diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-11 16:43:33 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-11 16:43:33 -0400 |
| commit | 5fa773c2cd4e166d2c31a40aff9fb63e7534fec3 (patch) | |
| tree | 871d394be07e1d8a991a2f85fa5c46cb0e8bd201 /kernel/gsp_sema_service.h | |
| parent | 1743c19465f4c024010d37e1fd96e9192cdc4525 (diff) | |
| download | open-iov-5fa773c2cd4e166d2c31a40aff9fb63e7534fec3.tar.gz open-iov-5fa773c2cd4e166d2c31a40aff9fb63e7534fec3.zip | |
vgsp-sema: scope channel deletion to the owning RM client (ISSUE-0002)
Handles are per-client, but the FREE path unregistered any channel whose
numeric handle matched the freed object, with no client check. r77 root
cause of the third-client pma scrub hang: the boot session's CeUtils
scrubber channel (h=0x2, gpfifo=0x120064000, entries=4096) was
unregistered when an unrelated class-0x2080 object with handle 0x2 in
client 0xc1d00011 was freed. The guest kept using the live channel for
the scrub; the service no longer pumped it, its pushes were never
decoded and the channel-buffer finish payload (pbGpuVA+0x6c004) was
never written, so scrubCheckAndWaitForSize polled forever (sysrq stack:
ceutilsUpdateProgress -> channelReadChannelMemdesc).
Channel registration now records h_client (the RM alloc header's client)
and deletion matches (h_object, h_client); a missing client on either
side keeps the handle-only behaviour. Re-registration keeps the
counter/release slots only for the same (handle, client) pair. Live
proof from the hung VM: sema_probe translates the finish-payload VA
0x12006c004 to pa=0x10f962004 aperture=ram - the word the guest polls is
reachable; the channel was simply invisible to the pump.
Diffstat (limited to 'kernel/gsp_sema_service.h')
| -rw-r--r-- | kernel/gsp_sema_service.h | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h index 4b04892..e00ef91 100644 --- a/kernel/gsp_sema_service.h +++ b/kernel/gsp_sema_service.h @@ -21,6 +21,12 @@ */ struct sema_channel_desc { u32 h_object; + u32 h_client; /* owning RM client; handles are per-client, + * so deletion must match it too (ISSUE-0002 + * r78: a class-0x2080 object with handle 0x2 + * in another client unregistered the scrubber + * channel 0x2 and its finish payload was never + * written again). */ u32 engine_type; u32 cid; /* RM channel id (the doorbell token vector) */ u64 gpfifo_va; @@ -33,7 +39,7 @@ struct sema_channel_desc { }; void gsp_sema_service_channel_add(const struct sema_channel_desc *desc); -void gsp_sema_service_channel_del(u32 h_object); +void gsp_sema_service_channel_del(u32 h_object, u32 h_client); /* * A GPU VA space whose top-level page directory the driver has published (the |