From 1bd1deac4b15ec3dd54d242b4f72d732d17901e6 Mon Sep 17 00:00:00 2001
From: Arthur Hanson Rasmusson <arthur@vgpu.io>
Date: Mon, 26 Oct 2026 12:07:57 -0400
Subject: vgsp-sema: SESSION 133c USERD-shape-derived ring pass - find the
 channel USERD by its own shape (put@+0x8c, get@+0x88, the find_userd layout)
 and derive the ring at userd-{0x10000,0x2000,0x1000}, validating entry0
 (shape + not provably dead) and the USERD probe; the USERD words appear at
 channel creation and stay while the ring entry may be written later, so this
 is the stabler trigger for the CE-family rings that the periodic ring-entry
 scan misses

---
 kernel/gsp_sema_service.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

(limited to 'kernel/gsp_sema_service.c')

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 8814a0a..5c5074f 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -16322,6 +16322,74 @@ static void svc_gr_ring_autopin(struct nv_vgpu_device *vgpu,
 			static const u64 udeltas[] = { 0x10000, SVC_GR_USERD_OFF,
 						       0x1000 };
 
+			/*
+			 * SESSION 133c pass 1: find the USERD by its OWN
+			 * shape (put@+0x8c, get@+0x88 - the find_userd
+			 * layout) and derive the ring from it. The USERD
+			 * words appear at channel creation and stay; the
+			 * ring entry may be written later, so this pass is
+			 * the stabler trigger. Each hit is validated by the
+			 * derived ring's entry0 (shape + not-dead), so a
+			 * coincidental put/get pair costs a failed check.
+			 */
+			for (off = 0; off + 0x90 <= lim; off += 0x100) {
+				u32 up, ug;
+				unsigned int ui;
+
+				memcpy(&up, sbase + off + 0x8c, 4);
+				if (up < 1 || up > 65535)
+					continue;
+				memcpy(&ug, sbase + off + 0x88, 4);
+				if (ug > up)
+					continue;
+				for (ui = 0; ui < ARRAY_SIZE(udeltas); ui++) {
+					u64 roff;
+					u32 h0, h1, p3 = 0, g3 = 0;
+					u64 hva;
+					u32 hlen;
+
+					if (off < udeltas[ui])
+						continue;
+					roff = off - udeltas[ui];
+					memcpy(&h0, sbase + roff, 4);
+					memcpy(&h1, sbase + roff + 4, 4);
+					hva = ((u64)(h1 & 0xff) << 32) |
+					      (u64)(h0 & 0xfffffffc);
+					hlen = ((h1 >> 10) & 0x1fffff) << 2;
+					if (!hva || (hva & 0xfffff) ||
+					    hva < SEMA_VA_LO ||
+					    hva >= SEMA_VA_HI || hlen < 4 ||
+					    hlen > 0x10000)
+						continue;
+					if (svc_ring_entry_dead(vgpu, h0, h1))
+						continue;
+					if (svc_userd_probe(vgpu, off,
+							    SVC_APERTURE_FB,
+							    ch->gpfifo_entries,
+							    &p3, &g3))
+						continue;
+					svc_pin_store(ch->gpfifo_va, roff,
+						      SVC_APERTURE_FB);
+					svc_lat_store(ch->gpfifo_va, roff,
+						      SVC_APERTURE_FB);
+					ch->userd_pa = off;
+					ch->userd_as = SVC_APERTURE_FB;
+					ch->userd_ok = true;
+					svc_gr_ring_base = roff;
+					set_bit(ch->gr_index,
+						&svc_gr_ring_done);
+					set_bit(ch->gr_index,
+						&svc_gr_ring_scan_done);
+					svc_ring_n++;
+					pr_info("sema-chan: auto-pinned GR ring h=0x%x rank=%u va=0x%llx -> fb 0x%llx (userd-shape scan d=0x%llx; entry0 va=0x%llx len=%u put=%u get=%u)\n",
+						ch->h_object, ch->gr_index,
+						ch->gpfifo_va, roff,
+						udeltas[ui], hva, hlen, p3,
+						g3);
+					return;
+				}
+			}
+			/* pass 2: ring-entry-shaped pages (below) */
 			for (off = 0; off + 8 <= lim; off += 0x100) {
 				u32 h0, h1;
 				u64 hva;
-- 
cgit v1.2.3