Age | Commit message (Collapse) | Author |
|
This commit adds:
- In Bifrost JM GPUs, L2 cache is explicitly flushed before the
power down of shader cores and cores are powered down before L2
is powered down.
- On older CSF GPUs, MCU will be halted before L2 is powered down and
FW will flush the L2 on halt.
Bug: 316204986
Test: Local SST
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/6275
Signed-off-by: Michael Stokes <mjstokes@google.com>
Change-Id: Ia8ba830cbaab6d9739c96e2a4851eef5a33f236e
|
|
GPUCORE-40571 Fix invalid page table entries from occuring.
This patch prevents the invalid page table entries from occuring.
Bug: 316204010
Change-Id: I6aa1fdb9f0a40dab5d8a7d1dcd85f7485c960a22
Signed-off-by: Renato Grottesi <otaner@google.com>
Test: platform can boot.
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/6262
|
|
MIDCET-4882,GPUCORE-40989 Break deadlock BTW user thread
and page fault worker
Additional fix over the previous commit where Arm forgot to change a
kbase_gpu_vm_lock to kbase_gpu_vm_lock_with_pmode_sync.
Bug: 301064831
Change-Id: I9179e0b4e4c7151c83061152fd877aba7204f037
Signed-off-by: Renato Grottesi <otaner@google.com>
Test: manual run of the use case from the ticket
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/6221
|
|
MIDCET-4882,GPUCORE-40989 Break deadlock BTW user thread and page fault worker
This commit adds a RW semaphore 1> to prevent MMU operations during
P.Mode entrance and 2> to break the deadlock on 'kctx reg_lock'
between user thread and page-fault worker thread.
Bug: 301064831
Signed-off-by: Renato Grottesi <otaner@google.com>
Test: manual run of the use case from the ticket
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/6221
Change-Id: I692f8fafc558a6a45b5ca4210aa3f66c2617553f
|
|
kbase_csf_kcpu_queue_new() places a queue ptr into
kctx->csf.kcpu_queues.array and proceeds to alloc/populate metadata.
If metadata setup fails, kbase kfree()-s the queue and bails out,
leaving behind a stale queue ptr in the array.
Using such a queue object crashes the kernel (eg. in delete_queue()).
Change-Id: I9c4117ac3e938567aedfa7a7d343254c2e2fa48d
Signed-off-by: Varad Gautam <varadgautam@google.com>
Bug: 303353064
|
|
These are addressed in mali kbase upstream R46P0 driver.
This commit can be reverted when R46P0 is merged in.
Bug: 302343291
Test: Local build
Change-Id: I113d3f06ce2098e5db8b6957fd77076b9e6bde14
Signed-off-by: Vamsidhar reddy Gaddam <gvamsi@google.com>
|
|
Address kernel-doc warnings in pixel gpu components
Bug: 302343291
Test: Local build
Change-Id: Ia5a654f5acd1c6ee5245472792553d0d2e2d9e49
Signed-off-by: Vamsidhar reddy Gaddam <gvamsi@google.com>
|
|
Bug: 300854197
SBMerger: 571992243
Change-Id: Idcd27a05bcccb9738bb0e4d8216b062c9d834062
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
|
|
Bug: 277090000
Test: Trigger sscd
Change-Id: I6ca23cc74806efc364b10ee17e654f4252d3ec1f
Signed-off-by: Yunju Lee <yunjulee@google.com>
|
|
Bug: 300854197
SBMerger: 571992243
Change-Id: Ie9096d3afd31c2e5959618fb2f1354bca8be3cfd
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
|
|
If a slot number parsed from trace data exceeds the number of supported
CSG slots, the trace data must be discarded. Otherwise the access to
the invalid memory address could happen.
Bug: 304341806
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/6057
Signed-off-by: Jörg Wagner <jorwag@google.com>
Change-Id: I8e702e7487f2bea3618f2fe8ad696a1b546f10f2
|
|
Bug: 300854197
SBMerger: 558810260
Change-Id: I1fd011faa1af3472ac4ef0b70560f44da49cdf2d
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
|
|
Fix potential out-of-bounds read due to missing bounds check.
