Revert "vgsp-sema: scope channel deletion to the owning RM client (ISSUE-0002)"

This reverts commit 5fa773c2cd4e166d2c31a40aff9fb63e7534fec3.

3 files changed, 14 insertions, 45 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index b4bee46..8318f56 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -2348,9 +2348,8 @@ static bool gsp_rm_is_channel_class(u32 class_id)
 #define GSPRM_CHAN_MEM_APERTURE		16	/* offset of addressSpace in the desc */
 #define GSPRM_CHAN_NOTIFIER_MEM		248
 
-static void gsp_rm_register_channel(struct gsp_emu_context *ctx, u32 h_client,
-				    u32 h_object, const u8 *params,
-				    u32 params_size)
+static void gsp_rm_register_channel(struct gsp_emu_context *ctx, u32 h_object,
+				    const u8 *params, u32 params_size)
 {
 	struct sema_channel_desc desc;
 
@@ -2359,7 +2358,6 @@ static void gsp_rm_register_channel(struct gsp_emu_context *ctx, u32 h_client,
 
 	memset(&desc, 0, sizeof(desc));
 	desc.h_object = h_object;
-	desc.h_client = h_client;
 	memcpy(&desc.gpfifo_va, params + GSPRM_CHAN_GPFIFO_OFFSET, 8);
 	memcpy(&desc.gpfifo_entries, params + GSPRM_CHAN_GPFIFO_ENTRIES, 4);
 	memcpy(&desc.engine_type, params + GSPRM_CHAN_ENGINE_TYPE, 4);
@@ -2437,7 +2435,7 @@ static void gsp_rm_handle_rm_alloc(struct gsp_emu_context *ctx,
 	/* Channels: hand the progress service everything it needs to run the
 	 * work submitted on this channel (GPFIFO ring + USERD). */
 	if (gsp_rm_is_channel_class(class_id))
-		gsp_rm_register_channel(ctx, hc, ho, params, params_size);
+		gsp_rm_register_channel(ctx, ho, params, params_size);
 
 	/*
 	 * NV01_EVENT (allocated with class 0x79 in the guest ABI; params are
@@ -3246,7 +3244,7 @@ static void gsp_rm_handle_free(struct gsp_emu_context *ctx, const u8 *elem,
 	memcpy(&hObjOld, params + 8, 4);
 	memset(params + 12, 0, 4); /* status = NV_OK */
 
-	gsp_sema_service_channel_del(hObjOld, hRoot);
+	gsp_sema_service_channel_del(hObjOld);
 
 	/*
 	 * Retire event records that refer to the object being freed. Posting an
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index d736ffe..ee73027 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -163,10 +163,6 @@ struct sema_map_entry {
 struct svc_channel {
 	bool	valid;
 	u32	h_object;
-	u32	h_client;	/* owning RM client (ISSUE-0002 r78: handles are
-				 * per-client; deletion must match the client or
-				 * an unrelated object with the same numeric
-				 * handle unregisters a live channel). */
 	u32	engine_type;
 	u32	cid;		/* RM channel id (doorbell token vector) */
 	u8	ce_index;	/* rank among the live CE channels (creation order) */
@@ -971,9 +967,7 @@ void gsp_sema_service_channel_add(const struct sema_channel_desc *desc)
 	}
 	spin_lock_irqsave(&svc.chan_lock, flags);
 	for (i = 0; i < SVC_MAX_CHANNELS; i++) {
-		if (svc.chan[i].valid && svc.chan[i].h_object == desc->h_object &&
-		    (!svc.chan[i].h_client || !desc->h_client ||
-		     svc.chan[i].h_client == desc->h_client)) {
+		if (svc.chan[i].valid && svc.chan[i].h_object == desc->h_object) {
 			ch = &svc.chan[i];
 			break;
 		}
@@ -986,9 +980,7 @@ void gsp_sema_service_channel_add(const struct sema_channel_desc *desc)
 		u64 keep_release_pa = 0;
 		u8 keep_gr_index = 0, keep_ce_index = 0;
 		DECLARE_BITMAP(keep_rel_done, SVC_GPFIFO_MAX_BITS);
-		bool same = ch->valid && ch->h_object == desc->h_object &&
-			    (!ch->h_client || !desc->h_client ||
-			     ch->h_client == desc->h_client);
+		bool same = ch->valid && ch->h_object == desc->h_object;
 
