Age | Commit message (Collapse) | Author |
|
Address kernel-doc warnings in pixel gpu components
Bug: 302343291
Test: Local build
Change-Id: Ia5a654f5acd1c6ee5245472792553d0d2e2d9e49
Signed-off-by: Vamsidhar reddy Gaddam <gvamsi@google.com>
|
|
Bug: 300854197
SBMerger: 571992243
Change-Id: Idcd27a05bcccb9738bb0e4d8216b062c9d834062
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
|
|
Bug: 277090000
Test: Trigger sscd
Change-Id: I6ca23cc74806efc364b10ee17e654f4252d3ec1f
Signed-off-by: Yunju Lee <yunjulee@google.com>
|
|
Bug: 300854197
SBMerger: 571992243
Change-Id: Ie9096d3afd31c2e5959618fb2f1354bca8be3cfd
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
|
|
If a slot number parsed from trace data exceeds the number of supported
CSG slots, the trace data must be discarded. Otherwise the access to
the invalid memory address could happen.
Bug: 304341806
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/6057
Signed-off-by: Jörg Wagner <jorwag@google.com>
Change-Id: I8e702e7487f2bea3618f2fe8ad696a1b546f10f2
|
|
Bug: 300854197
SBMerger: 558810260
Change-Id: I1fd011faa1af3472ac4ef0b70560f44da49cdf2d
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
|
|
Fix potential out-of-bounds read due to missing bounds check.
Bug: 298264460
Signed-off-by: Guus Sliepen <gsliepen@google.com>
Change-Id: I57b67a4177e4fe6d84a261eeb00b6b833da5486b
Merged-In: I57b67a4177e4fe6d84a261eeb00b6b833da5486b
|
|
Bug: 299948695
Change-Id: I28bde3744a365fb5a8b7794c26b5adf507041eec
|
|
Bug: 299991153
Change-Id: I63342d7ca91f4150d7e5e376d8e91f0accf22dd4
|
|
Bug: 300854197
SBMerger: 558810260
Change-Id: I2533a7f40800e1b5c32633543af66d1a58d66a43
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
|
|
Storing the waitqueue in struct kbase_context leaves epoll holding a
stale pointer to it, which it later attempts to deref and crashes the
kernel in:
[*][T15976] remove_wait_queue+0x64/0x190
[40350.510681][T15976] ep_unregister_pollwait+0x98/0xe8
Move this waitqueue to struct kbase_file to ensure that
it lives long enough during process termination that the
ep_unregister_pollwait access is valid (b/302281297).
Bug: 300750575
Test: SST: b/302324090#comment4, repro: b/300750575#comment26
Change-Id: Ib161a7d7d4314bb6951bddbd87183a7dc71d5ac0
Signed-off-by: Varad Gautam <varadgautam@google.com>
|
|
Move macros, struct, and functions required by sscd from source file to
header file. Add firmware core dump segment to sscd. Implement firmware
core dump in sscd.
Bug: 277090000
Test: Trigger sscd manually
Change-Id: I3546e74e647e60f13f18c5e9ef6a4a24413f02fb
|
|
Bug: 296839414
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/5965
Change-Id: I1c8a13de1e0abfff4e3cd7ec069fb139524c59db
|
|
android13-gs-pixel-5.10-24Q1" into android13-gs-pixel-5.10-24Q1
|
|
Bug: 300854197
SBMerger: 558810260
Change-Id: Ia28e47cbbe05c916007afaa7d0528972ae735e8c
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
|
|
Fix potential integer overflow within buffer liveness ioctl.
Bug: 296984851
Test: N/A
Change-Id: Ib1c9ee25a89b0a39ec905f109ee2c57c502428db
(cherry picked from https://partner-android-review.googlesource.com/q/commit:02e5329e2e3f4af00f51560895b5bbe87fe824ef)
Signed-off-by: Jack Diver <diverj@google.com>
|
|
Record the freq recommended by the governor before it's clamped
via a new `gpu_gov_rec` clock tracepoint.
Also record a new tracepoint `gpu_gov_rec_violate` if this freq
is outside of the level lock window.
Bug: 291855615
Test: Manual trace
Signed-off-by: Varad Gautam <varadgautam@google.com>
Change-Id: I45d0ffbebb6fa83d1a47b9d2afc8d96ce420afce
|
|
Bug: 291855615
Test: Record manual trace.
