PD#SWPL-8572
Problems:
based on android platfrom, each process may allocate 1MB vmalloc
memory space for IPC. But most process don't use full memory
range of vmalloc space. It's a waste of memory space and may
cause driver can't work normal based on 32bit kernel
Soluton:
On kernel 4.19, google have fixed it, so we need back porting
following changes:
Squashed commit of the following:
commit b12a56e5342e15e99b0fb07c67dfce0891ba2f6b
Author: Todd Kjos <tkjos@google.com>
Date: Tue Mar 19 09:53:01 2019 -0700
FROMGIT: binder: fix BUG_ON found by selinux-testsuite
The selinux-testsuite found an issue resulting in a BUG_ON()
where a conditional relied on a size_t going negative when
checking the validity of a buffer offset.
(cherry picked from commit 5997da8214
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
char-misc-linus)
Bug: 67668716
Change-Id: Ib3b408717141deadddcb6b95ad98c0b97d9d98ea
Fixes: 7a67a39320 ("binder: add function to copy binder object from buffer")
Reported-by: Paul Moore <paul@paul-moore.com>
Tested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
commit 5b28e504d93a5f1efc074dd7cdcadc07293bb783
Author: Todd Kjos <tkjos@android.com>
Date: Thu Feb 14 15:22:57 2019 -0800
UPSTREAM: binder: fix handling of misaligned binder object
Fixes crash found by syzbot:
kernel BUG at drivers/android/binder_alloc.c:LINE! (2)
(cherry pick from commit 26528be672)
Bug: 67668716
Reported-and-tested-by: syzbot+55de1eb4975dec156d8f@syzkaller.appspotmail.com
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ib8597dd05a158f78503d4affe6c5f46ded16a811
commit e110c3b44e437bad09f76c2b42f23dcad898f57d
Author: Todd Kjos <tkjos@android.com>
Date: Wed Feb 13 11:48:53 2019 -0800
UPSTREAM: binder: fix sparse issue in binder_alloc_selftest.c
Fixes sparse issues reported by the kbuild test robot running
on https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
char-misc-testing: bde4a19fc0 ("binder: use userspace pointer as base
of buffer space")
Error output (drivers/android/binder_alloc_selftest.c):
sparse: warning: incorrect type in assignment (different address spaces)
sparse: expected void *page_addr
sparse: got void [noderef] <asn:1> *user_data
sparse: error: subtraction of different types can't work
Fixed by adding necessary "__user" tags.
(cherry pick from commit 36f3093792)
Bug: 67668716
Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ia0a16d163251381d4bc04f46a44dddbc18b10a85
commit 9f6fd7733286f1af04d153c9d3a050ca2615b3cc
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:20 2019 -0800
BACKPORT: binder: use userspace pointer as base of buffer space
Now that alloc->buffer points to the userspace vm_area
rename buffer->data to buffer->user_data and rename
local pointers that hold user addresses. Also use the
"__user" tag to annotate all user pointers so sparse
can flag cases where user pointer vaues are copied to
kernel pointers. Refactor code to use offsets instead
of user pointers.
(cherry pick from commit bde4a19fc0)
Bug: 67668716
Change-Id: I9d04b844c5994d1f6214da795799e6b373bc9816
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 194d8606b011657ce30bf0c240a5adcad0691201
Author: Todd Kjos <tkjos@android.com>
Date: Wed Dec 5 15:19:25 2018 -0800
UPSTREAM: binder: fix kerneldoc header for struct binder_buffer
Fix the incomplete kerneldoc header for struct binder_buffer.
(cherry pick from commit 7a2670a5bc)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I6bb942e6a9466b02653349943524462f205af839
commit 55cb58623a60d48678d8eb74e1cabe7744ed62c2
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:19 2019 -0800
BACKPORT: binder: remove user_buffer_offset
Remove user_buffer_offset since there is no kernel
buffer pointer anymore.
(cherry pick from commit c41358a5f5)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I399219867704dc5013453a7738193c742fc970ad
commit 3301f77efa9d99e742e5642243b891e014becf17
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:18 2019 -0800
UPSTREAM: binder: remove kernel vm_area for buffer space
Remove the kernel's vm_area and the code that maps
buffer pages into it.
(cherry pick from commit 880211667b)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I2595bb8416c2bbfcf97ad3d7380ae94e29c209fb
commit 628c27a60665f15984364f6c0a1bda03473b3a78
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:17 2019 -0800
UPSTREAM: binder: avoid kernel vm_area for buffer fixups
Refactor the functions to validate and fixup struct
binder_buffer pointer objects to avoid using vm_area
pointers. Instead copy to/from kernel space using
binder_alloc_copy_to_buffer() and
binder_alloc_copy_from_buffer(). The following
functions were refactored:
refactor binder_validate_ptr()
binder_validate_fixup()
binder_fixup_parent()
(cherry pick from commit db6b0b810b)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: Ic222af9b6c56bf48fd0b65debe981d19a7809e77
commit ed39057090cc4a95c318bafcd97f418da56e3867
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:16 2019 -0800
BACKPORT: binder: add function to copy binder object from buffer
When creating or tearing down a transaction, the binder driver
examines objects in the buffer and takes appropriate action.
