vgsp-sema: bind the scrub slot to the EXACT 4096-entry channel (NUM_COPY_BLOCKS) - the >=4096 test also matched every client channel (32768 entries in this driver version), so the pass authored for whichever client channel registered last while the real scrubber's finish payload stayed zero (the vkAllocateMemory -2 gate, r701 live evidence: slot held h=0xbeee0102/entries=32768 and the pass logged 'scrub author put=0')

1 files changed, 19 insertions, 6 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index e7c55d2..b311c0d 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -1586,7 +1586,18 @@ void gsp_sema_service_channel_add(const struct sema_channel_desc *desc)
 		 * channel; the stashed geometry survives, so the scrub path
 		 * does not depend on the channel-table identity at all.
 		 */
-		if (desc->gpfifo_entries >= 4096 && desc->gpfifo_va &&
+		/*
+		 * m112b: the CeUtils scrubber is the ONLY exactly-4096-entry
+		 * channel (NUM_COPY_BLOCKS). The old `>= 4096` test also
+		 * matched every client channel (this driver version: 32768
+		 * entries, not the 1024 the comment below assumed), so the
+		 * single scrub slot bound to whichever client channel
+		 * registered last (observed r701: the slot held h=0xbeee0102
+		 * userd=0x8f400/entries=32768 and the pass authored put=0 for
+		 * the wrong channel while the real scrubber's payload stayed
+		 * zero - the vkAllocateMemory -2 gate).
+		 */
+		if (desc->gpfifo_entries == 4096 && desc->gpfifo_va &&
 		    desc->userd_pa) {
 			struct svc_scrub *s = svc_scrub_get(desc->vgpu, true);
 
@@ -1619,11 +1630,13 @@ void gsp_sema_service_channel_add(const struct sema_channel_desc *desc)
 				desc->h_object, desc->gpfifo_va,
 				desc->gpfifo_entries, desc->userd_pa,
 				s->userd_as);
-		} else if (desc->gpfifo_entries >= 4096) {
-			/* m112b: a 4096+-entry channel that fails the stash
-			 * condition (missing VA or USERD PA) never becomes a
-			 * scrub object - log it so a silent no-authoring
-			 * boot is diagnosable. */
+		} else if (desc->gpfifo_entries >= 4096 &&
+			   desc->gpfifo_entries != 32768) {
+			/* m112b: a non-32768 channel with >=4096 entries that
+			 * fails the stash condition (missing VA or USERD PA)
+			 * is a scrubber candidate the service cannot author
+			 * for - log it so a silent no-authoring boot is
+			 * diagnosable. */
 			pr_info_ratelimited("sema-svc: scrubber-stash MISS h=0x%x entries=%u va=0x%llx userd_pa=0x%llx\n",
 				desc->h_object, desc->gpfifo_entries,
 				desc->gpfifo_va, desc->userd_pa);