vgsp: m37 pcas gate (window-only stock form) + QMD w48..50 post-mortem

3 files changed, 39 insertions, 7 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index a4d9718..8b78d9a 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -13877,11 +13877,13 @@ static u32 gsp_phys_rmcall_build_gr_launch(u32 *pb,
 		memcpy(p, qmd, GSP_PHYS_GR_QMD_WORDS * 4);
 		p += GSP_PHYS_GR_QMD_WORDS;
 	}
-	p = gsp_phys_rmcall_push_gr(p, GSP_PHYS_RMCALL_GR_SEND_PCAS_A,
-				    (u32)(qmd_va >> 8));
-	p = gsp_phys_rmcall_push_gr(p,
-			GSP_PHYS_RMCALL_GR_SEND_SIGNALING_PCAS_B,
-			GSP_PHYS_RMCALL_GR_PCAS_INVALIDATE_SCHEDULE);
+	if (gsp_phys_rmcall_gr_pcas_value()) {
+		p = gsp_phys_rmcall_push_gr(p, GSP_PHYS_RMCALL_GR_SEND_PCAS_A,
+					    (u32)(qmd_va >> 8));
+		p = gsp_phys_rmcall_push_gr(p,
+				GSP_PHYS_RMCALL_GR_SEND_SIGNALING_PCAS_B,
+				GSP_PHYS_RMCALL_GR_PCAS_INVALIDATE_SCHEDULE);
+	}
 	p = gsp_phys_rmcall_push_gr(p, GSP_PHYS_RMCALL_GR_SET_REPORT_SEMAPHORE_A,
 				    (u32)(sem_va >> 32));
 	p = gsp_phys_rmcall_push_gr(p, GSP_PHYS_RMCALL_GR_SET_REPORT_SEMAPHORE_B,
@@ -14811,6 +14813,7 @@ gr_page_unmapped:
 						ud + GSP_PHYS_RMCALL_USERD_GPGET_OFF)
 					: 0;
 				u32 q0 = 0, q1 = 0, q23 = 0, q24 = 0, q25 = 0;
+				u32 q48 = 0, q49 = 0, q50 = 0;
 				u32 q63 = 0;
 				u32 relw = 0;
 
@@ -14826,6 +14829,9 @@ gr_page_unmapped:
 						q23 = get_unaligned_le32(qp + 92);
 						q24 = get_unaligned_le32(qp + 96);
 						q25 = get_unaligned_le32(qp + 100);
+						q48 = get_unaligned_le32(qp + 192);
+						q49 = get_unaligned_le32(qp + 196);
+						q50 = get_unaligned_le32(qp + 200);
 						q63 = get_unaligned_le32(
 							qp +
 							GSP_PHYS_GR_QMD_SENTINEL_WORD *
@@ -14836,9 +14842,9 @@ gr_page_unmapped:
 					relw = READ_ONCE(
 						*(u32 *)((u8 *)__va(qmd_rel_hpa) +
 							 qmd_rel_off));
-				pr_info("vgsp-gr: post-mortem gpget=%u->%u qmd_page w0=%08x w1=%08x w23..25=%08x %08x %08x w63=%08x relw=%08x iq2m=%s%s\n",
+				pr_info("vgsp-gr: post-mortem gpget=%u->%u qmd_page w0=%08x w1=%08x w23..25=%08x %08x %08x w48..50=%08x %08x %08x w63=%08x relw=%08x iq2m=%s%s\n",
 					sub.gpget, gpget_post, q0, q1, q23, q24,
-					q25, q63, relw,
+					q25, q48, q49, q50, q63, relw,
 					q63 == GSP_PHYS_GR_QMD_SENTINEL ?
 						"not-run (sentinel intact)" :
 						"ran (page overwritten)",
diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index 0c7e1e5..9100959 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -619,6 +619,25 @@ int gsp_phys_rmcall_gr_qmdvirt_value(void)
 EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_qmdvirt_value);
 
 /*
+ * Explicit-PCAS gate (default 1). The rebuilt launch carries the vendor's
+ * turingPushPcas(CU_PCAS_TYPE_COPY) pair (SEND_PCAS_A = QMD>>8 followed by
+ * SEND_SIGNALING_PCAS_B = INVALIDATE|SCHEDULE). The stock guest push does
+ * not emit these (it relies on the IQ2M window's implied copy PCAS); setting
+ * this to 0 emits the pure vendor window-only form for the A/B test.
+ */
+static int gsp_phys_rmcall_gr_pcas_param = 1;
+module_param_named(gsp_phys_rmcall_gr_pcas,
+		   gsp_phys_rmcall_gr_pcas_param, int, 0644);
+MODULE_PARM_DESC(gsp_phys_rmcall_gr_pcas,
+		 "Emit the explicit SEND_PCAS_A/SEND_SIGNALING_PCAS_B pair in the GR launch block (default 1 = vendor turingPushPcas copy form; 0 = window-only stock form)");
+
+int gsp_phys_rmcall_gr_pcas_value(void)
+{
+	return gsp_phys_rmcall_gr_pcas_param;
+}
+EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_pcas_value);
+
+/*
  * Rank-2 qmdwin diagnostic (gsp_phys_rmcall_gr_qmdwin; default 0). When set,
  * a forwarded GR launch relocates its inline-QMD destination from the guest
  * QMD VA to a dedicated module page mapped at the ladder's own window-0 VA
diff --git a/kernel/gsp_phys_gpu.h b/kernel/gsp_phys_gpu.h
index 2ebe167..d37f5d5 100644
--- a/kernel/gsp_phys_gpu.h
+++ b/kernel/gsp_phys_gpu.h
@@ -294,6 +294,13 @@ int gsp_phys_rmcall_gr_prelude_value(void);
 int gsp_phys_rmcall_gr_qmdvirt_value(void);
 
 /*
+ * gsp_phys_rmcall_gr_pcas (default 1): emit the explicit
+ * SEND_PCAS_A/SEND_SIGNALING_PCAS_B pair (vendor turingPushPcas copy form);
+ * 0 emits the stock window-only shape (implicit IQ2M copy PCAS only).
+ */
+int gsp_phys_rmcall_gr_pcas_value(void);
+
+/*
  * gsp_phys_rmcall_gr_qmdwin (default 0): 1 relocates the forwarded GR
  * inline-QMD destination from the guest QMD VA to a dedicated module page
  * mapped at the proven engine-reachable window-0 VA 0x107000 (the PTE is