nvidia-tegra-modules.git/drivers/platform/tegra/rtcpu/capture-ivc.c, branch rtss22-ae

capture-ivc: Fix race condition to update callback

2021-05-21T13:40:27+00:00

Added synchronization while update, and unregister the callback for
each channel-id.

In multi-session scenario, it is observed that RCE freed channel id,
and for new session allocate same channel-id again by RCE, but capture
driver did not unregister the callback and it returns channel context
is busy and it ends up with crash.

To fix this issue, added semaphore lock for each channel-id with 2
seconds timeout.

Bug 200722166

Change-Id: I62faac721511173487392dc40a8b3a529109206a
Signed-off-by: Devang Kubavat 
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2518598
Tested-by: mobile promotions 
Reviewed-by: mobile promotions

camera: Check for pending ivc frames

2021-05-05T16:11:16+00:00

If ivc message handler workqueue is not scheduled, driver
will report no reply from camera processor error. This gives
impression that rtcpu is in bad state. However, it is possible
that some IVC frames are pending read. Hence, before reporting
no reply from camera processor we check for pending IVC frames.

Bug 3293029
Bug 3291799

Change-Id: I653add5d363a81af816d81e1197868cc289249a2
Signed-off-by: Aniket Bahadarpurkar 
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2520521
(cherry picked from commit d3a7408c12cf1e51288cd1ee56f54668d8fdae1a)
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2524157
Tested-by: mobile promotions 
Reviewed-by: mobile promotions

tegra: capture-ivc: WAR: add check for msg_id

2020-05-26T15:40:30+00:00

Skip the callback if channel-id is 65, and msg-id is greater
than CAPTURE_CHANNEL_ISP_RELEASE_RESP. Channel id 65 is used
for csi and it is specific to v4l2.

Bug 200617837
Bug 2854501

Change-Id: Id439ef507d4dd2fd5932dec718642dffeb56a5a1
Signed-off-by: Devang Kubavat 
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2348139
Reviewed-by: automaticguardword 
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Prayas Mohanty 
Reviewed-by: Sudhir Vyas 
Reviewed-by: mobile promotions 
GVS: Gerrit_Virtual_Submit
Tested-by: mobile promotions

tegra: capture-ivc: change cb debug print level

2018-09-28T13:40:40+00:00

Change the log level of the print message to debug when an IVC
callback function is not set. Levels >= INFO are disallowed in
kernel code.

Change-Id: I1a1039dbd76911fa863ecfb8bf2ec3c450aecb97
Signed-off-by: Vincent Chung 
Reviewed-on: https://git-master.nvidia.com/r/1848083
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Pekka Pessi

tegra: capture-ivc: cancel work before removing

2018-09-13T00:49:16+00:00

Prevent channel from being removed while there are scheduled work.

Bug 2305627

Change-Id: Ibc26ad72b127da5ae4557a8caa8da57f2ddf3605
Originally-Reviewed-on: https://git-master.nvidia.com/r/1803897
Signed-off-by: Pekka Pessi 
Reviewed-on: https://git-master.nvidia.com/r/1819501
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bhanu Murthy V 
GVS: Gerrit_Virtual_Submit
Reviewed-by: mobile promotions 
Tested-by: mobile promotions

Revert "tegra: capture-ivc: cancel work before removing"

2018-09-10T23:03:19+00:00

This reverts commit 9558a1543cfb2e3534d0e8b8fb32ec6fde5ae70c.

Change-Id: I3ae881eaa565f2503ff2055dd76311aab40c824d
Reviewed-on: https://git-master.nvidia.com/r/1818388
Reviewed-by: Emad Mir 
Tested-by: Emad Mir 
Reviewed-by: mobile promotions 
Tested-by: mobile promotions

tegra: capture-ivc: cancel work before removing

2018-09-10T22:04:32+00:00

Prevent channel from being removed while there are scheduled work.

Bug 2305627

Change-Id: Ia64ccb86f3fde9984f46ace93a2ceed024192701
Signed-off-by: Pekka Pessi 
Reviewed-on: https://git-master.nvidia.com/r/1803897
Reviewed-by: Semi Malinen 
Reviewed-by: Bhanu Murthy V 
GVS: Gerrit_Virtual_Submit
Reviewed-by: mobile promotions 
Tested-by: mobile promotions

tegra:rtcpu: prevent speculative load related leak

2018-04-19T19:17:56+00:00

Data can be speculatively loaded from memory and stay in cache even
when bound check fails. This can lead to unintended information
disclosure via side-channel analysis.

To mitigate this problem, use array_index_nospec.

Bug 2060857
CVE-2017-5753

Change-Id: Iff6309f93d8924c57da55ec5befd71fc2be97a21
Signed-off-by: David Gilhooley 
Reviewed-on: https://git-master.nvidia.com/r/1684647
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: svc-mobile-coverity 
Reviewed-by: Bo Yan 
GVS: Gerrit_Virtual_Submit
Reviewed-by: mobile promotions 
Tested-by: mobile promotions

tegra:rtcpu: prevent speculative load related leak

2018-02-16T20:57:22+00:00

Data can be speculatively loaded from memory and stay in cache even
when bound check fails. This can lead to unintended information
disclosure via side-channel analysis. To mitigate this problem,
insert speculation barrier.

Bug 2039126
CVE-2017-5753

Change-Id: I72a1ed6ff3dfe0148bbab7293657064fb6aad46a
Signed-off-by: Hien Goi 
Reviewed-on: https://git-master.nvidia.com/r/1658310
Reviewed-by: Bhanu Murthy V 
Reviewed-by: David Gilhooley 
Reviewed-by: svc-mobile-coverity 
Reviewed-by: Paresh Anandathirtha 
GVS: Gerrit_Virtual_Submit
Reviewed-by: Frank Chen 
Reviewed-by: mobile promotions 
Tested-by: mobile promotions

platform: tegra: rtcpu: prevent speculative load related leak

2018-01-19T01:03:38+00:00

Data can be speculatively loaded from memory and stay in cache even
when bound check fails. This can lead to unintended information
disclosure via side-channel analysis.

To mitigate this problem, insert speculation barrier.

bug 2039126
CVE-2017-5753

Change-Id: I7d6af7d14ddce4cba6de337ffe821f4738fab754
Signed-off-by: David Gilhooley 
Reviewed-on: https://git-master.nvidia.com/r/1640355
Reviewed-by: svc-mobile-coverity 
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bhanu Murthy V 
Reviewed-by: mobile promotions 
Tested-by: mobile promotions