summaryrefslogtreecommitdiffstats
path: root/kernel/gsp_sema_service.c
diff options
context:
space:
mode:
Diffstat (limited to 'kernel/gsp_sema_service.c')
-rw-r--r--kernel/gsp_sema_service.c240
1 files changed, 239 insertions, 1 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 7f3a4b2..f095adc 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -7137,6 +7137,85 @@ static void svc_gl_cap_store(u64 push_va, u64 hash)
svc_gl_cap_hist[i].push_va = push_va;
svc_gl_cap_hist[i].hash = hash;
}
+/*
+ * SESSION 153 CONT.6 (task 1): the per-frame GL section-arrival ledger.
+ * svc_gl_flush is the ONLY point where a C597 section's whole push buffer
+ * (content included) reaches the GL machinery, so every arrival is
+ * recorded here: (push_va, content hash, arrival count). The question the
+ * ledger answers deterministically is whether a NEW (different-content)
+ * section ever arrives after the driver's init - the wall evidence says
+ * the X server's 1524 B section is byte-identical every capture ("replay
+ * already captured" by content hash), but that evidence only covered the
+ * budgeted replay/skip logs. Now: first arrival, every content change
+ * (with the first words and the bound-site words), and a periodic
+ * liveness row per push VA. A hash never seen before on ANY push VA is
+ * NEW-CONTENT - the moment a genuinely new section (a draw stream)
+ * appears, it is on record with its words.
+ */
+#define SVC_GL_ARRIVAL_MAX 64
+static struct {
+ u64 push_va;
+ u64 hash;
+ u32 arrivals;
+} svc_gl_arrivals[SVC_GL_ARRIVAL_MAX];
+static u32 svc_gl_arrival_n;
+static u64 svc_gl_arrival_total;
+static u32 svc_gl_arrival_log; /* bounded new/changed/periodic rows */
+
+static void svc_gl_arrival_note(u64 push_va, const u8 *buf, u32 len)
+{
+ u64 ph = svc_push_hash(buf, len);
+ u32 i, slot = SVC_GL_ARRIVAL_MAX;
+ bool known_hash = false;
+
+ for (i = 0; i < svc_gl_arrival_n; i++) {
+ if (svc_gl_arrivals[i].push_va == push_va) {
+ slot = i;
+ break;
+ }
+ if (svc_gl_arrivals[i].hash == ph)
+ known_hash = true;
+ }
+ svc_gl_arrival_total++;
+ if (slot < SVC_GL_ARRIVAL_MAX) {
+ bool changed = svc_gl_arrivals[slot].hash != ph;
+
+ svc_gl_arrivals[slot].arrivals++;
+ if (!changed &&
+ svc_gl_arrivals[slot].arrivals % 1024 != 0)
+ return;
+ if (svc_gl_arrival_log < 512) {
+ svc_gl_arrival_log++;
+ pr_info("sema-glass: %s h=0x%x push=0x%llx len=%u hash=0x%llx n=%u total=%llu first=%08x %08x %08x %08x\n",
+ changed ? "CONTENT-CHANGED" : "arrival",
+ 0, push_va, len, ph,
+ svc_gl_arrivals[slot].arrivals,
+ svc_gl_arrival_total,
+ len >= 4 ? get_unaligned_le32(buf) : 0,
+ len >= 8 ? get_unaligned_le32(buf + 4) : 0,
+ len >= 12 ? get_unaligned_le32(buf + 8) : 0,
+ len >= 16 ? get_unaligned_le32(buf + 12) : 0);
+ }
+ svc_gl_arrivals[slot].hash = ph;
+ return;
+ }
+ if (svc_gl_arrival_n < SVC_GL_ARRIVAL_MAX) {
+ slot = svc_gl_arrival_n++;
+ svc_gl_arrivals[slot].push_va = push_va;
+ svc_gl_arrivals[slot].hash = ph;
+ svc_gl_arrivals[slot].arrivals = 1;
+ if (svc_gl_arrival_log < 512) {
+ svc_gl_arrival_log++;
+ pr_info("sema-glass: %s h=0x%x push=0x%llx len=%u hash=0x%llx n=1 total=%llu first=%08x %08x %08x %08x\n",
+ known_hash ? "KNOWN-CONTENT-OTHER-VA" : "NEW-CONTENT",
+ 0, push_va, len, ph, svc_gl_arrival_total,
+ len >= 4 ? get_unaligned_le32(buf) : 0,
+ len >= 8 ? get_unaligned_le32(buf + 4) : 0,
+ len >= 12 ? get_unaligned_le32(buf + 8) : 0,
+ len >= 16 ? get_unaligned_le32(buf + 12) : 0);
+ }
+ }
+}
static u32 svc_gl_rep_log; /* bounded replay-already-captured witness */
static u32 svc_gl_prog_log; /* R16 bounded program-read witness */
static u32 svc_gl_up_log; /* R17 bounded section-upload-apply witness */
@@ -7452,6 +7531,13 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
const char *blob_src = "none";
const char *op_src = "stream";
+ /*
+ * SESSION 153 CONT.6 (task 1): record every section arrival (any
+ * trusted or replay state, before any early exit) so a content
+ * change after init cannot hide behind the bounded capture logs.