To do this without needing to dereference pointers into the
buffer, the local copies of the objects are needed. This patch
introduces a function to validate and copy binder objects
from the buffer to a local structure.
(cherry pick from commit 7a67a39320)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I42dfe238a2d20bdeff479068ca87a80e4577e64a
commit 01f8f48c56b53faf1c795112f451a032a0d00b75
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:15 2019 -0800
BACKPORT: binder: add functions to copy to/from binder buffers
Avoid vm_area when copying to or from binder buffers.
Instead, new copy functions are added that copy from
kernel space to binder buffer space. These use
kmap_atomic() and kunmap_atomic() to create temporary
mappings and then memcpy() is used to copy within
that page.
Also, kmap_atomic() / kunmap_atomic() use the appropriate
cache flushing to support VIVT cache architectures.
Allow binder to build if CPU_CACHE_VIVT is defined.
Several uses of the new functions are added here. More
to follow in subsequent patches.
(cherry picked from commit 8ced0c6231)
Bug: 67668716
Change-Id: I6a93d2396d0a80c352a1d563fc7fb523a753e38c
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit bfc28d4c046d2a1aea5db66508e7fbb65a31a4a9
Author: Todd Kjos <tkjos@android.com>
Date: Fri Feb 8 10:35:14 2019 -0800
UPSTREAM: binder: create userspace-to-binder-buffer copy function
The binder driver uses a vm_area to map the per-process
binder buffer space. For 32-bit android devices, this is
now taking too much vmalloc space. This patch removes
the use of vm_area when copying the transaction data
from the sender to the buffer space. Instead of using
copy_from_user() for multi-page copies, it now uses
binder_alloc_copy_user_to_buffer() which uses kmap()
and kunmap() to map each page, and uses copy_from_user()
for copying to that page.
(cherry picked from 1a7c3d9bb7)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I59ff83455984fce4626476e30601ed8b99858a92
commit 89a1a65d35200d8ca94c865f061f11af41a8ced7
Author: Todd Kjos <tkjos@android.com>
Date: Mon Jan 14 09:10:21 2019 -0800
FROMGIT: binder: create node flag to request sender's security context
To allow servers to verify client identity, allow a node
flag to be set that causes the sender's security context
to be delivered with the transaction. The BR_TRANSACTION
command is extended in BR_TRANSACTION_SEC_CTX to
contain a pointer to the security context string.
Signed-off-by: Todd Kjos <tkjos@google.com>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ec74136dedhttps://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
master)
Change-Id: I44496546e2d0dc0022f818a45cd52feb1c1a92cb
Signed-off-by: Todd Kjos <tkjos@google.com>
commit 4afd6d2498ecd54e4211c6e47d8956a686a52ee3
Author: Todd Kjos <tkjos@android.com>
Date: Wed Dec 5 15:19:26 2018 -0800
UPSTREAM: binder: filter out nodes when showing binder procs
When dumping out binder transactions via a debug node,
the output is too verbose if a process has many nodes.
Change the output for transaction dumps to only display
nodes with pending async transactions.
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit ecd589d8f5)
Bug: 112037142
Change-Id: Iaa76ebdc844037ce1ee3bf2e590676790a959cef
commit 72e3c1d60a499bfa547d962a150082f47bfb16af
Author: Todd Kjos <tkjos@android.com>
Date: Tue Nov 6 15:55:32 2018 -0800
binder: fix race that allows malicious free of live buffer
commit 7bada55ab5 upstream.
Malicious code can attempt to free buffers using the BC_FREE_BUFFER
ioctl to binder. There are protections against a user freeing a buffer
while in use by the kernel, however there was a window where
BC_FREE_BUFFER could be used to free a recently allocated buffer that
was not completely initialized. This resulted in a use-after-free
detected by KASAN with a malicious test program.
This window is closed by setting the buffer's allow_user_free attribute
to 0 when the buffer is allocated or when the user has previously freed
it instead of waiting for the caller to set it. The problem was that
when the struct buffer was recycled, allow_user_free was stale and set
to 1 allowing a free to go through.
Signed-off-by: Todd Kjos <tkjos@google.com>
Acked-by: Arve Hjønnevåg <arve@android.com>
Cc: stable <stable@vger.kernel.org> # 4.14
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c7940ee7e55f4caec80ab646b7f9d495ee2677c6
Author: Martijn Coenen <maco@android.com>
Date: Sat Aug 25 13:50:56 2018 -0700
UPSTREAM: binder: Add BINDER_GET_NODE_INFO_FOR_REF ioctl.
