Commit Graph

88808 Commits

Author SHA1 Message Date
David Rientjes
4c47b8462e compiler, clang: suppress warning for unused static inline functions
commit abb2ea7dfd upstream.

GCC explicitly does not warn for unused static inline functions for
-Wunused-function.  The manual states:

	Warn whenever a static function is declared but not defined or
	a non-inline static function is unused.

Clang does warn for static inline functions that are unused.

It turns out that suppressing the warnings avoids potentially complex

Suppress the warning for clang.

Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-12 16:27:29 +09:00
yao liu
1473adce54 vpp code style modify [1/1]
PD#SWPL-59491

Problem:
vpp code style modify

Solution:
vpp code style modify

Verify:
sm1

Signed-off-by: yao liu <yao.liu@amlogic.com>
Change-Id: I0ff44f15d441413a70366d86cabaee69a73587f7
2023-04-21 13:52:38 +09:00
chunlong.cao
51897c7f2f Revert "ge2d: t5: add ge2d support [1/1]"
This reverts commit 529c6f4f398b0783f9d19ad03dccd48d2511565c.

Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
Change-Id: Id751430c9532e2570f3ebf24633da8f66838a921
2023-04-21 13:52:36 +09:00
Cao Jian
77e2034375 ge2d: add custom stride support [1/1]
PD#SWPL-29770

Problem:
accept customized picture stride

Solution:
add this support

Verify:
w400

Change-Id: I582286f0f19a617b728cc262f1616a8fce6091b2
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
2023-04-21 13:52:36 +09:00
Cao Jian
a7d4bbc988 ge2d: add hw capability flags [1/1]
PD#SWPL-35263

Problem:
acquire HW capabilities at runtime

Solution:
add hw capability flags

Verify:
on w400

Change-Id: I6cab307cd5e3df848da72de64370b71826d30377
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
2023-04-21 13:52:36 +09:00
Cao Jian
87ea2f5e78 ge2d: add ioctl to attach/detach [1/1]
PD#SWPL-33277

Problem:
reduce cache invalidate actions
while doing bulk actions to improve the performance

Solution:
add ioctl to attach/detach dma fd

Verify:
on sm1/w400

Change-Id: Iea8fae9e483ff70044da748c78d8641c52a0c65d
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
2023-04-21 13:52:35 +09:00
Cao Jian
4d07716e42 ge2d: t5: add ge2d support [1/1]
PD#SWPL-32146

Problem:
need add ge2d support for t5

Solution:
add ge2d support

Verify:
on PTM

Change-Id: Iacb6771df7b349530b6f1913fcc51aa6532f837f
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
2023-04-21 13:52:35 +09:00
Cao Jian
9587417431 gdc: add the stride support in gdc_process_phys [1/1]
PD#SWPL-36752

Problem:
Support the stride in physical address configuration

Solution:
add this support

Verify:
verified on g12b

Change-Id: Ic85384af6b67687e9f437319f6bc397c6e39a0cc
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
2023-04-21 13:52:34 +09:00
Tao Zeng
9219f9ded0 rodata: fix compile error of rodata optimize [1/1]
PD#SWPL-31258

Problem:
Compile failed after merge https://scgit.amlogic.com/#/c/120275/

Solution:
Fix it

Verify:
x301

Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
Change-Id: Ida94b0853baca9126b145e378d69b657b9cd4419
2023-04-21 13:52:34 +09:00
Tao Zeng
1c6529b998 rodata: optimize memory usage of rodata section [5/5]
PD#SWPL-31258

Problem:
Kernel RO data is too large, about 4.5mb on 32bit and 5.9mb on
64bit kernel

Solution:
1, replace __FILE__ definition, using relative path instead of
absolute path. This can help to save about 50KB memory. For example:
[   36.820945@0] WARNING: CPU: 0 PID: 4817 at /mnt/fileroot/tao.zeng/p-android/
                                              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                 common/drivers/amlogic/memory_ext/page_trace.c:973
				 ~~~~~~ absolute path
		 pagetrace_write+0x10/0x18
[   42.792868@1] WARNING: CPU: 1 PID: 4864 at drivers/amlogic/
                 memory_ext/page_trace.c:973 pagetrace_write+0x10/0x18

2, replace __FUNC__ definition. using kallsyms interface to print function
instead of build in const string. This change can save about 100KB rodata.

