shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-09 04:10:18 +09:00
Code Issues Packages Projects Releases Wiki Activity
649,650 Commits 55 Branches 2,486 Tags
ddacfb8a37f08efab24cd1cfe0bf272909dfc742
Commit Graph

649650 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
yicheng shen
ddacfb8a37 hdmirx: update phy setting [1/1] 
PD#SWPL-3512

Problem:
HDMIRX no sinal in some mainboard.

Solution:
1.fix phy pll lock bit unstable issue(foce lock);
2.modify phy bandwidth definition;
3.optimize tmds_valid judgement;

Verify:
TL1

Change-Id: Idea20a46c465b20687654f071b259ebf8a7fed4a
Signed-off-by: yicheng shen <yicheng.shen@amlogic.com>
 2020-06-29 11:45:53 +09:00
Lei Yang
b036c6c67d hdmirx: add DRM RCV detection. [1/1] 
PD#SWPL-3117

Problem:
Cannot get the HDR packets/

Solution:
add HDR RCV detection, Low priority than EMP.

Verify:
txlx tl1

Change-Id: I364fc942840b6eef465df16b89fd0a9fd0ccb3ff
Signed-off-by: Lei Yang <lei.yang@amlogic.com>
 2020-06-29 11:45:53 +09:00
Lei Yang
4023718fff hdmirx: update the latest setting of phy. [1/1] 
PD#SWPL-2803

Problem:
PHY configuration update

Solution:
1.update phy setting for low_frequency;
2.rm the useless FSM code;
3.optimize the phy configeration interfaces;
4.fix PS4 Pro flashing black&blue screen issue;

Verify:
txlx tl1

Change-Id: I0bea4fa6ec5d9284ed04845b06c3583128f3332d
Signed-off-by: Lei Yang <lei.yang@amlogic.com>
 2020-06-29 11:45:53 +09:00
yicheng shen
a310028884 hdmirx: fix dvi issue when resume [1/1] 
PD#SWPL-2641

Problem:
SDA of I2C was pulled down,the box cant read EDID and then send DVI.

Solution:
Add rxsense pulse to avoid mtk box sda low issue.

Verify:
Local

Change-Id: I0d3dc4b0c3b956663be1d3e383094e456f3d4e7d
Signed-off-by: yicheng shen <yicheng.shen@amlogic.com>
 2020-06-29 11:45:53 +09:00
yicheng shen
a907f9875c hdmirx: fix hdcp2.2 cant work after resume issue [1/1] 
PD#SWPL-3187

Problem:
hdcp2.2 cant work after resume

Solution:
Update ESM hard reset handle

Verify:
Local

Change-Id: If8e94db2c2882896b547410537652056bc902f47
Signed-off-by: yicheng shen <yicheng.shen@amlogic.com>
 2020-06-29 11:45:53 +09:00
Yong Qin
d989dfb5c0 hdmirx: for dump tmds data [1/1] 
PD#SWPL-2931

Problem:
1.verify dump tmds data

Solution:
1.modify function and verify on tl1

Verify:
tl1

Change-Id: I36e922ba44f4f8c5201c9fb0869d65556a6e28c7
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
 2020-06-29 11:45:52 +09:00
Hongmin Hua
0a8d6f5b2d hdmirx: power down the phy at suspend for tl1 [1/1] 
PD#TV-1212

Problem:
the power comsuption is too high for hdmirx

Solution:
1.power down the phy at suspend
2.power on the phy at resume

Verify:
x301

Change-Id: I8920a6b38197109d424d225c4b31f5170b56ca08
Signed-off-by: hongmin hua <hongmin.hua@amlogic.com>
 2020-06-29 11:45:52 +09:00
Yong Qin
b70ceb2914 hdmirx: clean phy setting for tl1 [1/1] 
PD#172587

Problem:
1.clean phy setting

Solution:
1.put the phy data into a table
2.modify phy setting for low voltage tmds clk

Verify:
tl1

Change-Id: I8cad5d0639f72b17b90196f6143784f7b91dcdbc
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
 2020-06-29 11:45:52 +09:00
Yong Qin
9a3a8c0cc8 hdmirx: optimizing fsm clk monitor function [1/1] 
PD#172587

