From 928c0730f482b95cb5f27ff43f7500e191f012f4 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 26 Oct 2026 13:32:55 -0400 Subject: vgsp-sema: SESSION 134b fix the CE first-submission scan's entry decode (u32 hva truncated the 40-bit VA so no CE-window entry could ever match) hva must hold the 40-bit push VA (bit 32 set for the CE window) but was declared u32 in the scan, so ((h1 & 0xff) << 32) truncated to the low dword and hva < 0x120000000ULL was always true - scan_hits stayed 0 by construction. Same decode as svc_chan_userd/svc_gr_ring_candidate (u64). Verified building; the FB-convention latch itself (auto-pinned ring h=0xcaf00012 -> fb 0x80000, userd 0x90000, entry decode + push decode, ops_runs=1) was observed independently on r776. --- kernel/gsp_sema_service.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 910e7ef..4b315f6 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -14775,12 +14775,15 @@ static void svc_ce_firstsub_capture(struct nv_vgpu_device *vgpu, for (off = 0; off + 0x90 <= lim; off += 0x100) { static const u64 udeltas[] = { 0x10000, 0x2000, 0x1000, 0x0 }; - u32 h0, h1, hva, hlen; + u32 h0, h1; + u64 hva; + u32 hlen; unsigned int ui; memcpy(&h0, sbase + off, 4); memcpy(&h1, sbase + off + 4, 4); - hva = ((h1 & 0xff) << 32) | (h0 & 0xfffffffc); + hva = ((u64)(h1 & 0xff) << 32) | + (u64)(h0 & 0xfffffffc); hlen = ((h1 >> 10) & 0x1fffff) << 2; if ((hva & 0xfffff) || hva < 0x120000000ULL || hva >= 0x121000000ULL || hlen < 4 || -- cgit v1.2.3