Verify:
x301

Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
Change-Id: I65e4e9eb61a2226002557759833e4e16ed37b92e
2023-04-21 13:52:34 +09:00
Tao Zeng
ea094c64aa mm: fix Lost RAM too large problem when playing 4k [1/2]
PD#SWPL-16990

Problem:
Lost RAM will be over 200MB when playing 4K.

Solution:
Add cma pages in /proc/meminfo and give a information
for android layer to count them.

Verify:
x301

Change-Id: I99d1ded53ed351a5cb0d24f0e03850a55ef0d272
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
2023-04-21 13:52:34 +09:00
Cao Jian
479ffdf842 gdc: add a probed flag to avoid crash [1/1]
PD#SWPL-29848

Problem:
on platforms which GDC are not supported
if create_gdc_work_queue is invoked
a crash occurs

Solution:
add a probed flag to avoid crash
add a interface is_gdc_supported to query

Verify:
g12b/tm2

Change-Id: I65b88294822d8a2c7429d375039fee962b9612aa
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
2023-04-21 13:52:33 +09:00
Cao Jian
dfd7a2da8e gdc: support phy addr configuration [1/1]
PD#SWPL-15157

Problem:
GDC Driver Support physical address configuration

Solution:
add this support

Verify:
verified on g12b

Change-Id: I8aee517a13bb2a65c021279cc3b54bd9861fc20c
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
2023-04-21 13:52:33 +09:00
changqing.gao
10339a40a3 config: remove unused configs on ref-board [1/1]
PD#SWPL-27983

Problem:
code size of kernel is too large

Solution:
remove unused but default enabled configs for refernce-board
merge from:a3242b3096d5b9423105e2695723244e7edee433

Verify:
ac214

Change-Id: I9b66178acf67971c0144c4b7141d676866d7b65a
Signed-off-by: changqing.gao <changqing.gao@amlogic.com>
Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
2023-04-21 13:52:32 +09:00
Tao Zeng
c97cac5c71 config: remove unused configs on ref-board [1/1]
PD#SWPL-27983

Problem:
code size of kernel is too large

Solution:
remove unused but default enabled configs for refernce-board
code size comparison(base on ARMv7):
------------------------------------------
             |   before(KB)  |   after(KB)
------------------------------------------
kernel code: |    14336      |   11456
rwdata:      |     1352      |    1195
rodata:      |     5144      |    4560
init:        |     1024      |    1024
bss:         |     1379      |    1327
------------------------------------------
summary:     |    22211      |   18538
------------------------------------------

This change can save about 3.6MB kernel code size

Verify:
x301

Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
Change-Id: Iafc4b2a2b8dc55a42fbee197cc7272fd2c476cec
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
2023-04-21 13:52:32 +09:00
Nanxin Qin
4be10acc4e media: fixed issue of fastplay mode. [1/2]
PD#SWPL-30672

Problem:
1. echo 1 > /sys/class/codec_mm/fastplay_enable
fail with single mode playback on arch 32bit.

2. add codec_mm_memset to avoid vmap fail.

Solution:
fixed issue of reserve memory alloc from CMA.

Verify:
u212

Change-Id: I8823427dfde16d1811132d11c8bab0fe71f1d641
Signed-off-by: Nanxin Qin <nanxin.qin@amlogic.com>
2023-04-21 13:52:32 +09:00
Luke Go
7cfa86f4fd ODROID: arm64/configs: Add KEYBOARD_MATRIX to C4 and N2. matrix keypad
support polling feature.

Change-Id: Ibef25334c09987e09916b951297c10c2b8e3051c
Signed-off-by: Luke Go <sangch.go@gmail.com>
2022-08-31 14:38:42 +09:00
Chris
72d371dcd0 Revert "ODROID-COMMON: hdmitx: Add new hdmi resolution."
This reverts commit 44a7c003fa.