Problem:
optimizing fsm clk monitor function

Solution:
clock monitor for tl1

Verify:
tl1

Change-Id: I1cf50bcff2e2039b52071902d59deb17b6d01385
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
 2020-06-29 11:45:52 +09:00
Yong Qin
d73de7adfb hdmirx: optimizing rx fsm for tl1 [1/1] 
PD#172587

Problem:
1.optimizing rx fsm for tl1, some time cable
clk not stable

Solution:
1.use system clk measure
2.modify low frq phy and pll setting
3.fsm stable state add error cnt check

Verify:
tl1

Change-Id: I6b9078bdf73fc0a2269ed9386fd42db0678cf995
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
 2020-06-29 11:45:52 +09:00
Yong Qin
8dd28a3577 hdmirx: finetune phy setting [1/1] 
PD#172587

Problem:
1.eq performacec is not good (v1)
2.capture tmds raw data to ddr
3.skip unstable cable clock report

Solution:
1.dump tmds date and save as a file
2.1s check err counter
3.modify clock monitor function
4.modify fsm for tl1

Verify:
tl1

Change-Id: Iae51ea0cc8528e9c5fd0bc5c58b5dd7246ee68b1
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
 2020-06-29 11:45:52 +09:00
Yong Qin
e96d6dfb40 hdmirx: tl1 hdmirx no interrupt [1/1] 
PD#172587

Problem:
1.no interrupt
2.add fsm debug log

Solution:
1.change interrupt id
2.change interrupt source
3.change 6g phy setting
4.add axi clk
5.verify emp pkt data to ddr

Verify:
1.verify on chip

Change-Id: I349439d90a356144b96af4831e03fa0e9e90076b
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
 2020-06-29 11:45:52 +09:00
Yong Qin
70e16d437c hdmirx: modify audio pll setting [1/1] 
PD#172587

Problem:
1.audio divider it's not work

Solution:
1.modify audio top clk measure
2.modify audio divider clk source
3.modify audio divider band gap

Verify:
tl1

Change-Id: Iea254f043531f31383a727c58b4d992dd39ff2ce
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
 2020-06-29 11:45:52 +09:00
Yong Qin
04fbabda4e hdmirx: fix phy init err and add debug [1/1] 
PD#172587

Problem:
1.cable clk is not match from clk measure
2.add some debug interface for tl1

Solution:
1.add audio clock source from tmds
2.add audio clock source from mpll
3.low FRQ phy audio clock out is 4xtmds clk
4.add 6G phy setting
5.match clock measure return value hz
6.phy initial enable terminal by input source
7.add channel switch control 0/1
8.last line,mode:4k2k 420 deep color problem
9.dump register, add error cnt for tl1
10.capture emp data into a file
11.modify tmds data align, snps phy disable

Verify:
1.run ptm
2.verify on chip

Change-Id: I9d003748c0df3dfbd25f7ab987449e2097251c58
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
 2020-06-29 11:45:52 +09:00
Hang Cheng
63a76404db hdmirx: optimize for audio fifo [1/1] 
PD#SWPL-2114

Problem:
When change audio channel count on VG-877, the subpkts of skipped
middle channels are still carried, thus causing afifo overflow

Solution:
When afifo overflow, then store all audio subpkts(8ch)
into afifo, and output 8ch audio from afifo

Verify:
R321

Change-Id: I4b0933935d3a1aed20be10a7a8d3fe23c3a39323
Signed-off-by: Hang Cheng <hang.cheng@amlogic.com>
 2020-06-29 11:45:52 +09:00
Zongdong Jiao
3cdf2534fb hdmitx: fix sda hold low issue [1/1] 
PD#SWPL-8231

Problem:
When HDMI cable plugin, the SDA may hold low forever or for short time.

Solution:
Add sw_reset_flt reset to resolve hold low forever issue

Verify:
G12/Dongle

Change-Id: I53bbf704bb48a2cd3cc2ebef1444c69ad1623e87
Signed-off-by: Zongdong Jiao <zongdong.jiao@amlogic.com>
 2020-06-29 11:45:52 +09:00
Luke Go
7ae81236af Revert "ODROID-COMMON: adjust sound card dai link for spdif_out." 
This reverts commit 329632ae25.