Signed-off-by: Varad Gautam <varadgautam@google.com>
Change-Id: Id4341c3809b2e3b147122adaabaa01ac7b265dfc
|
|
Bug: 290882327
Change-Id: Ifb843070d65bdf4148b29c6d1a92bdf3a6f3aa89
Signed-off-by: Siddharth Kapoor <ksiddharth@google.com>
|
|
This line was re-added accidentally as part of the
merge of r44p1-00dev3 in b6fd708b3a.
Removed this line to restore exposure of the ftrace events.
Bug: 290882327
Change-Id: Ibf3215bab6d4699d905027cce3412b49e205f9fb
Signed-off-by: Debarshi Dutta <debarshid@google.com>
|
|
Split functionality to allow creation of arbitrary
thread tasks and kthread_worker_fn workers, while sharing
the promotion to RT scheduling policies for both.
Finally use this functionality to elevate "mali-gpuq-kthread"
to RT priority.
Bug: 290882327
Change-Id: Icf2c07849cdd0ca47bcfc06700853ac1856d0a87
|
|
android13-gs-pixel-5.10-udc-qpr1" into android13-gs-pixel-5.10-udc-qpr1
|
|
Conflict files:
mali_kbase/context/mali_kbase_context.c
mali_kbase/csf/mali_kbase_csf_defs.h
Bug: 292447561
SBMerger: 558810260
Change-Id: I3460f177e640d109891b9950359dabda85f607a6
|
|
Conflict files:
mali_kbase/context/mali_kbase_context.c
Bug: 292447561
SBMerger: 558810260
Change-Id: Ie51c66a74401c1d5660cd0845d5442d33e01ca39
|
|
Bug: 290882327
Change-Id: I90723cbaa3f294431087587fd8025f0688e51bf2
|
|
Provenance: ipdelivery@5c8fdf6c071d63537e87949cfb4845079a669a0b
Change-Id: Icc06581f804bf59be5fe923349318e703f02d5a3
|
|
protm_event_worker is responsible for triggering protected mode entry,
but it currently runs in a default priority workqueue, which results
in occasional long stalls for protected mode work.
The workload of this task is very light, typically only running
for a few tens of microseconds each invocation, so converting
it to a kthread should have no significant impact on overall
system performance.
Bug: 297019294
Test: Manual Netflix PiP perfetto trace inspection
Change-Id: Ica9e744bd390ae6b88a701bf2d390f82937581d0
|
|
This commit protects all JIT operations with the KCPU queues
context jit_lock.
TI2: 893173
Type: Fix
Change-Id: If500064c18827e0071651274ccba541a68168ac2
Merged-In: I84fb19e7ce5f28e735d44a4993d51bd985aac80b
(cherry picked from commit 1b3511e3f68a01459d7c8c09711a8aabd374853c)
(cherry picked from commit bbabc5947dcd1fa21d3a0d8cb996238153bd57d1)
Bug: 298157271
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/5448
|
|
memory accounting
Kbase accounts the GPU memory allocated for a context under the memory
footprint of a process, so that kernel's low memory killer or OoM killer
can kill the suitable process to free up decent amount of system memory.
For accounting, Kbase updates the 'MM_FILEPAGES' counter inside the
'mm_struct' corresponding to the process that created the Kbase context.
To ensure 'mm_struct' can always be safely accessed, a tracking page was
used which Kbase mandated to be mapped right after the opening of
'/dev/mali0' file. When the mapping was closed Kbase updated the kernel
counter to subtract all the GPU memory allocated so far for a context
but the actual freeing of GPU memory was done later. This was usually
not a problem as the mapping is closed by DDK Userspace just before the
context termination. But the Userspace is allowed to close it at will.
Malicious Userspace could have exploited this Kbase quirk by closing
the mapping which would have mislead the OoM killer in killing the
innocent processes before it gets around to the culprit process.
This commit removes the use of tracking page and uses mmgrab() to take
a reference on 'mm_struct' for User created Kbase context.
The reference doesn't prevent the freeing of address space on process
exit, it merely keeps the 'mm_struct' alive. The reference is dropped
on context termination.
For backward compatibility, the call from Base to create the mapping for
tracking page isn't rejected by Kbase. The Base code has been updated to
skip the mapping of tracking page only for newer Kbase so as to maintain
forward compatibility with the older Kbase. BASE_UK_VERSION_MINOR has
been incremented as the requirement to create a mapping for tracking
page is relaxed by Kbase.
Change-Id: I37407809d7187cb5c8fac63e6c10f72cc3bd762d
Bug: 275853921
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/5165
(cherry picked from commit b29f4a639e0863c09e72d7e34c0a6ad57f9572a6)
|
|
android13-gs-pixel-5.10-udc-qpr1" into android13-gs-pixel-5.10-udc-qpr1
|
|
This reverts commit e8fa58acd3f48031ac6297e64ae996d430fa31d4.
b/290409680 shows RESET_COMPLETED irq being missed in the absence of this
patch. The original patch (pa/I2dcec3ef431) was found to not cause the
stability problems for which it was reverted (pa/I6ee1b26063a).
