1 files changed, 65 insertions, 0 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 3e5b9dd..f9e8e06 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -26925,3 +26925,68 @@ int gsp_sema_service_sem_write(struct nv_vgpu_device *vgpu, u32 h, u64 va,
 		svc.post_hint_until = jiffies + msecs_to_jiffies(SVC_POST_HINT_MS);
 	return rc;
 }
+
+/*
+ * r616 diag: manual fault poke for the refused-launch hang experiment. A GR
+ * push that the fill cannot resolve is refused (degenerate data set) and the
+ * entry is consumed with a software release; the authored release lands in
+ * the guest page (measured: kcore read 0x6 == pay on r613d) yet the guest
+ * driver never completes cudaDeviceSynchronize for a launch that never ran.
+ * This writes the channel's error notifier in the exact shape the relayed-
+ * fault edge uses (info32=exceptType, info16=engine, status=0xffff, latched
+ * by notifier_err) and posts the channel event, so a hung client's kernel
+ * can be poked into observing an engine error and ending its wait. Debug
+ * only; harmless when no client is hung (the pump's completion clear resumes
+ * after SVC_NOTIFIER_ERR_HOLD). h_object 0 = every valid channel.
+ */
+int gsp_sema_channel_fault_poke(struct nv_vgpu_device *vgpu, u32 h_object)
+{
+	u8 notif[SVC_NOTIFY_SIZE] = {0};
+	u16 status = SVC_NOTIFY_ERROR_STATUS;
+	u32 info32 = 0x1;	/* generic engine exception */
+	int i, done = 0;
+
+	if (!vgpu)
+		return -ENODEV;
+	memcpy(notif + SVC_NOTIFY_INFO32_OFF, &info32, 4);
+	memcpy(notif + SVC_NOTIFY_STATUS_OFF, &status, 2);
+
+	for (i = 0; i < SVC_MAX_CHANNELS; i++) {
+		struct svc_channel *ch = &svc.chan[i];
+		unsigned long flags;
+		u64 pa;
+		u32 as, eng, h;
+		u16 info16;
+
+		spin_lock_irqsave(&svc.chan_lock, flags);
+		if (!ch->valid || ch->vgpu != vgpu || !ch->notifier_pa ||
+		    (h_object && ch->h_object != h_object)) {
+			spin_unlock_irqrestore(&svc.chan_lock, flags);
+			continue;
+		}
+		h = ch->h_object;
+		pa = ch->notifier_pa;
+		as = ch->notifier_as;
+		eng = ch->engine_type;
+		/* Latch exactly like the relayed-fault edge so the pump's
+		 * completion clear cannot wipe the poke before the guest
+		 * reads it. */
+		ch->notifier_err = true;
+		ch->notifier_err_until = jiffies + SVC_NOTIFIER_ERR_HOLD;
+		ch->notifier_err_put = ch->put_prev;
+		spin_unlock_irqrestore(&svc.chan_lock, flags);
+
+		info16 = (u16)eng;
+		memcpy(notif + SVC_NOTIFY_INFO16_OFF, &info16, 2);
+		if (svc_write_ap(vgpu, pa, as, notif, sizeof(notif))) {
+			pr_info("vgsp-fault: POKE ch=0x%x notifier write failed pa=0x%llx as=%u\n",
+				h, pa, as);
+			continue;
+		}
+		pr_info("vgsp-fault: POKE ch=0x%x engine=%u pa=0x%llx as=%u status=0x%x except=0x%x (manual experiment)\n",
+			h, eng, pa, as, status, info32);
+		gsp_rm_post_channel_event(vgpu, h);
+		done++;
+	}
+	return done ? done : -ENOENT;
+}