diff options
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/gsp_sema_service.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 561ebf0..0a97cea 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -12551,6 +12551,8 @@ static void svc_gr_req_bridge_fallback(struct nv_vgpu_device *vgpu) * forwarding can never overlap; the caller engages the release hold on a * true return. Service-thread only. */ +static void svc_handle_map_add(void); + static bool svc_gr_request(struct nv_vgpu_device *vgpu, const struct svc_channel *ch) { @@ -12591,6 +12593,17 @@ static bool svc_gr_request(struct nv_vgpu_device *vgpu, svc_gr_bridge_fallback(vgpu); return false; } + /* + * m143: drain the host injection queue before resolving the launch's + * pages. The watcher's pins for the client's a/b/c buffers can land + * between the service loop's map_add drain and this capture; the fill + * then misses them, nothing is relocated, and the win0 param page the + * SM reads keeps the driver's original guest VAs (the second client's + * all-zero results, rk1: candidate[0..2] -> 0 new pages). Draining + * here closes that window; svc_handle_map_add() runs on this same + * service thread, so there is no race with the loop's own drain. + */ + svc_handle_map_add(); rc = svc_gr_req_fill(vgpu, ch); if (rc) { clear_bit_unlock(SVC_FWD_INFLIGHT, &svc_fwd_state); |