Change-Id: I01d01cc0090005fdea4d4097320ee720e5347210
2021-12-27 14:48:32 +09:00
Chris
44a7c003fa ODROID-COMMON: hdmitx: Add new hdmi resolution.
3840x1080p50hz

Change-Id: I1f1deb6d2e6a45000284f7d5b150deeeb74d11fb
2021-09-29 12:27:00 +09:00
Marcel Holtmann
83c0d10da6 Bluetooth: Use bt_dev_err and bt_dev_info when possible
In case of using BT_ERR and BT_INFO, convert to bt_dev_err and
bt_dev_info when possible. This allows for controller specific
reporting.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Change-Id: I3cd472bf3ce8e797b112c36227884ee2d80b6394
2020-12-18 12:46:08 +09:00
Dongjin Kim
84d6acb892 ODROID-HC4: arch/arm64: Introduce new board 'ODROID-HC4'
Change-Id: Id020eb76109f1a7a3cabf50489cf1a0d5447b010
Signed-off-by: Dongjin Kim <tobetter@gmail.com>
2020-12-18 12:43:51 +09:00
Ruixuan Li
366ccec376 emmc: save tuning parameter of hs400 [1/1]
PD#SWPL-15199

Problem:
tunig process of hs400 is too slow

Solution:
saved tuning parameter of hs400 on emmc

Verify:
passed on tm2_t962e2_ab311

Change-Id: Ifd1ba375dd93745c9db33a94f3480ebfc21e999f
Signed-off-by: Ruixuan Li <ruixuan.li@amlogic.com>
Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
2020-12-17 17:39:21 +09:00
Dezhi Kong
e8cc1330bd vpp: add nv12 format support [1/1]
PD#SWPL-20468

Problem:
nv12 format is not support in vpp

Solution:
add nv12 format support

Verify:
on U212

Change-Id: I1e621bede63a283931743c2cd3a5ea1548149368
Signed-off-by: Dezhi Kong <dezhi.kong@amlogic.com>
2020-12-17 17:32:54 +09:00
yanan.wang
c5f75574b8 amstream: fix ff/fb for mpeg4&mpeg12&h265 format is abnormal. [2/2]
PD#SWPL-23122

Problem:
when ff/fb for mpeg4&mpeg12&h265 on trick mode is abnormal.

Solution:
add mpeg4&mpeg12&h265 TRICKMODE_I function.

Verify:
u212

Change-Id: I161d3a57480ed48b29de1fccf52185a28ccf8677
Signed-off-by: yanan.wang <yanan.wang@amlogic.com>
2020-12-17 17:32:53 +09:00
shuanglong.wang
6841226159 videosync: add vmaster mode for cobalt dual video [2/3]
PD#SWPL-20255

Problem:
add vmaster mode for cobalt dual video

Solution:
add vmaster mode for cobalt dual video

Verify:
verify by buildroot

Change-Id: Iacdbee5a83eab6b21c75a79b6665fa12375a6624
Signed-off-by: shuanglong.wang <shuanglong.wang@amlogic.com>
2020-12-17 17:32:53 +09:00
rongrong zhou
166414a886 v4l2: v4l2 vf video support [1/3]
PD#SWPL-16226

Problem:
v4l2 can not display on vf video

Solution:
add v4l2 vf video support

Verify:
U212

Change-Id: If04fc991edaa57c202f1adcf6b1be6d453bb2af9
Signed-off-by: rongrong zhou <rongrong.zhou@amlogic.com>
2020-12-17 17:32:46 +09:00
apollo.ling
587114712c vdec: add struct for getting multi-vdec information header files part [2/4]
PD#SWPL-1449

Problem:
need to implement a way to get multi-vdec information

Solution:
add new data struct to dynamically record each VDEC's information

Verify:
u212

Change-Id: I5e63d4cf6e7f5e2739b95e2626cc6565d42bdbb0
Signed-off-by: apollo.ling <apollo.ling@amlogic.com>
2020-12-17 17:32:11 +09:00
Nanxin Qin
5cc0a8afd0 v4l: add handles of dev and inst within v4l private data. [1/2]
PD#SWPL-19709

Problem:
Playback youtube 360vr video blurred screen when switch

Solution:
need to check the inst is valid when the res change.

Verify:
u212

Change-Id: I7c58d3b882be47f9681edf074673c4c75f6e3a62
Signed-off-by: Nanxin Qin <nanxin.qin@amlogic.com>
2020-12-17 17:32:11 +09:00
rongrong zhou
68f65aeaa4 v4l2: drop frames [1/3]
PD#SWPL-17328

Problem:
drop frames

Solution:
1. add trace for debug
2. less than 256K, do not use codec_mm allocation
3. osd fence crash

Verify:
local

Change-Id: Ibc0fe63b73cf20359bda1d743dfc6a14dc82c03f
Signed-off-by: rongrong zhou <rongrong.zhou@amlogic.com>
2020-12-17 17:32:11 +09:00
Nanxin Qin
af0f5ac26f v4l: fixed the build err. [1/1]
PD#SWPL-17646

Problem:
android P patchbuild failed.

