guest-diag: fix CE-window demand-pin offset mask (& 0xFFFFF folded every 1 MB rank to offset 0)

Demand pins for 0x120700000/0x120800000/0x120a00000 all resolved to page 0 of
the first nv_vm_map_pages area (the same wrong PA), so the host read garbage
for every rank but the first and repeat clients stalled at DEVICE. Use the
full 16 MB window offset (& 0xFFFFFF); the per-area page bound rejects areas
too small. Live: r161 ran victory_mail green as clients 1 AND 2 in one boot,
then matmul and smiley - the repeat-client stall class is gone for these.

1 files changed, 8 insertions, 1 deletions

diff --git a/tools/guest-diag/guest_pin_stream.py b/tools/guest-diag/guest_pin_stream.py
index ce98d5b..3f4183c 100644
--- a/tools/guest-diag/guest_pin_stream.py
+++ b/tools/guest-diag/guest_pin_stream.py
@@ -315,7 +315,14 @@ def resolve_va_by_content(kc, va, out):
     """
     if not (PB_CE_LO <= va < PB_CE_HI):
         return False
-    off = (va - PB_CE_LO) & 0xFFFFF
+    # 2026-10-16 fix: the CE push-buffer window is 16 MB (PB_CE_LO..PB_CE_HI)
+    # and each rank is a 1 MB slice of ONE nv_vm_map_pages vmap. The old
+    # `& 0xFFFFF` folded every 1 MB boundary to offset 0, so ranks 0x120700000,
+    # 0x120800000 and 0x120a00000 all resolved to page 0 of the first area -
+    # the same wrong PA - and the host read garbage for every rank but the
+    # first. Keep the full 16 MB offset: the page index is the true offset
+    # into the mem, and the per-area pages bound rejects areas too small.
+    off = (va - PB_CE_LO) & 0xFFFFFF
     k = off >> 12
     for (lo, _hi, pages) in _nv_vmap_areas(kc):
         for adj in (0, 1, -1):