vgsp-sema: drain the injection queue immediately before the GR fill (second-client zeros)

The watcher's pins for the second client's a/b/c buffers can land between
the service loop's svc_handle_map_add() and the launch capture; the fill
then misses them via svc_ipin_lookup, resolves 0 pages, relocates nothing,
and the win0 param page keeps the driver's guest VAs (rk1: candidate[0..2]
-> 0 new pages; DIAG win0[0] 160=753e4ec00000). Drain the queue right
before svc_gr_req_fill() (same service thread, no race).

1 files changed, 13 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 561ebf0..0a97cea 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -12551,6 +12551,8 @@ static void svc_gr_req_bridge_fallback(struct nv_vgpu_device *vgpu)
  * forwarding can never overlap; the caller engages the release hold on a
  * true return. Service-thread only.
  */
+static void svc_handle_map_add(void);
+
 static bool svc_gr_request(struct nv_vgpu_device *vgpu,
 			   const struct svc_channel *ch)
 {
@@ -12591,6 +12593,17 @@ static bool svc_gr_request(struct nv_vgpu_device *vgpu,
 		svc_gr_bridge_fallback(vgpu);
 		return false;
 	}
+	/*
+	 * m143: drain the host injection queue before resolving the launch's
+	 * pages. The watcher's pins for the client's a/b/c buffers can land
+	 * between the service loop's map_add drain and this capture; the fill
+	 * then misses them, nothing is relocated, and the win0 param page the
+	 * SM reads keeps the driver's original guest VAs (the second client's
+	 * all-zero results, rk1: candidate[0..2] -> 0 new pages). Draining
+	 * here closes that window; svc_handle_map_add() runs on this same
+	 * service thread, so there is no race with the loop's own drain.
+	 */
+	svc_handle_map_add();
 	rc = svc_gr_req_fill(vgpu, ch);
 	if (rc) {
 		clear_bit_unlock(SVC_FWD_INFLIGHT, &svc_fwd_state);