summaryrefslogtreecommitdiff
path: root/mali_kbase
AgeCommit message (Collapse)Author
2023-03-07GPUSWERRATA-1564 and GPUSWERRATA-1527android-13.0.0_r0.77android-13.0.0_r0.75android-13.0.0_r0.74android-13.0.0_r0.73android-gs-raviole-5.10-android13-qpr2android-gs-pantah-5.10-android13-qpr2android-gs-lynx-5.10-android13-qpr2-bandroid-gs-bluejay-5.10-android13-qpr2Rivaldo Hong
GPUSWERRATA-1564: Freed imported user memory can be accessed via vmap GPUSWERRATA-1527: Userspace can trigger a data abort by using protected memory for kmap/kbase_vmap(), which can lead to DoS Change-Id: I326d1a25cbbfb2574c48a6328ba5b0549bc14100 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4939 Bug: 270579983 Signed-off-by: Guus Sliepen <gsliepen@google.com>
2023-03-07GPUSWERRATA-1562, Fix UAF issue on KCPU QueueSheng Xu
Change-Id: I50c80f9d18055049af485a8a816af812ebcb4de8 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4940 Bug: 270580412 Signed-off-by: Guus Sliepen <gsliepen@google.com>
2023-01-20MIDCET-4348 Force cache flush for protected katomandroid-t-qpr2-beta-3.2_r0.5android-13.0.0_r0.91android-13.0.0_r0.70android-13.0.0_r0.69android-13.0.0_r0.68android-13.0.0_r0.64android-gs-tangorpro-5.10-android13-d2android-gs-bluejay-5.10-t-qpr2-beta-3Suzanne Candanedo
Bug: 263689926 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4859 Change-Id: I801d9add01ad36764bf4c0a38d858f7228802611 Signed-off-by: Siddharth Kapoor <ksiddharth@google.com>
2023-01-13MIDCET-4324/GPUCORE-35180 Clear GPU caches before terminating region trackerandroid-t-qpr2-beta-3_r0.5android-t-qpr2-beta-3_r0.4android-t-qpr2-beta-3_r0.3android-t-qpr2-beta-3.2_r0.6android-gs-raviole-5.10-android13-qpr2-betaandroid-gs-pantah-5.10-t-qpr2-beta-3.2android-gs-pantah-5.10-android13-qpr2-betaandroid-gs-bluejay-5.10-android13-qpr2-betaSuzanne Candanedo
Move the code to disable the MMU for a kctx (which also will flush the GPU caches for that kctx's Address Space) from the end of kctx termination to JM/CSF kctx-scheduler termination time. This ensures the GPU cached writes for that kctx are clear before we free the kctx's GPU memory pages in the region tracker, and before the MMU tables are freed. This in turn ensures the GPU cached writes do not land in freed memory (which would be a security issue). Change-Id: I2730a5762cb106ca2179cf9a2f789b8764f21901 (cherry picked from commit 09e14ccf27007dcb2cc0d4d64f5087ccc620a0b5) Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4810 Bug: 260123838
2023-01-10MIDCET-4324/GPUCORE-35490: Prevent incorrect clearing of no user free propertySuzanne Candanedo
Our code didn't check if KBASE_REG_NO_USER_FREE was already set in two code paths (in mali_kbase_csf_tiler_heap.c and mali_kbase_csf.c). This could be used to maliciously clear that KBASE_REG_NO_USER_FREE flag. We add a new refcount for this no user free property, replacing the KBASE_REG_NO_USER_FREE flag, as a stopgap solution. In addition to this: - fix a possible race condition in JIT alloc and tiler heap init where another thread could take a no user free reference while the DONT_NEED flag not yet being set - fix another issue in JIT alloc where reg->flags was updated without taking the appropriate lock - move the no user free decref to remove_queue to clean up context termination code - refactor memory helpers Also includes: - GPUCORE-35469: Fix list del corruption issue in shrinker callback - GPUCORE-35221 Defer the freeing of VA regions in the chunked tiler heap shrinker callback - GPUCORE-35499: Fix GROUP_SUSPEND kcpu suspend handling to prevent UAF - GPUCORE-35268: Fix UAF due to use of MEM_FLAGS_CHANGE ioctl for JIT allocs (cherry picked from commit 7a1dc910a6a8c9c5aa06677c936c8ad6e9c369ab) Bug: 260123539 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4801 Change-Id: I7e2349b135e61054f567bdf0577d27eb224d2b12
