From 896d3e406f409ce4e80e5682ea3666de55a13158 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Tue, 27 Oct 2026 15:00:43 -0400 Subject: vgsp: extend notifier-derived ring pin to all GR channels r859: the X channel never resolved its ring all boot (garbage entries va=0x41c000/0x2017a20/0x10104, unreadable/skipped, ~11 s per frame). Rule verified on the RC watchdog across r848/r853/r858: ring = notifier page + 0x400. Widened to every GR channel with a registered notifier PA; the standard entry0+USERD candidate probe still content-gates each derivation, so a wrong guess costs a failed probe (the current state). --- kernel/gsp_sema_service.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index c93ecc9..56cfefa 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -17042,20 +17042,17 @@ static void svc_gr_ring_autopin(struct nv_vgpu_device *vgpu, return; /* wait until the CE channels are known */ /* - * SESSION 148 perf (r858 evidence): the RC-watchdog channel's ring - * page sits at (notifier_pa page + 0x400) in EVERY observed boot - - * r848: notif 0x11b689420 -> ring 0x11b689400; r853: 0x11b8a6420 - * -> 0x11b8a6400; r858: 0x102e04420 -> 0x102e04400. The registered - * notifier PA is guest truth from the channel alloc, so this - * derivation is deterministic; the trusted walk resolved the same - * ring 14 s LATE on r858 (77280 registered, 77294 walk) and, on the - * failing boots, inside that window the driver's DMA test read - * zeros/garbage -> "Failed to initialize DMA" and guest vmap-lock - * livelocks followed. Content-gated by the standard candidate probe - * (entry0 + USERD validation), so a wrong derivation costs a failed - * probe, not a wrong pin. - */ - if (ch->h_object == 0x31415900u && ch->notifier_pa) { + * SESSION 148 perf (r858/r859 evidence): a GR channel's ring page + * sits at (notifier_pa page + 0x400). Verified for the RC watchdog + * across r848/r853/r858; extended to all GR channels after r859 + * showed the X channel (0x1000013) NEVER resolving its ring (no + * auto-pin all boot, entries decoded from garbage: va=0x41c000/ + * 0x2017a20/0x10104 with lens 20464..49152, unreadable, skipped; + * ~11 s per frame). The candidate probe (entry0 in the channel's + * own alloc + USERD shape) content-gates every derivation, so a + * wrong guess costs a failed probe - exactly the current behaviour. + */ + if (!ch->engine_type && ch->notifier_pa) { u64 rpa = (ch->notifier_pa & ~(u64)(SEMA_PAGE_SIZE - 1)) + 0x400; -- cgit v1.2.3