This allows the context manager to retrieve information about nodes
that it holds a reference to, such as the current number of
references to those nodes.
Such information can for example be used to determine whether the
servicemanager is the only process holding a reference to a node.
This information can then be passed on to the process holding the
node, which can in turn decide whether it wants to shut down to
reduce resource usage.
Bug: 79983843
Change-Id: I21e52ed1ca2137f7bfdc0300365fb1285b7e3d70
Signed-off-by: Martijn Coenen <maco@android.com>
commit afd02b5ead68a94eb6bf1bf5234271687d7eb461
Author: Minchan Kim <minchan@kernel.org>
Date: Thu Aug 23 14:29:56 2018 +0900
android: binder: fix the race mmap and alloc_new_buf_locked
There is RaceFuzzer report like below because we have no lock to close
below the race between binder_mmap and binder_alloc_new_buf_locked.
To close the race, let's use memory barrier so that if someone see
alloc->vma is not NULL, alloc->vma_vm_mm should be never NULL.
(I didn't add stable mark intentionallybecause standard android
userspace libraries that interact with binder (libbinder & libhwbinder)
prevent the mmap/ioctl race. - from Todd)
"
Thread interleaving:
CPU0 (binder_alloc_mmap_handler) CPU1 (binder_alloc_new_buf_locked)
===== =====
// drivers/android/binder_alloc.c
// #L718 (v4.18-rc3)
alloc->vma = vma;
// drivers/android/binder_alloc.c
// #L346 (v4.18-rc3)
if (alloc->vma == NULL) {
...
// alloc->vma is not NULL at this point
return ERR_PTR(-ESRCH);
}
...
// #L438
binder_update_page_range(alloc, 0,
(void *)PAGE_ALIGN((uintptr_t)buffer->data),
end_page_addr);
// In binder_update_page_range() #L218
// But still alloc->vma_vm_mm is NULL here
if (need_mm && mmget_not_zero(alloc->vma_vm_mm))
alloc->vma_vm_mm = vma->vm_mm;
Crash Log:
==================================================================
BUG: KASAN: null-ptr-deref in __atomic_add_unless include/asm-generic/atomic-instrumented.h:89 [inline]
BUG: KASAN: null-ptr-deref in atomic_add_unless include/linux/atomic.h:533 [inline]
BUG: KASAN: null-ptr-deref in mmget_not_zero include/linux/sched/mm.h:75 [inline]
BUG: KASAN: null-ptr-deref in binder_update_page_range+0xece/0x18e0 drivers/android/binder_alloc.c:218
Write of size 4 at addr 0000000000000058 by task syz-executor0/11184
CPU: 1 PID: 11184 Comm: syz-executor0 Not tainted 4.18.0-rc3 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x16e/0x22c lib/dump_stack.c:113
kasan_report_error mm/kasan/report.c:352 [inline]
kasan_report+0x163/0x380 mm/kasan/report.c:412
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x140/0x1a0 mm/kasan/kasan.c:267
kasan_check_write+0x14/0x20 mm/kasan/kasan.c:278
__atomic_add_unless include/asm-generic/atomic-instrumented.h:89 [inline]
atomic_add_unless include/linux/atomic.h:533 [inline]
mmget_not_zero include/linux/sched/mm.h:75 [inline]
binder_update_page_range+0xece/0x18e0 drivers/android/binder_alloc.c:218
binder_alloc_new_buf_locked drivers/android/binder_alloc.c:443 [inline]
binder_alloc_new_buf+0x467/0xc30 drivers/android/binder_alloc.c:513
binder_transaction+0x125b/0x4fb0 drivers/android/binder.c:2957
binder_thread_write+0xc08/0x2770 drivers/android/binder.c:3528
binder_ioctl_write_read.isra.39+0x24f/0x8e0 drivers/android/binder.c:4456
binder_ioctl+0xa86/0xf34 drivers/android/binder.c:4596
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x154/0xd40 fs/ioctl.c:686
ksys_ioctl+0x94/0xb0 fs/ioctl.c:701
__do_sys_ioctl fs/ioctl.c:708 [inline]
__se_sys_ioctl fs/ioctl.c:706 [inline]
__x64_sys_ioctl+0x43/0x50 fs/ioctl.c:706
do_syscall_64+0x167/0x4b0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
"
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: Martijn Coenen <maco@android.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3ed5fd0f095e9d6fe5f33f909165a8cd596e8b46
Author: Sherry Yang <sherryy@android.com>
Date: Tue Aug 7 12:57:13 2018 -0700
android: binder: Rate-limit debug and userspace triggered err msgs
Use rate-limited debug messages where userspace can trigger
excessive log spams.