2022-12-20mali_kbase: workaround: pause before init L2 on.Kevin DuBois
Some devices seem to get stuck when trying to turn L2 on in rare case. As workaround, place a pause of 200us before writing L2_PWRON. Test: build, boot Test: stability test Bug: 262266339 Change-Id: I6acfbb5fbe4497e4adacab01ceb6bfd90e646874
2022-12-14GPUCORE-32316: Wait for AS_ACTIVE_INT to become 0 before L2 poweroffSuzanne Candanedo
Change-Id: I86ecbdba8cdd3b18c0da137cc4194e7cb034101d Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4761 Bug: 243522189 Bug: 241217496 Test: Tested GPU reset as b/241217496#comment8
2022-12-11Merge android13-gs-pixel-5.10-gs101-tm-qpr1 into android13-gs-pixel-5.10-tm-qpr2PixelBot AutoMerger
SBMerger: 478053055 Change-Id: Ia69ab924d682318f9b47efaf2389fd2caf2919d0 Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
2022-12-06GPUCORE-35499: Fix GROUP_SUSPEND kcpu suspend handling to prevent UAFandroid-13.0.0_r0.59android-13.0.0_r0.58android-gs-raviole-5.10-android13-qpr1android-gs-bluejay-5.10-android13-qpr1Nongji Chen
This commit fixes a buffer vulnerability that is provided for internal test/dump use in kcpu queue to get a CSG's suspend buffer content. The change ensures that the user supplied GPU VA mapped dump receiving buffer must meet some additional expected attributes so as to avoid the risk the dump buffer is abused from the user side, yielding potential vulnerability of use after free in kbase GPU mapped buffers from the said kcpu dump arrangement for CSG suspend buffer content. TI2: 906872 (PLAN-39472r8 R38P1 DDK Precommit) TI2: 906873 (PLAN-39568r4 R38 GPU Core CS CSF, targeted R38 test, red an unrelated issue, intermittent) TI2: 907201 (PLAN-39568r4 R38 GPU Core CS CSF, rerun the targeted red) TI2: 906018 (PLAN-2596r269 GPU Core CS CSF, 1 unrelated red) TI2: 906307 (PLAN-2596r269 GPU Core CS CSF, rerun the red) TI2: 906019 (PLAN-28130r51 GPUCORE CS Android-12-CSF-Minimal, the red is a trunk issue, multiple nightly reds in history) (cherry picked from commit 3646ab9f80d1e57b6cdff4e0651f3f07f7065954) Bug: 254445909 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4746 Change-Id: I25275830b56941f597e6ebb7e38bf8764a5a2555
2022-11-30GPUCORE-36665 Fix OOB issue on KBASE_IOCTL_CS_TILER_HEAP_INITKevin Park
'group_id' member of the ioctl (KBASE_IOCTL_CS_TILER_HEAP_INIT) struct must be validated before initializing CSF tiler heap. Otherwise out-of-boundary of memory group pools array for the CSF tiler heap could happen and will potentially lead to kernel panic. TI2: 933204 (DDK Precommit) TI2: 933199 (BASE_CSF_TEST) Bug: 259061568 Test: verified fix using poc Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4766 Change-Id: I209a3d5152a34c278c17383e4aa9080aa9735822 (cherry picked from commit 55b44117111bf6a7e324301cbbf4f89669fa04c3)
2022-11-30Merge "Merge android13-gs-pixel-5.10-tm-qpr1 into ↵Joey Lin
android13-gs-pixel-5.10-tm-qpr2" into android13-gs-pixel-5.10-tm-qpr2
2022-11-27Merge android13-gs-pixel-5.10-tm-qpr1 into android13-gs-pixel-5.10-tm-qpr2PixelBot AutoMerger
SBMerger: 478053055 Change-Id: Ic2a88fea0db3fefbbfd167bc6cfad56e050a8b24 Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
2022-11-23GPUCORE-36251: Make HeapContext GPU VA to be GPU cacheline alignedandroid-t-qpr2-beta-1_r0.6android-gs-pantah-5.10-t-qpr2-beta-1Akash Goel