Bug: 298264460
Signed-off-by: Guus Sliepen <gsliepen@google.com>
Change-Id: I57b67a4177e4fe6d84a261eeb00b6b833da5486b
Merged-In: I57b67a4177e4fe6d84a261eeb00b6b833da5486b
|
|
Bug: 299948695
Change-Id: I28bde3744a365fb5a8b7794c26b5adf507041eec
|
|
Bug: 299991153
Change-Id: I63342d7ca91f4150d7e5e376d8e91f0accf22dd4
|
|
Bug: 300854197
SBMerger: 558810260
Change-Id: I2533a7f40800e1b5c32633543af66d1a58d66a43
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
|
|
Storing the waitqueue in struct kbase_context leaves epoll holding a
stale pointer to it, which it later attempts to deref and crashes the
kernel in:
[*][T15976] remove_wait_queue+0x64/0x190
[40350.510681][T15976] ep_unregister_pollwait+0x98/0xe8
Move this waitqueue to struct kbase_file to ensure that
it lives long enough during process termination that the
ep_unregister_pollwait access is valid (b/302281297).
Bug: 300750575
Test: SST: b/302324090#comment4, repro: b/300750575#comment26
Change-Id: Ib161a7d7d4314bb6951bddbd87183a7dc71d5ac0
Signed-off-by: Varad Gautam <varadgautam@google.com>
|
|
Move macros, struct, and functions required by sscd from source file to
header file. Add firmware core dump segment to sscd. Implement firmware
core dump in sscd.
Bug: 277090000
Test: Trigger sscd manually
Change-Id: I3546e74e647e60f13f18c5e9ef6a4a24413f02fb
|
|
Bug: 296839414
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/5965
Change-Id: I1c8a13de1e0abfff4e3cd7ec069fb139524c59db
|
|
android13-gs-pixel-5.10-24Q1" into android13-gs-pixel-5.10-24Q1
|
|
Fix potential integer overflow within buffer liveness ioctl.
Bug: 296984851
Test: N/A
Change-Id: Ib1c9ee25a89b0a39ec905f109ee2c57c502428db
(cherry picked from https://partner-android-review.googlesource.com/q/commit:02e5329e2e3f4af00f51560895b5bbe87fe824ef)
Signed-off-by: Jack Diver <diverj@google.com>
|
|
Record the freq recommended by the governor before it's clamped
via a new `gpu_gov_rec` clock tracepoint.
Also record a new tracepoint `gpu_gov_rec_violate` if this freq
is outside of the level lock window.
Bug: 291855615
Test: Manual trace
Signed-off-by: Varad Gautam <varadgautam@google.com>
Change-Id: I45d0ffbebb6fa83d1a47b9d2afc8d96ce420afce
|
|
Bug: 291855615
Test: Record manual trace.
Signed-off-by: Varad Gautam <varadgautam@google.com>
Change-Id: Id4341c3809b2e3b147122adaabaa01ac7b265dfc
|
|
Bug: 290882327
Change-Id: Ifb843070d65bdf4148b29c6d1a92bdf3a6f3aa89
Signed-off-by: Siddharth Kapoor <ksiddharth@google.com>
|
|
This line was re-added accidentally as part of the
merge of r44p1-00dev3 in b6fd708b3a.
Removed this line to restore exposure of the ftrace events.
Bug: 290882327
Change-Id: Ibf3215bab6d4699d905027cce3412b49e205f9fb
Signed-off-by: Debarshi Dutta <debarshid@google.com>
|
|
Split functionality to allow creation of arbitrary
thread tasks and kthread_worker_fn workers, while sharing
the promotion to RT scheduling policies for both.
Finally use this functionality to elevate "mali-gpuq-kthread"
to RT priority.
Bug: 290882327
Change-Id: Icf2c07849cdd0ca47bcfc06700853ac1856d0a87
|
|
Bug: 290882327
Change-Id: I90723cbaa3f294431087587fd8025f0688e51bf2
|
|
Provenance: ipdelivery@5c8fdf6c071d63537e87949cfb4845079a669a0b
Change-Id: Icc06581f804bf59be5fe923349318e703f02d5a3
|
|
protm_event_worker is responsible for triggering protected mode entry,
but it currently runs in a default priority workqueue, which results
in occasional long stalls for protected mode work.
The workload of this task is very light, typically only running
for a few tens of microseconds each invocation, so converting
it to a kthread should have no significant impact on overall
system performance.
