1 files changed, 82 insertions, 1 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 0f89f5a..25ae31f 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -17743,6 +17743,53 @@ static void svc_opdef_reset_all(void)
  * once per service iteration: deliver forward-only to the still-live owner
  * channel, count a LOSS when the owner is gone.
  */
+/*
+ * r563b: forced variant of the expiry sweep for the stall self-heal. The
+ * regular sweep skips slots younger than SVC_OPDEF_HOLD_MS; when the pump
+ * has already been stuck for SVC_STALL_WATCH_MS, age no longer matters -
+ * deliver every withheld release forward-only (recording the delivered
+ * marks so a re-decode cannot re-hold) and clear the slots. This is the
+ * same delivery the slot's own 3 s bound would perform, just executed at
+ * the watchdog's discretion.
+ */
+static void svc_opdef_force_flush(void)
+{
+	int i;
+
+	for (i = 0; i < SVC_OPDEF_SLOTS; i++) {
+		struct svc_opdef_ent *e = &svc_opdef[i];
+		u8 k;
+
+		if (!e->active || !e->n)
+			continue;
+		for (k = 0; k < e->n; k++)
+			svc_opdef_done_note(e->h_object, e->entry_idx,
+					    &e->rel[k]);
+		{
+			static struct svc_channel ch_scratch;
+			unsigned long flags;
+			struct svc_channel *local = NULL;
+			int c;
+
+			spin_lock_irqsave(&svc.chan_lock, flags);
+			for (c = 0; c < SVC_MAX_CHANNELS; c++)
+				if (svc.chan[c].valid &&
+				    svc.chan[c].vgpu == e->vgpu &&
+				    svc.chan[c].h_object == e->h_object) {
+					ch_scratch = svc.chan[c];
+					local = &ch_scratch;
+					break;
+				}
+			spin_unlock_irqrestore(&svc.chan_lock, flags);
+			if (local)
+				svc_fwd_rel_apply_all(e->vgpu, local,
+						      e->rel, e->n);
+		}
+		svc.opdef_expired++;
+		svc_opdef_clear(e, SVC_OPDEF_CLR_SWEEP);
+	}
+}
+
 static void svc_opdef_expire_sweep(void)
 {
 	/*
@@ -25065,7 +25112,41 @@ static void svc_stall_watch_check(void)
 		return;	/* idle boot, not a stall */
 	svc_stall_watch_dumps++;
 	svc_stall_watch_dump();
-	/* r563: self-heal after the dump (see svc_hold_bypass). */
+	/*
+	 * r563: self-heal after the dump. The r564 boot showed the force
+	 * budget alone is not enough: the walk broke BEFORE the instrumented
+	 * hold sites (no STALL-HEAL lines while held=727 climbed), so clear
+	 * the state blockers every break site consults, and force-deliver
+	 * the withheld opdef slots:
+	 *  - per channel: the cheap-wait unread window (its break at the
+	 *    loop top) and the GR hold/nocap indices;
+	 *  - the opdef slots: deliver forward-only and mark delivered, so
+	 *    the next decode cannot re-hold (the same edge the 3 s bound
+	 *    would run);
+	 *  - the force-consume budget stays as the belt for the hold sites.
+	 */
+	svc_opdef_force_flush();
+	{
+		unsigned long flags;
+		u32 c;
+
+		spin_lock_irqsave(&svc.chan_lock, flags);
+		for (c = 0; c < SVC_MAX_CHANNELS; c++) {
+			struct svc_channel *ch = &svc.chan[c];
+
+			if (!ch->valid)
+				continue;
+			ch->unread_va = 0;
+			ch->unread_until = 0;
+			ch->gr_hold_idx = ~0u;
+			ch->gr_hold_until = 0;
+			ch->gr_nocap_idx = ~0u;
+			ch->gr_nocap_va = 0;
+		}
+		spin_unlock_irqrestore(&svc.chan_lock, flags);
+	}
+	pr_err("vgsp-sema: STALL-HEAL: forced opdef flush + walk-state clear (dumps=%u)\n",
+	       svc_stall_watch_dumps);
 	svc_force_consume = 4;
 }