Customer reported an issue where an unexpected GPU page fault happened due to Tiler trying to access the chunk that was already freed by the Userspace. The issue was root caused to cacheline sharing between the HeapContexts of 2 Tiler heaps of the same Kbase context. The page fault occurred for an Application that made use of more than 1 GPU queue group where one of the group, and its corresponding Tiler heap instance, is created and destroyed multiple times over the lifetime of Application. Kbase sub-allocates memory for a HeapContext from a 4KB page that is mapped as cached on GPU side, and the memory for HeapContext is zeroed on allocation through an uncached CPU mapping. Since the size of HeapContext is 32 bytes, 2 HeapContexts (corresponding to 2 Tiler heaps of the same context) can end up sharing the same GPU cacheline (which is 64 bytes in size). GPU page fault occurred as FW found a non NULL or stale value for the 'free_list_head' pointer in the HeapContext, even though the Heap was newly created, and so FW assumed a free chunk is available and passed the address of it to the Tiler and didn't raise an OoM event for Host. The stale value was found as the zeroing of new HeapContext's memory on allocation got lost due to the eviction of cacheline from L2 cache. The cacheline became dirty when FW had updated the contents of older HeapContext (sharing the cacheline with new HeapContext) on CSG suspend operation. This commit makes the GPU VA of HeapContext to be GPU cacheline aligned to avoid cacheline sharing. The alignment would suffice and there is no explicit cache flush needed when HeapContext is freed, as whole GPU cache would anyways be flushed on Odin & Turse GPUs when the initial chunks are freed just before the HeapContext is freed. Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4724/ Test: Boot to home Bug: 259523790 Change-Id: Ie9e8bffcadbd2ca7705dcd44f9be76754e28138d Signed-off-by: Jeremy Kemp <jeremykemp@google.com>
2022-11-22GPUCORE-35268: Fix UAF due to use of MEM_FLAGS_CHANGE ioctl for JIT allocsandroid-13.0.0_r0.54android-13.0.0_r0.53Akash Goel
Through MEM_FLAGS_CHANGE ioctl Userspace can mark a native allocation as evictable so that backing pages for it can be reclaimed by the shrinker when system runs low on memory. The ioctl can also be used for the dma buf imported memory to update the shareability attribute of its GPU mapping. The former case can be abused to mark an active JIT allocation as evictable, due to which the active JIT allocation can be freed via the shrinker. This would cause use after free on Kbase side when it handles the JIT free softjob or kcpu command for the already freed allocation. This commit restricts the use of MEM_FLAGS_CHANGE ioctl for JIT allocations and for any other allocations that have NO_USER_FREE flag set for them. There is no use case to support the ioctl in question for such allocations. A Base defect test has also been added to verify the changes. Bug: 259695958 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4739 Change-Id: I9571060946b3d8e1c59e497392a480570d9b39c5
2022-11-22GPUCORE-35268: Fix UAF due to use of MEM_FLAGS_CHANGE ioctl for JIT allocsandroid-13.0.0_r0.55Akash Goel
Through MEM_FLAGS_CHANGE ioctl Userspace can mark a native allocation as evictable so that backing pages for it can be reclaimed by the shrinker when system runs low on memory. The ioctl can also be used for the dma buf imported memory to update the shareability attribute of its GPU mapping. The former case can be abused to mark an active JIT allocation as evictable, due to which the active JIT allocation can be freed via the shrinker. This would cause use after free on Kbase side when it handles the JIT free softjob or kcpu command for the already freed allocation. This commit restricts the use of MEM_FLAGS_CHANGE ioctl for JIT allocations and for any other allocations that have NO_USER_FREE flag set for them. There is no use case to support the ioctl in question for such allocations. A Base defect test has also been added to verify the changes. Bug: 259695958 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4739 Change-Id: I9571060946b3d8e1c59e497392a480570d9b39c5
2022-11-14Disabled APC ioctl on CSF platformsandroid-t-qpr2-beta-1_r0.5android-t-qpr2-beta-1_r0.4android-gs-raviole-5.10-t-qpr2-beta-1android-gs-bluejay-5.10-t-qpr2-beta-1Yunju Lee
