vgsp-sema: budget the data window - only real device operands get the full span

r141 showed the 68-pages-per-pointer change starved the operands: the
launch's own QMD VA (0x204608000) and other low-VA candidates each consumed
68 window pages, so a 256 KB operand resolved 0 pages before the 205-page
cap. Give the full span only to high, cudaMalloc-shaped VAs, skip the QMD
VA entirely, and give every other candidate one page. Three 256 KB operands
(3x68=204) now fit.

1 files changed, 19 insertions, 1 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index c07915f..d2d1462 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -12624,8 +12624,26 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu)
 		u32 before = svc_fwd_req.gr_n_data;
 		u64 pba = 0;
 		u32 pba_ap = 0;
+		u32 span;
 		const char *pba_src = "?";
 
+		/*
+		 * Window budget discipline (large buffers): only real device
+		 * operands (high, cudaMalloc-shaped VAs) get the full per-pointer
+		 * span. Low-VA candidates (the launch's own QMD/release/reloc
+		 * pointers) need a single page at most, and the launch's QMD VA
+		 * is not a kernel operand at all - relocating 68 pages for it
+		 * starved the operands that follow and blew the 205-page cap
+		 * (r141: a 256 KB operand resolved 0 pages because the QMD and
+		 * param candidates consumed the window). Excluding them lets
+		 * three 256 KB operands (3x68 = 204) fit.
+		 */
+		if ((base & ~(u64)(SEMA_PAGE_SIZE - 1)) ==
+		    (svc_fwd_req.gr_qmd_dev_va & ~(u64)(SEMA_PAGE_SIZE - 1)))
+			continue;
+		span = (base >= 0x40000000000ULL) ?
+			SVC_GR_DATA_PAGES_PER_PTR : 1u;
+
 		if (is_arg[w] && base >= 0x40000000000ULL)
 			n_arg_hi++;
 
@@ -12640,7 +12658,7 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu)
 				svc_pd_found, svc.ipin_n);
 		}
 
-		for (p = 0; p < SVC_GR_DATA_PAGES_PER_PTR; p++) {
+		for (p = 0; p < span; p++) {
 			u64 va = wins[w] + (u64)p * SEMA_PAGE_SIZE;
 			u64 pa = 0;
 			u32 ap = 0, x;