From f5961087aa17111c6cdb7f6641626c0c877eee6b Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Sun, 11 Oct 2026 16:43:33 -0400 Subject: vgsp-sema: scope channel deletion to the owning RM client (ISSUE-0002) Handles are per-client, but the FREE path unregistered any channel whose numeric handle matched the freed object, with no client check. r77 root cause of the third-client pma scrub hang: the boot session's CeUtils scrubber channel (h=0x2, gpfifo=0x120064000, entries=4096) was unregistered when an unrelated class-0x2080 object with handle 0x2 in client 0xc1d00011 was freed. The guest kept using the live channel for the scrub; the service no longer pumped it, its pushes were never decoded and the channel-buffer finish payload (pbGpuVA+0x6c004) was never written, so scrubCheckAndWaitForSize polled forever (sysrq stack: ceutilsUpdateProgress -> channelReadChannelMemdesc). Channel registration now records h_client (the RM alloc header's client) and deletion matches (h_object, h_client); a missing client on either side keeps the handle-only behaviour. Re-registration keeps the counter/release slots only for the same (handle, client) pair. Live proof from the hung VM: sema_probe translates the finish-payload VA 0x12006c004 to pa=0x10f962004 aperture=ram - the word the guest polls is reachable; the channel was simply invisible to the pump. --- kernel/gsp_sema_service.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'kernel/gsp_sema_service.h') diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h index 4b04892..e00ef91 100644 --- a/kernel/gsp_sema_service.h +++ b/kernel/gsp_sema_service.h @@ -21,6 +21,12 @@ */ struct sema_channel_desc { u32 h_object; + u32 h_client; /* owning RM client; handles are per-client, + * so deletion must match it too (ISSUE-0002 + * r78: a class-0x2080 object with handle 0x2 + * in another client unregistered the scrubber + * channel 0x2 and its finish payload was never + * written again). */ u32 engine_type; u32 cid; /* RM channel id (the doorbell token vector) */ u64 gpfifo_va; @@ -33,7 +39,7 @@ struct sema_channel_desc { }; void gsp_sema_service_channel_add(const struct sema_channel_desc *desc); -void gsp_sema_service_channel_del(u32 h_object); +void gsp_sema_service_channel_del(u32 h_object, u32 h_client); /* * A GPU VA space whose top-level page directory the driver has published (the -- cgit v1.2.3