Acked-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Sherry Yang <sherryy@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8129fb3ee7af23a888383aa23647c9d576ecdfef
Author: Sherry Yang <sherryy@android.com>
Date: Thu Jul 26 17:17:17 2018 -0700
android: binder: Show extra_buffers_size in trace
Add extra_buffers_size to the binder_transaction_alloc_buf tracepoint.
Acked-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Sherry Yang <sherryy@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 3b0bbcb65457ddec6fbee72bb26002e2bba16089
Author: Guenter Roeck <linux@roeck-us.net>
Date: Mon Jul 23 14:41:38 2018 -0700
android: binder: Include asm/cacheflush.h after linux/ include files
If asm/cacheflush.h is included first, the following build warnings are
seen with sparc32 builds.
In file included from arch/sparc/include/asm/cacheflush.h:11:0,
from drivers/android/binder.c:54:
arch/sparc/include/asm/cacheflush_32.h:40:37: warning:
'struct page' declared inside parameter list will not be visible
outside of this definition or declaration
Moving the asm/ include after linux/ includes solves the problem.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit e8a4948f49629c6ab122339f46908884d55ca7e9
Author: Guenter Roeck <linux@roeck-us.net>
Date: Mon Jul 23 14:47:23 2018 -0700
android: binder_alloc: Include asm/cacheflush.h after linux/ include files
If asm/cacheflush.h is included first, the following build warnings are
seen with sparc32 builds.
In file included from ./arch/sparc/include/asm/cacheflush.h:11:0,
from drivers/android/binder_alloc.c:20:
./arch/sparc/include/asm/cacheflush_32.h:40:37: warning:
'struct page' declared inside parameter list
Moving the asm/ include after linux/ includes fixes the problem.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 8cae6730ef318700ab3a0db3ef43ee6a5e5856c8
Author: Geert Uytterhoeven <geert@linux-m68k.org>
Date: Wed Jun 6 14:40:56 2018 +0200
android: binder: Drop dependency on !M68K
As of commit 7124330dab ("m68k/uaccess: Revive 64-bit
get_user()"), the 64-bit Android binder interface builds fine on m68k.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
verify:
p212
Change-Id: I1bac2c5345bcac64a3890f1688c1ecc4a3654a79
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
PD#SWPL-8132
Problem:
In Jira TV-5143, final fix change have increased 128MB address space
for vmalloc. Because binder wasted too many vmalloc space but it's
hard to fix it in kernel side.
Due to incease of vmalloc address space, old design of address space
layout for KASAN32 is not suitable after this change. So we need to
change memory layout to fix this problem and let KASAN can running OK
again.
Solution:
1, rebuild address space layout for kasan
2, make kasan compatible with vmap stack config
Verify:
p212
Change-Id: I2ce8a840df0ce1fcda61ebeb14a64b1d609719ca
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
PD#SWPL-7676
Problem:
If we open kasan on 32bit kernel, after resume we usually will
get a stack-out-of-bounds KASAN error report. But infact that's
a fake report. Because On arm architecture, cpu suspend/resume
routine is done in function call path:
cpu_suspend -> psci_cpu_suspend -> __invoke_psci_fn_smc
during this call path, some parts of stack will be marked as
shadow memory. But when cpu resume from smc call, it directly
return to point which saved in cpu_suspend and call resume
procedure. Which do not comeback as a reverse return path:
__invoke_psci_fn_smc -> psci_cpu_suspend -> cpu_suspend
So some residual shadow memory may affect KASAN report when
cpu is calling resume hooks.
Solution:
We just need to clear all shadow in stack for this case.