Bug: 258707257 Test: Run APC ioctl cracker and check APC log Change-Id: I8a03cd0b23540cda9312c80ded1c5895ddcf0d56
2022-11-11mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1436Suzanne Candanedo
This patch is a fix for: - SW Errata: 2716399 - CVE: None This patch fixes bad pointer access in shrinker callback. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4612 Signed-off-by: Jack Diver <diverj@google.com> Change-Id: I49f11ef55a8fb1c7f8af9a56b3391ee10feb5cbd
2022-11-11mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1430Suzanne Candanedo
This patch is a fix for: - SW Errata: 2715151 - CVE: CVE-2022-36449 This patch fixes potential use-after-free after userbuf un-pin Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4611 Change-Id: I89aae381705466ca5971485d5b3b4ef48bc229d3 Signed-off-by: Jack Diver <diverj@google.com>
2022-11-11mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1425Suzanne Candanedo
This patch is a fix for: - SW Errata: 2713569 - CVE: CVE-2022-36449 This patch frees PGD pages after invalidation of L2 cache & MMU TLB Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4610 Signed-off-by: Jack Diver <diverj@google.com> Change-Id: I4204a351417d944a3c9efe077bca4e180a29270c
2022-11-11mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1423Suzanne Candanedo
This patch is a fix for: - SW Errata: 2713363 - CVE: CVE-2022-36449 Fixes overrun by kbase_read. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4609/1 Signed-off-by: Jack Diver <diverj@google.com> Change-Id: I86d5af2b9d6a85a520987acb7c1e9a49c19f4d42
2022-11-11mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1420Suzanne Candanedo
This patch is a fix for: - SW Errata: 2712858 - CVE: CVE-2022-36449 It excludes MMU dumping and invalidates PGD before free. For this fix to work, GPUCORE-32152 is needed which adds hooks for physical address translation. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4607/1 Signed-off-by: Jack Diver <diverj@google.com> Change-Id: I9d3718b57199b7e66a5b49730ac32c810a1fc9c9
2022-11-11mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1347Suzanne Candanedo
This patch is a fix for: - SW Errata: 2618270 - CVE: CVE-2022-28348 This fix adds an overflow check to kbase_mem_alias. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4606/1 Signed-off-by: Jesse Hall <jessehall@google.com> Change-Id: I33dcda73ec4e5871f5373d38ada29d8c6df7f311
2022-11-11mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1350Suzanne Candanedo
This patch is a fix for: - SW Errata: 2619157 - CVE: CVE-2022-28350 It fixes UAF issue with enqueue of FENCE_SIGNAL kcpu command. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4605/1 Signed-off-by: Jesse Hall <jessehall@google.com> Change-Id: Ibf2e760dee56190759c5bee047071644798f1aaa
2022-11-11mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1400Suzanne Candanedo
This patch is a fix for SW errata 2696314 fixing race with kctx->csf.event.error_list. Bug: 240184939 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4604/1 Signed-off-by: Jesse Hall <jessehall@google.com> Change-Id: I8c7ddaec720ede29720ade20e56363ce010503a8
2022-11-11mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1399Suzanne Candanedo
This patch is a fix for SW errata 2695802 fixing handling of remap or partial unmap for User IO pages mapping. Bug: 240185324 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4598 Signed-off-by: Jesse Hall <jessehall@google.com> Change-Id: I2124955de9027bb65c365930ef69d65af72ec4ac
2022-11-11mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1371Suzanne Candanedo
This patch is a fix for SW errata 2645822 installing fence fd at last stage Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4582 Signed-off-by: Jesse Hall <jessehall@google.com> Change-Id: I6386a8ae56d9b1923b4e4faa0c80483ab41c0bf2
