summaryrefslogtreecommitdiffstats
path: root/kernel/gsp_sema_service.c
diff options
context:
space:
mode:
Diffstat (limited to 'kernel/gsp_sema_service.c')
-rw-r--r--kernel/gsp_sema_service.c182
1 files changed, 157 insertions, 25 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index ac6f392..6d2bee7 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -7153,6 +7153,104 @@ static u64 svc_gl_att_h; /* channel whose subch carries the C597 bind */
static u32 svc_gl_att_subch;
static u32 svc_gl_draw_log; /* bounded draw-section-open witness */
/*
+ * SESSION 153-CONTINUED-13: the C597 attachment is per-channel. The single
+ * (h_object, subch) slot was overwritten by the RM channel's periodic
+ * C597-bind pushes (h=0xbfef0002, observed every ~7 s on this boot), after
+ * which the GLX client's draw pushes on 0x1000013 failed the BEGIN
+ * recogniser's `svc_gl_att_h == ch->h_object` test and no draw section was
+ * ever opened (a boot-level, order-dependent race: the r954 boot decoded
+ * no such pushes). A small table (first match wins, dedup on note) keeps
+ * every channel's bind sticky independently, so the draw channel's
+ * attachment cannot be stolen.
+ */
+#define SVC_GL_ATT_MAX 8
+static u64 svc_gl_att_tab_h[SVC_GL_ATT_MAX];
+static u8 svc_gl_att_tab_sub[SVC_GL_ATT_MAX];
+
+static void svc_gl_att_note(u64 h, u32 subch)
+{
+ u32 i, free = SVC_GL_ATT_MAX;
+
+ for (i = 0; i < SVC_GL_ATT_MAX; i++) {
+ if (svc_gl_att_tab_h[i] == h &&
+ svc_gl_att_tab_sub[i] == (u8)subch) {
+ /* refresh LRU position: move to slot 0 */
+ if (i) {
+ memmove(&svc_gl_att_tab_h[1],
+ &svc_gl_att_tab_h[0],
+ (size_t)i * sizeof(u64));
+ memmove(&svc_gl_att_tab_sub[1],
+ &svc_gl_att_tab_sub[0],
+ (size_t)i);
+ svc_gl_att_tab_h[0] = h;
+ svc_gl_att_tab_sub[0] = (u8)subch;
+ }
+ return;
+ }
+ if (!svc_gl_att_tab_h[i] && free == SVC_GL_ATT_MAX)
+ free = i;
+ }
+ if (free == SVC_GL_ATT_MAX) {
+ /* table full: evict the oldest (last) slot */
+ free = SVC_GL_ATT_MAX - 1;
+ }
+ memmove(&svc_gl_att_tab_h[1], &svc_gl_att_tab_h[0],
+ (size_t)free * sizeof(u64));
+ memmove(&svc_gl_att_tab_sub[1], &svc_gl_att_tab_sub[0],
+ (size_t)free);
+ svc_gl_att_tab_h[0] = h;
+ svc_gl_att_tab_sub[0] = (u8)subch;
+ /* keep the legacy single slot pointing at the newest note (logging) */
+ svc_gl_att_h = h;
+ svc_gl_att_subch = subch;
+}
+
+static bool svc_gl_att_has(u64 h, u32 subch)
+{
+ u32 i;
+
+ for (i = 0; i < SVC_GL_ATT_MAX; i++)
+ if (svc_gl_att_tab_h[i] == h &&
+ svc_gl_att_tab_sub[i] == (u8)subch)
+ return true;
+ return false;
+}
+
+static u32 svc_gl_att_subch_of(u64 h)
+{
+ u32 i;
+
+ for (i = 0; i < SVC_GL_ATT_MAX; i++)
+ if (svc_gl_att_tab_h[i] == h)
+ return svc_gl_att_tab_sub[i];
+ return 0xffu;
+}
+
+static void svc_gl_att_clear(u64 h, u32 subch)
+{
+ u32 i;
+
+ for (i = 0; i < SVC_GL_ATT_MAX; i++)
+ if (svc_gl_att_tab_h[i] == h &&
+ svc_gl_att_tab_sub[i] == (u8)subch) {
+ u32 n = SVC_GL_ATT_MAX - 1 - i;
+
+ if (n)
+ memmove(&svc_gl_att_tab_h[i],
+ &svc_gl_att_tab_h[i + 1],
+ (size_t)n * sizeof(u64));
+ if (n)
+ memmove(&svc_gl_att_tab_sub[i],
+ &svc_gl_att_tab_sub[i + 1],
+ (size_t)n);
+ svc_gl_att_tab_h[SVC_GL_ATT_MAX - 1] = 0;
+ svc_gl_att_tab_sub[SVC_GL_ATT_MAX - 1] = 0;
+ if (svc_gl_att_h == h)
+ svc_gl_att_h = svc_gl_att_tab_h[0];
+ return;
+ }
+}
+/*
* SESSION 153 (G-B gate: the client's own C597 draws must open sections).
