From 3e677f506db6d247a19b2b3df28ff86b6f763b51 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 12 Oct 2026 01:39:17 -0400 Subject: vgsp-sema: a stale-dropped pool read must not consume the residue rule (second-client fix) r99/r100: the fresh session's reused pool page reads the previous session's residue (cur=2) before the first genuine release (pay=1) is translated; the translated read set ch->pool_rel_seen, so every later residue release (payload <= cur) was silently dropped by the final else and the client spun at DEVICE forever. A read that applied or deferred nothing now leaves the flag clear so the r63/r64 residue re-seed still fires for the first genuine release of the session. --- kernel/gsp_sema_service.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 7d690ab..3c47ed3 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -6499,6 +6499,7 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, u32 cur = 0; int pending = 0; bool have_cur = false; + bool pool_stale_drop = false; bool inc, inc_apply = false; if (page_pa) @@ -6646,6 +6647,8 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, have_cur = true; if (st.sem_payload > cur) pending = 1; + else + pool_stale_drop = true; } /* * ISSUE-0002 r70: the residue rule @@ -6657,8 +6660,22 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, * so a submissions-based freshness * test misses the re-decode; this * flag does not. + * + * r101: a read the stale-drop path + * discarded (payload <= cur, nothing + * applied or deferred) must NOT set + * the flag. The reused pool page of + * a fresh session reads the previous + * session's residue (cur > payload) + * BEFORE the first genuine release is + * translated; that read used to set + * the flag and every later residue + * release was then silently dropped + * (r99/r100: pay=1 cur=2 dropped, the + * client spins at DEVICE). */ - if (!rrc2 && svc_pool_sem_va(sem_va) && ch) + if (!rrc2 && svc_pool_sem_va(sem_va) && ch && + !pool_stale_drop) ch->pool_rel_seen = true; } -- cgit v1.2.3