+ */
+ if (gsp_sema_dbg)
+ svc_gl_arrival_note(push_va, buf, len);
svc_gl_prog_apply_param();
if (!svc_gl.seen || !trusted)
goto out;
@@ -12018,6 +12104,135 @@ static void svc_notify2d_keepalive(struct nv_vgpu_device *vgpu,
}
}
+/*
+ * SESSION 153 CONT.6 (task 2): serve a DENIED DMA copy.
+ *
+ * The X server's GL loop re-pushes transfer-shaped launches whose copy
+ * lands on a pass the trust/replay rules deny (witness:
+ * `sema-dmatrace: denied h=0x1000013 push=0x12001c64c dma=0x0000030d ...
+ * in=0x122281200 out=0x120350000 ... replay=1 eng=0`). Both operands of
+ * this class sit inside the identity guest-RAM window (< svc_pa_max()),
+ * so the emulator can execute the copy itself: read the source GPA, write
+ * the destination GPA, verify the landing bytes. The copy is exactly the
+ * work the hardware copy engine was asked to perform - refusing it only
+ * stalls whatever consumes the destination (the driver's own fence/state
+ * progression). Exactly-once per (push_va, content hash); a refused
+ * shape (operand outside guest RAM, oversized, or failing the readback)
+ * falls through to the existing deny/hold machinery unchanged.
+ */
+#define SVC_SERVE_MAX_BYTES (4u << 20)
+#define SVC_SERVE_HIST 64
+static bool gsp_sema_serve_denied = true;
+module_param_named(sema_serve_denied, gsp_sema_serve_denied, bool, 0644);
+MODULE_PARM_DESC(sema_serve_denied,
+ "Serve a denied transfer-shaped DMA copy between guest-RAM operands by executing it in the emulator (default 1; session 153 CONT.6)");
+static struct {
+ u64 push_va;
+ u64 hash;
+} svc_serve_hist[SVC_SERVE_HIST];
+static u32 svc_serve_hist_next;
+static u32 svc_serve_log; /* bounded served witness */
+static u32 svc_serve_ref_log; /* bounded refusal witness */
+static u64 svc_serve_bytes;
+static u64 svc_serve_ops;
+
+static bool svc_serve_seen(u64 push_va, u64 hash)
+{
+ u32 i;
+
+ for (i = 0; i < SVC_SERVE_HIST; i++)
+ if (svc_serve_hist[i].push_va == push_va &&
+ svc_serve_hist[i].hash == hash)
+ return true;
+ return false;
+}
+
+static void svc_serve_store(u64 push_va, u64 hash)
+{
+ u32 i = svc_serve_hist_next++ % SVC_SERVE_HIST;
+
+ svc_serve_hist[i].push_va = push_va;
+ svc_serve_hist[i].hash = hash;
+}
+
+static bool svc_serve_denied_copy(struct nv_vgpu_device *vgpu,
+ struct svc_channel *ch,
+ const struct svc_push_state *st, u32 dma,
+ u64 push_va, u64 pass_hash)
+{
+ u8 bounce[256];
+ u8 head[32];
+ u64 total = st->line_length;
+ u64 off, bytes = 0;
+ u64 hash = 1469598103934665603ULL;
+ int rc = 0;
+
+ if (!total || total > SVC_SERVE_MAX_BYTES)
+ return false;
+ if (st->offset_in + total > svc_pa_max() ||
+ st->offset_out + total > svc_pa_max()) {
+ if (gsp_sema_dbg && svc_serve_ref_log < 16) {
+ svc_serve_ref_log++;
+ pr_info("sema-serve: refused h=0x%x push=0x%llx in=0x%llx out=0x%llx line=%u dma=0x%08x (operand outside guest RAM)\n",
+ ch->h_object, push_va, st->offset_in,
+ st->offset_out, st->line_length, dma);
+ }
+ return false;
+ }
+ for (off = 0; off < total; off += sizeof(bounce)) {
+ size_t n = (size_t)min_t(u64, sizeof(bounce), total - off);
+ size_t b;
+
+ rc = svc_read(vgpu, st->offset_in + off, bounce, n);
+ if (rc)
+ break;
+ for (b = 0; b < n; b++) {
+ hash ^= bounce[b];
+ hash *= 1099511628211ULL;
+ }
+ rc = svc_write(vgpu, st->offset_out + off, bounce, n);
+ if (rc)
+ break;
+ bytes += n;
+ }
+ if (rc) {
+ if (gsp_sema_dbg && svc_serve_ref_log < 16) {
+ svc_serve_ref_log++;
+ pr_info("sema-serve: refused h=0x%x push=0x%llx in=0x%llx out=0x%llx line=%u rc=%d (read/write failed)\n",
+ ch->h_object, push_va, st->offset_in,
+ st->offset_out, st->line_length, rc);
+ }
+ return false;
+ }
+ /*
+ * Verified landing: read the destination back and compare its first
+ * bytes with the source's. A mismatch means the GPA model of the
+ * operand pair is wrong for this push - say so and do not latch it
+ * as served (the deny path then keeps its historical behaviour).