Change-Id: I4fc646e958b3adff97ec98f4bba764e80da2e86e
 2020-06-29 11:45:51 +09:00
Jihong Sui
0f1f3e1b5d deinterlace: add retry for pre timeout [1/1] 
PD#SWPL-13664

Problem:
when open some special UI app, DI will have a lot of timeout,
this cause display  abnormal.

Solution:
add retry after timeout;

Verify:
tl1

Change-Id: I3316252577bad218256651ebbc6d4fd8b25acb12
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
 2020-06-29 11:45:51 +09:00
Jihong Sui
009a42ad94 deinterlace: add condition for switch to EI in de_post_process [1/1] 
PD#SWPL-12002

Problem:
pause and plug out/in hdmi tx, display abnormal

Solution:
add condition for switch to EI in de_post_process
ref to IPTV's project

Verify:
G12A

Change-Id: I6230464c308660c62199aa24ad5843e7c7bd070d
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
 2020-06-29 11:45:51 +09:00
Jihong Sui
15c7bea6f2 deinterlace: set post phase to 8 when crop left odd [2/2] 
PD#SWPL-13223

Problem:
there is a white line on left when crop left is odd

Solution:
set post mif phase to 8;

Verify:
TL1

Change-Id: Ic39e15f5c1d07e756ecc4909366af35d1472dc29
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
 2020-06-29 11:45:51 +09:00
Jihong Sui
7e3ef1e914 deinterlace: add condition for recycle mirror buf [1/1] 
PD#SWPL-11555

Problem:
there is jaggy in the seek process

Solution:
add condition for recycle mirror buf

Verify:
TL1

Change-Id: I13c17fd78386ef2cb5f44b4e8c33be3fa92e31e2
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
 2020-06-29 11:45:51 +09:00
Jihong Sui
ef6c3534c7 deinterace: close cue except local play [1/1] 
PD#SWPL-12404

Problem:
red and green stripes dividing line flash black line

Solution:
close cue(422/444) except local play(420)
VLSI-yanling suggest

Verify:
TL1

Change-Id: Ied1554d6a0e64e00aea1e692ab6b405f87387095
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
 2020-06-29 11:45:50 +09:00
Jihong Sui
ab73ff8a48 deinterlace: add di-multi v2 [1/3] 
PD#SWPL-10064

Problem:
Prepare for adding multi-di

Solution:
1. add di_local for reserved mem alloc;
2. add dil_attach_ext_api for di_api;
3. move some setting to prob;
4. add interface for di pq;

Verify:
U212

Change-Id: I023694dffabed47fd62ec3fa90b8de9302ac341e
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>

Conflicts:
	MAINTAINERS
 2020-06-29 11:45:50 +09:00
Jihong Sui
288a06b00e deinterlace: disable afbc for tl1/tm2 [1/1] 
PD#TV-8024

Problem:
abnormal display in small window.

Solution:
turn off afbc temporary.

Verify:
tl1

Change-Id: I6f863330ed9261ef00b0d1c7bdeaa341a9aaa2ca
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
 2020-06-29 11:45:50 +09:00
Jihong Sui
7a632c479d deinterlace: add pulldown info to vframe. [1/2] 
PD#SWPL-11389

Problem:
PQ need work around for 1080i(based on VLSI's suggestions)
co-work with yanling/mingliang

Solution:
add pulldown information to vframe;
u32 di_pulldown:
-bit 3: interlace
-bit 2: flmxx
-bit 1: flm22
-bit 0: flm32

Verify:
TL1

Change-Id: I9ff06ffa7aaa9516a3e64cec9768272499678fd5
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
 2020-06-29 11:45:50 +09:00
yao liu
94ae3cfbb0 dv: graphic blend test failed on HDR TV [1/1] 
PD#SWPL-15631

Problem:
There is an error in
c62207ef53

Solution:
correct the err

Verify:
SM1

Change-Id: If645ee88533dab7e28ff95d578be019a2cb894a6
Signed-off-by: yao liu <yao.liu@amlogic.com>
 2020-06-29 11:45:50 +09:00
Pengcheng Chen
672c578285 osd: set gxm afbc hardware reset correctly [1/1] 
PD#SWPL-13524

Problem:
gxm afbc hardware reset is not set.

