vgsp: sema_client_slot - clear armed 0xffff completion slots below beef-family channel-notifier base in svc_notify_complete; first real client submissions (submissions=29, sema-pushall h=0xbeef0100 va=0x421f758 len=1720 allow=1 trusted=1); attempt still recycles ~12s - SESSION 153 r1023

1 files changed, 49 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 34dda47..40c7f99 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -19523,6 +19523,29 @@ static void svc_ce_firstsub_capture(struct nv_vgpu_device *vgpu,
 			latch_off, latch_upa, latch_put, latch_get);
 }
 
+/*
+ * SESSION 153-CONTINUED-41 (mission: advance the client's completed side
+ * host-side): the direct GL client's kernel channels (h=0xbeef01xx) arm
+ * their OWN completion sentinel. Glcore's submit pump writes 0xffff into
+ * a u16 at notifier-page+0x0e+i*16 (i=0..5) and spins until the word
+ * changes (glcore+0xB1A313 scan loop; live: armed at +0x2e during the
+ * yield wait, SESSION 40/41). On real hardware the RM completion
+ * overwrites that word; the emulation never did, so every ladder attempt
+ * timed out (~11 s), the client fell back to no-op frames and GP_PUT was
+ * never stored. Proof by host-side emission: blindly writing 0 over the
+ * armed word took a live client from ~23.4 s/frame to ~11.7 s/frame.
+ * The channel notifier proper starts at `base` (page+0x60 for this
+ * family), so the client's six 16-byte records are just below it; clear
+ * any that read 0xffff. Only the client family is touched - the X DDX's
+ * bfef-family member page uses a different all-zero wait discipline and
+ * a 0xffff there means a delivered error, so it must not be wiped.
+ */
+static bool gsp_sema_client_slot = true;
+module_param_named(sema_client_slot, gsp_sema_client_slot, bool, 0644);
+MODULE_PARM_DESC(sema_client_slot,
+	"Clear the GL client's armed 0xffff completion slots (beef-family notifier pages)");
+static u32 svc_client_slot_n;
+
 static void svc_notify_complete(struct nv_vgpu_device *vgpu,
 				struct svc_channel *ch)
 {
@@ -19534,6 +19557,32 @@ static void svc_notify_complete(struct nv_vgpu_device *vgpu,
 	if (!ch->notifier_pa)
 		return;
 
+	if (gsp_sema_client_slot &&
+	    (ch->h_object & 0xfffff000u) == 0xbeef0000u) {
+		u64 page = base & ~((u64)SEMA_PAGE_SIZE - 1);
+		int i;
+
+		for (i = 0; i < 6; i++) {
+			u64 pa = page + 0x0e + (u64)i * SVC_NOTIFY_SIZE;
+			u16 st = 0, z = 0;
+
+			if (pa + sizeof(st) > base)
+				break;
+			if (svc_read_ap(vgpu, pa, ch->notifier_as,
+					&st, sizeof(st)))
+				continue;
+			if (st != 0xffff)
+				continue;
+			if (!svc_write_ap(vgpu, pa, ch->notifier_as,
+					  &z, sizeof(z))) {
+				svc_client_slot_n++;
+				if (gsp_sema_dbg && svc_client_slot_n <= 64)
+					pr_info("sema-chan: client-slot cleared h=0x%x slot=%d pa=0x%llx\n",
+						ch->h_object, i, pa);
+			}
+		}
+	}
+
 	/*
 	 * P6c C3: while a delivered fault notifier is latched the pump must
 	 * not clear the error slot. The latch clears when the guest ack reads