kernel: decode release pushes read through injected pins instead of rescuing them

Real CE release pushes start with INC_METHOD addr 0x700 (0x200381c0, count
3, subch 4), and svc_method_stream_plausible requires method address 0, so
every readable release push was treated as a false pairing, rescued (fails)
and skipped - the client's tracking-semaphore release never applied and
cuCtxCreate waited forever (slot payload 74 vs queued 75). A buffer read
through a host-injected (ipin) translation is now decoded release-only
(allow_ops=false) when it fails the push-start heuristic; self-discovered
translations keep the strict rescue path.

1 files changed, 24 insertions, 6 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index fa0fe65..ac1849f 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -3872,6 +3872,8 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 					bool unreadable =
 						svc_read_va_trusted(vgpu, va,
 								    pb, len) != 0;
+					bool injected = false;
+					bool allow_ops = (ch->engine_type != 0);
 
 					/*
 					 * A resolved buffer that does not start
@@ -3879,12 +3881,28 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 					 * (content-scanned map; observed firmware
 					 * and kernel data pages). Handle it like
 					 * an unreadable push so the content rescue
-					 * can find the real page.
+					 * can find the real page. Exception: a
+					 * host-injected translation is verified
+					 * truth, and real CE release pushes start
+					 * with an INC_METHOD whose address is not
+					 * zero (observed 0x200381c0, addr 0x700):
+					 * decode those release-only instead of
+					 * discarding them, so the client's
+					 * tracking-semaphore releases still apply.
 					 */
-					if (!unreadable &&
-					    !svc_method_stream_plausible(pb, len)) {
-						svc.false_trans++;
-						unreadable = true;
+					if (!unreadable) {
+						u64 ipa;
+						int iap;
+
+						injected = (svc_ipin_lookup(va, &ipa,
+									    &iap) == 0);
+						if (!svc_method_stream_plausible(pb, len)) {
+							svc.false_trans++;
+							if (injected)
+								allow_ops = false;
+							else
+								unreadable = true;
+						}
 					}
 
 					if (!unreadable) {
@@ -3902,7 +3920,7 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 
 							svc_decode_stream(vgpu, pb,
 									  len, 0,
-									  ch->engine_type != 0,
+									  allow_ops,
 									  ch->h_object,
 									  ch->engine_type,
 									  va);