From 439cb2e0b28267a9e2645b9555e85f0dd3008c1b Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 9 Oct 2026 14:45:12 -0400 Subject: vgsp-sema+guest-diag: fix CE USERD discovery for re-registered sessions (ISSUE-0002) svc_chan_userd now prefers the layout-derived CE USERD (ring_pa + 0x10000 in the ring aperture) and accepts it while idle, so a second session cannot latch onto the registered pool-relative offset when that alias holds a DIFFERENT rank's stale USERD: r40 c2 rank0 read rank3's stale 1/1 at FB 0xf0000 and the pump never followed rank0's own GP_PUT (guest GPUT mapping for gpFifoGpuVa proves ring+0x10000). guest_pin_stream.va_to_pa drops translations outside the registered guest-RAM windows so BAR1-phys addresses (0x70000xxxxx) are no longer injected as SYS pins; r40 rank2's ring resolved to the bogus pa=0x70000c0000 ap=SYS and read 66/66. --- kernel/gsp_sema_service.c | 30 ++++++++++++++++++++++++++++++ tools/guest-diag/guest_pin_stream.py | 23 +++++++++++++++++++++++ 2 files changed, 53 insertions(+) diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 3692246..309210d 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -7714,6 +7714,36 @@ static int svc_chan_userd(struct nv_vgpu_device *vgpu, struct svc_channel *ch, int ring_alt = ring_ap == SVC_APERTURE_FB ? SVC_APERTURE_SYS : SVC_APERTURE_FB; + /* + * ISSUE-0002 (r40): prefer the layout-derived CE USERD and accept it + * while it is still idle. In a second session the registered userdMem + * offset (pool-relative, see below) aliases a DIFFERENT rank's real + * USERD whose stale put/get from the previous session won the + * coherent-pair probe while this channel's true block was still 0/0: + * c2 rank0 read rank3's stale 1/1 at FB 0xf0000 and the pump never + * followed rank0's own GP_PUT. The true CE USERD sits at + * ring + 0x10000 in the ring's aperture - confirmed by the guest + * CPU mapping of gpFifoGpuVa (GPU VA gpfifo+0x20000 maps to BAR + * offset ring+0x10000) and by every CE rank that resolved correctly. + * An idle (0/0) read is accepted here because the guest writes the + * block on the channel's first push; only unreadable or incoherent + * candidates fall through to the old list. + */ + if (ring_pa && ch->engine_type != 0) { + u32 p = 0, g = 0; + int rc = svc_userd_probe(vgpu, ring_pa + 0x10000, ring_ap, + ch->gpfifo_entries, &p, &g); + + if (rc == 0 || rc == -EAGAIN) { + ch->userd_pa = ring_pa + 0x10000; + ch->userd_as = ring_ap; + ch->userd_ok = true; + *put = p; + *get = g; + return 0; + } + } + if (ring_pa) { cand[nc] = ring_pa + 0x2000; as[nc++] = ring_ap; cand[nc] = ring_pa + 0x2000; as[nc++] = ring_alt; diff --git a/tools/guest-diag/guest_pin_stream.py b/tools/guest-diag/guest_pin_stream.py index 14cd526..031271c 100644 --- a/tools/guest-diag/guest_pin_stream.py +++ b/tools/guest-diag/guest_pin_stream.py @@ -166,6 +166,9 @@ class Kcore: self._pa_cache[page] = 0 return None pa = e & 0x000FFFFFFFF000 + if not _is_ram_pa(pa): + self._pa_cache[page] = 0 + return None self._pa_cache[page] = pa return pa @@ -178,6 +181,26 @@ def is_gpu_va(v): return v and 0x120000000 <= v < 0x200000000 +# Guest-RAM windows registered with the host (debugfs gsp-phys-guest-ram): +# low 0..2 GiB and high 4..6 GiB. A CPU mapping of a channel block resolves +# through the guest page tables to a phys address in one of these windows +# when the backing is guest sysmem, but to a PCI BAR address (e.g. +# 0x70000xxxxx, the mdev BAR1 aperture) when the backing is the emulated +# vidmem. The host pin stream must only carry guest-RAM PAs: a BAR phys fed +# to sema_map_add as a "sysmem" pin poisoned the ring/USERD lookups (r40: +# rank2's ring resolved to pa=0x70000c0000 ap=SYS and read 66/66 garbage). +RAM_WINDOWS = ((0x0, 0x80000000), (0x100000000, 0x180000000)) + + +def _is_ram_pa(pa): + if not pa: + return False + for lo, hi in RAM_WINDOWS: + if lo <= pa < hi: + return True + return False + + def _is_gpu_va_wide(v): """GPU VAs above 0x200000000 are the GR share window; accept them too.""" return v and (is_gpu_va(v) or 0x200000000 <= v < 0x208000000) -- cgit v1.2.3