2022-11-11mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1360Suzanne Candanedo
This patch is fix for SW errata 2637762 fixing possible out of bounds array access. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4580 Signed-off-by: Jesse Hall <jessehall@google.com> Change-Id: Ie8a48bbe903fe1127d298a33b9533753d0763452
2022-11-10mali_kbase: Disable IFPOSiddharth Kapoor
Disable HOST_CONTROLS_SC_RAILS compile flags to disable IFPO Bug: 257052747 Change-Id: Id9d87a365495b160f2f9c46015bfa0a12601c10f Signed-off-by: Siddharth Kapoor <ksiddharth@google.com>
2022-11-09platform: Disable GPU FW logJack Diver
Disable GPU FW log, as it incurs performance penalty when left on Bug: 228779790 Test: benchmark before and after setting this switch Change-Id: If3b824eb3a7cbde502b3eef38befb9e9856eee50 Signed-off-by: Jack Diver <diverj@google.com> (cherry picked from commit d4578bc2eb297fdb4c15bb54cd48d45c38ff1885)
2022-11-09Revert "Revert "Merge r38p1 from upstream into ↵Jack Diver
partner/android13-gs-pixel-5.10-tm-qpr2"" This reverts commit 34e635317dc2a91076ac341df3867ac3bdb31ef1. Bug: 228779790 Change-Id: Ic9d131af5568d7f55f610f255fa1c02925b18482 (cherry picked from commit 1c916e3f7c4d999f68e40c60fee6fe39418fcecd)
2022-11-08mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1436Suzanne Candanedo
This patch is a fix for: - SW Errata: 2716399 - CVE: None This patch fixes bad pointer access in shrinker callback. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4612 Change-Id: I1eccf3e0852f6e9d9b44d6527fa050ffdbe87caa Signed-off-by: Jack Diver <diverj@google.com> (cherry picked from commit 1a13e0c1c4e95f7584d99e7fcf84f79de96e8624)
2022-11-08mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1430Suzanne Candanedo
This patch is a fix for: - SW Errata: 2715151 - CVE: CVE-2022-36449 This patch fixes potential use-after-free after userbuf un-pin Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4611 Change-Id: I3f0887a9465065cc60874c965d91ae2970b6f38a Signed-off-by: Jack Diver <diverj@google.com> (cherry picked from commit fb2e7ed2859a7cb88c50dc0d357bb27837aaa843)
2022-11-08mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1425Suzanne Candanedo
This patch is a fix for: - SW Errata: 2713569 - CVE: CVE-2022-36449 This patch frees PGD pages after invalidation of L2 cache & MMU TLB Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4610 Change-Id: Ibb96f289330abb8c23630b06e26af8025b43e4ef Signed-off-by: Jack Diver <diverj@google.com> (cherry picked from commit 348355041f171b55a3b93f52821158689ae38b1c)
2022-11-08mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1423Suzanne Candanedo
This patch is a fix for: - SW Errata: 2713363 - CVE: CVE-2022-36449 Fixes overrun by kbase_read. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4609/1 Change-Id: I4fbed81f7f36906d228bf84667ebe0eea3e05a7f Signed-off-by: Jack Diver <diverj@google.com> (cherry picked from commit c7b5fc80ec4a8d89465cb004d22c24068125ea30)
2022-11-08mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1420Suzanne Candanedo
This patch is a fix for: - SW Errata: 2712858 - CVE: CVE-2022-36449 It excludes MMU dumping and invalidates PGD before free. For this fix to work, GPUCORE-32152 is needed which adds hooks for physical address translation. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4607/1 Change-Id: Ia0aab34bc483978243aff1bc6e9546385ce8c2eb Signed-off-by: Jack Diver <diverj@google.com> (cherry picked from commit 48ab9bf5fc5f938816b416a121a84128fabb4d5b)
2022-11-08mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1347Suzanne Candanedo
