summaryrefslogtreecommitdiffstats
path: root/kernel/gsp_sema_service.c
diff options
context:
space:
mode:
Diffstat (limited to 'kernel/gsp_sema_service.c')
-rw-r--r--kernel/gsp_sema_service.c222
1 files changed, 221 insertions, 1 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 13d99cc..4674987 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -6640,6 +6640,15 @@ static bool svc_gr_cand_push_seen(u64 push_va, u64 hash);
/* SESSION 149 R16 (M3): trusted-walk VA read, defined below the decode. */
static int svc_read_va_trusted(struct nv_vgpu_device *vgpu, u64 va, void *buf,
size_t len);
+/*
+ * SESSION 149 R17 (M4): the section's memory-writing upload commands are
+ * applied through the shared inline-write path (defined below the section
+ * code) with its (push, hash, dst, bytes) once-only guard.
+ */
+static int svc_grce_inline_write(struct nv_vgpu_device *vgpu, u64 dst_va,
+ const u8 *data, u32 bytes, u32 ch_h);
+static bool svc_inline_once_seen(u64 push_va, u64 hash, u64 dst, u32 bytes);
+static void svc_inline_once_store(u64 push_va, u64 hash, u64 dst, u32 bytes);
/* QMD field decode: the exact shape the host CUDA bridge uses. */
static void svc_gr_qmd_decode(struct svc_gr_cand_rec *c)
@@ -6805,6 +6814,18 @@ module_param_named(sema_gl_xlate, gsp_sema_gl_xlate, bool, 0644);
MODULE_PARM_DESC(sema_gl_xlate,
"GL/3D (C597) direct stream -> synthesized GR candidate (default 0 = off)");
+/*
+ * SESSION 149 R17 (M4): one recorded section upload command. The 3D-class
+ * i2m shape is a 0x180 (LINE_LENGTH_IN) run naming the destination followed
+ * by a 0x1b0 (LAUNCH_DMA + LOAD_INLINE_DATA) run carrying the payload.
+ */
+#define SVC_GL_UPLOAD_MAX 24
+struct svc_gl_up {
+ u64 dst_va; /* from the 0x180 run's OFFSET_OUT_UPPER|OFFSET_OUT */
+ u32 len; /* payload bytes copied (payload = run data minus cfg) */
+ u8 data[SVC_GR_INLINE_BYTES];
+};
+
struct svc_gl_sec {
bool seen;
u32 subch;
@@ -6816,6 +6837,18 @@ struct svc_gl_sec {
u64 ptr[SVC_GR_POINTER_MAX];
u32 n_ptr;
/*
+ * SESSION 149 R17 (M4): the section's memory-writing upload commands
+ * collected in order. On real hardware the 3D engine executes these
+ * i2m copies (constants, tex pools, ...); in this emulation no engine
+ * ran them, so every destination stayed zero. svc_gl_flush applies
+ * the recorded bytes through svc_grce_inline_write (FB aperture ->
+ * vidmem shadow, sysmem -> guest RAM, unresolved -> VA shadow).
+ */
+ u64 up_dst; /* destination of the last 0x180 run */
+ u32 up_bytes; /* its length word (stream); witness only */
+ u32 n_up;
+ struct svc_gl_up up[SVC_GL_UPLOAD_MAX];
+ /*
* SESSION 149 R15 (M2-S1): bytes of the first LAUNCH_DMA /
* LOAD_INLINE_DATA run observed inside the section (the observed
* upload payload). Attached to the synthesized candidate as an
@@ -6830,6 +6863,66 @@ struct svc_gl_sec {
static struct svc_gl_sec svc_gl; /* service thread only */
static u32 svc_gl_rep_log; /* bounded replay-already-captured witness */
static u32 svc_gl_prog_log; /* R16 bounded program-read witness */
+static u32 svc_gl_up_log; /* R17 bounded section-upload-apply witness */
+/*
+ * SESSION 149 R17 (M4): explicit program bytes for the synthesized GL
+ * launch (hex string, <= GSP_BRIDGE_INLINE_BYTES). The GL program page
+ * (e.g. 0x121201b00) is empty in every buffer this emulation can see: no
+ * memory-writing command in any readable push targets it and the
+ * context-init upload never reached a decodable ring. When set, these
+ * bytes are attached as the program record (after a trusted VA read, so a
+ * real upload still wins). Development use only: a minimal real sm_75
+ * SASS program (EXIT;NOP;...) proves the engine executes OUR bytes.