Bug: 297019294
Test: Manual Netflix PiP perfetto trace inspection
Change-Id: Ica9e744bd390ae6b88a701bf2d390f82937581d0
|
|
android13-gs-pixel-5.10-udc-qpr1" into android13-gs-pixel-5.10-udc-qpr1
|
|
This reverts commit e8fa58acd3f48031ac6297e64ae996d430fa31d4.
b/290409680 shows RESET_COMPLETED irq being missed in the absence of this
patch. The original patch (pa/I2dcec3ef431) was found to not cause the
stability problems for which it was reverted (pa/I6ee1b26063a).
Reintroduce it.
Test: Boot to home.
ARM Upstreaming: Pending in https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/4835
Bug: 290409680
Change-Id: Iada51bb1d9c88dd0d3b0fdab5961c85699221b47
Signed-off-by: Varad Gautam <varadgautam@google.com>
|
|
Bug: 292447561
SBMerger: 558810260
Change-Id: Ic618ad7008dfa915ff71de71bc205d9e219b7c34
Signed-off-by: Pindar Yang <pindaryang@google.com>
|
|
mapping
As a result of this change now the whole of each of the pages
underlying a memory region imported as a USER_BUFFER region
are synchronized and the driver disables automatic CPU cache
synchronization upon DMA map/unmap operations.
(cherry picked from commit 0c2790fb2b006edb3e648a8a9a732e3aadcf2436)
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/5829
Bug: 295897369
Change-Id: Ifbd656b78e49ae614ca87e156321d0ccd6dd8887
|
|
We use pm_runtime for handling suspends, which means that an
internal linux power workqueue will take and hold the CSF
scheduler lock while performing suspend operations.
This workqueue runs at default priority and so might not be
scheduled fast enough if there is high CPU load, which results
in missed frames.
By promoting the CSF scheduler lock to an rt_mutex we ensure
that the GPU wakes up faster when there is work that needs to
be done, since our other internal realtime threads will be
waiting on the scheduler lock in these cases.
Bug: 296862283
Test: CUJ close camera
Change-Id: Ibe81ad7e26a75acb1640b2820902eb8144a48fdd
Merged-In: I0e81a45e3d65f60337250d35c53ef6447c876051
|
|
The change ca522e4491584d5a2a5f122ee90e3edb3581182b was added
by the automerger. It changed the sequence of the mutex_unlock
Restore it according to bce5281a0408a175137c08dc93028e2a2c0fb69b
[upstream R43P0 merge]
Bug 294759508
Change-Id: Ie9ed80e48237111e190a070f0615fad47cfb8f3a
Signed-off-by: Debarshi Dutta <debarshid@google.com>
|
|
Test: Boot to home, gfx-bench sweep
Bug: 294167925
(cherry picked from https://partner-android-review.googlesource.com/q/commit:3143995156d9372ca6af0be57aa29dd0ec14cce1)
Merged-In: I4a122fe023b43c3763884fda99cfed17048a3eb0
Change-Id: I4a122fe023b43c3763884fda99cfed17048a3eb0
Signed-off-by: Jack Diver <diverj@google.com>
|
|
Refactor kbase_mmu_update_pages, extracting flush/invalidate into new
function.
Expose no-flush variant.
Test: Build, boot
Bug: 294167925
Signed-off-by: Jack Diver <diverj@google.com>
(cherry picked from https://partner-android-review.googlesource.com/q/commit:b36ce28e0779c27e57dad90d98c5e202eb654013)
Merged-In: I4d1fce75d6ccf352ee54935138d6c92cdc609049
Change-Id: I4d1fce75d6ccf352ee54935138d6c92cdc609049
|
|
transition timeout
This patch continues FLUSH_MEM operation at function caller and increases the timeout value for the core power transition.
Change-Id: I8cf5417976ab31b8d1e9e33e6359a91455d37144
(cherry picked from commit 71f7017252aabbb0013a2f151d894959b7c7c226)
Bug: 295942377
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/5812
|
|
android13-gs-pixel-5.10-udc-qpr1" into android13-gs-pixel-5.10-udc-qpr1
|
|
Invoke kbase_csf_tiler_heap_context_term() after an unsuccessful call
to kbasep_ctx_user_reg_page_mapping_init().