Verify:
p212
Change-Id: Ic6c877212240d03902b11184e54ac363455e0094
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
PD#SWPL-7326
Problem:
slab-out-of-bounds in strlen called by name_store
Solution:
Make sure the string passed to strlen is always '\0'
ended
Verify:
Locally
Change-Id: Ifd78a100c0e34ff9afb527ebe7b044ceb5c3505e
Signed-off-by: Jiamin Ma <jiamin.ma@amlogic.com>
PD#SWPL-7085
Problem:
Currently kasan can't be used on 32bit kernel, it's difficult to debug
memory problems;
Solution:
Bring up KASAN on 32bit kernel
Verify:
p212
Change-Id: I4d80568f023315994e969c79b786eba856177c9c
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
PD#SWPL-5045
Problem:
cts cec version is not right
Solution:
cec version 1.4
Verify:
android p
Change-Id: Iffb9712ce2f7724e9dd0abd9119588a9914159a4
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
PD#SWPL-8419
Problem:
Get the wrong g_vpotch value when platform bootup
Solution:
reset the g_vpotch value according to current vinfo
Verify:
verified by u212
Change-Id: Ied06ee71ac12c1daca8af71bbd98840ef0c2a731
Signed-off-by: Brian Zhu <brian.zhu@amlogic.com>
PD#OTT-2783
Problem:
when the second channel exit, the first channel will freeze
Solution:
pip not need set omx_secret_mode
Verify:
U212
Change-Id: I1f5f2624699ad29df06f67b288d16a15ab4edcf9
Signed-off-by: jintao xu <jintao.xu@amlogic.com>
PD#SWPL-8124
Problem:
There are too many trace info when enabled
Lack some important trace info
Solution:
Add tag to enable/disable trace info for different modules
Add more trace info
Verify:
P212
Change-Id: I9916b97071dc6b3a5e133bb0ea55eb9a9532cec8
Signed-off-by: Tao Guo <tao.guo@amlogic.com>
PD#SWPL-7775
Problem:
dtv video freeze when the stream is replayed
Solution:
when replay at pcrmaster, check the vpts and systime,
if the vpts > systime and the diff > margin,
then adjust the sysclk to make playback smooth.
Verify:
X301
Change-Id: Id1474db030e06fff6ce425a54562cfa4e02ceaa9
Signed-off-by: Xiaoming Sui <xiaoming.sui@amlogic.com>
PD#SWPL-7740
Problem:
tl1 report response crc error on tl1 when hs400 200M busmode
Solution:
find a eyetest hole between 14-20 or 48-54, otherwise
tuning tx_delay and find again
Verify:
passed on tl1_skt
Change-Id: I46e2c3c4d7ef24bcac7b44fee73112894540fc33
Signed-off-by: Ruixuan Li <ruixuan.li@amlogic.com>
PD#SWPL-8663
Problem:
there is no audio clk on SM1
Solution:
fixed clk source setting error
Verify:
AC200
Change-Id: Ief01d680c435cfc2f50f9b7da0a6e4d68db846d5
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
PD#SWPL-70
Problem:
arm isp driver need to use dts
Solution:
add arm isp device node
Verify:
w400
Test: camera preview and capture OK
Change-Id: Idc603890f07afe25beba5deab3ab391825aee584
Signed-off-by: Keke Li <keke.li@amlogic.com>
PD#SWPL-5302
Problem:
For dongle products, it is connected to TV directly, and some
parameters are different from mbox.
Solution:
Add dongle mode for driver's usage
Verify:
U211/S905Y2
Change-Id: Ibe45b167800d3b830d78ca8e9d7b67efd64d8564
Signed-off-by: Zongdong Jiao <zongdong.jiao@amlogic.com>
0504a9a audio: add clk tuning_enable/start_enable control in dts [1/1]
32dd894 audio: add lock for resampler [1/1]
2ad1050 audio: set hdmi format-check threshold by input samplerate [2/2]
953435d audio: fix TDMOUT channel map error [1/1]
9eace31 audio: auge: add lower power mode for PDM & vad [1/1]
90b9c44 audio: auge: add loopback driver [1/1]
0d736dd audio: add 10ms sleep before pdn enable [1/1]
51d1794 audio: add 10ms delay before pdn enable [1/1]
998f60b audio: disable tl1 acodec dac dapm to depop [1/1]
7b0ef35 audio: enable hw resmaple pause thd [1/1]
fcb2613 audio: TM2 bringup: enable ADC for linein [1/1]
4f4dc5a audio: TM2: bringup AMP ti5805 on ab301 [1/1]
758b24b audio: fixed kernel panic when resample is disabled [1/1]
19e844f audio: TM2 audio basic function bringup [1/1]
27c68d0 audio: add codec trigger mute for depop [1/1]
d415bb5 audio: fixed the issue of PDM 16 channel capture. [1/1]
d6e5cf5 audio: always on DDR arb [1/1]
0663274 audio: add HW resample for HDMIRX [1/1]
22f4718 audio: add param check for resample [1/1]
audio: add HW resample for HDMIRX [1/1]
PD#SWPL-6118
Problem:
No resample will cause mismatch between
input and output if they are not at same
samplerate.
Solution:
Add resample for hdmirx case
Verify:
Local tested.
Change-Id: I298e401578bf49484d6b75fd736d2a74c38508e4
Signed-off-by: Shuai Li <shuai.li@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
audio: always on DDR arb [1/1]
PD#TV-3452
Problem:
Toddr stuck after a long time playback.
Solution:
For debug usage.
Verify:
No need.
Change-Id: Ibf4446148f5e028040d7d6527c7695f23f964f7c
Signed-off-by: Shuai Li <shuai.li@amlogic.com>
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
audio: fixed the issue of PDM 16 channel capture. [1/1]
PD#SWPL-5551
Problem:
cannot capture 8PDM + 8LOOPBACK.
