diff options
Diffstat (limited to 'kernel/gsp_sema_service.c')
| -rw-r--r-- | kernel/gsp_sema_service.c | 30 |
1 files changed, 16 insertions, 14 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 77ae4b4..fa76162 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -4614,21 +4614,23 @@ static void svc_run_ops(struct nv_vgpu_device *vgpu, struct svc_memset_op *ops, else svc.memsets_fail++; /* - * ISSUE-0002 (r71): ANY failed op leaves work owed on this - * entry, not only an unresolvable operand. The pma scrub - * memsets resolve a bogus out-of-bounds vidmem destination - * through a walk before the scanner pins the real sysmem - * page; svc_copy fails them with -EINVAL, and the old code - * consumed the entry and applied the release anyway, leaving - * the client frozen in scrubCheckAndWaitForSize. Mark the - * pass as op-pending so the pump holds the entry and - * withholds its releases (bounded by SVC_OPDEF_HOLD_MS, - * exactly like the -ENOENT path): the retried decode checks - * the injected pins first and runs the memset once the real - * translation lands. On expiry the release is flushed and the - * op stays skipped (the pre-r62 fallback). + * ISSUE-0002 (r71/r72): a failed LARGE op leaves work owed on + * this entry. The pma scrub memsets (>= 256 KB) resolve a bogus + * out-of-bounds vidmem destination through a walk before the + * scanner pins the real sysmem pages; svc_copy fails them with + * -EINVAL, and the old code consumed the entry and applied the + * release anyway, leaving the client frozen in + * scrubCheckAndWaitForSize. Mark the pass as op-pending so the + * pump holds the entry and withholds its releases (bounded by + * SVC_OPDEF_HOLD_MS): the retried decode checks the injected + * pins first and runs the memset once the real translation + * lands. Deliberately limited to >= 256 KB: a small failing op + * (observed r72 c2) must not withhold a release that gates a GR + * launch with a 5 s poll deadline. On expiry the release is + * flushed and the op stays skipped (the pre-r62 fallback). */ - if (rc != 0 && rc != SVC_COPY_FORWARDED) + if (rc != 0 && rc != SVC_COPY_FORWARDED && + m->bytes >= (256u << 10)) svc.op_tr_pending = 1; if (gsp_sema_dbg && m->bytes == 256 && svc.sem256_log < 64) { svc.sem256_log++; |