vgsp: CE semaphore-release decode fix (count>=2 folds v1) - DDX sem-wait completion authored; xwd -root unblocked (SESSION 153 r942)

1 files changed, 19 insertions, 2 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 7773efe..639ca94 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -13405,12 +13405,29 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
 		}
 		switch (addr) {
 		case CE_M_SET_SEMAPHORE_A:
+			/*
+			 * SESSION 153 CONT.8: the X DDX's CE release pushes
+			 * the semaphore pair as ONE contiguous count-2 run at
+			 * 0x240 (raw witness, h=0x1000013 va=0x120012434:
+			 * `addr=0x240 cnt=2 v0=00000001 v1=2000c010` = the
+			 * hi/lo halves of VA 0x12000c010, followed by a
+			 * count-1 run at 0x248 with the payload).  The old
+			 * count>=3-only fold left sem_va_lo at 0, so every
+			 * such release assembled the bogus VA 0x100000000
+			 * (hi<<32) and was deferred forever on an
+			 * untranslatable address while the DDX's nvSemWait
+			 * on the real slot spun (xwd -root / server-side
+			 * readback wedged the whole Xorg).  Fold the low
+			 * half for count>=2; the payload stays on the 0x248
+			 * run (or v2 when a count-3 triple arrives).
+			 */
 			st.sem_va_hi = v0;
-			if (count >= 3) {
+			if (count >= 2) {
 				st.sem_va_lo = v1;
-				st.sem_payload = v2;
 				st.have_sem = 1;
 			}
+			if (count >= 3)
+				st.sem_payload = v2;
 			break;
 		case CE_M_SET_SEMAPHORE_B:
 			st.sem_va_lo = v0;