PD#OTT-5666
[Problem]
In pppol2tp_connect, there is possible memory corruption due to a
use after free. This could lead to local escalation of privilege with
System execution privileges needed. User interaction is not needed for
exploitation.
[Solution]
l2tp: pass tunnel pointer to ->session_create()
Using l2tp_tunnel_find() in pppol2tp_session_create() and
l2tp_eth_create() is racy, because no reference is held on the
returned session. These functions are only used to implement the
->session_create callback which is run by l2tp_nl_cmd_session_create().
Therefore searching for the parent tunnel isn't necessary because
l2tp_nl_cmd_session_create() already has a pointer to it and holds a
reference.
This patch modifies ->session_create()'s prototype to directly pass the
the parent tunnel as parameter, thus avoiding searching for it in
pppol2tp_session_create() and l2tp_eth_create().
Since we have to touch the ->session_create() call in
l2tp_nl_cmd_session_create(), let's also remove the useless conditional:
we know that ->session_create isn't NULL at this point because it's
already been checked earlier in this same function.
Finally, one might be tempted to think that the removed
l2tp_tunnel_find() calls were harmless because they would return the
same tunnel as the one held by l2tp_nl_cmd_session_create() anyway.
But that tunnel might be removed and a new one created with same tunnel
Id before the l2tp_tunnel_find() call. In this case l2tp_tunnel_find()
would return the new tunnel which wouldn't be protected by the
reference held by l2tp_nl_cmd_session_create().
Change-Id: I50e19ae5abb4009205e59105222bf92e3587f9c4
Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com>
PD#OTT-5669
[Problem]
Linux kernel versions 4.9+ can be forced to make very expensive calls
to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming
packet which can lead to a denial of service.
[Solution]
Juha-Matti Tilli reported that malicious peers could inject tiny
packets in out_of_order_queue, forcing very expensive calls
to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for
every incoming packet.
With tcp_rmem[2] default of 6MB, the ooo queue could
contain ~7000 nodes.
This patch series makes sure we cut cpu cycles enough to
render the attack not critical.
We might in the future go further, like disconnecting
or black-holing proven malicious flows.
[Test]
Change-Id: I09c72cd11a38516f3b6e293deb21c5dd0faa3d9e
Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com>
PD#SWPL-13232
Problem:
amvideo drops excessive video frames than it should drop
Solution:
drop only after omx_run is true
Verify:
verified on Franklin
Change-Id: Iacb8f23c9635d00ce6265a0228c1e1e458902c6a
Signed-off-by: Rico Yang <wei.yang@amlogic.com>
PD#SWPL-13243
Problem:
pmu event is not accurate or not complete in A53/A55/A73.
Solution:
1, modify event config for A53/A55/A73.
2, perf executable file must compiled from latest kernel(5.1+)
3, A55 events are most complete, A73 are least complete(eg: less ld_retired/st_retired/stall/prefetch events)
4, A55/A53 same event meanings simlar, but A73 is more different(eg: L1/L2 dcache/icache loads meanings)
sample commands:
a55 arm64:
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,armv8_pmuv3/ld_retired/,armv8_pmuv3/st_retired/,cycles,branch-loads,branch-load-misses,armv8_pmuv3/a55_l1d_cache_rd/,armv8_pmuv3/a55_l1d_cache_refill_rd/,armv8_pmuv3/a55_l1d_cache_wr/,armv8_pmuv3/a55_l1d_cache_refill_wr/,L1-icache-loads,L1-icache-load-misses,armv8_pmuv3/a55_l2d_cache_rd/,armv8_pmuv3/a55_l2d_cache_refill_rd/,armv8_pmuv3/a55_l1d_cache_refill_inner/,armv8_pmuv3/a55_l1d_cache_refill_outer/,armv8_pmuv3/a55_l1d_cache_refill_prefetch/,armv8_pmuv3/a55_l2d_cache_refill_prefetch/,armv8_pmuv3/a5x_stall_frontend_cache/,armv8_pmuv3/a5x_stall_frontend_tlb/,armv8_pmuv3/a5x_stall_backend_ld/,armv8_pmuv3/a55_stall_backend_ld_cache/,armv8_pmuv3/a55_stall_backend_ld_tlb/,armv8_pmuv3/a5x_stall_backend_st/,armv8_pmuv3/a5x_stall_backend_ilock_agu/,armv8_pmuv3/a5x_stall_backend_ilock_fpu/ ls
