diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-26 13:32:55 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-26 13:32:55 -0400 |
| commit | 928c0730f482b95cb5f27ff43f7500e191f012f4 (patch) | |
| tree | 533b63097c2eb333538c5ab9b9df8c0d9caf854b /kernel | |
| parent | 366427182657526b32de60c6df3ef747568c3be7 (diff) | |
| download | open-iov-928c0730f482b95cb5f27ff43f7500e191f012f4.tar.gz open-iov-928c0730f482b95cb5f27ff43f7500e191f012f4.zip | |
vgsp-sema: SESSION 134b fix the CE first-submission scan's entry decode (u32 hva truncated the 40-bit VA so no CE-window entry could ever match)
hva must hold the 40-bit push VA (bit 32 set for the CE window) but was
declared u32 in the scan, so ((h1 & 0xff) << 32) truncated to the low
dword and hva < 0x120000000ULL was always true - scan_hits stayed 0 by
construction. Same decode as svc_chan_userd/svc_gr_ring_candidate (u64).
Verified building; the FB-convention latch itself (auto-pinned ring
h=0xcaf00012 -> fb 0x80000, userd 0x90000, entry decode + push decode,
ops_runs=1) was observed independently on r776.
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/gsp_sema_service.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 910e7ef..4b315f6 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -14775,12 +14775,15 @@ static void svc_ce_firstsub_capture(struct nv_vgpu_device *vgpu, for (off = 0; off + 0x90 <= lim; off += 0x100) { static const u64 udeltas[] = { 0x10000, 0x2000, 0x1000, 0x0 }; - u32 h0, h1, hva, hlen; + u32 h0, h1; + u64 hva; + u32 hlen; unsigned int ui; memcpy(&h0, sbase + off, 4); memcpy(&h1, sbase + off + 4, 4); - hva = ((h1 & 0xff) << 32) | (h0 & 0xfffffffc); + hva = ((u64)(h1 & 0xff) << 32) | + (u64)(h0 & 0xfffffffc); hlen = ((h1 >> 10) & 0x1fffff) << 2; if ((hva & 0xfffff) || hva < 0x120000000ULL || hva >= 0x121000000ULL || hlen < 4 || |