Solution:
add the head file v4lvideo_ext.h

Verify:
U212

Change-Id: I17c5cc6f56490335a0d592e4a216e31c6896800a
Signed-off-by: Nanxin Qin <nanxin.qin@amlogic.com>
Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
2020-12-17 17:32:10 +09:00
changqing.gao
52710ce1a0 kmemleak: system would panic after enabling kmemleak [1/1]
PD#SWPL-27030

Problem:
system would panic after enabling kmemleak.

Solution:
make sure the kernel thread stack addr is mapped to physical
memory before kmemleak scanning it.

Verify:
verified by sm1_s905x3_ac214.

Change-Id: I930e9c3d6e5930d4f71b42c2cdbc39d11c24eeb0
Signed-off-by: changqing.gao <changqing.gao@amlogic.com>
2020-12-17 17:23:23 +09:00
Xishi Qiu
b8ab988365 mm: use is_migrate_highatomic() to simplify the code
PD#SWPL-27367

Introduce two helpers, is_migrate_highatomic() and is_migrate_highatomic_page().

Simplify the code, no functional changes.

[akpm@linux-foundation.org: use static inlines rather than macros, per mhocko]
Link: http://lkml.kernel.org/r/58B94F15.6060606@huawei.com
Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: Iba435ad7129eaa1b9e99d7766f0605489184186d
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
2020-12-17 17:23:23 +09:00
Linus Torvalds
8c35e2bf57 mremap: properly flush TLB before releasing the page (CVE-2018-18281)
PD#SWPL-26439

commit eb66ae0308 upstream

Jann Horn points out that our TLB flushing was subtly wrong for the
mremap() case.  What makes mremap() special is that we don't follow the
usual "add page to list of pages to be freed, then flush tlb, and then
free pages".  No, mremap() obviously just _moves_ the page from one page
table location to another.

That matters, because mremap() thus doesn't directly control the
lifetime of the moved page with a freelist: instead, the lifetime of the
page is controlled by the page table locking, that serializes access to
the entry.

As a result, we need to flush the TLB not just before releasing the lock
for the source location (to avoid any concurrent accesses to the entry),
but also before we release the destination page table lock (to avoid the
TLB being flushed after somebody else has already done something to that
page).

This also makes the whole "need_flush" logic unnecessary, since we now
always end up flushing the TLB for every valid entry.

Change-Id: Ida7dcda3734c75e4656346904ff17aa0073960cb
Reported-and-tested-by: Jann Horn <jannh@google.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Tested-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-17 17:23:22 +09:00
Soheil Hassas Yeganeh
a993176551 tcp: reset sk_send_head in tcp_write_queue_purge (CVE-2020-0040)
PD#SWPL-26439

[ Upstream commit dbbf2d1e40 ]

tcp_write_queue_purge clears all the SKBs in the write queue
but does not reset the sk_send_head. As a result, we can have
a NULL pointer dereference anywhere that we use tcp_send_head
instead of the tcp_write_queue_tail.

For example, after a27fd7a8ed (tcp: purge write queue upon RST),
we can purge the write queue on RST. Prior to
75c119afe1 (tcp: implement rb-tree based retransmit queue),
tcp_push will only check tcp_send_head and then accesses
tcp_write_queue_tail to send the actual SKB. As a result, it will
dereference a NULL pointer.

This has been reported twice for 4.14 where we don't have
75c119afe1:

By Timofey Titovets:

[  422.081094] BUG: unable to handle kernel NULL pointer dereference
at 0000000000000038
[  422.081254] IP: tcp_push+0x42/0x110
[  422.081314] PGD 0 P4D 0
[  422.081364] Oops: 0002 [#1] SMP PTI