a53 arm64:
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,armv8_pmuv3/ld_retired/,armv8_pmuv3/st_retired/,cycles,branch-loads,branch-load-misses,armv8_pmuv3/l1d_cache/,armv8_pmuv3/l1d_cache_refill/,L1-icache-loads,L1-icache-load-misses,armv8_pmuv3/a5x_l2d_cache/,armv8_pmuv3/a5x_l2d_cache_refill/,armv8_pmuv3/a53_cache_refill_prefetch/,armv8_pmuv3/a53_scu_snooped/,armv8_pmuv3/a5x_stall_frontend_cache/,armv8_pmuv3/a5x_stall_frontend_tlb/,armv8_pmuv3/a5x_stall_backend_ld/,,armv8_pmuv3/a5x_stall_backend_st/,armv8_pmuv3/a5x_stall_backend_ilock_agu/,armv8_pmuv3/a5x_stall_backend_ilock_fpu/ ls
a73 arm64: (w400 bind to a73 cpu2)
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,cycles,branch-loads,branch-load-misses,armv8_pmuv3/l1d_cache/,armv8_pmuv3/l1d_cache_refill/,armv8_pmuv3/a55_l1d_cache_rd/,armv8_pmuv3/a55_l1d_cache_wr/,armv8_pmuv3/a5x_l2d_cache/,armv8_pmuv3/a5x_l2d_cache_refill/,armv8_pmuv3/a55_l2d_cache_rd/,armv8_pmuv3/a55_l2d_cache_wr/ busybox taskset 4 ls
a55 arm:
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,armv7_cortex_a15/ld_retired/,armv7_cortex_a15/st_retired/,cycles,branch-loads,branch-load-misses,armv7_cortex_a15/a55_l1d_cache_rd/,armv7_cortex_a15/a55_l1d_cache_refill_rd/,armv7_cortex_a15/a55_l1d_cache_wr/,armv7_cortex_a15/a55_l1d_cache_refill_wr/,L1-icache-loads,L1-icache-load-misses,armv7_cortex_a15/a55_l2d_cache_rd/,armv7_cortex_a15/a55_l2d_cache_refill_rd/,armv7_cortex_a15/a55_l1d_cache_refill_inner/,armv7_cortex_a15/a55_l1d_cache_refill_outer/,armv7_cortex_a15/a55_l1d_cache_refill_prefetch/,armv7_cortex_a15/a55_l2d_cache_refill_prefetch/,armv7_cortex_a15/a5x_stall_frontend_cache/,armv7_cortex_a15/a5x_stall_frontend_tlb/,armv7_cortex_a15/a5x_stall_backend_ld/,armv7_cortex_a15/a55_stall_backend_ld_cache/,armv7_cortex_a15/a55_stall_backend_ld_tlb/,armv7_cortex_a15/a5x_stall_backend_st/,armv7_cortex_a15/a5x_stall_backend_ilock_agu/,armv7_cortex_a15/a5x_stall_backend_ilock_fpu/ ls
a53 arm:
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,armv7_cortex_a15/ld_retired/,armv7_cortex_a15/st_retired/,cycles,branch-loads,branch-load-misses,armv7_cortex_a15/l1d_cache/,armv7_cortex_a15/l1d_cache_refill/,L1-icache-loads,L1-icache-load-misses,armv7_cortex_a15/a5x_l2d_cache/,armv7_cortex_a15/a5x_l2d_cache_refill/,armv7_cortex_a15/a53_cache_refill_prefetch/,armv7_cortex_a15/a53_scu_snooped/,armv7_cortex_a15/a5x_stall_frontend_cache/,armv7_cortex_a15/a5x_stall_frontend_tlb/,armv7_cortex_a15/a5x_stall_backend_ld/,armv7_cortex_a15/a5x_stall_backend_st/,armv7_cortex_a15/a5x_stall_backend_ilock_agu/,armv7_cortex_a15/a5x_stall_backend_ilock_fpu/ ls
a73 arm: (w400 bind to a73 cpu2)
perf stat -e task-clock,context-switches,cpu-migrations,page-faults,instructions,cycles,branch-loads,branch-load-misses,armv7_cortex_a15/l1d_cache/,armv7_cortex_a15/l1d_cache_refill/,armv7_cortex_a15/a55_l1d_cache_rd/,armv7_cortex_a15/a55_l1d_cache_wr/,armv7_cortex_a15/a5x_l2d_cache/,armv7_cortex_a15/a5x_l2d_cache_refill/,armv7_cortex_a15/a55_l2d_cache_rd/,armv7_cortex_a15/a55_l2d_cache_wr/ busybox taskset 4 ls
Verify:
ac200/u200/w400
Change-Id: I7f11e1480c3c27d016b011d2a84c33e824f69b08
Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com>
PD#TV-10211
Problem:
log level less than 3, the function call flow changed, and
enc mode vlock max line, max pixel varible havn't be initialed.