Solution:
set gxm afbc hardware reset correctly

Verify:
Verified on S912

Change-Id: Iccde705fe408852671d367f1b3853a7055bdf050
Signed-off-by: Pengcheng Chen <pengcheng.chen@amlogic.com>
 2020-06-29 11:45:50 +09:00
Pengcheng Chen
93f0ecce02 osd: fix osd source crop issue [1/1] 
PD#SWPL-14906

Problem:
osd source crop setting error.

Solution:
if source crop adjust blending out data.

Verify:
franklin

Change-Id: I067642ef6fe435da0c65362abedee49de3f1384d
Signed-off-by: Pengcheng Chen <pengcheng.chen@amlogic.com>
 2020-06-29 11:45:50 +09:00
Pengcheng Chen
638cbe0239 osd: fix exit hdr play,screen flash for osd hdr matrix not sync [1/1] 
PD#SWPL-14902

Problem:
Play HDR video locally, after exiting, the screen flashes 1, 2 seconds

Solution:
set rdma_hdr_delay default value to 0

Verify:
Verified by T962-P321

Change-Id: I9c0a56332e38d1238129e682535f588104faf8be
Signed-off-by: Pengcheng Chen <pengcheng.chen@amlogic.com>
 2020-06-29 11:45:50 +09:00
Cao Jian
22de8b3e55 osd: modify VPP_OSD_SC_DUMMY_DATA alpha conditions [1/1] 
PD#SWPL-14256

Problem:
When ATV Mode has no signal
the bright line interference at the bottom
if freescale height is set to vinfo height

Solution:
modify VPP_OSD_SC_DUMMY_DATA alpha value

Verify:
verified on txlx-r311

Change-Id: I48bbb1be533a88e8b3c622550a0a2e8c07f2a863
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
 2020-06-29 11:45:50 +09:00
Jian Cao
803f63023f osd: modify VPP_OSD_SC_DUMMY_DATA alpha conditions [1/1] 
PD#TV-6994

Problem:
When ATV Mode has no signal
the bright line interference at the bottom

Solution:
modify VPP_OSD_SC_DUMMY_DATA alpha value

Verify:
verified on txlx-r311

Change-Id: Icc5039f80bd794ed5adb98e22fbf41f52758ef83
Signed-off-by: Jian Cao <jian.cao@amlogic.com>
 2020-06-29 11:45:50 +09:00
Cao Jian
e155a3e2ef osd: adjust threshold by using active_begin_line [2/2] 
PD#SWPL-11936

Problem:
set screen position frequently
frame flashes white stripes

Solution:
modify threshold for updating all registers
on vsync coming

Verify:
Verfied on u212

Change-Id: Iac1ec8b5ec36809d5f5ffe2fe8e79c182e9c126b
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
 2020-06-29 11:45:50 +09:00
Pengcheng Chen
ef0a8629e3 osd: add viu2 reg write optimize [1/1] 
PD#TV-8354

Problem:
keystone screen blank probability,
viu2 reg write caused blank

Solution:
add viu2 reg write optimize, update reg that needed

Verify:
tl1

Change-Id: I17d1cdca2f9dec270ec61bd413b9f9753ab548a8
Signed-off-by: Pengcheng Chen <pengcheng.chen@amlogic.com>
 2020-06-29 11:45:50 +09:00
yao liu
da29ea3112 osd: add osd blend bypass function for tm2 [2/3] 
PD#SWPL-6631

Problem:
dv certification need osd blend bypass

Solution:
add osd blend bypass function

Verify:
verified on tm2 t96e2

Change-Id: I91ba9c622aacc7bc9ad657105fd5e53a3cee595b
Signed-off-by: yao liu <yao.liu@amlogic.com>
 2020-06-29 11:45:50 +09:00
yao liu
f8a69636c3 dolby: TM2 black screen on 4k60hz [1/1] 
PD#SWPL-11431

Problem:
black screen on 4k60hz
display abnormal on 1080p24hz/1080i/576p/480p

Solution:
1.Adjust potch according to resolution
2.Add tm2 in is_graphics_output_off
3.Move osd sc to the back of core2

Verify:
Verified on TM2

Change-Id: Ida1b4a67b3a7233d3a03b0536d246a0bd677e90c
Signed-off-by: yao liu <yao.liu@amlogic.com>
 2020-06-29 11:45:49 +09:00
Cao Jian
8a5dca900d osd: overflow on 4k src height/width left-shift [1/1] 
PD#SWPL-10952

Problem:
osd for 4k native UI

Solution:
modify u32 to u64 for left-shift

Verify:
verified on g12b-w400

Change-Id: I9e98e3b5769d61132570f3f4bb1f47694cffde8f
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
 2020-06-29 11:45:49 +09:00
sky zhou
aee823f14c osd: osd ext leaked buf when viu2 displaymode is NULL. [1/1] 
PD#TV-7713

Problem:
osd buffer leaked dma buffer when switch
display pipe.