+ */
+static char *sema_gl_prog_hex;
+module_param_named(sema_gl_prog_hex, sema_gl_prog_hex, charp, 0644);
+MODULE_PARM_DESC(sema_gl_prog_hex,
+ "explicit program bytes (hex) for the synthesized GL launch (<=64 B)");
+static u8 svc_gl_prog[GSP_BRIDGE_INLINE_BYTES];
+static u32 svc_gl_prog_len;
+static bool svc_gl_prog_parsed;
+
+static void svc_gl_prog_apply_param(void)
+{
+ const char *h = sema_gl_prog_hex;
+ u32 n, i;
+
+ if (svc_gl_prog_parsed)
+ return;
+ svc_gl_prog_parsed = true;
+ if (!h || !h[0])
+ return;
+ n = (u32)strlen(h);
+ if (n % 2 || n / 2 > GSP_BRIDGE_INLINE_BYTES) {
+ pr_warn("sema-gl: prog-hex param ignored (bad length %u)\n",
+ n);
+ return;
+ }
+ for (i = 0; i < n; i += 2) {
+ unsigned int b;
+
+ if (sscanf(h + i, "%2x", &b) != 1) {
+ pr_warn("sema-gl: prog-hex param bad at %u\n", i);
+ return;
+ }
+ svc_gl_prog[i / 2] = (u8)b;
+ }
+ svc_gl_prog_len = n / 2;
+ pr_info("sema-gl: prog-hex param: %u bytes stored\n",
+ svc_gl_prog_len);
+}
+/*
+ * SESSION 149 R17 (M4): standalone GL-class upload tracker. A context-init
+ * upload push (the one-shot program upload) is NOT required to sit inside a
+ * C597 section, but it carries the same subchannel-0 0x180/0x1b0 i2m shape.
+ * The tracker pairs the last 0x180 destination with each following 0x1b0
+ * payload and applies it on sight (sema_gl_xlate, eng==0, trusted/allow,
+ * once-only) so the destination (e.g. the program page) gets its content
+ * even when the push carries no class bind this pass recognises.
+ */
+static u64 svc_gl_spot_dst; /* last 0x180 destination (per pass) */
+static u32 svc_gl_spot_bytes; /* its length word (witness) */
+static u32 svc_gl_lid_log; /* bounded standalone-apply witness */
static void svc_gl_add_ptr(u64 va)
{
@@ -6895,6 +6988,13 @@ static void svc_gl_field(u32 addr, u32 count, const u8 *data, u32 dlen)
if (count >= 4)
svc_gl_add_ptr(((u64)(v[2] & 0xff) << 32) |
(u64)(v[3] & 0xfffffffc));
+ /* R17: this run names the destination the next 0x1b0
+ * LAUNCH_DMA/LOAD_INLINE_DATA run writes to. */
+ if (count >= 5) {
+ svc_gl.up_dst = ((u64)(v[2] & 0xff) << 32) |
+ (u64)(v[3] & 0xfffffffc);
+ svc_gl.up_bytes = v[0];
+ }
return;
case 0x01b0: /* LAUNCH_DMA + LOAD_INLINE_DATA (op3/op5): the run's
* data words ARE the observed upload payload. Keep the
@@ -6921,6 +7021,27 @@ static void svc_gl_field(u32 addr, u32 count, const u8 *data, u32 dlen)
svc_gl.blob_len = n;
}
}
+ /*
+ * R17: record the run's payload at the destination the
+ * preceding 0x180 run named (the payload starts after the
+ * LAUNCH_DMA config word - same split as the blob above).
+ */
+ if (svc_gl.up_dst && count > 1 && dlen > 4 &&
+ svc_gl.n_up < SVC_GL_UPLOAD_MAX) {
+ struct svc_gl_up *u = &svc_gl.up[svc_gl.n_up];
+ u32 n = (count - 1) * 4;
+
+ if (n > dlen - 4)
+ n = dlen - 4;
+ if (n > sizeof(u->data))
+ n = (u32)sizeof(u->data);
+ if (n) {
+ u->dst_va = svc_gl.up_dst;
+ u->len = n;
+ memcpy(u->data, data + 4, n);
+ svc_gl.n_up++;
+ }
+ }
return;
default:
return;
@@ -6955,7 +7076,9 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
u32 blob_n = 0;
int blob_rc = -1;
bool blob_trusted = false;
+ const char *blob_src = "none";
+ svc_gl_prog_apply_param();
if (!svc_gl.seen || !svc_gl.prog_va || !svc_gl.param_va ||
!svc_gl.rel_va || !trusted)
goto out;
@@ -7057,6 +7180,41 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
* exactly that"). A trusted read that lands on an all-zero page is
* treated as "not real" and falls through to the LID bytes.
*/
+ /*
+ * SESSION 149 R17 (M4): apply the section's memory-writing upload
+ * commands BEFORE reading the program page, so an upload that
+ * targets the program VA is visible to the read below (the section's
+ * engine commands never ran: every destination - constants, tex
+ * pools, program - stayed zero). The shared inline-write path
+ * resolves each destination (FB aperture -> emulated vidmem shadow,
+ * sysmem -> guest RAM, unresolved -> VA shadow) and the once-only
+ * guard is keyed by (push, content hash, dst, bytes) so a
+ * replay/rescue pass cannot double-apply.
