc. Which caused kasan can't be used
Solution:
change kasan address layout
Verify:
x301
Change-Id: I28aee4b1d9b622dd884e6c2d6b621aa870cd8586
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
PD#SWPL-8572
Problems:
based on android platfrom, each process may allocate 1MB vmalloc
memory space for IPC. But most process don't use full memory
range of vmalloc space. It's a waste of memory space and may
cause driver can't work normal based on 32bit kernel
Soluton:
On kernel 4.19, google have fixed it, so we need back porting
following changes:
Squashed commit of the following:
commit b12a56e5342e15e99b0fb07c67dfce0891ba2f6b
Author: Todd Kjos <tkjos@google.com>
Date: Tue Mar 19 09:53:01 2019 -0700
FROMGIT: binder: fix BUG_ON found by selinux-testsuite
The selinux-testsuite found an issue resulting in a BUG_ON()
where a conditional relied on a size_t going negative when
checking the validity of a buffer offset.
(cherry picked from commit 5997da8214
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
char-misc-linus)
Bug: 67668716
Change-Id: Ib3b408717141deadddcb6b95ad98c0b97d9d98ea
Fixes: 7a67a39320 ("binder: add function to copy binder object from buffer")
Reported-by: Paul Moore <paul@paul-moore.com>
Tested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
commit 5b28e504d93a5f1efc074dd7cdcadc07293bb783
Author: Todd Kjos <tkjos@android.com>
Date: Thu Feb 14 15:22:57 2019 -0800
UPSTREAM: binder: fix handling of misaligned binder object
Fixes crash found by syzbot:
kernel BUG at drivers/android/binder_alloc.c:LINE! (2)
(cherry pick from commit 26528be672)
Bug: 67668716
Reported-and-tested-by: syzbot+55de1eb4975dec156d8f@syzkaller.appspotmail.com
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ib8597dd05a158f78503d4affe6c5f46ded16a811
commit e110c3b44e437bad09f76c2b42f23dcad898f57d
Author: Todd Kjos <tkjos@android.com>
Date: Wed Feb 13 11:48:53 2019 -0800
UPSTREAM: binder: fix sparse issue in binder_alloc_selftest.c
Fixes sparse issues reported by the kbuild test robot running
on https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
char-misc-testing: bde4a19fc0 ("binder: use userspace pointer as base
of buffer space")
Error output (drivers/android/binder_alloc_selftest.c):
sparse: warning: incorrect type in assignment (different address spaces)
sparse: expected void *page_addr
sparse: got void [noderef] <asn:1> *user_data
sparse: error: subtraction of different types can't work
Fixed by adding necessary "__user" tags.
(cherry pick from commit 36f3093792)
Bug: 67668716
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ia0a16d163251381d4bc04f46a44dddbc18b10a85
commit 9f6fd7733286f1af04d153c9d3a050ca2615b3cc
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:20 2019 -0800
BACKPORT: binder: use userspace pointer as base of buffer space
Now that alloc->buffer points to the userspace vm_area
rename buffer->data to buffer->user_data and rename
local pointers that hold user addresses. Also use the
"__user" tag to annotate all user pointers so sparse
can flag cases where user pointer vaues are copied to
kernel pointers. Refactor code to use offsets instead
of user pointers.
(cherry pick from commit bde4a19fc0)
Bug: 67668716
Change-Id: I9d04b844c5994d1f6214da795799e6b373bc9816
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 194d8606b011657ce30bf0c240a5adcad0691201
Author: Todd Kjos <tkjos@android.com>
Date: Wed Dec 5 15:19:25 2018 -0800
UPSTREAM: binder: fix kerneldoc header for struct binder_buffer
Fix the incomplete kerneldoc header for struct binder_buffer.
(cherry pick from commit 7a2670a5bc)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I6bb942e6a9466b02653349943524462f205af839
commit 55cb58623a60d48678d8eb74e1cabe7744ed62c2
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:19 2019 -0800
BACKPORT: binder: remove user_buffer_offset
Remove user_buffer_offset since there is no kernel
buffer pointer anymore.
(cherry pick from commit c41358a5f5)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I399219867704dc5013453a7738193c742fc970ad
commit 3301f77efa9d99e742e5642243b891e014becf17
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:18 2019 -0800
UPSTREAM: binder: remove kernel vm_area for buffer space
Remove the kernel's vm_area and the code that maps
buffer pages into it.