This patch is a fix for: - SW Errata: 2618270 - CVE: CVE-2022-28348 This fix adds an overflow check to kbase_mem_alias. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4606/1 Change-Id: I548539e8dcf776e13e1b9be2033b64f4c271b5ef Signed-off-by: Jesse Hall <jessehall@google.com> (cherry picked from commit 55f1819bd982ca824ee16d19c6d2aa1bbc0ea706)
2022-11-08mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1350Suzanne Candanedo
This patch is a fix for: - SW Errata: 2619157 - CVE: CVE-2022-28350 It fixes UAF issue with enqueue of FENCE_SIGNAL kcpu command. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4605/1 Change-Id: I094d1559fc27603fa64ef61a267a0205d67de8f7 Signed-off-by: Jesse Hall <jessehall@google.com> (cherry picked from commit bc304db0cec36bcd040f0c265845c7bf6151245c)
2022-11-08mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1400Suzanne Candanedo
This patch is a fix for SW errata 2696314 fixing race with kctx->csf.event.error_list. Bug: 240184939 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4604/1 Change-Id: Id89773bee8409b046a97dea5c3535d3df04c68b0 Signed-off-by: Jesse Hall <jessehall@google.com> (cherry picked from commit 2a266f07e9903e9d1d3959e49dbb8e8aea820070)
2022-11-08mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1399Suzanne Candanedo
This patch is a fix for SW errata 2695802 fixing handling of remap or partial unmap for User IO pages mapping. Bug: 240185324 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4598 Change-Id: I9c1365f748d39116afa279dff960b3f1ff01d1ee Signed-off-by: Jesse Hall <jessehall@google.com> (cherry picked from commit 828f8f33c56e5e4fc447783976ec56f41c2791ba)
2022-11-08mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1371Suzanne Candanedo
This patch is a fix for SW errata 2645822 installing fence fd at last stage Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4582 Change-Id: I15882589090eadfa8ca912b78d5ce7891e821937 Signed-off-by: Jesse Hall <jessehall@google.com> (cherry picked from commit e29928e40415de6eba26a802d4feb1d9c68d9c5c)
2022-11-08mali_kbase: MIDCET-4220 Patch for GPUSWERRATA-1360Suzanne Candanedo
This patch is fix for SW errata 2637762 fixing possible out of bounds array access. Bug: 251397485 Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4580 Change-Id: I1597418f91390de7afc0c520d11fdfb739c1e69c Signed-off-by: Jesse Hall <jessehall@google.com> (cherry picked from commit 825d564553db3985e94a2e69e6168d596e58ec00)
2022-11-02Revert "Merge r38p1 from upstream into partner/android13-gs-pixel-5.10-tm-qpr2"Kevin DuBois
This reverts commit 6dcd9736cbf84712dd7073dab4aea256e30517c2. Reason for revert: UMD taking too long to merge Bug: 228779790 Change-Id: I08b861ba3cfc8b025f653ef86b0a5ec643e5b13d
2022-10-31Merge r38p1 from upstream into partner/android13-gs-pixel-5.10-tm-qpr2Jack Diver
Bug: 228779790 Bug: 240184939 Bug: 240185324 Test: Boot to home Test: SST run Test: Camera, portrait, video record Test: VK CTS dEQP-VK.protected_memory.stack#* Test: CtsDisplayTestCases Test: CtsOpenGLTestCases Test: CtsSkQPTestCases Test: CtsNativeHardwareTestCases Test: CtsUiRenderingTestCases Test: CtsGpuToolsHostTestCases Test: CtsGpuProfilingDataTestCases Test: CtsVrTestCases Test: CtsCameraTestCases Test: CtsDeqpTestCases Signed-off-by: Jack Diver <diverj@google.com> Change-Id: I555b0c61cd08c973aaf7f75dc92d0c7573fa7c91
2022-10-25Fixed mali failing to report EPROBE_DEFERYunju Lee
In the module initialization for job manager, it should return error if any of the initialization it calls return error. The static variable is persistent even if the module is unloaded. After module unload, sscd_dev contains garbage. Made a constant copy of sscd_dev and sscd_dev be initialized every time the module is loaded. Bug: 218395503 Test: test patch simulating defer situation Change-Id: I26070c6b2c8e826b2fc78fe337cdf0ca1d2f154b
2022-10-24GPUCORE-35468: Serialize access to GLB_DB_REQ to ring CSG doorbellbo meng
