vgsp-sema: m154 drop injected pins that collide with a live channel ring

r153 root cause (3rd-client userspace spin for the rest of the boot): the
guest scanner's merged CE-window run (va=0x121000000 len=0x40000; the
merged length varies per session) covered a CE channel's GPFIFO ring VA
0x121010000. svc_ipin_store took precedence in the ring read path, so the
ring read the guest page at the wrong PA (0x102e02000): an all-zero entry
was silently consumed, the pool release was never authored
(pushes frozen at 1643, crel frozen), and victory_matmul spun in
userspace for 50+ min. The ring VA translation must come from the
channel's own discovery path; an injected pin inside any live channel's
ring range is always wrong - drop it (counted + logged, first 8 per
session). Validated on the next cycle: 'injected pin ... DROPPED' lines
plus 'entry[1] raw!=0', advancing pushes, MATMUL bad=0 STATUS OK.

1 files changed, 70 insertions, 2 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index d2d1462..f8925df 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -989,6 +989,13 @@ static bool svc_gr_content_rearm;
 static u32 svc_cepin_log;
 
 /*
+ * m154: injected pins dropped because they collide with a live channel's
+ * GPFIFO ring range (see svc_handle_map_add). Counted + logged so the
+ * defensive drop is visible in the boot log.
+ */
+static u32 svc_ring_pin_skips;
+
+/*
  * m148 (second-client wedge): re-arm the per-rank one-shot ring/push-buffer
  * latches for a (re-)registered channel. The guest driver rebuilds the GSP
  * session for every client context and RM reuses the same object handles and
@@ -1034,6 +1041,7 @@ void gsp_sema_service_channel_add(const struct sema_channel_desc *desc)
 	if (!desc->engine_type) {
 		WRITE_ONCE(svc_gr_content_rearm, true);
 		svc_cepin_log = 0;
+		svc_ring_pin_skips = 0;
 	}
 
 	/*
@@ -15404,6 +15412,41 @@ static u32 svc_map_add_head;	/* producer */
 static u32 svc_map_add_tail;	/* consumer (service thread) */
 static DEFINE_SPINLOCK(svc_map_add_lock);
 
+/*
+ * m154: does this injected-pin VA fall inside any live channel's GPFIFO ring
+ * range? The ring VA translation must come from the channel's own discovery
+ * path (channel object / push-buffer scan); a scanner run that happens to
+ * span the ring VA is enumerating a different mapping and its translation is
+ * always wrong for the ring (r153: an all-zero read consumed a ring entry
+ * and wedged the client for the boot). Called on the service thread; takes
+ * chan_lock like the rewind below.
+ */
+static bool svc_va_hits_chan_ring(u64 va)
+{
+	unsigned long flags;
+	u32 i;
+	bool hit = false;
+
+	spin_lock_irqsave(&svc.chan_lock, flags);
+	for (i = 0; i < SVC_MAX_CHANNELS; i++) {
+		struct svc_channel *ch = &svc.chan[i];
+		u64 lo, hi;
+
+		if (!ch->valid || !ch->gpfifo_va || !ch->gpfifo_entries)
+			continue;
+		lo = ch->gpfifo_va & ~(u64)(SEMA_PAGE_SIZE - 1);
+		hi = (ch->gpfifo_va +
+		      (u64)ch->gpfifo_entries * 8 + SEMA_PAGE_SIZE - 1) &
+		     ~(u64)(SEMA_PAGE_SIZE - 1);
+		if (va >= lo && va < hi) {
+			hit = true;
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&svc.chan_lock, flags);
+	return hit;
+}
+
 static void svc_handle_map_add(void)
 {
 	unsigned long flags;
@@ -15428,8 +15471,33 @@ static void svc_handle_map_add(void)
 		ap = req.ap ? req.ap : SVC_APERTURE_SYS;
 		for (off = 0; off < (req.len ? req.len : 1);
 		     off += SEMA_PAGE_SIZE) {
-			svc_ipin_store(req.va + off, req.pa + off, ap);
-			svc_lat_store(req.va + off, req.pa + off, ap);
+			u64 va = req.va + off;
+
+			/*
+			 * m154: never let an injected pin shadow a live
+			 * channel's GPFIFO ring. r153: the scanner's merged
+			 * CE-window run (va=0x121000000 len=0x40000, the
+			 * length varies per session) covered a CE channel's
+			 * ring VA 0x121010000; the injected translation took
+			 * precedence in svc_ipin_lookup/read, the ring then
+			 * read the guest page at 0x102e02000 - an all-zero
+			 * entry was silently consumed, the pool release was
+			 * never authored, and the client spun in userspace
+			 * for the rest of the boot (pushes frozen). The ring
+			 * pages already have their own discovery path (the
+			 * channel object / push-buffer scan); a colliding
+			 * injection is always the wrong translation, so drop
+			 * it and leave the ring to that path.
+			 */
+			if (svc_va_hits_chan_ring(va)) {
+				svc_ring_pin_skips++;
+				if (svc_ring_pin_skips <= 8)
+					pr_info("sema-svc: injected pin va=0x%llx DROPPED (live channel ring range; ring reads stay on the channel's own translation)\n",
+						va);
+				continue;
+			}
+			svc_ipin_store(va, req.pa + off, ap);
+			svc_lat_store(va, req.pa + off, ap);
 		}
 		/*
 		 * m149: bounded per-session evidence that the CE push-buffer