From dac10b66798694de675852c94bc26c6e90d39705 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 6 Nov 2026 09:48:53 -0500 Subject: vgsp-gl: spend the draw-coverage receipts on real-CB draws The GL-COVER 12/boot budget was consumed by the pre-CB (synthetic identity) draws, so no clip-coverage receipt ever described a draw that used the client's real fixed CB. Emit the receipts only while svc_gl_cb_img_valid and re-arm the counter whenever a new CB image passes the strict projection gate, so the first draws after the real matrix lands carry the cover receipt. --- kernel/gsp_sema_service.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 5d54990..5348c95 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -15663,6 +15663,7 @@ static u32 svc_gl_cb_copy_val; static u32 svc_gl_cb_copy_hash; static u32 svc_gl_cb_copy_log; static u32 svc_gl_cb_seed_log; +static u32 svc_gl_cover_n; /* * r1512: provenance of the page most recently written into the forced MME * seed (what the VS's c[0x0] bank will contain). Read by the coverage @@ -16050,6 +16051,8 @@ static void svc_gl_cb_upload_scan(struct nv_vgpu_device *vgpu, u32 h_object, */ if (!svc_gl_cb_img_valid && svc_gl_cb_mvp_ok(svc_gl_cb_img)) { svc_gl_cb_img_valid = true; + /* r1523: fresh draw-coverage receipts for the real-CB draws. */ + svc_gl_cover_n = 0; pr_info("vgsp-sema: sema-gl: CB-UPLOAD h=0x%x push=0x%llx base=0x%llx sel=%u a=0x%08x bc=0x%llx off=0x%x runs=%llu words=%llu projection=ok first8=%08x %08x %08x %08x %08x %08x %08x %08x\n", h_object, push_va, svc_gl_cb_img_base, svc_gl_cb_sel_seen ? 1u : 0u, svc_gl_cb_sel_a, @@ -16634,7 +16637,6 @@ static void svc_gl_cover_log(struct nv_vgpu_device *vgpu, const u8 *buf, u32 first, u32 count, u64 iva, u32 stride, u32 voff, const u32 *cand, u32 ncand) { - static u32 cover_n; static u8 cbalt[SEMA_PAGE_SIZE]; const u8 *cbp; u32 cbm[16], cbfirst[8]; @@ -16655,9 +16657,15 @@ static void svc_gl_cover_log(struct nv_vgpu_device *vgpu, const u8 *buf, void __iomem *bar0; u32 k; - if (cover_n >= 12u) + /* + * r1523: the draw-coverage receipt is only meaningful once the fixed-CB + * image is the client's real page (the first receipts used to burn the + * 12/boot budget on the pre-CB synthetic draws). The counter re-arms + * when a new CB image is validated (svc_gl_cb_upload_scan). + */ + if (!svc_gl_cb_img_valid || svc_gl_cover_n >= 12u) return; - cover_n++; + svc_gl_cover_n++; if (!stride) stride = 24u; -- cgit v1.2.3