vgsp: m170 fail-closed argument spans (an arg pointer whose first page resolves nothing at fill time marks the launch stalled for the bounded m150 hold instead of forwarding stale/zero operands; r174 matmul cand[2]/[3] probe=none -> bad=65536)

1 files changed, 31 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 93bcd20..8303c87 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -13197,6 +13197,7 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu)
 		u64 base = wins[w];
 		u32 p;
 		u32 before = svc_fwd_req.gr_n_data;
+		bool first_unresolved = false;	/* m170: span's first page failed */
 		u64 pba = 0;
 		u32 pba_ap = 0;
 		u32 span;
@@ -13292,6 +13293,18 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu)
 					pa = ipa;
 					ap = (u32)iap;
 				} else if (svc_resolve_va(vgpu, va, &pa, &ap)) {
+					/*
+					 * m170 (R4a): remember that the very
+					 * first page of this span failed to
+					 * resolve - the fail-closed trigger
+					 * below distinguishes it from the
+					 * benign "0 new pages" of a span
+					 * whose pages an earlier candidate
+					 * already mapped.
+					 */
+					if (p == 0 &&
+					    svc_fwd_req.gr_n_data == before)
+						first_unresolved = true;
 					break;
 				}
 			}
@@ -13337,6 +13350,24 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu)
 		pr_info("vgsp-sema: svc-gr candidate[%u] base=0x%llx -> %u new pages (total %u)\n",
 			w, base, svc_fwd_req.gr_n_data - before,
 			svc_fwd_req.gr_n_data);
+		if (is_arg[w] && svc_fwd_req.gr_n_data == before &&
+		    first_unresolved) {
+			/*
+			 * m170 (AGENT-F R4a): a high argument pointer whose
+			 * FIRST page resolved nothing at fill time is the
+			 * partial-operand signature - the launch would forward
+			 * with stale/zero data for that operand (r174: matmul
+			 * cand[2]/[3] probe=none, 0 pages, bad=65536; the
+			 * other operands resolved via pins). Fail closed: mark
+			 * the launch stalled so the m150 hold keeps the entry
+			 * and retries the fill while the pins land (bounded,
+			 * then forwards anyway - never a hang, never silent
+			 * truncation).
+			 */
+			svc_gr_data_stalled = true;
+			pr_err_ratelimited("vgsp-sema: svc-gr data fill: arg base=0x%llx resolved 0 pages; launch held fail-closed\n",
+					   base);
+		}
 		/*
 		 * m150: an argument pointer that resolves zero pages is the
 		 * second-client zeros signature; record the walk result per