linux.git/drivers/gpu/host1x/debug.c, branch v7.3-rc2 Linux kernel source tree gpu: host1x: Avoid stack over-read in debug output helpers 2026-07-16T18:29:21+00:00 Mikko Perttunen mperttunen@nvidia.com 2026-06-09T08:09:20+00:00 bc17ac285fb708f22a8fa2c0ed32eceb1d37e6d6 host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. That return value was passed straight to o->fn as the number of bytes to emit. This could cause a read past end of the output buffer if a call to host1x_debug_* produced a string longer than 256 bytes. This only affected the debugfs files as the printk debug sink ignores the number of bytes. In practice, this is very unlikely to occur. Fix by switching to vscnprintf(), which returns the number of bytes actually written. Fixes: 6236451d83a7 ("gpu: host1x: Add debug support") Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-4-7c1131c0b3ad@nvidia.com 
host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which
returns the length the formatted string would have reached with an
unbounded buffer. That return value was passed straight to o->fn as
the number of bytes to emit.

This could cause a read past end of the output buffer if a call to
host1x_debug_* produced a string longer than 256 bytes. This only
affected the debugfs files as the printk debug sink ignores the
number of bytes. In practice, this is very unlikely to occur.

Fix by switching to vscnprintf(), which returns the number of bytes
actually written.

Fixes: 6236451d83a7 ("gpu: host1x: Add debug support")
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-4-7c1131c0b3ad@nvidia.com
gpu: host1x: Remove unused host1x_debug_dump_syncpts 2025-02-28T16:44:13+00:00 Dr. David Alan Gilbert linux@treblig.org 2024-12-15T21:47:50+00:00 3cfae15302b398fd2d9884dcea0a1d2188e6513d host1x_debug_dump_syncpts() has been unused since commit f0fb260a0cdb ("gpu: host1x: Implement syncpoint wait using DMA fences") Remove it. Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Acked-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241215214750.448209-1-linux@treblig.org 
host1x_debug_dump_syncpts() has been unused since
commit f0fb260a0cdb ("gpu: host1x: Implement syncpoint wait using DMA
fences")

Remove it.

Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org>
Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241215214750.448209-1-linux@treblig.org
gpu: host1x: Rewrite syncpoint interrupt handling 2023-01-26T14:55:38+00:00 Mikko Perttunen mperttunen@nvidia.com 2023-01-19T13:09:20+00:00 625d4ffb438cacc9b1ebaa48748cdc7171587cdc Move from the old, complex intr handling code to a new implementation based on dma_fences. While there is a fair bit of churn to get there, the new implementation is much simpler and likely faster as well due to allowing signaling directly from interrupt context. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> 
Move from the old, complex intr handling code to a new implementation
based on dma_fences. While there is a fair bit of churn to get there,
the new implementation is much simpler and likely faster as well due
to allowing signaling directly from interrupt context.

Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
gpu: host1x: Use DEFINE_SHOW_ATTRIBUTE to simplify debugfs code 2022-11-25T15:14:59+00:00 Liu Shixin liushixin2@huawei.com 2022-09-22T14:23:16+00:00 a624bd9cbdcfdc4e0cf68bb0061af6de366ebd7d Use DEFINE_SHOW_ATTRIBUTE helper macro to simplify the debugfs code for the status and status_all entries. No functional change. Signed-off-by: Liu Shixin <liushixin2@huawei.com> Signed-off-by: Thierry Reding <treding@nvidia.com> 
Use DEFINE_SHOW_ATTRIBUTE helper macro to simplify the debugfs code for
the status and status_all entries. No functional change.

Signed-off-by: Liu Shixin <liushixin2@huawei.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
gpu: host1x: Show all allocated syncpts via debugfs 2022-04-06T13:33:57+00:00 Jon Hunter jonathanh@nvidia.com 2022-01-14T14:04:53+00:00 74bb98dd91106fcfd16aad852fafa5970a268427 When the host1x syncpts status is dumped via the debugfs, syncpts that have been allocated but not yet used are not shown and so currently it is not possible to see all the allocated syncpts. Update the path for dumping the syncpt status via the debugfs to show all allocated syncpts even if they have not been used yet. Note that when the syncpt status is dumped by the kernel itself for debugging only the active syncpt are shown. Signed-off-by: Jon Hunter <jonathanh@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> 
When the host1x syncpts status is dumped via the debugfs, syncpts that
have been allocated but not yet used are not shown and so currently it
is not possible to see all the allocated syncpts. Update the path for
dumping the syncpt status via the debugfs to show all allocated syncpts
even if they have not been used yet. Note that when the syncpt status
is dumped by the kernel itself for debugging only the active syncpt are
shown.

Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
gpu: host1x: Add initial runtime PM and OPP support 2021-12-16T13:07:07+00:00 Dmitry Osipenko digetx@gmail.com 2021-11-30T23:23:15+00:00 6b6776e2ab8ac7086cf31ad339411df7681715b7 Add runtime PM and OPP support to the Host1x driver. For the starter we will keep host1x always-on because dynamic power management require a major refactoring of the driver code since lot's of code paths are missing the RPM handling and we're going to remove some of these paths in the future. Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org> Tested-by: Peter Geis <pgwipeout@gmail.com> # Ouya T30 Tested-by: Paul Fertser <fercerpav@gmail.com> # PAZ00 T20 Tested-by: Nicolas Chauvet <kwizart@gmail.com> # PAZ00 T20 and TK1 T124 Tested-by: Matt Merhar <mattmerhar@protonmail.com> # Ouya T30 Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Signed-off-by: Thierry Reding <treding@nvidia.com> 
Add runtime PM and OPP support to the Host1x driver. For the starter we
will keep host1x always-on because dynamic power management require a major
refactoring of the driver code since lot's of code paths are missing the
RPM handling and we're going to remove some of these paths in the future.

Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Tested-by: Peter Geis <pgwipeout@gmail.com> # Ouya T30
Tested-by: Paul Fertser <fercerpav@gmail.com> # PAZ00 T20
Tested-by: Nicolas Chauvet <kwizart@gmail.com> # PAZ00 T20 and TK1 T124
Tested-by: Matt Merhar <mattmerhar@protonmail.com> # Ouya T30
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
gpu: host1x: Show number of pending waiters in debugfs 2021-03-30T17:53:24+00:00 Mikko Perttunen mperttunen@nvidia.com 2021-03-29T13:38:29+00:00 49a5fb1679952a76861bd2580f785e33e3de712c Show the number of pending waiters in the debugfs status file. This is useful for testing to verify that waiters do not leak or accumulate incorrectly. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> 
Show the number of pending waiters in the debugfs status file.
This is useful for testing to verify that waiters do not leak
or accumulate incorrectly.

Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
gpu: host1x: debug: Fix multiple channels emitting messages simultaneously 2020-07-17T14:06:14+00:00 Dmitry Osipenko digetx@gmail.com 2020-06-29T03:18:41+00:00 35681862808472a0a4b9a8817ae2789c0b5b3edc Once channel's job is hung, it dumps the channel's state into KMSG before tearing down the offending job. If multiple channels hang at once, then they dump messages simultaneously, making the debug info unreadable, and thus, useless. This patch adds mutex which allows only one channel to emit debug messages at a time. Signed-off-by: Dmitry Osipenko <digetx@gmail.com> Signed-off-by: Thierry Reding <treding@nvidia.com> 
Once channel's job is hung, it dumps the channel's state into KMSG before
tearing down the offending job. If multiple channels hang at once, then
they dump messages simultaneously, making the debug info unreadable, and
thus, useless. This patch adds mutex which allows only one channel to emit
debug messages at a time.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Merge tag 'drm/tegra/for-5.3-rc1' of git://anongit.freedesktop.org/tegra/linux into drm-next 2019-06-25T02:59:43+00:00 Dave Airlie airlied@redhat.com 2019-06-25T02:59:35+00:00 dfd03396d7b66f90071aa5e8fdc0f3c4a66471c5 drm/tegra: Changes for v5.3-rc1 This contains a couple of small improvements and cleanups for the Tegra DRM driver. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thierry Reding <thierry.reding@gmail.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190621150753.19550-1-thierry.reding@gmail.com 
drm/tegra: Changes for v5.3-rc1

This contains a couple of small improvements and cleanups for the Tegra
DRM driver.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thierry Reding <thierry.reding@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190621150753.19550-1-thierry.reding@gmail.com
host1x: debugfs_create_dir() can never return NULL 2019-06-13T16:23:38+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2019-06-13T11:45:22+00:00 eb7cf945a8dac8603e6d0759023e9b6cfed7a008 So there is no need to check for a value that can never happen. No need to check the return value all anyway, as any debugfs call can take the result of this function as an option just fine. Cc: Thierry Reding <thierry.reding@gmail.com> Cc: dri-devel@lists.freedesktop.org Cc: linux-tegra@vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Thierry Reding <treding@nvidia.com> 
So there is no need to check for a value that can never happen.  No need
to check the return value all anyway, as any debugfs call can take the
result of this function as an option just fine.

Cc: Thierry Reding <thierry.reding@gmail.com>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-tegra@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>