By Yongjian Xu:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
IP: tcp_push+0x48/0x120
PGD 80000007ff77b067 P4D 80000007ff77b067 PUD 7fd989067 PMD 0
Oops: 0002 [#18] SMP PTI
Modules linked in: tcp_diag inet_diag tcp_bbr sch_fq iTCO_wdt
iTCO_vendor_support pcspkr ixgbe mdio i2c_i801 lpc_ich joydev input_leds shpchp
e1000e igb dca ptp pps_core hwmon mei_me mei ipmi_si ipmi_msghandler sg ses
scsi_transport_sas enclosure ext4 jbd2 mbcache sd_mod ahci libahci megaraid_sas
wmi ast ttm dm_mirror dm_region_hash dm_log dm_mod dax
CPU: 6 PID: 14156 Comm: [ET_NET 6] Tainted: G D 4.14.26-1.el6.x86_64 #1
Hardware name: LENOVO ThinkServer RD440 /ThinkServer RD440, BIOS A0TS80A
09/22/2014
task: ffff8807d78d8140 task.stack: ffffc9000e944000
RIP: 0010:tcp_push+0x48/0x120
RSP: 0018:ffffc9000e947a88 EFLAGS: 00010246
RAX: 00000000000005b4 RBX: ffff880f7cce9c00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff8807d00f5000
RBP: ffffc9000e947aa8 R08: 0000000000001c84 R09: 0000000000000000
R10: ffff8807d00f5158 R11: 0000000000000000 R12: ffff8807d00f5000
R13: 0000000000000020 R14: 00000000000256d4 R15: 0000000000000000
FS: 00007f5916de9700(0000) GS:ffff88107fd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000038 CR3: 00000007f8226004 CR4: 00000000001606e0
Call Trace:
tcp_sendmsg_locked+0x33d/0xe50
tcp_sendmsg+0x37/0x60
inet_sendmsg+0x39/0xc0
sock_sendmsg+0x49/0x60
sock_write_iter+0xb6/0x100
do_iter_readv_writev+0xec/0x130
? rw_verify_area+0x49/0xb0
do_iter_write+0x97/0xd0
vfs_writev+0x7e/0xe0
? __wake_up_common_lock+0x80/0xa0
? __fget_light+0x2c/0x70
? __do_page_fault+0x1e7/0x530
do_writev+0x60/0xf0
? inet_shutdown+0xac/0x110
SyS_writev+0x10/0x20
do_syscall_64+0x6f/0x140
? prepare_exit_to_usermode+0x8b/0xa0
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
RIP: 0033:0x3135ce0c57
RSP: 002b:00007f5916de4b00 EFLAGS: 00000293 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000003135ce0c57
RDX: 0000000000000002 RSI: 00007f5916de4b90 RDI: 000000000000606f
RBP: 0000000000000000 R08: 0000000000000000 R09: 00007f5916de8c38
R10: 0000000000000000 R11: 0000000000000293 R12: 00000000000464cc
R13: 00007f5916de8c30 R14: 00007f58d8bef080 R15: 0000000000000002
Code: 48 8b 97 60 01 00 00 4c 8d 97 58 01 00 00 41 b9 00 00 00 00 41 89 f3 4c 39
d2 49 0f 44 d1 41 81 e3 00 80 00 00 0f 85 b0 00 00 00 <80> 4a 38 08 44 8b 8f 74
06 00 00 44 89 8f 7c 06 00 00 83 e6 01
RIP: tcp_push+0x48/0x120 RSP: ffffc9000e947a88
CR2: 0000000000000038
---[ end trace 8d545c2e93515549 ]---

There is other scenario which found in stable 4.4:
Allocated:
 [<ffffffff82f380a6>] __alloc_skb+0xe6/0x600 net/core/skbuff.c:218
 [<ffffffff832466c3>] alloc_skb_fclone include/linux/skbuff.h:856 [inline]
 [<ffffffff832466c3>] sk_stream_alloc_skb+0xa3/0x5d0 net/ipv4/tcp.c:833
 [<ffffffff83249164>] tcp_sendmsg+0xd34/0x2b00 net/ipv4/tcp.c:1178
 [<ffffffff83300ef3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
Freed:
 [<ffffffff82f372fd>] __kfree_skb+0x1d/0x20 net/core/skbuff.c:676
 [<ffffffff83288834>] sk_wmem_free_skb include/net/sock.h:1447 [inline]
 [<ffffffff83288834>] tcp_write_queue_purge include/net/tcp.h:1460 [inline]
 [<ffffffff83288834>] tcp_connect_init net/ipv4/tcp_output.c:3122 [inline]
 [<ffffffff83288834>] tcp_connect+0xb24/0x30c0 net/ipv4/tcp_output.c:3261
 [<ffffffff8329b991>] tcp_v4_connect+0xf31/0x1890 net/ipv4/tcp_ipv4.c:246