* The replay guard at svc_gl_flush consults svc_gr_cand_push_seen(), which
* returns true when the push VA sits in the GR candidate ring - even when
@@ -7411,7 +7509,13 @@ static void svc_gl_hold_store(u32 h, u64 prog, u64 param, u32 psize,
{
u32 i, free = SVC_GL_HOLD_MAX;
- if (!h || !prog || !param || !rel)
+ /*
+ * SESSION 153-CONTINUED-13: rel == 0 is admitted (a section that has
+ * real operands but flushed before the channel's release was decoded
+ * stashes them here); a later call with rel != 0 completes the entry
+ * and a rel == 0 call must NEVER wipe a stored release.
+ */
+ if (!h || !prog || !param)
return;
for (i = 0; i < SVC_GL_HOLD_MAX; i++) {
if (svc_gl_hold_tab[i].h == h) {
@@ -7427,8 +7531,10 @@ static void svc_gl_hold_store(u32 h, u64 prog, u64 param, u32 psize,
svc_gl_hold_tab[free].prog_va = prog;
svc_gl_hold_tab[free].param_va = param;
svc_gl_hold_tab[free].param_size = psize;
- svc_gl_hold_tab[free].rel_va = rel;
- svc_gl_hold_tab[free].rel_payload = rpay;
+ if (rel) {
+ svc_gl_hold_tab[free].rel_va = rel;
+ svc_gl_hold_tab[free].rel_payload = rpay;
+ }
}
static bool svc_gl_hold_load(u32 h, u64 *prog, u64 *param, u32 *psize,
@@ -7770,7 +7876,30 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
}
if (!svc_gl.prog_va || !svc_gl.param_va ||
!svc_gl.rel_va) {
- if (gsp_sema_dbg && svc_gl_skip_log < 16) {
+ /*
+ * SESSION 153-CONTINUED-13: the release may be
+ * decoded AFTER this section in ring order
+ * (the r955 init: the 24 B release pushes sit
+ * behind the 1524 B init push in the ring, so
+ * every replay pass of the section flushed
+ * before svc_gl.rel_va was known). When the
+ * operands are real but only the release is
+ * missing, stash them for the channel so the
+ * next section/pass (by then the constant
+ * release stream has been decoded) captures
+ * with src=hold instead of losing the init
+ * capture - without which the guest's GLX
+ * init completion degrades and the client
+ * never emits its draw pushes at all.
+ */
+ if (svc_gl.prog_va && svc_gl.param_va &&
+ !svc_gl.rel_va)
+ svc_gl_hold_store(ch->h_object,
+ svc_gl.prog_va,
+ svc_gl.param_va,
+ svc_gl.param_size,
+ 0, 0);
+ if (gsp_sema_dbg && svc_gl_skip_log < 2048) {
svc_gl_skip_log++;
pr_info("sema-gl: flush skip h=0x%x push=0x%llx prog=0x%llx param=0x%llx rel=0x%llx (no operands, no hold)\n",
ch->h_object, push_va,
@@ -12705,7 +12834,7 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
* colour target, constant-buffer selectors).
