diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-25 08:44:34 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-25 08:44:34 -0400 |
| commit | cb8b75c544953e74951e9c91753f3ca0729d060d (patch) | |
| tree | 1bae9d17c12c945ff9e5a1d2580abbbbe04b6705 | |
| parent | 154acff203153d750eb5a381be9183d4e141bf7f (diff) | |
| download | open-iov-cb8b75c544953e74951e9c91753f3ca0729d060d.tar.gz open-iov-cb8b75c544953e74951e9c91753f3ca0729d060d.zip | |
vgsp-sema r686: accept the low aperture (>=0x4000000) for GR/GL release decode in both release forms (0x5c-form and SET_REPORT_SEMAPHORE)
The GR/GL ucode init pushes carry their releases on the RM's low aperture
(the same 0x4000000-0x4ffffff VA family as the push/ring windows): the
live GL init push decodes as rel=0x4b19b10 pay=1 (REPORT_SEM group
200426c0 00000000 04b19b10 00000001 10000000) and rel=0x4b17bb0 pay=3 /
0x4b17e30 pay=1 (0x5c-form 2005c017 04923060 ...), all rejected by the
sysmem-only SEMA_VA_LO bound - the NvOgl engine-init wait then spun
forever. With the bound relaxed (and the push windows injected via the
window-record/memdesc recipe) the releases decode live (have_rel=1,
applied rising) and the un-translated ones queue in svc_pending (417 at
the observed steady state) awaiting the semaphore-VA translations.
| -rw-r--r-- | kernel/gsp_sema_service.c | 21 |
1 files changed, 19 insertions, 2 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index b6fa436..993e507 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -88,6 +88,20 @@ static inline u64 svc_fb_shadow_size(const struct nv_vgpu_device *vgpu) #define SEMA_VA_LO 0x100000000ULL #define SEMA_VA_HI 0x2000000000ULL +/* + * session 79: the GR/GL ucode init releases target the RM's LOW aperture + * (the same 0x4000000-0x4ffffff VA family as the push/ring windows): the + * live GL init push carries `2005c017 04923060 ... 02000001` (0x5c-form, + * va=0x4923060, payload 1, RELEASE) and `200426c0 00000000 04b19b10 + * 00000001 10000000` (REPORT_SEM group, va=0x4b19b10, payload 1, + * RELEASE) - both rejected by the sysmem-only range check, so the GR + * completion never applied and the NvOgl engine-init wait spun forever. + * Accept the low aperture for release decode (the pushes are only + * decoded from trusted ring reads, so the false-positive risk the + * sysmem bound guarded against does not apply here). + */ +#define SVC_LOW_REL_VA_LO 0x4000000ULL + /* Canonical kernel virtual address range (x86_64). */ #define KVA_LO 0xffff800000000000ULL #define KVA_HI 0xffffc00000000000ULL @@ -10760,7 +10774,8 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, if ((op == HOST_SEM_OP_RELEASE || op == HOST_SEM_OP_REDUCTION) && payload && - va >= SEMA_VA_LO && va < SEMA_VA_HI) { + (va >= SEMA_VA_LO || va >= SVC_LOW_REL_VA_LO) && + va < SEMA_VA_HI) { if (page_pa) svc_mark_hot(page_pa); svc.pushes_seen++; @@ -10953,7 +10968,9 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, break; va = ((u64)st.rs_upper << 32) | st.rs_lower; - if (va < SEMA_VA_LO || va >= SEMA_VA_HI) + if ((va < SEMA_VA_LO && + va < SVC_LOW_REL_VA_LO) || + va >= SEMA_VA_HI) break; if (page_pa) svc_mark_hot(page_pa); |