vgsp: golden9d - FBMEM channel memdescs and FBMEM MAIN

The golden9c cycle reached the promote commit and hung the GR engine in the
ctxsw wait (FECS_A/B TDR records then a fatal assert). The real golden capture
carried client-local FBMEM instance/USERD/RAMFC/mthd memdescs and FBMEM ctx
buffers; the host-sysmem substitution is the remaining aperture difference.
Allocate one FBMEM block for the four channel memdescs (sliced 0x1000/0x200/
0x1000/0x1000 like the client memmgr) and back the promoted MAIN with the
server FBMEM allocation (VIDMEM physAttr 0x4, VIDMEM PDB leaf PTEs) for mode
25. PATCH/FECS/PRIV/UNR stay host sysmem in this iteration.

1 files changed, 61 insertions, 16 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index cc95175..36a71d0 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -790,6 +790,18 @@ bool gsp_phys_boot_requested(void)
 #define GSP_PHYS_RMCALL_HANDLE_GOLDEN_CHANNEL	0xcaf00054u
 #define GSP_PHYS_RMCALL_HANDLE_GOLDEN_GR_OBJ	0xcaf00058u
 #define GSP_PHYS_RMCALL_HANDLE_GOLDEN_GR3D_LADDER	0xcaf0005cu
+/*
+ * Mode-25 golden9d: one FBMEM block sliced into the golden channel's
+ * instance/USERD/RAMFC/mthd memdescs (the real capture used client-local
+ * FBMEM for all four; host sysmem made the engine's instance/RAMFC fetch
+ * hang during the ctxsw wait).
+ */
+#define GSP_PHYS_RMCALL_HANDLE_GOLDEN_FB_MEM	0xcaf00060u
+#define GSP_PHYS_RMCALL_GOLDEN_FB_MEM_SIZE	0x4000u
+#define GSP_PHYS_RMCALL_GOLDEN_FB_INSTANCE	0x0000u
+#define GSP_PHYS_RMCALL_GOLDEN_FB_USERD		0x1000u
+#define GSP_PHYS_RMCALL_GOLDEN_FB_RAMFC		0x2000u
+#define GSP_PHYS_RMCALL_GOLDEN_FB_MTHD		0x3000u
 
 /*
  * Golden-image replay sizes (kernel_graphics.c:2058-2060, 2273-2276): the
@@ -7146,6 +7158,18 @@ gsp_phys_rmcall_mem_desc(u32 index)
 	return d;
 }
 
+static struct gsp_phys_rmcall_mem_desc
+gsp_phys_rmcall_mem_desc_fb(u64 base, u64 size)
+{
+	struct gsp_phys_rmcall_mem_desc d;
+
+	d.base = cpu_to_le64(base);
+	d.size = cpu_to_le64(size);
+	d.address_space = cpu_to_le32(GSP_PHYS_RMCALL_ADDR_FBMEM);
+	d.cache_attrib = cpu_to_le32(GSP_PHYS_RMCALL_CACHE_UNCACHED);
+	return d;
+}
+
 /*
  * Channel-alloc variants tried in table order after the TSG exists. V5
  * (tsg-vas-pdb-skip-scrubber) is tried first: the pre-allocated
@@ -7810,6 +7834,7 @@ static int gsp_phys_rmcall_golden_replay(void __iomem *bar0)
 	struct gsp_phys_rmcall_channel_params ch;
 	struct gsp_phys_rmcall_mem_obj_shape shape;
 	u32 rpc = 0, status = 0;
+	u64 golden_fb = 0;
 	bool pb_ok = true;
 	int ret;
 