Solution:
when viu is NULL, osd need still release correct
display file.

Verify:
verified on macroni

Change-Id: Ib2df6b022b6fd654430eedae08e351ae53701fc1
Signed-off-by: sky zhou <sky.zhou@amlogic.com>
 2020-06-29 11:45:49 +09:00
Pengcheng Chen
8db46377b1 rdma: add rdma multi reg trace function [1/1] 
PD#SWPL-11388

Problem:
rdma not support multi reg trace

Solution:
add rdma multi reg trace function

Verify:
verify by g12b w400

Change-Id: I74496e11f85af5f2e9aa99108dfc5842eb98d9fc
Signed-off-by: Pengcheng Chen <pengcheng.chen@amlogic.com>
 2020-06-29 11:45:49 +09:00
Pengcheng Chen
85561b17d8 osd: fixed fb mmap failed on android [3/3] 
PD#SWPL-6631

Problem:
dolby vision graphic tests need fb_test

Solution:
Alloc buffer when mmap

Verify:
verified on tm2 t96e2

Change-Id: I12896d7ef9ad4a8122e2784c4692ff2d0bc69d1b
Signed-off-by: Pengcheng Chen <pengcheng.chen@amlogic.com>
 2020-06-29 11:45:49 +09:00
Pengcheng Chen
d59e7b5b9e osd: add wait_hw_vsync_viu2 [1/1] 
PD#TV-7584

Problem:
osd on viu2 present timeout

Solution:
add wait_hw_vsync_viu2

Verify:
Verified on X30A1-T962X2

Change-Id: Iab80f4cef830652923e1de73eba6d87715bad855
Signed-off-by: Pengcheng Chen <pengcheng.chen@amlogic.com>
 2020-06-29 11:45:49 +09:00
Pengcheng Chen
b6e7b048ec osd: add osd virtual fb support [1/1] 
PD#SWPL-8187

Problem:
need implement the new virtual FB device

Solution:
add osd virtual fb support

Verify:
Verified on U200 spi lcd board

Change-Id: I52c4257f6a0a202eb63b2ee3383f6e306e5ec16a
Signed-off-by: Pengcheng Chen <pengcheng.chen@amlogic.com>
 2020-06-29 11:45:49 +09:00
Pengcheng Chen
f8e4ac85c2 buildroot: fix buildroot compile error and ge2d crash issue [1/1] 
PD#SWPL-10483

Problem:
1. buildroot autobuild error
2. buildroot ge2d crash on s400

Solution:
1. fix buildroot compile error
2. move video_keep_init from _init to probe

Verify:
verified on s400,w400

Change-Id: I624fed9669387c94a50974f77b32a4730db08314
Signed-off-by: Pengcheng Chen <pengcheng.chen@amlogic.com>
 2020-06-29 11:45:49 +09:00
Luke Go
c4899c384e Revert "ODROID-N2: cpu-opp-table: Add 1000 microvolts." 
This reverts commit 1fbc1ea16a.
 2020-06-29 11:45:49 +09:00
Hong Guo
584c3cd9e1 cpufreq: update dvfs voltage and pwm for g12b revb [1/1] 
PD#SWPL-7636

Problem:
update dvfs voltage and pwm for g12b revb

Solution:
update dvfs voltage and pwm for g12b revb

Verify:
update dvfs voltage and pwm for g12b revb

Change-Id: I29deea791126fcb1819be380ed81bc2aa29eeec6
Signed-off-by: Hong Guo <hong.guo@amlogic.com>
 2020-06-29 11:45:49 +09:00
Tao Zeng
3cbc6e6115 event: restore watch point after cpu pm event [1/1] 
PD#TV-9668

Problem:
After cpu idle enabled, watch point event register will be cleared
if cpu exit pm(idle). This will cause watch point can't work.