Bug 294759508
Change-Id: I6ef97a6e69042ab9e2351939d23e09cf4ec83216
Signed-off-by: Debarshi Dutta <debarshid@google.com>
|
|
Conflict files:
mali_kbase/context/mali_kbase_context.c
mali_kbase/mali_kbase_mem.h
SBMerger: 526756187
Change-Id: I6e2a522d8735896f970cac1157943fa2670664c7
|
|
android13-gs-pixel-5.10-udc-qpr1
|
|
memory accounting
Kbase accounts the GPU memory allocated for a context under the memory
footprint of a process, so that kernel's low memory killer or OoM killer
can kill the suitable process to free up decent amount of system memory.
For accounting, Kbase updates the 'MM_FILEPAGES' counter inside the
'mm_struct' corresponding to the process that created the Kbase context.
To ensure 'mm_struct' can always be safely accessed, a tracking page was
used which Kbase mandated to be mapped right after the opening of
'/dev/mali0' file. When the mapping was closed Kbase updated the kernel
counter to subtract all the GPU memory allocated so far for a context
but the actual freeing of GPU memory was done later. This was usually
not a problem as the mapping is closed by DDK Userspace just before the
context termination. But the Userspace is allowed to close it at will.
Malicious Userspace could have exploited this Kbase quirk by closing
the mapping which would have mislead the OoM killer in killing the
innocent processes before it gets around to the culprit process.
This commit removes the use of tracking page and uses mmgrab() to take
a reference on 'mm_struct' for User created Kbase context.
The reference doesn't prevent the freeing of address space on process
exit, it merely keeps the 'mm_struct' alive. The reference is dropped
on context termination.
For backward compatibility, the call from Base to create the mapping for
tracking page isn't rejected by Kbase. The Base code has been updated to
skip the mapping of tracking page only for newer Kbase so as to maintain
forward compatibility with the older Kbase. BASE_UK_VERSION_MINOR has
been incremented as the requirement to create a mapping for tracking
page is relaxed by Kbase.
Change-Id: I37407809d7187cb5c8fac63e6c10f72cc3bd762d
Bug: 275853921
Provenance: https://code.ipdelivery.arm.com/c/GPU/mali-ddk/+/5165
(cherry picked from commit b29f4a639e0863c09e72d7e34c0a6ad57f9572a6)
|
|
An accidental change back to a lower hysteresis time as
a part of the R43P0 merge commit resulted in GPU
powering on and off more frequently and regressing previously
established perf. Restore the same to a value that was previously
determined and set in our downstream driver.
Bug 292157710
Bug 278174418
Change-Id: Id44337bc1fd672722a5edaf27aaca16f320b7ad0
Signed-off-by: Debarshi Dutta <debarshid@google.com>
|
|
Restore the history relationship between our side and Arm's
(goog/upstream) which was left decoupled by 20fff721667a22.
Bug: 294759508
Change-Id: I21dc645bb7376c7e659ad879d8ad2f5d683eb944
|
|
Provenance: ipdelivery@d10c137c7691a470b8b33786aec4965315db4561
Change-Id: I4fbcc669d3b8e36c8288c91fdddd8b79258b6635
|
|
We have accumulated various logging that is no longer required, and
some messages that sound more scary than they need to.
Bug: 291710900
Test: boot to home
Change-Id: I870a4136e1de423281b14a2e3ba8f643e9243d81
|
|
This restores kbase fence tracepoint operation.
Bug: 291242575
Test: b/291242575#comment12
Change-Id: I3cebd8118373b6cc43b28298955d108b2b85d505
Signed-off-by: Varad Gautam <varadgautam@google.com>
ARM upstream: Available r44p0 onwards b/291902034#comment2
|
|
When an ITMON fault report identifies a transaction originated by the
GPU, search for the faulting address in all GPU page tables and log
whether it was found or not.
Bug: 288088318
Test: boot to home
Change-Id: Ic774d4d84af625a33b94b79069f62c8a71adaad7
|
|
`TASK_COMM_LEN` is defined to 16, which means thread names longer than
15 characters (+ '\0') get truncated.
The `mali_kbase_csf_` prefix is 15 characters by itself, shorten it to
`csf_` instead to make the rest of the name readable.
This also brings those names inline with other threads created through
`kbase_create_realtime_thread` which already used the base `csf_*`
prefix.
Bug: 230023102
Test: record trace in perfetto and look for `csf_*` kthread names
Change-Id: I07d6c3d49d3f0dcda85f168e7295dba8f22c031b
|