BUG: KASAN: use-after-free in tcp_skb_pcount include/net/tcp.h:796 [inline]
BUG: KASAN: use-after-free in tcp_init_tso_segs net/ipv4/tcp_output.c:1619 [inline]
BUG: KASAN: use-after-free in tcp_write_xmit+0x3fc2/0x4cb0 net/ipv4/tcp_output.c:2056
 [<ffffffff81515cd5>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814f9784>] __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:427
 [<ffffffff83286582>] tcp_skb_pcount include/net/tcp.h:796 [inline]
 [<ffffffff83286582>] tcp_init_tso_segs net/ipv4/tcp_output.c:1619 [inline]
 [<ffffffff83286582>] tcp_write_xmit+0x3fc2/0x4cb0 net/ipv4/tcp_output.c:2056
 [<ffffffff83287a40>] __tcp_push_pending_frames+0xa0/0x290 net/ipv4/tcp_output.c:2307

stable 4.4 and stable 4.9 don't have the commit abb4a8b870 ("tcp: purge write queue upon RST")
which is referred in dbbf2d1e40,
in tcp_connect_init, it calls tcp_write_queue_purge, and does not reset sk_send_head, then UAF.

stable 4.14 have the commit abb4a8b870 ("tcp: purge write queue upon RST"),
in tcp_reset, it calls tcp_write_queue_purge(sk), and does not reset sk_send_head, then UAF.

So this patch can be used to fix stable 4.4 and 4.9.

Change-Id: I333e712e919b9bebffa6649b040883d6912e4659
Fixes: a27fd7a8ed (tcp: purge write queue upon RST)
Reported-by: Timofey Titovets <nefelim4ag@gmail.com>
Reported-by: Yongjian Xu <yongjianchn@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Tested-by: Yongjian Xu <yongjianchn@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-17 17:23:21 +09:00
Pengguang Zhu
e688df6bfa tee: add api tee_unprotect_mem [1/1]
PD#TV-17133

Problem:
need API to unprotect mem for codec and so on

Solution:
add api tee_unprotect_mem

Verify:
Android Q + TM2

Test: manual
Change-Id: I9dc205e209988297724c9461254c028e779ae1eb
Signed-off-by: Pengguang Zhu <pengguang.zhu@amlogic.com>
2020-12-17 17:23:20 +09:00
Pengguang Zhu
603cf6dccd tee: add api tee_protect_mem_by_type [1/1]
PD#SWPL-16829

Problem:
need API to protect mem for gpu and so on

Solution:
add api tee_protect_mem_by_type

Verify:
Android Q + TL1

Test: manual
wq
Signed-off-by: Pengguang Zhu <pengguang.zhu@amlogic.com>

Change-Id: Ibf420e1d4845c1020ae2ff91629f6e31a32a7bc3
Signed-off-by: changqing.gao <changqing.gao@amlogic.com>
2020-12-17 17:23:20 +09:00
Pengguang Zhu
1c1328208a tee: add api tee_protect_tvp_mem [1/1]
PD#SWPL-18795

Problem:
need API to protect mem for tvp

Solution:
add api tee_protect_tvp_mem

Verify:
Android Q + franklin

Test: manual

Change-Id: I46daec70a843524789aa63b32ef5e43111b65c66
Signed-off-by: Pengguang Zhu <pengguang.zhu@amlogic.com>
2020-12-17 17:23:20 +09:00
zhiqiang liang
11d6296451 power: add the probe done flag for DOS power control compatibilty [1/1]
PD#SWPL-17563

Problem:
DOS should be compatible forward previous version in the same chip

Solution:
add the probe done flag

Verify:
AC200

Change-Id: Id8696147646d6ecb1077acd0907650987823dea4
Signed-off-by: zhiqiang liang <zhiqiang.liang@amlogic.com>
2020-12-17 17:23:20 +09:00
zhiqiang liang
8ea51067ea power: add empty function for compile error [1/1]
PD#SWPL-17563

Problem:
add empty function for compile error

Solution:
add empty function for compile error

Verify:
T962E2

Change-Id: Iff8310ded23e2b3657df8434b1dbde7398e66142
Signed-off-by: zhiqiang liang <zhiqiang.liang@amlogic.com>
2020-12-17 17:23:20 +09:00
zhiqiang liang
7b1af7284f power: add the power domain control API [1/1]
PD#SWPL-17563

