From e4fd8ec8598ceee29954a5f6a918bd7aa86ac27b Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Tue, 20 Oct 2026 17:11:16 -0400 Subject: sema: two-path identity check for the FB shadow hpa (__va(hpa) vs base+pa) - the sum=0 class shows the engine output written through one path and read through the other --- kernel/gsp_sema_service.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 83dfcc7..08547fe 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -3124,6 +3124,7 @@ static u64 svc_ledger_pin_repairs; static u64 svc_pool_alt_skipped; /* r372: bounded page-note resolution diagnostics (va/pa/ap/branch). */ static u32 svc_gr_pagenote_log; +static u32 svc_fbhpa_log; /* * Fan a pool release out to the last displaced translation of the same page @@ -14317,6 +14318,24 @@ static int svc_fwd_operand_hpa(struct nv_vgpu_device *vgpu, u8 kind, return -EFAULT; *hpa = (u64)page_to_phys(pg); *out_off = page_off; + /* + * r372 two-path identity check: the copy-out writes through + * __va(hpa) while every reader reads base+pa - if those are + * not the same memory the engine's output silently vanishes + * (the sum=0 class). Prove it empirically, bounded. + */ + if (svc_fbhpa_log < 16) { + u64 at_base = 0, at_va = 0; + + svc_fbhpa_log++; + memcpy(&at_base, base + page, sizeof(at_base)); + memcpy(&at_va, (u8 *)__va(*hpa), sizeof(at_va)); + pr_info("sema-fbhpa: pa=0x%llx base=%px pg=%px hpa=0x%llx shadow=0x%llx at_base=%016llx at___va=%016llx %s\n", + page, base, pg, *hpa, + (unsigned long long)svc_fb_shadow_size(vgpu), + at_base, at_va, + at_base == at_va ? "SAME" : "DIFFER"); + } return 0; } if (kind != SVC_APERTURE_SYS) -- cgit v1.2.3