+ */
+ {
+ u64 ph = svc_push_hash(buf, len);
+ u32 ap_n = 0, ap_b = 0;
+
+ for (k = 0; k < svc_gl.n_up && k < SVC_GL_UPLOAD_MAX; k++) {
+ struct svc_gl_up *u = &svc_gl.up[k];
+
+ if (svc_inline_once_seen(push_va, ph, u->dst_va,
+ u->len))
+ continue;
+ svc_inline_once_store(push_va, ph, u->dst_va, u->len);
+ if (!svc_grce_inline_write(vgpu, u->dst_va, u->data,
+ u->len, ch->h_object)) {
+ ap_n++;
+ ap_b += u->len;
+ }
+ }
+ if (gsp_sema_dbg && svc_gl_up_log < 8) {
+ svc_gl_up_log++;
+ pr_info("sema-gl: uploads applied=%u/%u bytes=%u h=0x%x push=0x%llx\n",
+ ap_n, svc_gl.n_up, ap_b, ch->h_object,
+ push_va);
+ }
+ }
memset(blob, 0, sizeof(blob));
blob_rc = svc_read_va_trusted(vgpu, svc_gl.prog_va, blob,
sizeof(blob));
@@ -7070,9 +7228,15 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
}
if (blob_trusted) {
blob_n = sizeof(blob);
+ blob_src = "trusted-prog";
+ } else if (svc_gl_prog_len) {
+ blob_n = svc_gl_prog_len;
+ memcpy(blob, svc_gl_prog, blob_n);
+ blob_src = "prog-hex";
} else if (svc_gl.blob_len) {
blob_n = svc_gl.blob_len;
memcpy(blob, svc_gl.blob, blob_n);
+ blob_src = "lid-fallback";
}
if (blob_n) {
memset(&pr, 0, sizeof(pr));
@@ -7095,7 +7259,7 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
s2.qmd[19], s2.qmd[20], s2.qmd[29], s2.qmd[31],
s2.qmd[5]);
pr_info("sema-gl: M3 code src=%s read_rc=%d len=%u lid=%u first=%08x %08x %08x %08x\n",
- blob_trusted ? "trusted-prog" : "lid-fallback",
+ blob_src,
blob_rc, blob_n, svc_gl.blob_len,
get_unaligned_le32(blob),
get_unaligned_le32(blob + 4),
@@ -11348,6 +11512,10 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
/* r391f: the inline-write once-only key needs the push's identity. */
svc_pass_hash = svc_push_hash(buf, len);
+ /* SESSION 149 R17 (M4): per-pass reset of the standalone 0x180/0x1b0
+ * upload pair (the tracker pairs one run with its successor). */
+ svc_gl_spot_dst = 0;
+ svc_gl_spot_bytes = 0;
/*
* r316: pending releases record the channel they were decoded for;
@@ -11863,6 +12031,58 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
len - off - 4);
}
+ /*
+ * SESSION 149 R17 (M4): standalone GL-class upload apply. The
+ * context-init upload push (the one-shot program upload) need
+ * not sit inside a recognised C597 section, but it carries
+ * the same subchannel-0 0x180 (LINE_LENGTH_IN) + 0x1b0
+ * (LAUNCH_DMA + LOAD_INLINE_DATA) i2m shape. Pair the last
+ * 0x180 destination with each following 0x1b0 payload and
+ * apply it through the shared inline-write path (the engine
+ * never ran these commands). Once-only by (push, content
+ * hash, dst, bytes); the witness line is bounded.
+ */
+ if (gsp_sema_gl_xlate && ch->engine_type == 0 && subch == 0) {
+ if (op == 1 && addr == 0x180 && count >= 4) {
+ u32 w2, w3;
+
+ memcpy(&w2, buf + off + 12, 4);
+ memcpy(&w3, buf + off + 16, 4);
+ svc_gl_spot_dst =
+ ((u64)(w2 & 0xff) << 32) |
+ (u64)(w3 & 0xfffffffc);
+ memcpy(&svc_gl_spot_bytes, buf + off + 4, 4);
+ } else if (op == 5 && addr == 0x1b0 && count > 1 &&
+ svc_gl_spot_dst &&
+ (trusted || allow_ops)) {
+ u32 bytes = (count - 1) * 4;
+
+ if (bytes && !svc_inline_once_seen(push_va,
+ svc_pass_hash, svc_gl_spot_dst,
+ bytes)) {
+ svc_inline_once_store(push_va,
+ svc_pass_hash,
+ svc_gl_spot_dst, bytes);
+ (void)svc_grce_inline_write(vgpu,
+ svc_gl_spot_dst,
+ buf + off + 8, bytes,
+ ch->h_object);
+ if (gsp_sema_dbg &&
+ svc_gl_lid_log < 24) {
+ svc_gl_lid_log++;
+ pr_info("sema-gl-lid: h=0x%x push=0x%llx dst=0x%llx bytes=%u len=%u trusted=%d first=%08x %08x %08x\n",
+ ch->h_object, push_va,
+ svc_gl_spot_dst, bytes,
+ svc_gl_spot_bytes,
+ trusted,
+ *(const u32 *)(buf + off + 8),
+ off + 16 <= len ? *(const u32 *)(buf + off + 12) : 0,
+ off + 20 <= len ? *(const u32 *)(buf + off + 16) : 0);
+ }
+ }
+ }
+ }
+
if (op == 3 || op == 5) {
/*
* NON_INC / ONE_INC methods carry their own data
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-28 16:16:11 +0000