(cherry pick from commit 880211667b)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I2595bb8416c2bbfcf97ad3d7380ae94e29c209fb
commit 628c27a60665f15984364f6c0a1bda03473b3a78
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:17 2019 -0800
UPSTREAM: binder: avoid kernel vm_area for buffer fixups
Refactor the functions to validate and fixup struct
binder_buffer pointer objects to avoid using vm_area
pointers. Instead copy to/from kernel space using
binder_alloc_copy_to_buffer() and
binder_alloc_copy_from_buffer(). The following
functions were refactored:
refactor binder_validate_ptr()
binder_validate_fixup()
binder_fixup_parent()
(cherry pick from commit db6b0b810b)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ic222af9b6c56bf48fd0b65debe981d19a7809e77
commit ed39057090cc4a95c318bafcd97f418da56e3867
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:16 2019 -0800
BACKPORT: binder: add function to copy binder object from buffer
When creating or tearing down a transaction, the binder driver
examines objects in the buffer and takes appropriate action.
To do this without needing to dereference pointers into the
buffer, the local copies of the objects are needed. This patch
introduces a function to validate and copy binder objects
from the buffer to a local structure.
(cherry pick from commit 7a67a39320)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I42dfe238a2d20bdeff479068ca87a80e4577e64a
commit 01f8f48c56b53faf1c795112f451a032a0d00b75
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:15 2019 -0800
BACKPORT: binder: add functions to copy to/from binder buffers
Avoid vm_area when copying to or from binder buffers.
Instead, new copy functions are added that copy from
kernel space to binder buffer space. These use
kmap_atomic() and kunmap_atomic() to create temporary
mappings and then memcpy() is used to copy within
that page.
Also, kmap_atomic() / kunmap_atomic() use the appropriate
cache flushing to support VIVT cache architectures.
Allow binder to build if CPU_CACHE_VIVT is defined.
Several uses of the new functions are added here. More
to follow in subsequent patches.
(cherry picked from commit 8ced0c6231)
Bug: 67668716
Change-Id: I6a93d2396d0a80c352a1d563fc7fb523a753e38c
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit bfc28d4c046d2a1aea5db66508e7fbb65a31a4a9
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:14 2019 -0800
UPSTREAM: binder: create userspace-to-binder-buffer copy function
The binder driver uses a vm_area to map the per-process
binder buffer space. For 32-bit android devices, this is
now taking too much vmalloc space. This patch removes
the use of vm_area when copying the transaction data
from the sender to the buffer space. Instead of using
copy_from_user() for multi-page copies, it now uses
binder_alloc_copy_user_to_buffer() which uses kmap()
and kunmap() to map each page, and uses copy_from_user()
for copying to that page.
(cherry picked from 1a7c3d9bb7)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I59ff83455984fce4626476e30601ed8b99858a92
commit 89a1a65d35200d8ca94c865f061f11af41a8ced7
Author: Todd Kjos <tkjos@android.com>
Date: Mon Jan 14 09:10:21 2019 -0800
FROMGIT: binder: create node flag to request sender's security context
To allow servers to verify client identity, allow a node
flag to be set that causes the sender's security context
to be delivered with the transaction. The BR_TRANSACTION
command is extended in BR_TRANSACTION_SEC_CTX to
contain a pointer to the security context string.
Signed-off-by: Todd Kjos <tkjos@google.com>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ec74136dedhttps://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
master)
Change-Id: I44496546e2d0dc0022f818a45cd52feb1c1a92cb
Signed-off-by: Todd Kjos <tkjos@google.com>
commit 4afd6d2498ecd54e4211c6e47d8956a686a52ee3
Author: Todd Kjos <tkjos@android.com>
Date: Wed Dec 5 15:19:26 2018 -0800
UPSTREAM: binder: filter out nodes when showing binder procs
When dumping out binder transactions via a debug node,
the output is too verbose if a process has many nodes.
Change the output for transaction dumps to only display
nodes with pending async transactions.
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ecd589d8f5)
Bug: 112037142
Change-Id: Iaa76ebdc844037ce1ee3bf2e590676790a959cef
commit 72e3c1d60a499bfa547d962a150082f47bfb16af
Author: Todd Kjos <tkjos@android.com>
Date: Tue Nov 6 15:55:32 2018 -0800
binder: fix race that allows malicious free of live buffer
commit 7bada55ab5 upstream.
Malicious code can attempt to free buffers using the BC_FREE_BUFFER
ioctl to binder. There are protections against a user freeing a buffer
while in use by the kernel, however there was a window where
BC_FREE_BUFFER could be used to free a recently allocated buffer that
was not completely initialized. This resulted in a use-after-free
detected by KASAN with a malicious test program.
This window is closed by setting the buffer's allow_user_free attribute
to 0 when the buffer is allocated or when the user has previously freed
it instead of waiting for the caller to set it. The problem was that
when the struct buffer was recycled, allow_user_free was stale and set
to 1 allowing a free to go through.
