diff options
Diffstat (limited to 'kernel/gsp_sema_service.c')
| -rw-r--r-- | kernel/gsp_sema_service.c | 36 |
1 files changed, 35 insertions, 1 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 3c47ed3..561ebf0 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -928,6 +928,34 @@ static int svc_write_ap(struct nv_vgpu_device *vgpu, u64 addr, u32 aperture, static bool svc_gr_content_rearm; /* + * m148 (second-client wedge): re-arm the per-rank one-shot ring/push-buffer + * latches for a (re-)registered channel. The guest driver rebuilds the GSP + * session for every client context and RM reuses the same object handles and + * channel ranks across sessions. The ISSUE-0002 session flush only runs on + * the last-channel-closed transition, so a second session that re-registers + * the same handles while the first session's entries are still present (or + * before the deferred flush executes) inherits the previous session's latch + * bits. The CE/GR ring autopin and the push-buffer pairing then never re-run, + * the new session's ring stays untranslated (svc_lookup fails for its GPFIFO + * VA), the pump counts the entries as nomap and the guest spins forever in + * uvm_tracker_wait_for_entry waiting for its channel-creation push release - + * the second-client wedge. Both autopin paths and the pairing are + * content-validated (entry0 must parse; a discovered base must carry this + * channel's slot), so re-arming is safe and idempotent within a session. + */ +static void svc_chan_rearm_rank(struct svc_channel *ch) +{ + if (!ch || !ch->valid) + return; + if (ch->engine_type) { + clear_bit(ch->ce_index, &svc_ring_done); + clear_bit(ch->ce_index, &svc_pb_done); + } else { + clear_bit(ch->gr_index, &svc_gr_ring_done); + } +} + +/* * Register a guest channel. Called from the GSP-RM emulation when the guest * driver allocates a channel (the allocation carries the GPFIFO GPU VA, its * entry count and the guest-physical USERD/instance blocks), and dropped when @@ -1050,6 +1078,13 @@ void gsp_sema_service_channel_add(const struct sema_channel_desc *desc) spin_unlock_irqrestore(&svc.chan_lock, flags); if (ch) { + /* + * m148: force the ring/push-buffer discovery latches for this + * rank to re-run for the (possibly new) session, so the new + * ring is translated from its own content instead of inheriting + * the previous session's one-shot state (second-client wedge). + */ + svc_chan_rearm_rank(ch); svc.last_chan_reg = jiffies; pr_info("sema-svc: channel 0x%x registered gpfifo=0x%llx entries=%u userd=0x%llx eng=%u cid=%u notif=0x%llx\n", desc->h_object, desc->gpfifo_va, desc->gpfifo_entries, @@ -1063,7 +1098,6 @@ void gsp_sema_service_channel_add(const struct sema_channel_desc *desc) /* P6b wave-1.5 hold state is defined with the forwarding section below. */ static void svc_fwd_hold_abort(u32 h_object); - /* * P6b wave-2 inline software fallback for a withheld (skipped) candidate; * defined with the forwarding section below. Service-thread only. |