r526 THE XDIFF ROOT CAUSE: the LOAD_INLINE_DATA destination cursor must advance even when the r391f once-only gate suppresses the write. A re-decode pass that skipped the FIRST run of a split upload left the cursor at the first run's destination, so the SECOND run's data landed at offset 0 (the deterministic tgemm X[0..1]<-X[2..3] 8-byte overwrite, present in every pass); the gate suppresses the write, not the method stream's positional semantics

1 files changed, 19 insertions, 11 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index bc21e95..42e8d76 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -9657,17 +9657,6 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
 							      bytes,
 							      ch->h_object);
 					/*
-					 * fail4: hardware semantics - a
-					 * LOAD_INLINE_DATA run advances the
-					 * destination cursor by the bytes it
-					 * wrote. Without this, the consecutive
-					 * runs of a split 64 KB upload all land
-					 * at the first destination and the page
-					 * ends up with only the last run's
-					 * words (the RAWA junk).
-					 */
-					st.offset_out += bytes;
-					/*
 					 * fail4: name the header that follows
 					 * each big LID run - the split 64 KB
 					 * upload's other payload carriers sit
@@ -9695,6 +9684,25 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
 						trusted, allow_ops, st.have_out,
 						st.line_length, ch->h_object);
 				}
+				/*
+				 * fail4 (r526): hardware semantics - a
+				 * LOAD_INLINE_DATA run advances the destination
+				 * cursor by the bytes it carries whether or not
+				 * the once-only gate let the write run. Without
+				 * this, the consecutive runs of a split upload
+				 * all land at the first destination (the old
+				 * RAWA bug), and worse: on a re-decode pass where
+				 * the gate suppresses the FIRST run, the cursor
+				 * stays at the first run's destination and the
+				 * SECOND run executes there - its data (the
+				 * buffer's bytes 8..16) overwriting offset 0
+				 * (the observed tgemm XDIFF: X[0..1] <-
+				 * X[2..3], deterministic, every pass). The gate
+				 * suppresses the write, not the method stream's
+				 * positional semantics.
+				 */
+				if (bytes)
+					st.offset_out += bytes;
 			}
 			/*
 			 * Record the destination and the payload bytes for