*/
if (gsp_sema_gl_xlate && !ch->engine_type && trusted &&
- !svc_gl_att_h) {
+ !svc_gl_att_has(ch->h_object, 0)) {
u32 o2 = 0;
while (o2 + 4 <= len) {
@@ -12717,8 +12846,7 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
sc2 = (h2 >> 13) & 0x7;
ad2 = (h2 & 0x1fff) << 2;
if (op2 == 4 && ad2 == 0x1618 && sc2 == 0) {
- svc_gl_att_h = ch->h_object;
- svc_gl_att_subch = 0;
+ svc_gl_att_note(ch->h_object, 0);
if (gsp_sema_dbg && svc_gl_draw_log < 64) {
svc_gl_draw_log++;
pr_info("sema-gl: attach-on-BEGIN h=0x%x push=0x%llx off=0x%x (no explicit C597 bind seen)\n",
@@ -12760,13 +12888,17 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
* the replay channel cannot translate (the r929 v1 fault
* class), so they must stay outside the sliced window.
*/
- if (gsp_sema_gl_xlate && !ch->engine_type &&
- svc_gl_att_h == ch->h_object) {
- if (subch != svc_gl_att_subch)
- gl_win_start = 0;
- else if (!gl_win_start &&
- !(op == 1 && addr >= 0x1b00 && addr <= 0x1b0c))
- gl_win_start = off;
+ if (gsp_sema_gl_xlate && !ch->engine_type) {
+ u32 as = svc_gl_att_subch_of(ch->h_object);
+
+ if (as != 0xffu) {
+ if (subch != as)
+ gl_win_start = 0;
+ else if (!gl_win_start &&
+ !(op == 1 && addr >= 0x1b00 &&
+ addr <= 0x1b0c))
+ gl_win_start = off;
+ }
}
/*
@@ -13028,8 +13160,7 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
*/
if (gsp_sema_gl_xlate && !ch->engine_type && op == 4 &&
addr == 0x1618 && !svc_gl.seen &&
- svc_gl_att_h == ch->h_object &&
- subch == svc_gl_att_subch) {
+ svc_gl_att_has(ch->h_object, subch)) {
u64 keep_rel = svc_gl.rel_va;
u32 keep_pay = svc_gl.rel_payload;
u32 wstart = gl_win_start ? gl_win_start : off;
@@ -13061,8 +13192,7 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
if (gsp_sema_gl_xlate && op == 4 && addr >= 0x2000 &&
addr < 0x2800 && (addr & 0x3f) == 0 &&
((svc_gl.seen && subch == svc_gl.subch) ||
- (svc_gl_att_h == ch->h_object &&
- subch == svc_gl_att_subch))) {
+ svc_gl_att_has(ch->h_object, subch))) {
u32 j = (addr - 0x2000) / 0x40;
if (j < 32)
@@ -13170,9 +13300,11 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
* remember it so the class-space recognizer
* (BEGIN 0x1618, below) accepts this channel's
* later per-push-CONTENT pushes that carry no
- * SET_OBJECT of their own. */
- svc_gl_att_h = ch->h_object;
- svc_gl_att_subch = subch;
+ * SET_OBJECT of their own.
+ * SESSION 153-CONTINUED-13: per-channel table -
+ * a foreign channel's periodic C597 bind must
+ * not steal this channel's attachment. */
+ svc_gl_att_note(ch->h_object, subch);
/*
* SESSION 153: witness every C597 section open
* (bounded) - it is the recognizer-side proof
@@ -13194,10 +13326,10 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
/* A different class bound over the attached
* subchannel replaces the C597 bind: drop the
* attachment so the class-space recognizer
- * cannot misread methods of the new class. */
- if (ch->h_object == svc_gl_att_h &&
- subch == svc_gl_att_subch)
- svc_gl_att_h = 0;
+ * cannot misread methods of the new class.
+ * SESSION 153-CONTINUED-13: clears only this
+ * channel's entry. */
+ svc_gl_att_clear(ch->h_object, subch);
}
} else if (gsp_sema_gl_xlate && svc_gl.seen &&
subch == svc_gl.subch) {
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-29 17:51:23 +0000