Solution:
move initial max line/pixel varible in vlock initial function.
Verify:
tl1
Change-Id: Ib36662045e28a911bf1585bf57bc849b1952d6f9
Signed-off-by: Yong Qin <yong.qin@amlogic.com>
PD#SWPL-3826
Problem:
use gp1 pll for cpufreq.
Solution:
use gp1 pll for cpufreq.
Verify:
x301_tl1
Change-Id: Iefb6d31ec40ba304f41024e4b7adceec881d043e
Signed-off-by: Hong Guo <hong.guo@amlogic.com>
PD#SWPL-14156
Problem:
TOSHIBA Disk can't be recognized on the Port of USB 2.0 and since then
any disk can't be recognized.This is because
that the CCS flag of the PORTSC is still set and if write 0
to 0x38 of usb phy register the CCS will change to
0 and so that other disks can be recognized.
Solution:
when the enumeration fails, call set_usb_phy_host_tuning.
Verify:
test pass on u212
Change-Id: I507f269afc825de75c7dcce5f79c9c1dd7793d84
Signed-off-by: he.he <he.he@amlogic.com>
PD#SWPL-3826
Problem:
optimize the power consumption of tl1 with vad wakeup
Solution:
optimize the power consumption when enter freeze mode
switch the clk81 to 24M
cpu and dsu clk switch to gp1 pll，frequency is 600M
closed the fixed pll
closed the vddio_3.3V
Verify:
TL1 revB
Change-Id: I39170bb8efb91b126b6a15faad3cefee19b13089
Signed-off-by: zhiqiang liang <zhiqiang.liang@amlogic.com>
Signed-off-by: Jian Hu <jian.hu@amlogic.com>
Signed-off-by: Hong Guo <hong.guo@amlogic.com>
PD#SWPL-14024
Problem:
add protection mechanism for all plls
Solution:
add protection mechanism for all plls
Verify:
test passed on
1)axg
2)g12a
3)txl
4)txlx
Change-Id: I6f29026422f73c690854d5ffa292857d14922d22
Signed-off-by: Jian Hu <jian.hu@amlogic.com>
PD#SWPL-14115
Problem:
DV is bypass for SDR->SDR case on sm1, but
bypass failed due to dolby_vision_status is
not sync with uboot.
Solution:
Update dolby_vision_status after startup.
Verify:
passed on sm1
Change-Id: I8025b0982ce5bfb2afc5ece1b5f14be54f3a80d6
Signed-off-by: yao liu <yao.liu@amlogic.com>
PD#SH-1185
Problem:
AXG need to support secure upgrade check
Solution:
1.add defendkey support in AXG dts
2.add defendkey config in smarthome defconfig
Verify:
AXG skt board verify pass
Change-Id: I1d173d4e7ce8d47c486bf8df4f6b7e417809c424
Signed-off-by: Zhongfu Luo <zhongfu.luo@amlogic.com>
PD#SWPL-14033
Problem:
if clk invert bit set, 100M will not connect
Solution:
don't invert clk when connect 100M network
Verify:
w400
Change-Id: I4c3acbcc0d05fc2c99b5a982461ab3d5ff83fe26
Signed-off-by: qi duan <qi.duan@amlogic.com>
PD#SWPL-12602
Problem:
omni phy can not connect network probably
after long stress suspend test
for gxl/txl/txlx
Solution:
In suspend/resume sequeue, add eth reset
Verify:
verify on p212/r311
Change-Id: I4b6ab34eb2eae40533f4a33db8fb40a00f5b3d51
Signed-off-by: qi duan <qi.duan@amlogic.com>
PD#SWPL-12746
Problem:
VAD does not use HIFI PLL, it will effect vad wakup
Solution:
VAD use HIFI PLL
Verify:
T962X2_X301
Change-Id: Iad13661c4ec3495130f485447f3c8b034bee9ce2
Signed-off-by: jian.zhou <jian.zhou@amlogic.com>
PD#SWPL-13914
Problem:
G12A TDMA affects the tuning, make tuning process
+/- dly is useless.