 		/*
 		 * A re-registration of the same channel must not lose the
@@ -1038,7 +1030,6 @@ void gsp_sema_service_channel_add(const struct sema_channel_desc *desc)
 		ch->valid = true;
 		svc_sess_active = 1;
 		ch->h_object = desc->h_object;
-		ch->h_client = desc->h_client;
 		ch->engine_type = desc->engine_type;
 		ch->cid = desc->cid;
 		ch->gpfifo_va = desc->gpfifo_va;
@@ -1091,7 +1082,7 @@ static void svc_opdef_drop(struct nv_vgpu_device *vgpu,
 			   struct svc_channel *ch, u32 entry_idx);
 static void svc_opdef_reset_all(void);
 
-void gsp_sema_service_channel_del(u32 h_object, u32 h_client)
+void gsp_sema_service_channel_del(u32 h_object)
 {
 	unsigned long flags;
 	int i;
@@ -1101,26 +1092,12 @@ void gsp_sema_service_channel_del(u32 h_object, u32 h_client)
 
 	spin_lock_irqsave(&svc.chan_lock, flags);
 	for (i = 0; i < SVC_MAX_CHANNELS; i++) {
-		if (!svc.chan[i].valid || svc.chan[i].h_object != h_object)
-			continue;
-		/*
-		 * ISSUE-0002 (r78): handles are per-client. An unrelated
-		 * object in another client can share the numeric handle
-		 * (r77: a class-0x2080 object with handle 0x2 in client
-		 * 0xc1d00011 unregistered the boot session's CeUtils scrubber
-		 * channel 0x2; the guest kept using the channel and its
-		 * finish payload was never written again, so the third
-		 * client's pma scrub waited forever). Only the owning client
-		 * may unregister the channel. A missing client on either
-		 * side keeps the old handle-only behaviour.
-		 */
-		if (h_client && svc.chan[i].h_client &&
-		    svc.chan[i].h_client != h_client)
-			continue;
-		svc.chan[i].valid = false;
-		pr_info("sema-svc: channel 0x%x unregistered (submissions=%llu)\n",
-			h_object, svc.chan[i].submissions);
-		break;
+		if (svc.chan[i].valid && svc.chan[i].h_object == h_object) {
+			svc.chan[i].valid = false;
+			pr_info("sema-svc: channel 0x%x unregistered (submissions=%llu)\n",
+				h_object, svc.chan[i].submissions);
+			break;
+		}
 	}
 	/*
 	 * ISSUE-0002: when the last channel closes, the next client is a new
diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index e00ef91..4b04892 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -21,12 +21,6 @@
  */
 struct sema_channel_desc {
 	u32 h_object;
-	u32 h_client;		/* owning RM client; handles are per-client,
-				 * so deletion must match it too (ISSUE-0002
-				 * r78: a class-0x2080 object with handle 0x2
-				 * in another client unregistered the scrubber
-				 * channel 0x2 and its finish payload was never
-				 * written again). */
 	u32 engine_type;
 	u32 cid;		/* RM channel id (the doorbell token vector) */
 	u64 gpfifo_va;
@@ -39,7 +33,7 @@ struct sema_channel_desc {
 };
 
 void gsp_sema_service_channel_add(const struct sema_channel_desc *desc);
-void gsp_sema_service_channel_del(u32 h_object, u32 h_client);
+void gsp_sema_service_channel_del(u32 h_object);
 
 /*
  * A GPU VA space whose top-level page directory the driver has published (the