Solution:
PDM cannot support 8PDM + 8LOOPBACK.
Verify:
s420/s400, verify pass
Change-Id: Iaf38bdcb218ebfc024666312162569cab93a76a9
Signed-off-by: Renjun Xu <renjun.xu@amlogic.com>
audio: add codec trigger mute for depop [1/1]
PD#SWPL-6944
Problem:
TV-3381
Speaker sometimes has clicking noise when playing DTV program.
Solution:
add codec trigger mute for depop
Verify:
Local verified.
Change-Id: Ib15a6b90bd3a6cdda2255afaf86daeab68ba07e2
Signed-off-by: Shuai Li <shuai.li@amlogic.com>
audio: TM2 audio basic function bringup [1/1]
PD#SWPL-6721
Problem:
TM2 bringup
Solution:
audio basic function bringup
Verify:
Verified on T962e2_ab311
Change-Id: Ic48ded3964ea87e40c4d683d71a50bbdc1975f91
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
audio: fixed kernel panic when resample is disabled [1/1]
PD#SWPL-7039
Problem:
Kernel Panic when resample A is disabled
Solution:
When resample is disabled，don't init resample
Verify:
Verified on T962e2_ab311
Change-Id: Id9552ffc6be40f133b828dbded4ad3f15d177ab0
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
audio: TM2: bringup AMP ti5805 on ab301 [1/1]
PD#SWPL-7074
Problem:
speaker doesn't work
Solution:
bringup AMP ti5805 on ab301
Verify:
Verified on T962x3_ab301
Change-Id: Icb27691b4fd5a1e54070c4a6d3d3c68cdf3a60b7
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
audio: TM2 bringup: enable ADC for linein [1/1]
PD#SWPL-7027
Problem:
audio path AVin is on audio
Solution:
enable ADC for linein
Verify:
Verify on AB311
Change-Id: Iea1d694e0b605d62596635d85416d33f56dbbcb2
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
audio: enable hw resmaple pause thd [1/1]
PD#TV-4638
Problem:
Speaker output high frequency howling
after change from pattern 615 to pattern 1 on chroma22294.
The hw resampler keeps sending noise if it has no input.
Solution:
Enable the hw resample pause thd by default.
Verify:
TL1 X301.
Change-Id: Ib6f0924025e155eaa8ba0e3681b307f7ff56b449
Signed-off-by: Shuai Li <shuai.li@amlogic.com>
audio: disable tl1 acodec dac dapm to depop [1/1]
PD#TV-3933
Problem:
Tl1 acodec has pop sound when first sound appear.
Solution:
Disable the DAPM which disable/enable every time
start/stop the audio stream.
Verify:
Tl1 X301.
Change-Id: Iaaf7da125de513bd8297f6c6e41af0a42c9d25bd
Signed-off-by: Shuai Li <shuai.li@amlogic.com>
audio: add 10ms delay before pdn enable [1/1]
PD#SWPL-7680
Problem:
the pwn signal is self excitable
Solution:
1)add 10ms delay before pdn enable
2)set default clk for extern codec
Verify:
HW verify
Change-Id: I031b20851ee1eeb65215075fc8abe783ceddf42b
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
audio: add 10ms sleep before pdn enable [1/1]
PD#SWPL-7680
Problem:
mdelay will pend the system
Solution:
change mdelay to usleep_range
Verify:
HW verify
Change-Id: I8452dc7b1056378dbc6b743fc43316eccbf525a5
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
audio: auge: add loopback driver [1/1]
PD#SWPL-7240
Problem:
limit of current loopback
add loopback b for tl1
add tdmin_lb
Solution:
optimize loopback driver
Verify:
s400, u200, x301, ac200, ab301
Change-Id: I9dd4c7ad041231bb2c49513e354cfb4fb92131c4
Signed-off-by: Xing Wang <xing.wang@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
audio: auge: add lower power mode for PDM & vad [1/1]
PD#SWPL-3825
Problem:
VAD & PDM works in 24m clks for lowpower mode when in deep suspend
Solution:
support VAD & PDM in 24m sysclk, 768k dclk
Verify:
x301
Change-Id: Ic363337ee9b0eba0f890ae62b9e0cb6bb54dcd6a
Signed-off-by: Xing Wang <xing.wang@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
audio: fix TDMOUT channel map error [1/1]
PD#SWPL-6427
Problem:
ALSA tdmout buffer frequently underrun.
This will cause the tdmout channel map error.
And the other channels data go into the spk.
Solution:
1)Adjust the sequence of starting and stopping.
2)reserved frddrA for EQ/DRC module
Verify:
Test more that 1 hour and pass.
Need more stress test.