Solution:
add pdata save val operation.
Verify:
G12A_u212
Change-Id: I204dd989fae0d400b14725df068378be0262b1cc
Signed-off-by: Nan Li <nan.li@amlogic.com>
PD#SWPL-14102
Problem:
need to detect out of range signal
correctly
Solution:
refine the checking
Verify:
tl1
Change-Id: Ia2e47ca3a427e4f66a5464997aeb8dd766b4f7ff
Signed-off-by: Xihai Zhu <xihai.zhu@amlogic.com>
PD#SWPL-14041
Problem:
sometimes after hpcp_hpd 0->1, ESM doesn't
respond to AKE_INIT, it will lead to flash
red screen on TCL DCLS-HG50
Solution:
add control for hpcp_hpd, keep it high by default
Verify:
X301
Change-Id: I8f8e5c880400084d6ed252667460c4e397b9909d
Signed-off-by: Hang Cheng <hang.cheng@amlogic.com>
PD#SWPL-12796
Problem:
tm2 is run hs200 200M now
Solution:
modify dts
Verify:
passed on tm2_t962e2_ab311
Change-Id: If834e822aefe3c9b469ff69ce58672a94caaabb4
Signed-off-by: Ruixuan Li <ruixuan.li@amlogic.com>
PD#SWPL-13103
Problem:
S905Y2 can not use adb.
Solution:
config dts, and switch the state in uboot.
setenv otg_device 0 or 1.
Verify:
verify by faraday.
Change-Id: If4cda761e346fb63d6918db74bc03f23cdcb3a1b
Signed-off-by: Luan Yuan <luan.yuan@amlogic.com>
PD#SWPL-11936
Problem:
set screen position frequently
frame flashes white stripes
Solution:
modify threshold for updating all registers
on vsync coming
Verify:
Verfied on u212
Change-Id: Iac1ec8b5ec36809d5f5ffe2fe8e79c182e9c126b
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
PD#SWPL-13948
Problem:
customer want to set hdr tone mapping curve themself,
we provide hdr interface for them
Solution:
add hdr iocontrol interface
Verify:
verify on TL1
Change-Id: I9b7d5b33e0a72c6d1ca1fca2ebffe2a3c7e460aa
Signed-off-by: MingLiang Dong <mingliang.dong@amlogic.com>
PD#SWPL-13523
Problem:
gxm can't enter suspend
Solution:
modify the system sleep parameter
Verify:
gxm_q201
Change-Id: I697f03170a56925aa0fdb2160340cc0d480623a8
Signed-off-by: Hong Guo <hong.guo@amlogic.com>
PD#SWPL-13880
Problem:
free_irq was called twice continuously while ponter is NULL at 2nd time.
Solution:
use mutex to prevent reentry
Verify:
verified by t962x2_x301
Change-Id: I8032d15de0a2fe5a1ab30b70af0e342d0aa3ac40
Signed-off-by: zhiwei.yuan <zhiwei.yuan@amlogic.com>
PD#SWPL-13378
Problem:
BUG: KASAN: use-after-free in di_task_handle+0x1dc/0x790
Solution:
add judgement before use
Verify:
u212
Change-Id: I6281257997239fa9adbe215ca31ef7d760c9302c
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
PD#SWPL-11934
Problem:
pcie pll lock failed some times
Solution:
1.add retry mechanism when pcie lock failed
2.add protection mechanism for all plls
Verify:
test passed on tm2 ab311
Change-Id: Id34e87d84e2bc2368c074556f500f8af1f2a4088
Signed-off-by: Jian Hu <jian.hu@amlogic.com>
PD#SWPL-13664
Problem:
when open some special UI app, DI will have a lot of timeout,
this cause display abnormal.
Solution:
add retry after timeout;
Verify:
tl1
Change-Id: I3316252577bad218256651ebbc6d4fd8b25acb12
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
PD#SWPL-13075
Problem:
some pattern need special handling
Solution:
per VLSI'e suggestion, add pattern
detection to try to detect special pattern
Verify:
tl1
Change-Id: I545b6e8c1b4a11fca927be46f16caeeb2cbe5327
Signed-off-by: Xihai Zhu <xihai.zhu@amlogic.com>
PD#OTT-5603
Problem:
Configurate GPIO_AO 9 as mclk_0,it doesn't work.
Solution:
From SM1, the mclk pad register is changed.
