From 8f7d265476f233f91b75c0cdfd8b6f3a8ce1afcb Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Thu, 22 Oct 2026 19:01:08 -0400 Subject: r496j VAS candidates are registered only after a content-verified ring walk (+3 fixes) The r496g blast registration of every COPY_SERVER_PDES directory let a stale kernel directory answer another client's VA in the walker's first-success order (the r459 stale-directory class) - measured as a CUDA client hanging after DEVICE. Candidates are now parked and registered only when a walk of the client's own content-validated ring VA through them reproduces that ring's PA; the r496f vidmem sweep remains as a fallback. Also in this batch: - svc_chan_userd's VRAM shape scan now prefers a block with work PENDING (get < put) and then the one nearest the registered memdesc offset: on a channel re-registration the stale previous USERD still validates (it holds the same put/entry values) and the old first-match adoption made the pump write GP_GET into the dead block (r504 second DMA init). - The USERD/FB scan and the CE caps byte-1 BL bits (r496i) are unchanged; TU104_CE_CAPS1 = 0x03 needs the CUDA battery re-verification. --- kernel/gsp_rm_emulation.c | 43 +++++++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 20 deletions(-) (limited to 'kernel/gsp_rm_emulation.c') diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c index 4c848b8..eddfab5 100644 --- a/kernel/gsp_rm_emulation.c +++ b/kernel/gsp_rm_emulation.c @@ -2509,25 +2509,24 @@ static void gsp_rm_handle_copy_server_pdes(struct gsp_emu_context *ctx, } /* - * r496g: this control IS the kernel RM publishing the page-table + * r496j: this control IS the kernel RM publishing the page-table * chain of its internal VAS (the level[0..] instances with their - * phys addresses and page shifts). Register the root with the - * progress service so the walker can translate every VA of this - * client - the X/GL channel's pushbuffer pages and its progress - * semaphore, for which no other translation source exists (the - * fn-54 SET_PAGE_DIRECTORY path is external-VAS/UVM only). The - * level values are sanity-gated; a wrong chain only costs failed - * walks. + * phys addresses and page shifts). The chain can name the X/GL + * channel's pushbuffer pages and progress semaphore, for which no + * other translation source exists (the fn-54 SET_PAGE_DIRECTORY + * path is external-VAS/UVM only). It is NOT registered directly: + * a blast registration of every client's directory let a stale + * kernel directory answer another client's VA in the walker's + * first-success order (the r459 stale-directory class; observed + * as a CUDA client hanging after DEVICE with r496g). Instead the + * root is offered as a CANDIDATE; the progress service registers + * it only after it has been VERIFIED against a content-validated + * pair of that very client (the ring found by the RAM content + * scan). */ if (num_levels >= 1 && rm->pt.levels[0].phys && rm->pt.levels[0].size >= 16 && rm->pt.levels[0].size <= 4096 * 8) { - struct sema_vaspace_desc d; - - memset(&d, 0, sizeof(d)); - d.h_vaspace = h_object; - d.pdb = rm->pt.levels[0].phys; - d.num_entries = (u32)(rm->pt.levels[0].size / 8); /* * The level phys values are guest PAs on this platform * (observed 4+ GiB, above any FB shadow); aperture 3 in the @@ -2536,13 +2535,17 @@ static void gsp_rm_handle_copy_server_pdes(struct gsp_emu_context *ctx, * FB, everything else sysmem. The walker also retries the * other aperture, so a misclassification only costs a walk. */ - d.b_vidmem = rm->pt.levels[0].phys < - (u64)ctx->vgpu->bars[1].size; - gsp_sema_service_vaspace_add(&d); + bool vidmem = rm->pt.levels[0].phys < + (u64)ctx->vgpu->bars[1].size; + + gsp_sema_service_vaspace_candidate_add( + h_object, rm->pt.levels[0].phys, + (u32)(rm->pt.levels[0].size / 8), vidmem); nv_vgpu_info(ctx->vgpu, - "vgsp-rm: VAS 0x%x page directory registered from COPY_SERVER_PDES pdb=0x%llx entries=%u (%s)", - h_object, d.pdb, d.num_entries, - d.b_vidmem ? "vidmem" : "sysmem"); + "vgsp-rm: VAS 0x%x page directory offered as candidate pdb=0x%llx entries=%u (%s; registered only after a content-verified ring walk)", + h_object, (u64)rm->pt.levels[0].phys, + (u32)(rm->pt.levels[0].size / 8), + vidmem ? "vidmem" : "sysmem"); } } -- cgit v1.2.3