@@ -7930,22 +7955,35 @@ static int gsp_phys_rmcall_golden_replay(void __iomem *bar0)
 		ch.h_va_space = cpu_to_le32(boot_stage.rmcall_vas);
 		ch.h_object_buffer = cpu_to_le32(0);
 		/*
-		 * The real wire carries its client-local USERD handle; the
-		 * ladder keeps the memdesc pair the V5 shape proved
-		 * (userdMem sysmem chunk, handle array zeroed).
+		 * The captured golden wire carried client-local FBMEM
+		 * instance/USERD/RAMFC/mthd memdescs; the earlier host-sysmem
+		 * substitution made the engine's instance/RAMFC fetch hang in
+		 * the commit's ctxsw wait (FECS TDRs + fatal assert). Allocate
+		 * one FBMEM block and slice it like the client memmgr would.
+		 * hUserdMemory[0] stays 0 (the real wire's handle is
+		 * client-local and unavailable here).
 		 */
 		ch.h_userd_memory[0] = cpu_to_le32(0);
-		ch.instance_mem = gsp_phys_rmcall_mem_desc(
-			GSP_PHYS_RMCALL_BUF_INSTANCE);
-		ch.userd_mem = gsp_phys_rmcall_mem_desc(
-			GSP_PHYS_RMCALL_BUF_USERD);
-		ch.ramfc_mem = gsp_phys_rmcall_mem_desc(
-			GSP_PHYS_RMCALL_BUF_RAMFC);
-		ch.mthdbuf_mem = gsp_phys_rmcall_mem_desc(
-			GSP_PHYS_RMCALL_BUF_MTHDBUF);
-		pr_info("vgsp-boot: rm-call: GOLDEN9 channel shape: flags=0x%x (PRIVILEGED|USERD_INDEX_VALUE=3|USERD_INDEX_PAGE_FIXED, no SKIP_SCRUBBER/SKIP_CTXBUFFER_ALLOC) hObjectBuffer=0 gpFifoEntries=0x%x instance/userd/ramfc/mthd=host sysmem memdescs (capture used client-local FBMEM)\n",
+		ret = gsp_phys_rmcall_alloc_fb_mem(bar0,
+				GSP_PHYS_RMCALL_HANDLE_GOLDEN_FB_MEM,
+				GSP_PHYS_RMCALL_GOLDEN_FB_MEM_SIZE, &golden_fb,
+				"GOLDEN channel memdescs");
+		if (ret) {
+			pr_err("vgsp-boot: rm-call: GOLDEN9 channel FBMEM memdesc block (0x%x bytes) allocation failed: %d; the golden replay aborts with no retry\n",
+			       GSP_PHYS_RMCALL_GOLDEN_FB_MEM_SIZE, ret);
+			return ret;
+		}
+		ch.instance_mem = gsp_phys_rmcall_mem_desc_fb(
+			golden_fb + GSP_PHYS_RMCALL_GOLDEN_FB_INSTANCE, 0x1000);
+		ch.userd_mem = gsp_phys_rmcall_mem_desc_fb(
+			golden_fb + GSP_PHYS_RMCALL_GOLDEN_FB_USERD, 0x200);
+		ch.ramfc_mem = gsp_phys_rmcall_mem_desc_fb(
+			golden_fb + GSP_PHYS_RMCALL_GOLDEN_FB_RAMFC, 0x1000);
+		ch.mthdbuf_mem = gsp_phys_rmcall_mem_desc_fb(
+			golden_fb + GSP_PHYS_RMCALL_GOLDEN_FB_MTHD, 0x1000);
+		pr_info("vgsp-boot: rm-call: GOLDEN9 channel shape: flags=0x%x (PRIVILEGED|USERD_INDEX_VALUE=3|USERD_INDEX_PAGE_FIXED, no SKIP_SCRUBBER/SKIP_CTXBUFFER_ALLOC) hObjectBuffer=0 gpFifoEntries=0x%x instance/userd/ramfc/mthd=FBMEM memdescs block=0x%llx (capture-matched apertures)\n",
 			GSP_PHYS_RMCALL_CHANNEL_FLAG_GOLDEN9,
-			GSP_PHYS_RMCALL_GOLDEN_GPFIFO_ENTRIES);
+			GSP_PHYS_RMCALL_GOLDEN_GPFIFO_ENTRIES, golden_fb);
 	}
 	ret = gsp_phys_rmcall_alloc(bar0, boot_stage.rmcall_client,
 				    boot_stage.rmcall_device,
@@ -8430,7 +8468,9 @@ static int gsp_phys_rmcall_gr_ctx_prepare(void __iomem *bar0)
 	    boot_stage.rmcall_gr_promote ==
 			GSP_PHYS_RMCALL_GR_PROMOTE_KMD_FB ||
 	    boot_stage.rmcall_gr_promote ==
-			GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT_FB) {
+			GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT_FB ||
+	    boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN9) {
 		u64 fb_base = 0;
 
 		ret = gsp_phys_rmcall_alloc_fb_mem(bar0,
@@ -8788,7 +8828,9 @@ static int gsp_phys_rmcall_golden9_promote(void __iomem *bar0)
 	gsp_phys_rmcall_promote_entry_fill(p, 0,
 		GSP_PHYS_RMCALL_GR_CTX_BUFFER_ID_MAIN,
 		boot_stage.rmcall_ctx_pa, boot_stage.rmcall_ctx_va,
-		boot_stage.rmcall_ctx_size, attr, 1, 0);
+		boot_stage.rmcall_ctx_size,
+		boot_stage.rmcall_ctx_fbmem ?
+			GSP_PHYS_RMCALL_GR_CTX_PHYS_ATTR_FB : attr, 1, 0);
 	gsp_phys_rmcall_promote_entry_fill(p, 1,
 		GSP_PHYS_RMCALL_GR_CTX_BUFFER_ID_PATCH,
 		boot_stage.rmcall_patch_pa, GSP_PHYS_RMCALL_VA_GR_PATCH,
@@ -9835,7 +9877,10 @@ static int gsp_phys_rmcall_gr_ctx_promote(void __iomem *bar0)
 					GSP_PHYS_RMCALL_GR_CTX_BUFFER_ID_MAIN,
 					boot_stage.rmcall_ctx_pa,
 					boot_stage.rmcall_ctx_va,
-					boot_stage.rmcall_ctx_size, attr, 1, 0);
+					boot_stage.rmcall_ctx_size,
+					boot_stage.rmcall_ctx_fbmem ?
+						GSP_PHYS_RMCALL_GR_CTX_PHYS_ATTR_FB :
+						attr, 1, 0);
 				gsp_phys_rmcall_gr_promote_log_entry(0,
 					&p->entry[0],
 					"combined (PDB-mapped ctx VA)");