Using standard clk tree to make it compitable.
Verify:
TM2, SM1.
Change-Id: I8d53296297536c90768495232570f33fc89db131
Signed-off-by: Shuai Li <shuai.li@amlogic.com>
PD#TV-8586
Problem:
av pali need update 0x18b setting
Solution:
update 0x18b setting for av pali for tl1
Verify:
x301
Change-Id: I64bddac5c4196110b46ebfbd7a89ee97095a7f82
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>
PD#SWPL-12002
Problem:
pause and plug out/in hdmi tx, display abnormal
Solution:
add condition for switch to EI in de_post_process
ref to IPTV's project
Verify:
G12A
Change-Id: I6230464c308660c62199aa24ad5843e7c7bd070d
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
PD#SWPL-13676
Problem:
vdin status is confused when enter hdmi
Solution:
reset afifo every time enter the channel
Verify:
verified by t962x2_x301
Change-Id: I9ec78bebec4d2d5e312de82942c29a940fc322ea
Signed-off-by: zhiwei.yuan <zhiwei.yuan@amlogic.com>
PD#SWPL-13367
Problem:
HDMI hotplugged during video pause,
system control first set disable_video 1,
then DV core turn on due to sink changed,
then OMX sets disable video 2. DV core 1
is disabled after video_onoff_state is set to OFF.
Solution:
Monitor video status, parser and toggle once
to enable core1 when video off->on.
Verify:
SM1
Change-Id: Ied6f1f05ed1592f9917c093b5d567904a3bdc61c
Signed-off-by: yao liu <yao.liu@amlogic.com>
PD#SWPL-13667
Problem:
some devices may forcely send signal above 3.4G
even if TV announce hdmi1.4 edid, such as apple
TV box, Samsung UBD-K8500 dvd; and for QD6508 box
of TCL, it will not send signal out if scdc NAK
Solution:
add a scdc force enable option to cover this
issue. by default, scdc is enabled or not
accroding to current edid version
Verify:
X301
Change-Id: Ibdacbd3bb1edbdcb99637252530d19510fbcfb1d
Signed-off-by: Hang Cheng <hang.cheng@amlogic.com>
PD#SWPL-13779
Problem:
esm can not work after burning a new key and regenerating new
fw.le as the esm clock was not configured when probe.
Solution:
so we need to configure ESM clock no matter hdcp2.2
is burned or not.
Verify:
None
Change-Id: I793b63ad2f20434b9f8f27ccca7c80dee2990718
Signed-off-by: yicheng shen <yicheng.shen@amlogic.com>
PD#SWPL-13491
Problem:
After plugging and unplugging HDMITX,
the panel screen color display is abnormal
for dual display platform.
Solution:
add vinfo->mode check for csc process,
avoid process null and invalid vinfo case.
Verify:
verify by AC202(sm1)
Change-Id: I54c54adcf2a0fc9a02e35b0ef24a720a55a8781a
Signed-off-by: Dezhi Kong <dezhi.kong@amlogic.com>
PD#SWPL-2049
Problem:
osd3 din blend config may be incorrect when viu2 is enable
Solution:
add osd blend reg config check
Verify:
verify by AC202(sm1)
Change-Id: I3d8ff0d247226d4df1386808caba2a21a34f0b10
Signed-off-by: Dezhi Kong <dezhi.kong@amlogic.com>
PD#SWPL-13498
Problem:
The printing may delay the usb_disconnect processing, result to
USB transfer error during reconnecting.
Solution:
Moving the print in proc_setconfig of devio.c .
Verify:
test pass on sm1
Change-Id: I5c45abb2d5d640e2e02dc3e0c08b10ca7a294eeb
Signed-off-by: he.he <he.he@amlogic.com>
PD#TV-8363
Problem:
Loopback doesn't work on TM2.
TL1 doesn't support loopback in OE pins.
Solution:
Make it compitable with chips.
Add tdm_lb format and chmasks.
Verify:
TM2 AB311 and TL1 X301.
Change-Id: If878fe75fc87857eae7a44439a451c5b2f494c67
Signed-off-by: Shuai Li <shuai.li@amlogic.com>
PD#SWPL-13669
Problem:
Ge2d irq number is wrong on g12a/g12b/sm1.
Solution:
Replace the correct number
Verify:
Verified on u212
Change-Id: Ia3d202dc10cb978033892efb1de251bf5cf1df31
Signed-off-by: Brian Zhu <brian.zhu@amlogic.com>