Reintroduce it.
Test: Boot to home.
ARM Upstreaming: Pending in https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4835
Bug: 290409680
Change-Id: Iada51bb1d9c88dd0d3b0fdab5961c85699221b47
Signed-off-by: Varad Gautam <varadgautam@google.com>
|
|
Bug: 292447561
SBMerger: 558810260
Change-Id: Ic618ad7008dfa915ff71de71bc205d9e219b7c34
Signed-off-by: Pindar Yang <pindaryang@google.com>
|
|
mapping
As a result of this change now the whole of each of the pages
underlying a memory region imported as a USER_BUFFER region
are synchronized and the driver disables automatic CPU cache
synchronization upon DMA map/unmap operations.
(cherry picked from commit 0c2790fb2b006edb3e648a8a9a732e3aadcf2436)
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/5829
Bug: 295897369
Change-Id: Ifbd656b78e49ae614ca87e156321d0ccd6dd8887
|
|
We use pm_runtime for handling suspends, which means that an
internal linux power workqueue will take and hold the CSF
scheduler lock while performing suspend operations.
This workqueue runs at default priority and so might not be
scheduled fast enough if there is high CPU load, which results
in missed frames.
By promoting the CSF scheduler lock to an rt_mutex we ensure
that the GPU wakes up faster when there is work that needs to
be done, since our other internal realtime threads will be
waiting on the scheduler lock in these cases.
Bug: 296862283
Test: CUJ close camera
Change-Id: Ibe81ad7e26a75acb1640b2820902eb8144a48fdd
Merged-In: I0e81a45e3d65f60337250d35c53ef6447c876051
|
|
The change ca522e4491584d5a2a5f122ee90e3edb3581182b was added
by the automerger. It changed the sequence of the mutex_unlock
Restore it according to bce5281a0408a175137c08dc93028e2a2c0fb69b
[upstream R43P0 merge]
Bug 294759508
Change-Id: Ie9ed80e48237111e190a070f0615fad47cfb8f3a
Signed-off-by: Debarshi Dutta <debarshid@google.com>
|
|
Implicit SLC caching results in a high volume of PTE updates.
Tracking the number of updates shows up when profiling.
Disable these nodes and the associated tracking by default.
Bug: 294167925
Test: gfxbench sweep, genshin
(cherry picked from https://partner-android-review.googlesource.com/q/commit:82d0547845919e91b27196dccc0202fe7e7e40de)
Merged-In: I551b8f58f633ba6cfb74b0651bbbe30a6909eeb2
Change-Id: I551b8f58f633ba6cfb74b0651bbbe30a6909eeb2
Signed-off-by: Jack Diver <diverj@google.com>
|
|
Test: Boot to home, gfx-bench sweep
Bug: 294167925
(cherry picked from https://partner-android-review.googlesource.com/q/commit:3143995156d9372ca6af0be57aa29dd0ec14cce1)
Merged-In: I4a122fe023b43c3763884fda99cfed17048a3eb0
Change-Id: I4a122fe023b43c3763884fda99cfed17048a3eb0
Signed-off-by: Jack Diver <diverj@google.com>
|
|
Refactor kbase_mmu_update_pages, extracting flush/invalidate into new
function.
Expose no-flush variant.
Test: Build, boot
Bug: 294167925
Signed-off-by: Jack Diver <diverj@google.com>
(cherry picked from https://partner-android-review.googlesource.com/q/commit:b36ce28e0779c27e57dad90d98c5e202eb654013)
Merged-In: I4d1fce75d6ccf352ee54935138d6c92cdc609049
Change-Id: I4d1fce75d6ccf352ee54935138d6c92cdc609049
|
|
transition timeout
This patch continues FLUSH_MEM operation at function caller and increases the timeout value for the core power transition.
Change-Id: I8cf5417976ab31b8d1e9e33e6359a91455d37144
(cherry picked from commit 71f7017252aabbb0013a2f151d894959b7c7c226)
Bug: 295942377
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/5812
|
|
Pages in the SLC group were often 'migrated' there from the reserved
group. This leads to unbalanced accounting as at alloc time the reserved
group counter is incremented, but at free time the SLC group counter is
decremented.
Add custom logic to detect this, but plan to remove it soon when memory
groups are decoupled from SLC partitions (b/290354607).