Solution:
re-enable watch point after cpu exit pm(idle)

Verify:
TL1

Change-Id: I4fc2002eaabecd4c5e60a5916bc29e0107882bec
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
 2020-06-29 11:45:49 +09:00
Hanjie Lin
802b47d3f8 mm: vmap: decrease wrps num [1/1] 
PD#SWPL-6813

Problem:
sys_ptrace watchpoint can't stop

Solution:
decrease wrps num

Verify:
u212

Change-Id: I18947bd91f8dd07cedeebbfca6d7ce01107c6a3e
Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com>
 2020-06-29 11:45:48 +09:00
Tao Zeng
c93f59a541 vmap: print pfn for register in vmalloc range [1/1] 
PD#SWPL-5564

Problem:
When open VMAP for kernel stack, if we meet kernel panic log, we
can't know physical address of stack and hard to debug.

Solution:
Print pfn for register in vmalloc range

Verify:
p212

Change-Id: Iee120df1feab88e412ef63e87c2e2bb4ad0645fb
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
 2020-06-29 11:45:48 +09:00
Jiamin Ma
4333209505 backtrace: add validation checking for fp [1/1] 
PD#SWPL-15010

Problem:
Crash if keep executing echo w > /proc/sysrq-trigger
on android platform

Solution:
Add necessary checking for the fp to be dereferenced in
dump_backtrace_entry with VMAP stack enabled

Verify:
U212

Change-Id: I69d8d7353cf99a71dc3e7640efa1d460ef2f5f9a
Signed-off-by: Jiamin Ma <jiamin.ma@amlogic.com>
 2020-06-29 11:45:48 +09:00
Hanjie Lin
e74c229341 perf: pmu fine-tune for aarch32/64 of A53/A55/A73 [1/1] 
PD#SWPL-13243

Problem:
pmu event is not accurate or not complete in A53/A55/A73.

Solution:
1, modify event config for A53/A55/A73.
2, perf executable file must compiled from latest kernel(5.1+)
3, A55 events are most complete, A73 are least complete(eg: less ld_retired/st_retired/stall/prefetch events)
4, A55/A53 same event meanings simlar, but A73 is more different(eg: L1/L2 dcache/icache loads meanings)

sample commands:
a55 arm64:
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,armv8_pmuv3/ld_retired/,armv8_pmuv3/st_retired/,cycles,branch-loads,branch-load-misses,armv8_pmuv3/a55_l1d_cache_rd/,armv8_pmuv3/a55_l1d_cache_refill_rd/,armv8_pmuv3/a55_l1d_cache_wr/,armv8_pmuv3/a55_l1d_cache_refill_wr/,L1-icache-loads,L1-icache-load-misses,armv8_pmuv3/a55_l2d_cache_rd/,armv8_pmuv3/a55_l2d_cache_refill_rd/,armv8_pmuv3/a55_l1d_cache_refill_inner/,armv8_pmuv3/a55_l1d_cache_refill_outer/,armv8_pmuv3/a55_l1d_cache_refill_prefetch/,armv8_pmuv3/a55_l2d_cache_refill_prefetch/,armv8_pmuv3/a5x_stall_frontend_cache/,armv8_pmuv3/a5x_stall_frontend_tlb/,armv8_pmuv3/a5x_stall_backend_ld/,armv8_pmuv3/a55_stall_backend_ld_cache/,armv8_pmuv3/a55_stall_backend_ld_tlb/,armv8_pmuv3/a5x_stall_backend_st/,armv8_pmuv3/a5x_stall_backend_ilock_agu/,armv8_pmuv3/a5x_stall_backend_ilock_fpu/ ls

a53 arm64:
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,armv8_pmuv3/ld_retired/,armv8_pmuv3/st_retired/,cycles,branch-loads,branch-load-misses,armv8_pmuv3/l1d_cache/,armv8_pmuv3/l1d_cache_refill/,L1-icache-loads,L1-icache-load-misses,armv8_pmuv3/a5x_l2d_cache/,armv8_pmuv3/a5x_l2d_cache_refill/,armv8_pmuv3/a53_cache_refill_prefetch/,armv8_pmuv3/a53_scu_snooped/,armv8_pmuv3/a5x_stall_frontend_cache/,armv8_pmuv3/a5x_stall_frontend_tlb/,armv8_pmuv3/a5x_stall_backend_ld/,,armv8_pmuv3/a5x_stall_backend_st/,armv8_pmuv3/a5x_stall_backend_ilock_agu/,armv8_pmuv3/a5x_stall_backend_ilock_fpu/ ls