Signed-off-by: Todd Kjos <tkjos@google.com>
Acked-by: Arve Hjønnevåg <arve@android.com>
Cc: stable <stable@vger.kernel.org> # 4.14
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c7940ee7e55f4caec80ab646b7f9d495ee2677c6
Author: Martijn Coenen <maco@android.com>
Date: Sat Aug 25 13:50:56 2018 -0700
UPSTREAM: binder: Add BINDER_GET_NODE_INFO_FOR_REF ioctl.
This allows the context manager to retrieve information about nodes
that it holds a reference to, such as the current number of
references to those nodes.
Such information can for example be used to determine whether the
servicemanager is the only process holding a reference to a node.
This information can then be passed on to the process holding the
node, which can in turn decide whether it wants to shut down to
reduce resource usage.
Bug: 79983843
Change-Id: I21e52ed1ca2137f7bfdc0300365fb1285b7e3d70
Signed-off-by: Martijn Coenen <maco@android.com>
commit afd02b5ead68a94eb6bf1bf5234271687d7eb461
Author: Minchan Kim <minchan@kernel.org>
Date: Thu Aug 23 14:29:56 2018 +0900
android: binder: fix the race mmap and alloc_new_buf_locked
There is RaceFuzzer report like below because we have no lock to close
below the race between binder_mmap and binder_alloc_new_buf_locked.
To close the race, let's use memory barrier so that if someone see
alloc->vma is not NULL, alloc->vma_vm_mm should be never NULL.
(I didn't add stable mark intentionallybecause standard android
userspace libraries that interact with binder (libbinder & libhwbinder)
prevent the mmap/ioctl race. - from Todd)
"
Thread interleaving:
CPU0 (binder_alloc_mmap_handler) CPU1 (binder_alloc_new_buf_locked)
===== =====
// drivers/android/binder_alloc.c
// #L718 (v4.18-rc3)
alloc->vma = vma;
// drivers/android/binder_alloc.c
// #L346 (v4.18-rc3)
if (alloc->vma == NULL) {
...
// alloc->vma is not NULL at this point
return ERR_PTR(-ESRCH);
}
...
// #L438
binder_update_page_range(alloc, 0,
(void *)PAGE_ALIGN((uintptr_t)buffer->data),
end_page_addr);
// In binder_update_page_range() #L218
// But still alloc->vma_vm_mm is NULL here
if (need_mm && mmget_not_zero(alloc->vma_vm_mm))
alloc->vma_vm_mm = vma->vm_mm;
Crash Log:
==================================================================
BUG: KASAN: null-ptr-deref in __atomic_add_unless include/asm-generic/atomic-instrumented.h:89 [inline]
BUG: KASAN: null-ptr-deref in atomic_add_unless include/linux/atomic.h:533 [inline]
BUG: KASAN: null-ptr-deref in mmget_not_zero include/linux/sched/mm.h:75 [inline]
BUG: KASAN: null-ptr-deref in binder_update_page_range+0xece/0x18e0 drivers/android/binder_alloc.c:218
Write of size 4 at addr 0000000000000058 by task syz-executor0/11184
CPU: 1 PID: 11184 Comm: syz-executor0 Not tainted 4.18.0-rc3 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x16e/0x22c lib/dump_stack.c:113
kasan_report_error mm/kasan/report.c:352 [inline]
kasan_report+0x163/0x380 mm/kasan/report.c:412
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x140/0x1a0 mm/kasan/kasan.c:267
kasan_check_write+0x14/0x20 mm/kasan/kasan.c:278
__atomic_add_unless include/asm-generic/atomic-instrumented.h:89 [inline]
atomic_add_unless include/linux/atomic.h:533 [inline]
mmget_not_zero include/linux/sched/mm.h:75 [inline]
binder_update_page_range+0xece/0x18e0 drivers/android/binder_alloc.c:218
binder_alloc_new_buf_locked drivers/android/binder_alloc.c:443 [inline]
binder_alloc_new_buf+0x467/0xc30 drivers/android/binder_alloc.c:513
binder_transaction+0x125b/0x4fb0 drivers/android/binder.c:2957
binder_thread_write+0xc08/0x2770 drivers/android/binder.c:3528
binder_ioctl_write_read.isra.39+0x24f/0x8e0 drivers/android/binder.c:4456
binder_ioctl+0xa86/0xf34 drivers/android/binder.c:4596
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x154/0xd40 fs/ioctl.c:686
ksys_ioctl+0x94/0xb0 fs/ioctl.c:701
__do_sys_ioctl fs/ioctl.c:708 [inline]
__se_sys_ioctl fs/ioctl.c:706 [inline]
__x64_sys_ioctl+0x43/0x50 fs/ioctl.c:706
do_syscall_64+0x167/0x4b0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
"
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: Martijn Coenen <maco@android.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3ed5fd0f095e9d6fe5f33f909165a8cd596e8b46
Author: Sherry Yang <sherryy@android.com>
Date: Tue Aug 7 12:57:13 2018 -0700
android: binder: Rate-limit debug and userspace triggered err msgs
Use rate-limited debug messages where userspace can trigger
excessive log spams.