Bug: 289501175
Signed-off-by: Jack Diver <diverj@google.com>
(cherry picked from https://partner-android-review.googlesource.com/q/commit:7bb27d3d29f850315d0b7ee103fbdfe75e9403da)
Merged-In: Ia878a05c4d8dd7db7969f7089c6b93bf90c17f8e
Change-Id: Ia878a05c4d8dd7db7969f7089c6b93bf90c17f8e
|
|
Remove window where mismanagement of counters could be missed.
Bug: 289501175
Signed-off-by: Jack Diver <diverj@google.com>
(cherry picked from https://partner-android-review.googlesource.com/q/commit:b6b86cbf708df94173f9a5152229a39c043e8909)
Merged-In: I6d17726667c2d1fda4cd928e10d5143405ecd38f
Change-Id: I6d17726667c2d1fda4cd928e10d5143405ecd38f
|
|
Bug: 289501175
Signed-off-by: Jack Diver <diverj@google.com>
(cherry picked from https://partner-android-review.googlesource.com/q/commit:252edb03c91ebb738377caf5fe0c4cef52c36fb1)
Merged-In: Ib66717ef8acc13ede87b4e324fdc3489c119865f
Change-Id: Ib66717ef8acc13ede87b4e324fdc3489c119865f
|
|
android13-gs-pixel-5.10-udc-qpr1" into android13-gs-pixel-5.10-udc-qpr1
|
|
Invoke kbase_csf_tiler_heap_context_term() after an unsuccessful call
to kbasep_ctx_user_reg_page_mapping_init().
Bug 294759508
Change-Id: I6ef97a6e69042ab9e2351939d23e09cf4ec83216
Signed-off-by: Debarshi Dutta <debarshid@google.com>
|
|
Conflict files:
mali_kbase/context/mali_kbase_context.c
mali_kbase/mali_kbase_mem.h
SBMerger: 526756187
Change-Id: I6e2a522d8735896f970cac1157943fa2670664c7
|
|
android13-gs-pixel-5.10-udc-qpr1
|
|
memory accounting
Kbase accounts the GPU memory allocated for a context under the memory
footprint of a process, so that kernel's low memory killer or OoM killer
can kill the suitable process to free up decent amount of system memory.
For accounting, Kbase updates the 'MM_FILEPAGES' counter inside the
'mm_struct' corresponding to the process that created the Kbase context.
To ensure 'mm_struct' can always be safely accessed, a tracking page was
used which Kbase mandated to be mapped right after the opening of
'/dev/mali0' file. When the mapping was closed Kbase updated the kernel
counter to subtract all the GPU memory allocated so far for a context
but the actual freeing of GPU memory was done later. This was usually
not a problem as the mapping is closed by DDK Userspace just before the
context termination. But the Userspace is allowed to close it at will.
Malicious Userspace could have exploited this Kbase quirk by closing
the mapping which would have mislead the OoM killer in killing the
innocent processes before it gets around to the culprit process.
This commit removes the use of tracking page and uses mmgrab() to take
a reference on 'mm_struct' for User created Kbase context.
The reference doesn't prevent the freeing of address space on process
exit, it merely keeps the 'mm_struct' alive. The reference is dropped
on context termination.
For backward compatibility, the call from Base to create the mapping for
tracking page isn't rejected by Kbase. The Base code has been updated to
skip the mapping of tracking page only for newer Kbase so as to maintain
forward compatibility with the older Kbase. BASE_UK_VERSION_MINOR has
been incremented as the requirement to create a mapping for tracking
page is relaxed by Kbase.
Change-Id: I37407809d7187cb5c8fac63e6c10f72cc3bd762d
Bug: 275853921
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/5165
(cherry picked from commit b29f4a639e0863c09e72d7e34c0a6ad57f9572a6)
|
|
An accidental change back to a lower hysteresis time as
a part of the R43P0 merge commit resulted in GPU
powering on and off more frequently and regressing previously
established perf. Restore the same to a value that was previously
determined and set in our downstream driver.
Bug 292157710
Bug 278174418
Change-Id: Id44337bc1fd672722a5edaf27aaca16f320b7ad0
Signed-off-by: Debarshi Dutta <debarshid@google.com>
|
|
Restore the history relationship between our side and Arm's
(goog/upstream) which was left decoupled by 20fff721667a22.
Bug: 294759508
Change-Id: I21dc645bb7376c7e659ad879d8ad2f5d683eb944
|
|
Provenance: ipdelivery@d10c137c7691a470b8b33786aec4965315db4561
Change-Id: I4fbcc669d3b8e36c8288c91fdddd8b79258b6635
|