Change-Id: Ib9b6897f0b6c32652c611a8c2c367aa76b9f1e3f
Signed-off-by: Shuai Li <shuai.li@amlogic.com>
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
audio: set hdmi format-check threshold by input samplerate [2/2]
PD#SWPL-6340
Problem:
ddp audio input from hdmiin is not smooth
Solution:
set hdmiin format-check threshold by input sr
Verify:
Verified by x301.
Change-Id: Idb8ffa616c3880b1c34d61ca4e8c2917343a9ffc
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
audio: add lock for resampler [1/1]
PD#SWPL-8134
Problem:
kernel NULL pointer for aml_resample_enable
Solution:
add lock for resampler
Verify:
Need stress test for x301
Change-Id: I1bbf5d7aeab681399c93f0cba9cc59195d3be0d6
Signed-off-by: Shuai Li <shuai.li@amlogic.com>
audio: add clk tuning_enable/start_enable control in dts [1/1]
PD#SWPL-8306
Problem:
speaker without audio on S400. sideeffect of SWPL-7680
Solution:
add control interface in dts to enable clk tuning
and start clk before codec init
Verify:
verify on S400
Change-Id: Ic9f4e7b13b7d4ced18852346cdc7cf5f48e510dc
Signed-off-by: Zhe Wang <Zhe.Wang@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
audio: add param check for resample [1/1]
PD#SWPL-7798
Problem:
Crashed when audio resample setting params
are invalid.
Solution:
Add check method if the params is invalid.
Verify:
Tl1.
Change-Id: I1e0396be8d401c0a49ff0de9fd7f160f0c8133ca
Signed-off-by: Shuai Li <shuai.li@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
PD#SWPL-5427
Problem:
lack vad function for sm1
Solution:
add vad function for sm1
Verify:
ac200
Change-Id: Ib4118b16405102a72f98ff65396e6f9d98f97bca
Signed-off-by: Xing Wang <xing.wang@amlogic.com>
PD#TV-470
Problem:
t950 ddr bandwidth usage is error
Solution:
t950/805x ddr is 16bit, correct the param to get right usage
Verify:
t950
Change-Id: Ice876f82e5c33e778b3ac9f593e0c163d57d7f3f
Signed-off-by: wenbiao zhang <wenbiao.zhang@amlogic.com>
PD#SWPL-8315
Problem:
flanklin dvb dts used 3.14 mode
Solution:
flanklin update dvb dts to adapte attach mode
Verify:
verify it on franklin.
Change-Id: I53a9ed2c6f28e75cbb327c2d1c122622b2e4b23e
Signed-off-by: Cheng Tong <cheng.tong@amlogic.com>
dts: flanklin bring up based on google-ref! [1/2]
PD#SWPL-7184
Problem:
flanklin bring up based on google-ref.
Solution:
Modify copy file for franklin.
Verify:
verify it on franklin.
Change-Id: Ibaba2dcb7a3e8715243f5a93d69a1bf96e8c49a7
Signed-off-by: qiyao.zhou <qiyao.zhou@amlogic.com>
dts: flanklin bring up based on google-ref! [1/1]
PD#SWPL-7184
Problem:
flanklin bring up based on google-ref.
Solution:
Modify copy file for franklin.
Verify:
verify it on franklin.
Change-Id: If55159835daf0a87439647586526f836a226504c
Signed-off-by: qiyao.zhou <qiyao.zhou@amlogic.com>
PD#SWPL-5404
Problem:
run hs400 200M on sm1
Solution:
config sm1 and modify dts
Verify:
passed on ac200
Change-Id: I34e54f88db79ce42f9effbf8d673ade613de328f
Signed-off-by: Ruixuan Li <ruixuan.li@amlogic.com>
PD#SWPL-5040
Problem:
not support HS400 busmode
Solution:
add HS400 busmode support for G12B-RevB
Verify:
T962X-R311,TL1-T962X2_X301,G12B-W400
Change-Id: I11a1f47b9473fa341c7d754a51d6e270551758a7
Signed-off-by: long yu <long.yu@amlogic.com>
PD#SWPL-2311
Problem:
not support HS400 busmode
Solution:
add HS400 busmode support for TL1
Verify:
TL1-T962X2_X301
Change-Id: I95ac19e9c0c5b84c9225602cda6964aaaee4151e
Signed-off-by: Long Yu <long.yu@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
PD#SWPL-8219
Problem:
not support lcd panel in ac202
Solution:
support lcd panel.
Verify:
verify by ac202.
Change-Id: Ib462a3536c21f0a55c0e0ff947f01c8f52ef3f13
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
PD#SWPL-7973
Problem:
s905d2 panel need new projects config.
Solution:
copy dts config from u200
Verify:
no need verify
Change-Id: I37a884ae951b8c6ede7adb065239ce59dca25c3a
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
u202: add dts-id for multi-dts in 32bit. [1/1]
PD#SWPL-7973
Problem:
upgrade failed, because can not found dts.