+ */
+ rc = svc_read(vgpu, st->offset_in, bounce, sizeof(head));
+ if (!rc)
+ rc = svc_read(vgpu, st->offset_out, head, sizeof(head));
+ if (rc || memcmp(head, bounce, sizeof(head))) {
+ if (gsp_sema_dbg && svc_serve_ref_log < 16) {
+ svc_serve_ref_log++;
+ pr_info("sema-serve: declined h=0x%x push=0x%llx out=0x%llx (readback mismatch)\n",
+ ch->h_object, push_va, st->offset_out);
+ }
+ return false;
+ }
+ svc_serve_store(push_va, pass_hash);
+ svc_serve_bytes += bytes;
+ svc_serve_ops++;
+ if (svc_serve_log < 128) {
+ svc_serve_log++;
+ pr_info("sema-serve: served h=0x%x push=0x%llx dma=0x%08x in=0x%llx out=0x%llx bytes=%llu hash=0x%llx verify=ok n=%llu\n",
+ ch->h_object, push_va, dma, st->offset_in,
+ st->offset_out, bytes, hash, svc_serve_ops);
+ }
+ return true;
+}
+
static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
u32 len, u64 page_pa, bool allow_ops,
struct svc_channel *ch, u32 entry_idx,
@@ -13292,6 +13507,7 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
u32 dma = v0;
u32 transfer = DMA_DATA_TRANSFER_TYPE(dma);
u32 n_ops_before = n_ops;
+ bool dma_served = false;
if (gsp_sema_dbg &&
svc.lda_log < (gsp_sema_ops_log > 48 ? gsp_sema_ops_log : 48)) {
@@ -13643,6 +13859,28 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
}
/*
+ * SESSION 153 CONT.6 (task 2): execute the copy a
+ * denied pass would otherwise refuse (see
+ * svc_serve_denied_copy). Placement: after the
+ * allow-path builder (a built op means the copy is
+ * already owned by svc_run_ops), before the owed/
+ * pending marks. A successful serve means nothing is
+ * owed - the dstpend note and the op_tr_pending mark
+ * below are suppressed via dma_served so the slot
+ * completes and later passes classify as replays.
+ */
+ if (gsp_sema_serve_denied && transfer != 0 &&
+ n_ops == n_ops_before && trusted && !replay &&
+ !ch->engine_type && st.line_length && st.have_out &&
+ st.have_in && !DMA_REMAP_ENABLE(dma) &&
+ !svc_serve_seen(push_va, svc_pass_hash) &&
+ svc_serve_denied_copy(vgpu, ch, &st, dma, push_va,
+ svc_pass_hash)) {
+ dma_served = true;
+ svc_dstpend_clear(st.offset_out);
+ }
+
+ /*
* r567: a trusted, transfer-shaped push that decoded
* NO op this pass (its operands are not resolved yet:
* the r569 mail b-copy needed have_in, which the
@@ -13815,7 +14053,7 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
* (non-replay) denied pass marks pending exactly as
* before.
*/
- if (!allow_ops && trusted && !replay &&
+ if (!allow_ops && trusted && !replay && !dma_served &&
!ch->engine_type && transfer != 0 &&
st.line_length && st.have_out && st.have_in &&
!DMA_REMAP_ENABLE(dma) &&
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-29 17:12:23 +0000