vgsp+diag: resolver GL pushbuffer families (0x4000000/0x42000000 learn-once byte-exact, raw-tail newest-first scan), setup-hold demand cap 0x8000->0x10000 (60216B push=16 pages), pin_gr_stream harvest 2MB - r1089 target reached: setup push readable (unreadable=0), MME prelude captured words=511; beef context still tears down (submissions=0); demand races dmesg ring (manual demand fixed r1090); host / was 100%, freed ~6G - SESSION 153 r1088-r1090

1 files changed, 9 insertions, 2 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 25598bd..f5ce23c 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -22099,9 +22099,16 @@ static bool svc_gr_setup_push(u32 len, const u8 *buf)
  * demand is the existing stalled-VA channel: svc_log_stalled_va rows are
  * deduped and harvested by tools/guest-diag/pin_gr_stream.py, which asks
  * the guest scanner to resolve the VA set and inject the pages. Only one
- * arm line per (va,slot) is logged. `page_cap` bounds the VA rows (the
+ * arm line per (va,slot) is logged. The loop is bounded by `page_cap` (the
  * 12288 B setup push needs 3; the cap keeps a bulk push from eating the
  * 256-entry stalled-VA budget).
+ *
+ * SESSION 153-CONTINUED-55: the cap was 0x8000 (8 pages). The GL client's
+ * observed setup push is 60216 B (16 pages); pages 1..8 were demanded but
+ * pages 9..15 never were, so the host's per-chunk read of the entry had no
+ * source for the tail chunks and the whole read failed (unreadable=1, the
+ * hold re-armed forever). 0x10000 covers the full 60216 B push within the
+ * stalled-VA budget.
  */
 static void svc_gr_setup_hold_arm(struct svc_channel *ch, u64 va, u32 idx,
 				  u32 len)
@@ -22119,7 +22126,7 @@ static void svc_gr_setup_hold_arm(struct svc_channel *ch, u64 va, u32 idx,
 		pr_info("sema-chan: GR setup hold h=0x%x entry=%u va=0x%llx len=%u armed (demanding 4K pages; pending until the pin lands, window %u ms)\n",
 			ch->h_object, idx, va, len, gsp_sema_gr_setup_hold_ms);
 	}
-	for (poff = 0; poff < len && poff < 0x8000u; poff += SEMA_PAGE_SIZE)
+	for (poff = 0; poff < len && poff < 0x10000u; poff += SEMA_PAGE_SIZE)
 		svc_log_stalled_va(page + poff);
 }