sema: opdef and GR hold bounds are never re-armed while active - the arm-on-VA-change rule moved the deadline on every held entry (streams2 wedge: opdef=955/13/0, drain held climbing, expired 0); entries held while a bound is active ride it and flush together

1 files changed, 22 insertions, 2 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 45ce693..21f880d 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -14838,7 +14838,18 @@ static bool svc_opdef_hold(struct nv_vgpu_device *vgpu, struct svc_channel *ch,
 	 */
 	if (!launch_va)
 		launch_va = 1;	/* anonymous launch: still absolutely bound */
-	if (ch->opdef_hold_dead_va != launch_va) {
+	/*
+	 * r368: an ACTIVE bound is never re-armed. The pump walks up to
+	 * SVC_OPDEF_SLOTS held entries, each with its OWN push VA; the r361
+	 * arm-on-VA-change rule restarted the deadline on every entry
+	 * change, so with several held launches the deadline moved forever
+	 * (streams2 wedge: opdef=955/13/0, held climbing, expired 0). The
+	 * first hold arms the absolute deadline; entries held while it is
+	 * active ride it and flush together when it fires. A fresh bound is
+	 * armed once the previous one has passed.
+	 */
+	if (!ch->opdef_hold_dead_va ||
+	    time_after_eq(jiffies, ch->opdef_hold_deadline)) {
 		ch->opdef_hold_dead_va = launch_va;
 		ch->opdef_hold_deadline = jiffies +
 			msecs_to_jiffies(SVC_OPDEF_HOLD_MS);
@@ -16749,7 +16760,16 @@ static bool svc_gr_hold_bound_expired(struct svc_channel *ch, u64 launch_va)
 		launch_va = 1;	/* anonymous launch: still absolutely bound */
 	if (!cap_ms)
 		cap_ms = 3000;
-	if (ch->gr_hold_dead_va != launch_va) {
+	/*
+	 * r368: mirror of the opdef fix - an ACTIVE bound is never re-armed
+	 * by a different launch VA. The pump can hold several launches whose
+	 * push VAs differ; arming on every VA change moved the deadline
+	 * forever (the same identity bug class as the opdef=955/13/0
+	 * streams2 wedge). The first hold arms; others ride it; a fresh
+	 * bound arms once the previous one has passed.
+	 */
+	if (!ch->gr_hold_dead_va ||
+	    time_after_eq(jiffies, ch->gr_hold_deadline)) {
 		ch->gr_hold_dead_va = launch_va;
 		ch->gr_hold_dead_since = jiffies;
 		ch->gr_hold_deadline = jiffies + msecs_to_jiffies(cap_ms);