a73 arm64: (w400 bind to a73 cpu2)
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,cycles,branch-loads,branch-load-misses,armv8_pmuv3/l1d_cache/,armv8_pmuv3/l1d_cache_refill/,armv8_pmuv3/a55_l1d_cache_rd/,armv8_pmuv3/a55_l1d_cache_wr/,armv8_pmuv3/a5x_l2d_cache/,armv8_pmuv3/a5x_l2d_cache_refill/,armv8_pmuv3/a55_l2d_cache_rd/,armv8_pmuv3/a55_l2d_cache_wr/ busybox taskset 4 ls

a55 arm:
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,armv7_cortex_a15/ld_retired/,armv7_cortex_a15/st_retired/,cycles,branch-loads,branch-load-misses,armv7_cortex_a15/a55_l1d_cache_rd/,armv7_cortex_a15/a55_l1d_cache_refill_rd/,armv7_cortex_a15/a55_l1d_cache_wr/,armv7_cortex_a15/a55_l1d_cache_refill_wr/,L1-icache-loads,L1-icache-load-misses,armv7_cortex_a15/a55_l2d_cache_rd/,armv7_cortex_a15/a55_l2d_cache_refill_rd/,armv7_cortex_a15/a55_l1d_cache_refill_inner/,armv7_cortex_a15/a55_l1d_cache_refill_outer/,armv7_cortex_a15/a55_l1d_cache_refill_prefetch/,armv7_cortex_a15/a55_l2d_cache_refill_prefetch/,armv7_cortex_a15/a5x_stall_frontend_cache/,armv7_cortex_a15/a5x_stall_frontend_tlb/,armv7_cortex_a15/a5x_stall_backend_ld/,armv7_cortex_a15/a55_stall_backend_ld_cache/,armv7_cortex_a15/a55_stall_backend_ld_tlb/,armv7_cortex_a15/a5x_stall_backend_st/,armv7_cortex_a15/a5x_stall_backend_ilock_agu/,armv7_cortex_a15/a5x_stall_backend_ilock_fpu/ ls

a53 arm:
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,armv7_cortex_a15/ld_retired/,armv7_cortex_a15/st_retired/,cycles,branch-loads,branch-load-misses,armv7_cortex_a15/l1d_cache/,armv7_cortex_a15/l1d_cache_refill/,L1-icache-loads,L1-icache-load-misses,armv7_cortex_a15/a5x_l2d_cache/,armv7_cortex_a15/a5x_l2d_cache_refill/,armv7_cortex_a15/a53_cache_refill_prefetch/,armv7_cortex_a15/a53_scu_snooped/,armv7_cortex_a15/a5x_stall_frontend_cache/,armv7_cortex_a15/a5x_stall_frontend_tlb/,armv7_cortex_a15/a5x_stall_backend_ld/,armv7_cortex_a15/a5x_stall_backend_st/,armv7_cortex_a15/a5x_stall_backend_ilock_agu/,armv7_cortex_a15/a5x_stall_backend_ilock_fpu/ ls

a73 arm: (w400 bind to a73 cpu2)
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,cycles,branch-loads,branch-load-misses,armv7_cortex_a15/l1d_cache/,armv7_cortex_a15/l1d_cache_refill/,armv7_cortex_a15/a55_l1d_cache_rd/,armv7_cortex_a15/a55_l1d_cache_wr/,armv7_cortex_a15/a5x_l2d_cache/,armv7_cortex_a15/a5x_l2d_cache_refill/,armv7_cortex_a15/a55_l2d_cache_rd/,armv7_cortex_a15/a55_l2d_cache_wr/ busybox taskset 4 ls

Verify:
ac200/u200/w400

Change-Id: I7f11e1480c3c27d016b011d2a84c33e824f69b08
Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com>
 2020-06-29 11:45:48 +09:00
daozai.ye
61a21b7619 OSS vulnerability found in [boot.img]:[linux_kernel] (CVE-2019-8912) Risk:[] [1/1] 
PD#OTT-6791

Problem:
net: crypto set sk to NULL when af_alg_release.
KASAN has found use-after-free in sockfs_setattr.
The existed commit 6d8c50dcb0 ("socket: close race condition between sock_close()
and sockfs_setattr()") is to fix this simillar issue, but it seems to ignore
that crypto module forgets to set the sk to NULL after af_alg_release.