Solution:
change dts-id
Verify:
verify by u202
Change-Id: I9cfd85ebfda1bff60abc78bd09355f977f25f4bf
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
PD#SWPL-6423
Problem:
deghost refresh according to motion
Solution:
disable deghost refresh according to motion
Verify:
verify on TL1
Change-Id: Ic3647462e5f5686f6cc182c30797752ea72c013c
Signed-off-by: MingLiang Dong <mingliang.dong@amlogic.com>
PD#SWPL-5046
Problem:
PD22 para is incorrect
Solution:
correct the parameters
Verify:
verified by t962x2_x301
Change-Id: I0b26914694dd19f9b06cb37c50f7589a200ea0b1
Signed-off-by: zhiwei.yuan <zhiwei.yuan@amlogic.com>
PD#SWPL-5837
Problem:
dtv is out of avsync when dolby ms12 certificate
Solution:
when the audio is played, recalculate the apts to sync
pcrsrc when pcrmaster.
Verify:
X301
Change-Id: I199383aa1c0de1b4f0ec646d9d066910b3bb2b42
Signed-off-by: Xiaoming Sui <xiaoming.sui@amlogic.com>
avsync: tsync: fix the avsync for ms12 [3/4]
PD#SWPL-5837
Problem:
dtv is out of avsync when dolby ms12 certificate
Solution:
when the audio is played, recalculate the apts to sync
pcrsrc when pcrmaster.
Verify:
X301
Change-Id: Ia121e57ad69c5b0d211e14bf3a61f165457e54c7
Signed-off-by: Xiaoming Sui <xiaoming.sui@amlogic.com>
PD#SWPL-6094
Problem:
some mvc stream is not smooth.
Solution:
optimize the condition for pts loockup fail code.
Verify:
x301
Change-Id: I50bb3f317e1245735f9ce0ffcc44376c91e871ed
Signed-off-by: shihong.zheng <shihong.zheng@amlogic.com>
PD#SWPL-6152
Problem:
in some special cases, there are many sync
log information from serial port.
Solution:
remove this log and add pts realign.
Verify:
X301
Change-Id: I81d1753ef6d4e6c1e39d6c7f38eb3836e07be05d
Signed-off-by: Xiaoming Sui <xiaoming.sui@amlogic.com>
PD#TV-5140
Problem:
when play some ts stream , the video will hold all the time
Solution:
when the pcr is invalid ,use apts or vpts as system
time and enable the system time up funciton
Verify:
x301
Change-Id: Iec01434ab305be1ea32e03549edd8521a8c4620d
Signed-off-by: live.li <live.li@amlogic.com>
PD#SWPL-6586
Problem:
Android P trunk can not compile 64bit kernel
Android P vendor size is not enough,
64bit kernel and isp so etc ,
the size exceeds 256M
Solution:
change vendor size from 256M into 320M
Verify:
galilei
Change-Id: Icc7b3d7c8d56f5c361acf9722bba6422b8dc3af2
Signed-off-by: Liang Ji <liang.ji@amlogic.com>
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
PD#SWPL-6607
Problem:
Not support QOS information for mh264.h265,avs2
Solution:
Support QOS information picking for mh264,h265,avs2
Support QOS information access interface by ioctl
Verify:
Verified franklin
Change-Id: I4e6f85392007bc78a274726aba510c39088018e3
Signed-off-by: Rong Zhang <rong.zhang@amlogic.com>
PD#SWPL-5038
Problem:
image will block when pts discontinue
Solution:
do not show the frame when pts greater than pcr
Verify:
tested on Marconi
Change-Id: I57ea973b7fdcdc7cded2c5c9b681be29f0a31a4b
Signed-off-by: peter wang <peter.wang@amlogic.com>
PD#SWPL-7166
Problem:
suspend resume test failed
Solution:
cancel work queue first
Verify:
verify on u200 board
Change-Id: Ibd1a9587a32edf5583db564d2efe0ff0279d4d10
Signed-off-by: Zhuo Wang <zhuo.wang@amlogic.com>
PD#SWPL-6608
Problem:
system will report tx error somethime after resume
Solution:
reset ethernet when resume
Verify:
verify on u200 board
Change-Id: I9863a8a50c08addd4e2d8c024f46a2e7568c28b4
Signed-off-by: Zhuo Wang <zhuo.wang@amlogic.com>
PD#SWPL-5295
Problem:
add RX delay for 8211f and add led setup interface
Solution:
tuning delay and leds
Verify:
verify on u200 board
Change-Id: I45e855894d570fdd976f90fd8f03151ad52a3683
Signed-off-by: Zhuo Wang <zhuo.wang@amlogic.com>
