vgsp-sema: scope CE/GR rank assignment to the owning client (ISSUE-0002)

r78 validation of the client-scoped deletion: the boot session's CeUtils
scrubber channel (client != the UVM client, entries=4096) stayed
registered as intended, but it consumed CE rank 0 and every UVM channel's
rank shifted by one. Ring autopin and push-buffer pairing derive the ring
and pool-semaphore offsets from the rank (0x121010000 + 0x30000*rank,
0x121000000 + 4*rank), so the first client's pairing went to the wrong
offsets and the guest wedged on an rwsem (sysrq: rwsem_spin_on_owner).

Rank is now counted only among live channels of the same owning client;
the UVM client's channels keep ranks 0..5 and the kernel/GPU-global
scrubber gets its own (unused for the pool layout) rank. Missing clients
keep the old counting.

1 files changed, 13 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index d736ffe..638a866 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -1017,12 +1017,23 @@ void gsp_sema_service_channel_add(const struct sema_channel_desc *desc)
 		 * same order, so the rank is what ties a channel to its ring
 		 * offset and its push-buffer base (see svc_ring_autopin /
 		 * svc_pb_pair).
+		 *
+		 * ISSUE-0002 (r78): the rank is per OWNING CLIENT - the UVM
+		 * pool layout (0x121000000 + 4*rank) is allocated by that
+		 * client. The kernel/GPU-global CeUtils scrubber channel
+		 * (client != the UVM client, entries=4096) must not consume
+		 * rank 0: r78 kept it registered (client-scoped deletion) and
+		 * every UVM channel's rank shifted by one, so ring autopin and
+		 * push-buffer pairing used the wrong offsets and the first
+		 * client wedged.
 		 */
 		if (desc->engine_type) {
 			u8 rank = 0;
 
 			for (k = 0; k < SVC_MAX_CHANNELS; k++)
 				if (svc.chan[k].valid && svc.chan[k].engine_type &&
+				    (!svc.chan[k].h_client || !desc->h_client ||
+				     svc.chan[k].h_client == desc->h_client) &&
 				    svc.chan[k].h_object < desc->h_object)
 					rank++;
 			ch->ce_index = rank;
@@ -1031,6 +1042,8 @@ void gsp_sema_service_channel_add(const struct sema_channel_desc *desc)
 
 			for (k = 0; k < SVC_MAX_CHANNELS; k++)
 				if (svc.chan[k].valid && !svc.chan[k].engine_type &&
+				    (!svc.chan[k].h_client || !desc->h_client ||
+				     svc.chan[k].h_client == desc->h_client) &&
 				    svc.chan[k].h_object < desc->h_object)
 					rank++;
 			ch->gr_index = rank;