vgsp-sema: raise the sema-rdw witness budget to 6000/client and log the viawalk retry outcome (walk rc, pa, plausibility) - session 124 evidence: for the GR submit push 0x4ca0000 the read returns rc=0 src=4 (trusted) even AFTER the user VAS registers and walk_probe rc=0, yet NO viawalk row and NO decode row appear and the entry skips after ~250 rescues: the entry is consumed between the read and the decode (plausibility passed but the decode never ran, or an earlier branch took it) - next: witness the branch taken after the read (plausibility verdict, injected/zero_nop/displaced flags)

1 files changed, 18 insertions, 6 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index c9f5969..90ea545 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -24431,7 +24431,7 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 					rd_rc = svc_read_va_push(vgpu, ch, va,
 								 pb, len);
 					unreadable = rd_rc != 0;
-					if (gsp_sema_dbg && svc_rdw_log < 400 &&
+					if (gsp_sema_dbg && svc_rdw_log < 6000 &&
 					    !ch->engine_type) {
 						svc_rdw_log++;
 						pr_info("sema-rdw: h=0x%x va=0x%llx len=%u rc=%d src=%u\n",
@@ -24543,16 +24543,28 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 									 * again and keep the entry
 									 * unreadable.
 									 */
-									if (!svc_walk_vaspaces(vgpu,
+									int wr = svc_walk_vaspaces(vgpu,
 										va & ~0xfffULL,
-										&wpa, &wap) &&
-									    !svc_read_ap(vgpu,
+										&wpa, &wap);
+									int rr = wr ? wr : svc_read_ap(vgpu,
 										wpa + (va & 0xfff),
 										wap == SVC_APERTURE_FB ?
 											SVC_APERTURE_FB :
 											SVC_APERTURE_SYS,
-										vb, len) &&
-									    svc_method_stream_plausible(vb, len)) {
+										vb, len);
+									bool pl = !rr ? svc_method_stream_plausible(vb, len)
+										      : false;
+
+									if (gsp_sema_dbg &&
+									    svc_pushpg_fb_log < 64) {
+										svc_pushpg_fb_log++;
+										pr_info("sema-pushpg: h=0x%x va=0x%llx viawalk rc=%d pa=0x%llx plaus=%d\n",
+											ch->h_object, va,
+											wr ? wr : rr,
+											wpa + (va & 0xfff),
+											pl ? 1 : 0);
+									}
+									if (!wr && !rr && pl) {
 										memcpy(pb, vb, len);
 										svc.pushpg_fallback++;
 										ok = true;