Acked-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Sherry Yang <sherryy@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8129fb3ee7af23a888383aa23647c9d576ecdfef
Author: Sherry Yang <sherryy@android.com>
Date: Thu Jul 26 17:17:17 2018 -0700
android: binder: Show extra_buffers_size in trace
Add extra_buffers_size to the binder_transaction_alloc_buf tracepoint.
Acked-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Sherry Yang <sherryy@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3b0bbcb65457ddec6fbee72bb26002e2bba16089
Author: Guenter Roeck <linux@roeck-us.net>
Date: Mon Jul 23 14:41:38 2018 -0700
android: binder: Include asm/cacheflush.h after linux/ include files
If asm/cacheflush.h is included first, the following build warnings are
seen with sparc32 builds.
In file included from arch/sparc/include/asm/cacheflush.h:11:0,
from drivers/android/binder.c:54:
arch/sparc/include/asm/cacheflush_32.h:40:37: warning:
'struct page' declared inside parameter list will not be visible
outside of this definition or declaration
Moving the asm/ include after linux/ includes solves the problem.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e8a4948f49629c6ab122339f46908884d55ca7e9
Author: Guenter Roeck <linux@roeck-us.net>
Date: Mon Jul 23 14:47:23 2018 -0700
android: binder_alloc: Include asm/cacheflush.h after linux/ include files
If asm/cacheflush.h is included first, the following build warnings are
seen with sparc32 builds.
In file included from ./arch/sparc/include/asm/cacheflush.h:11:0,
from drivers/android/binder_alloc.c:20:
./arch/sparc/include/asm/cacheflush_32.h:40:37: warning:
'struct page' declared inside parameter list
Moving the asm/ include after linux/ includes fixes the problem.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8cae6730ef318700ab3a0db3ef43ee6a5e5856c8
Author: Geert Uytterhoeven <geert@linux-m68k.org>
Date: Wed Jun 6 14:40:56 2018 +0200
android: binder: Drop dependency on !M68K
As of commit 7124330dab ("m68k/uaccess: Revive 64-bit
get_user()"), the 64-bit Android binder interface builds fine on m68k.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
verify:
p212
Change-Id: I1bac2c5345bcac64a3890f1688c1ecc4a3654a79
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
PD#SWPL-8132
Problem:
In Jira TV-5143, final fix change have increased 128MB address space
for vmalloc. Because binder wasted too many vmalloc space but it's
hard to fix it in kernel side.
Due to incease of vmalloc address space, old design of address space
layout for KASAN32 is not suitable after this change. So we need to
change memory layout to fix this problem and let KASAN can running OK
again.
Solution:
1, rebuild address space layout for kasan
2, make kasan compatible with vmap stack config
Verify:
p212
Change-Id: I2ce8a840df0ce1fcda61ebeb14a64b1d609719ca
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
PD#SWPL-7676
Problem:
If we open kasan on 32bit kernel, after resume we usually will
get a stack-out-of-bounds KASAN error report. But infact that's
a fake report. Because On arm architecture, cpu suspend/resume
routine is done in function call path:
cpu_suspend -> psci_cpu_suspend -> __invoke_psci_fn_smc
during this call path, some parts of stack will be marked as
shadow memory. But when cpu resume from smc call, it directly
return to point which saved in cpu_suspend and call resume
procedure. Which do not comeback as a reverse return path:
__invoke_psci_fn_smc -> psci_cpu_suspend -> cpu_suspend
So some residual shadow memory may affect KASAN report when
cpu is calling resume hooks.
Solution:
We just need to clear all shadow in stack for this case.
Verify:
p212
Change-Id: Ic6c877212240d03902b11184e54ac363455e0094
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
PD#SWPL-7326
Problem:
slab-out-of-bounds in strlen called by name_store
Solution:
Make sure the string passed to strlen is always '\0'
ended
Verify:
Locally
Change-Id: Ifd78a100c0e34ff9afb527ebe7b044ceb5c3505e
Signed-off-by: Jiamin Ma <jiamin.ma@amlogic.com>