This commit fixes the race between the ring of CSG doorbell to send the acknowledgment for the CS_FAULT event and the ring of CSG doorbell for sending the CSG start/resume request. Due to the race the update made to GLB_DB_REQ for the start/resume request was lost and so the request timed out. The acknowledgment for the CS_FAULT event is sent in interrupt handler whereas CSG requests are sent in the process context where Scheduler mutex is held. To serialize the access to GLB_DB_REQ between interrupt handler and process context, this commit uses the interrupt_lock. Change-Id: I51b2abad52952e0f27a05deb0519508e4c9bd0d2 Bug: 242161241 Bug: 235434294 Test: ~60h local SST. Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4599 Note: Adapted for CONFIG_MALI_HOST_CONTROLS_SC_RAILS (378860272aef3). (cherry picked from commit 65820c20e66e2c801445d7c37c67a86707ce0b13)
2022-10-24GPUCORE-35070: Order write to JOB_IRQ_CLEAR reg with read from iface memAkash Goel
There was an issue on Turse platform where sometimes Kbase misses the CSG idle event notification from FW. This happens when FW sends back to back notifications for the same CSG for events like SYNC_UPDATE and IDLE but Kbase gets a single IRQ and observes only the first event. The issue was root caused to a barrier missing on Kbase side between the write to JOB_IRQ_CLEAR register and the read from interface memory, i.e. CSG_ACK. Without the barrier there is no guarantee about the ordering, the write to JOB_IRQ_CLEAR can take effect after the read from interface memory. The ordering is needed considering the way FW & Kbase writes to the JOB_IRQ_RAWSTAT & JOB_IRQ_CLEAR registers without any synchronization. This commit adds dmb(osh) barrier after the write to JOB_IRQ_CLEAR to resolve the issue. TI2: 896668 (PLAN-12467r490 TGT CS Nightly, few CSF scenarios) Bug: 243913790 Test: SST ~4600 hours Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/3841 Change-Id: I094a3b55c8ae28e8126057cdaf81990f62cd388e (cherry picked from commit 220d89fd264b11a5b68290c3ca5a8c232e1d45db)
2022-10-20mali_kbase: jm: Only execute work_begin on a transition to submittedJack Diver
Without this patch, the platform work_begin callback will be called multiple times for the same atom if a state update request is made and the atom still resolves to submitted. Bug: 247721380 Test: Boot g101 to home Test: No per-UID-tis warnings Signed-off-by: Jack Diver <diverj@google.com> Change-Id: I535d1a1c2f983f0162dc0e18fe40544e61246d4c
2022-10-20mali_kbase: Fix gs101 per-UID-tisJack Diver
Up to two Atoms can be submitted to the same Job slot. To prevent warnings about multiple work begin/end for the same slot we need to track the two atoms individually Bug: 247721380 Test: Boot g101 to home Test: No per-UID-tis warnings Change-Id: I96dcc635f351c9ebd7161c1c619fc50f32bf190a
2022-10-12mali_kbase: Merge gs101 and gs201 buildsSiddharth Kapoor
Refactor driver builds to support common codes for gs101 and gs201. - Check SoC specific CONFIG flag in Kbuild - Convert CONFIG_MALI_PIXEL_GPU_SSCD and CONFIG_MALI_HOST_CONTROLS_SC_RAILS to ccflags Bug: 245742922 Test: Not fully tested. DO NOT MERGE Change-Id: I1cf7c19e2a2e63de17153c70ede806dc773398d3 Signed-off-by: Siddharth Kapoor <ksiddharth@google.com> Signed-off-by: Lucas Wei <lucaswei@google.com>
2022-10-12Merge android13-gs-pixel-5.10-gs101-tm-qpr2 into android13-gs-pixel-5.10-tm-qpr2Lucas Wei
worklog: - commit 1b55a3b93f52 ("mali_kbase: use RT_MUTEX for some job submission and context locks") replaced some locks with RT_MUTEX. Replace corresponding locks to avoid build breakage. Test: Build kernel Test: Boot to home Bug: 238399460 Signed-off-by: Lucas Wei <lucaswei@google.com> Change-Id: Id0d3f05bd0b5ebacc29e126ba98db5bb789e91fe
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-10 12:08:51 +0000