Problem:
add power domain control API for TM2 and SM1

Solution:
add power domain control API for TM2 and SM1

Verify:
T962E2

Change-Id: I2587b2b554281ee7c81d77e8978a2640e5f73be5
Signed-off-by: zhiqiang liang <zhiqiang.liang@amlogic.com>
Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
2020-12-17 17:23:20 +09:00
Cao Jian
9da7abdfbf ppmgr: add support for secure memory [2/3]
PD#SWPL-26044

Problem:
secure memory is not enabled

Solution:
add support for secure memory

Verify:
ac214

Change-Id: If93577beba551b4495cd4eaa72c46e8dee8f866f
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
2020-12-17 17:23:19 +09:00
Cao Jian
d65c39a278 ge2d: add secure mode switch [1/3]
PD#SWPL-26044

Problem:
GE2D needs to access secure buffer

Solution:
add secure mode switch

Verify:
ac214

Change-Id: I724c5b8c9af049ac9e8432bb9bae850c484fe8f4
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
2020-12-17 17:23:19 +09:00
Cao Jian
db2dba6960 ge2d: add custom matrix support [1/1]
PD#SWPL-25894

Problem:
GE2D Support color space convert

Solution:
add this support

Verify:
w400

Change-Id: I0d47c3bb7734fcc6246d7e01cf8b6902ff2a5c15
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
2020-12-17 17:23:19 +09:00
Cao Jian
8576733d66 ge2d: add the power domain control [1/1]
PD#SWPL-17634

Problem:
add power domain control

Solution:
add power domain control

Verify:
T962E2 AB319

Change-Id: I1c0f8eef091a57b924c0cb431eb82c290ff56d35
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
2020-12-17 17:23:19 +09:00
Evoke Zhang
6d24fb3757 lcd: support more init_level [2/2]
PD#SWPL-27213

Problem:
need different lcd init_level policy

Solution:
support more init_level

Verify:
x301

Change-Id: I28d39d50066494fc0aed640fe3c93986f6fd394e
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>
2020-12-17 17:23:19 +09:00
Qiang Li
69260ff6d1 mmc: add ddr parameter partition char device. [1/1]
PD#SWPL-21265

Problem:
kernel can erase ddr parameter partiion
data

Solution:
add ddr parameter partition char device

Verify:
sm1

Change-Id: I9c906f2e9bebee1f8489bed93ddbda94dccdb270
Signed-off-by: Qiang Li <qiang.li@amlogic.com>
Signed-off-by: chunlong.cao <chunlong.cao@amlogic.com>
2020-12-17 17:21:07 +09:00
Evoke Zhang
7d8b199666 lcd: add clk frac shift support [2/2]
PD#SWPL-17480

Problem:
sometime there need shift a little for frac

Solution:
add clk frac shift support

Verify:
x301

Change-Id: I937cca1b07f20d95144d1b85addc2cac775d1aac
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>
2020-12-17 17:21:06 +09:00
Cao Jian
fc96e0f08f ge2d: fix ge2d crash when running burn-in test [1/1]
PD#SWPL-28030

Problem:
there is risk when trying to destroy
the context being processed.

Solution:
add mutex to avoid the risk

Verify:
SM1

Change-Id: I6b85b4eb54f3b185613f37e5f83ef54663ddb01f
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
2020-12-17 17:21:06 +09:00
Zhengrong.Zhu
f4e33f3a31 hdmitx: Connect with Hisense HZ55A65 TV, It will lost resolution [1/1]
PD#SWPL-19410

Problem:
Connect with Hisense HZ55A65 TV, It will lost resolution

Solution:
Modify the code using read edid

Verify:
verify on the board of U212

Change-Id: Iaa2692508db6bcde07578e027e23bbf52399b25c
Signed-off-by: Zhengrong Zhu <zhengrong.zhu@amlogic.com>
2020-12-17 17:19:06 +09:00
robin.zhu
7b0e00814d dv: powergate and mempd not optimized for g12 and tm2 [1/1]
PD#SWPL-22126

Problem:
powergate and mempd not optimized for g12 and tm2

Solution:
fix mempd in vpu and optimize power for dv

Verify:
ab311 and ac213

Change-Id: I204c03acbbc532793d0891631ae9dd132175a5c9
Signed-off-by: robin.zhu <robin.zhu@amlogic.com>
2020-12-17 17:17:51 +09:00