From 45b7a0b58e487f7e54e0aaf8f4ba96569a4233b1 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 19 Oct 2026 10:47:09 -0400 Subject: vgsp: fail4 r254-r257 - small-fill hold + copy landing ledger + per-launch reloc half Three fixes on top of 54cf842c, targeting the big-buffer clients: 1. m163 parity for fills: a small failing FILL op with a virtual device destination is now held/retried like the small copies (-ENOENT with the pins still landing was silently counted nomap and the release applied - the 8 MB cudaMemset landed only partially). Verified: memcpy_roundtrip now reaches STATUS OK (RT1 bad=0 csum exact, MSET bad=0, h_m all 0x5A). 2. svc_copy landing ledger parity with svc_fill: a large virtual-dst copy records its landing pages so the GR rec build (m171 ledger preference) follows the page the copy actually wrote. streams2's c1 moved from a stale-page mix ([28.0, 28.625, 29.25]) to the correct-page values ([0.0, 0.125, 0.25]). 3. Per-launch relocated-data base: concurrent forwarded launches (streams2's vadd pair) shared one base and their bounce windows overlapped; the base now alternates across the grown region's two halves keyed to the capture push (retries keep their half), cap halved accordingly. Also raise the per-page data attribution budget (16 -> 192 pages) for span forensics. Remaining on streams2/victory_multikernel: the single-slot svc_gr_cand capture is overwritten by the second concurrent launch before the work item consumes it - ctaid-probe evidence: c1 == a2+b2 exactly (the stream-2 result in the stream-1 output) with the in-tree candidate-overwrite witness present. Next: make the capture a small FIFO drained in order by the gsp-phys-work item. --- kernel/gsp_sema_service.c | 58 +++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 53 insertions(+), 5 deletions(-) (limited to 'kernel/gsp_sema_service.c') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 6dd83c9..b1ad7ba 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -5875,6 +5875,24 @@ static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total, pr_info("vgsp: COPYAUDIT path=ce-soft-copy va=0x%llx len=0x%llx done=0x%llx\n", dst_orig, (u64)total, (u64)o); } + /* + * m180 parity with svc_fill: a large virtual-destination copy is a + * write/read pair with the launch rec-build readers - record its + * landing pages so the GR fill follows the page the copy actually + * wrote. Without this, a rec table built before the pins landed + * kept the stale pre-pin pages while the copy landed on the pinned + * page (streams2 r254: the b1 rec range carried the a2 pages and + * the vadd read a2's pattern as its second input). + */ + if (!dst_phys && dst_virt && dst_orig >= SVC_VAS_FLOOR && + total >= (64u << 10)) { + u32 cap = (dst_aperture == CE_APERTURE_VID) ? + SVC_APERTURE_FB : SVC_APERTURE_SYS; + size_t po; + + for (po = 0; po < total; po += SEMA_PAGE_SIZE) + svc_ledger_store(dst_orig + po, dst + po, cap); + } if (done_out) *done_out = (u64)o; /* o == total on the success path */ return 0; @@ -6156,7 +6174,8 @@ static void svc_run_ops(struct nv_vgpu_device *vgpu, struct svc_memset_op *ops, */ if (rc != 0 && rc != SVC_COPY_FORWARDED && (m->bytes >= (256u << 10) || - (m->type == 1 && m->dst >= SVC_VAS_FLOOR))) + (m->type == 1 && m->dst >= SVC_VAS_FLOOR) || + (m->type == 0 && !m->phys && m->dst >= SVC_VAS_FLOOR))) svc.op_tr_pending = 1; if (gsp_sema_dbg && m->bytes == 256 && svc.sem256_log < 64) { svc.sem256_log++; @@ -15169,7 +15188,12 @@ static bool svc_gr_page_inline_covers(u64 page) * reach the engine. The legacy value is the pre-B-2 window below the mail * page (GSP_PHYS_RMCALL_GR_MAIL_SLOT = 206). */ -#define SVC_GR_DATA_BOUNCE_MAX GSP_PHYS_RMCALL_GR_DATA_BOUNCE_PAGES +/* + * fail4: each launch may relocate up to half of the grown region - the + * other half is the alternate base of a concurrently in-flight launch + * (see the per-capture base flip in svc_gr_data_fill). + */ +#define SVC_GR_DATA_BOUNCE_MAX (GSP_PHYS_RMCALL_GR_DATA_BOUNCE_PAGES / 2u) #define SVC_GR_DATA_BOUNCE_MAX_OLD 205u static u32 svc_gr_data_log; /* m142: bounded per-page attribution log */ @@ -15516,8 +15540,32 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu, * window below the mail page for A/B trialing. */ bool region_on = gsp_phys_gr_data_region_value() != 0; - u64 reloc_base = region_on ? SVC_GR_DATA_RELOC_BASE : - SVC_GR_DATA_RELOC_BASE_OLD; + /* + * fail4: two concurrent forwarded launches (streams2's vadd pair) + * both relocated their operands from the same base, so the second + * launch's copy-in overwrote the first's bounce windows and each + * engine read the other's inputs (c1 came out as a2+b2). Alternate + * the per-launch base across the grown region's two halves (32 MB + * each, above any single launch's span), keyed to the capture push + * so a retried launch keeps its half, so concurrent launches + * cannot collide. + */ + static u64 svc_gr_reloc_half_key; + static u8 svc_gr_reloc_half; + u64 reloc_off = 0; + + if (region_on) { + if (svc_gr_cand.push_va != svc_gr_reloc_half_key) { + svc_gr_reloc_half_key = svc_gr_cand.push_va; + svc_gr_reloc_half ^= 1; + } + if (svc_gr_reloc_half) + reloc_off = (u64)(GSP_PHYS_RMCALL_GR_DATA_BOUNCE_PAGES / + 2u) * SEMA_PAGE_SIZE; + } + u64 reloc_base = region_on ? + SVC_GR_DATA_RELOC_BASE + reloc_off : + SVC_GR_DATA_RELOC_BASE_OLD; u32 per_ptr = region_on ? SVC_GR_DATA_PAGES_PER_PTR : SVC_GR_DATA_PAGES_PER_PTR_OLD; u32 bounce_max = region_on ? SVC_GR_DATA_BOUNCE_MAX : @@ -15938,7 +15986,7 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu, * lines let a post-mortem compare the chosen PA against * the guest's own mapping. */ - if (svc_gr_data_log < 16) { + if (svc_gr_data_log < 192) { svc_gr_data_log++; pr_info("vgsp-sema: svc-gr data page va=0x%llx -> pa=0x%llx ap=%u\n", va, rec->pa, rec->ap); -- cgit v1.2.3