vgsp: apply userdOffset[subDeviceId] to channel USERD addr (real control page fb 0x20fc00, not 0x18fe00); low-aperture 0x4000000-class entry window; GR-ring USERD probe accepts g>p/put-cap>1024; own-VAS-first counter derive - USERD wall broken (chan h=0xbeef0100 userd=0x20fc00 as=2 ring rc=0 pa=0x233603000); new wall: client never stores GP_PUT (put=0, FB 0x20fc00+0x8c frozen; last RM call ZCULL_BIND 0x20801208) - SESSION 153 r1016

1 files changed, 48 insertions, 0 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index 2f63bcd..99f394c 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -3137,6 +3137,32 @@ static void gsp_rm_register_channel(struct gsp_emu_context *ctx, u32 h_object,
 	memcpy(&desc.cid, params + GSPRM_CHAN_CID, 4);
 	memcpy(&desc.instance_pa, params + GSPRM_CHAN_INSTANCE_MEM, 8);
 	memcpy(&desc.userd_pa, params + GSPRM_CHAN_USERD_MEM, 8);
+	/*
+	 * SESSION 153-CONTINUED-38: the USERD control page sits at
+	 * userdMem.address + userdOffset[subDeviceId] (NV_CHANNEL_ALLOC_PARAMS
+	 * userdOffset[NV_MAX_SUBDEVICES], @64; subDeviceId @136, the
+	 * one-hot bit index is normally 0 but the X client-share channel
+	 * carries 1). The GL client's kernel channels declare userdMem fb
+	 * 0x18fe00 with userdOffset[0]=0x7fe00, so the service was
+	 * probing/monitoring 0x18fe00 while the real control page
+	 * (GPGet/GPPut) lives at 0x20fc00 - both the registered candidate
+	 * and every FB observation were at the wrong offset, which is why
+	 * the direct client's channels never resolved a USERD (CONT-37
+	 * alloc/free retry loop). Index by the subdevice.
+	 */
+	{
+		u32 sd = 0;
+		u64 uo = 0;
+
+		if (params_size >= 140)
+			memcpy(&sd, params + 136, 4);
+		if (sd >= 8)
+			sd = 0;
+		if (params_size >= 64 + (sd + 1) * 8) {
+			memcpy(&uo, params + 64 + (u64)sd * 8, 8);
+			desc.userd_pa += uo;
+		}
+	}
 	memcpy(&desc.userd_as, params + GSPRM_CHAN_USERD_MEM +
 	       GSPRM_CHAN_MEM_APERTURE, 4);
 	memcpy(&desc.notifier_pa, params + GSPRM_CHAN_NOTIFIER_MEM, 8);
@@ -3161,6 +3187,28 @@ static void gsp_rm_register_channel(struct gsp_emu_context *ctx, u32 h_object,
 				desc.notifier_pa, desc.notifier_as);
 		}
 	}
+	/*
+	 * SESSION 153-CONTINUED-38: name the per-subdevice userdOffset (the
+	 * kernel channels' control page may sit inside the declared userdMem
+	 * at a nonzero offset; the service currently assumes address+0).
+	 * Bounded.
+	 */
+	{
+		static u32 uo_log;
+
+		if (uo_log < 8 && params_size >= 80) {
+			u64 uo0 = 0;
+			u32 sd = 0;
+
+			memcpy(&uo0, params + 64, 8);
+			if (params_size >= 140)
+				memcpy(&sd, params + 136, 4);
+			uo_log++;
+			pr_info("vgsp-rm: chan userdOff[0]=0x%llx subDevId=0x%x hObject=0x%x (userd memdesc=0x%llx/%u)\n",
+				uo0, sd, h_object, desc.userd_pa,
+				desc.userd_as);
+		}
+	}
 	gsp_sema_service_channel_add(&desc);
 }