KASAN report details as below:
BUG: KASAN: use-after-free in sockfs_setattr+0x120/0x150
Write of size 4 at addr ffff88837b956128 by task syz-executor0/4186

CPU: 2 PID: 4186 Comm: syz-executor0 Not tainted xxx + #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.10.2-1ubuntu1 04/01/2014
Call Trace:
dump_stack+0xca/0x13e
print_address_description+0x79/0x330
? vprintk_func+0x5e/0xf0
kasan_report+0x18a/0x2e0
? sockfs_setattr+0x120/0x150
sockfs_setattr+0x120/0x150
? sock_register+0x2d0/0x2d0
notify_change+0x90c/0xd40
? chown_common+0x2ef/0x510
chown_common+0x2ef/0x510
? chmod_common+0x3b0/0x3b0
? __lock_is_held+0xbc/0x160
? __sb_start_write+0x13d/0x2b0
? __mnt_want_write+0x19a/0x250
do_fchownat+0x15c/0x190
? __ia32_sys_chmod+0x80/0x80
? trace_hardirqs_on_thunk+0x1a/0x1c
__x64_sys_fchownat+0xbf/0x160
? lockdep_hardirqs_on+0x39a/0x5e0
do_syscall_64+0xc8/0x580
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x462589
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89
f7 48 89 d6 48 89
ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3
48 c7 c1 bc ff ff
ff f7 d8 64 89 01 48
RSP: 002b:00007fb4b2c83c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000104
RAX: ffffffffffffffda RBX: 000000000072bfa0 RCX: 0000000000462589
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000007
RBP: 0000000000000005 R08: 0000000000001000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb4b2c846bc
R13: 00000000004bc733 R14: 00000000006f5138 R15: 00000000ffffffff

Allocated by task 4185:
kasan_kmalloc+0xa0/0xd0
__kmalloc+0x14a/0x350
sk_prot_alloc+0xf6/0x290
sk_alloc+0x3d/0xc00
af_alg_accept+0x9e/0x670
hash_accept+0x4a3/0x650
__sys_accept4+0x306/0x5c0
__x64_sys_accept4+0x98/0x100
do_syscall_64+0xc8/0x580
entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 4184:
__kasan_slab_free+0x12e/0x180
kfree+0xeb/0x2f0
__sk_destruct+0x4e6/0x6a0
sk_destruct+0x48/0x70
__sk_free+0xa9/0x270
sk_free+0x2a/0x30
af_alg_release+0x5c/0x70
__sock_release+0xd3/0x280
sock_close+0x1a/0x20
__fput+0x27f/0x7f0
task_work_run+0x136/0x1b0
exit_to_usermode_loop+0x1a7/0x1d0
do_syscall_64+0x461/0x580
entry_SYSCALL_64_after_hwframe+0x49/0xbe

Syzkaller reproducer:
r0 = perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0,
0xffffffffffffffff, 0x0)
r1 = socket$alg(0x26, 0x5, 0x0)
getrusage(0x0, 0x0)
bind(r1, &(0x7f00000001c0)=@alg={0x26, 'hash\x00', 0x0, 0x0,
'sha256-ssse3\x00'}, 0x80)
r2 = accept(r1, 0x0, 0x0)
r3 = accept4$unix(r2, 0x0, 0x0, 0x0)
r4 = dup3(r3, r0, 0x0)
fchownat(r4, &(0x7f00000000c0)='\x00', 0x0, 0x0, 0x1000)

Fixes: 6d8c50dcb0 ("socket: close race condition between sock_close() and sockfs_setattr()")

Solution:
set the sk to NULL after af_alg_release

This fixes CVE-2019-8912

Verify:
Raven

Change-Id: I0a655942b6cd522ecd2255af8f1fc1f78978d286
Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com>
 2020-06-29 11:45:48 +09:00