r470 the narrow streams_events stale-ring fix: an ALL-ZERO push page (ring entry written - previous session's or the client's own slot reuse - but the push content not yet landed) is held by the m164 GR no-capture window instead of being consumed as a no-op, so the end-of-pass counter publish cannot advance the guest's completion word before the real push is read (streams_events: h_c[2] = c0 because the c2 D2H completion was published 4.5 s before its copy ran). Deliberately narrower than the reverted r469 plausibility verdict: compute-class GR pushes legitimately fail the CE-shaped method matcher, so only an entirely zero page counts as unwritten (r469's broad hold delayed GR config pushes and triggered the engine-fetch-NONE wedge on the first client).

1 files changed, 47 insertions, 1 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 756e644..28e5906 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -21467,10 +21467,55 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 							 * through to the historical
 							 * consume so the channel can
 							 * never livelock.
+							 *
+							 * r470: an ALL-ZERO push page is
+							 * the same "not the client's work
+							 * yet" condition - the ring entry
+							 * is written (the previous
+							 * session's or the client's own
+							 * slot reuse) but the push
+							 * CONTENT has not landed, so the
+							 * decode sees no QMD and the
+							 * entry would be consumed as a
+							 * no-op; the end-of-pass counter
+							 * publish then advances the
+							 * guest's completion word while
+							 * the real push was never read,
+							 * and the client drains a
+							 * staging buffer that still holds
+							 * the PREVIOUS copy's bytes
+							 * (streams_events: h_c[2] = c0
+							 * because the c2 D2H's
+							 * completion was published 4.5 s
+							 * before its copy ran, the ring
+							 * slots having been decoded as
+							 * all-zero pushes). Deliberately
+							 * NARROWER than the CE-shaped
+							 * plausibility verdict: compute
+							 * pushes legitimately fail that
+							 * matcher, so only an entirely
+							 * zero page counts as unwritten.
 							 */
+							{
+								bool all_zero = false;
+
+								if (!ch->engine_type &&
+								    va && len) {
+									u32 zi;
+
+									all_zero = true;
+									for (zi = 0; zi < len;
+									     zi++)
+										if (pb[zi]) {
+											all_zero =
+												false;
+											break;
+										}
+								}
 							if (!ch->engine_type && va && len &&
 							    gsp_phys_gr_forward_enabled() &&
-							    svc_gr_qmd_seen > 0 &&
+							    (svc_gr_qmd_seen > 0 ||
+							     all_zero) &&
 							    !entry_replay &&
 							    !(svc_gr_cand.valid &&
 							      svc_gr_cand.h_object ==
@@ -21522,6 +21567,7 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 									ch->h_object,
 									(u32)idx, va, len);
 							}
+							}
 							/*
 							 * A CE push that should carry this
 							 * channel's next tracking release but