vgsp: m81 - map the PM ctx-buffer booking VA before the engine context load

The m80 window shows PGRAPH_INTR=0x00000010 (ILLEGAL_METHOD, the reserved-SW
prelude methods, same as the real driver) clearing, then 0x00200002
(SEMAPHORE|EXCEPTION) pending exactly when the QMD activates, followed by the
FECS save/unload. The real driver's launch transient carries the same
ILLEGAL_METHOD without ever setting EXCEPTION, so the exception is the
ctx-restore difference. The one R1-booked ctx VA with no PTE is PM
(0x2370000): the golden9 range mapping covers PATCH/FECS/PRIV/UNR and the four
globals (windows 17..22 after the golden9k 1->6 extension) but never PM, and
R1-before-F2 makes the image carry that VA as the PM pointer. Map it through
the ctx PT window right after the mode-35 PM FBMEM allocation, before any
engine context load and before the PTE line's first fetch.

1 files changed, 19 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index dbc6c43..5a5287f 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -12938,6 +12938,25 @@ static int gsp_phys_rmcall_user_lane_promote(void __iomem *bar0)
 			fb, alloc_size, boot_stage.rmcall_pm_size);
 	}
 
+	/*
+	 * m81: map the PM booking VA (0x2370000, R1 entry id 1) through the
+	 * ctx PT window before any engine context load. The context-image
+	 * initializer writes this VA as the context's PM pointer when
+	 * pmCtxswMode != NO_CTXSW; without a PTE the engine's context restore
+	 * takes an MMU fault and raises PGRAPH_INTR.EXCEPTION at the dispatch
+	 * (observed: SEMAPHORE|EXCEPTION pending, then the FECS saves/unloads
+	 * instead of running the QMD). The ctx PT pages were allocated by the
+	 * golden9k prepare and installed in the channel PDB by pdb_build,
+	 * both before this point, and the engine has not yet fetched the PM
+	 * PTE cache line.
+	 */
+	gsp_phys_rmcall_golden9_map_range(GSP_PHYS_RMCALL_VA_GOLDEN9_PM,
+					  boot_stage.rmcall_pm_pa,
+					  boot_stage.rmcall_pm_size);
+	pr_info("vgsp-boot: rm-call: mode 35 PM VA mapped: va=0x%llx pa=0x%llx size=0x%x (ctx PT window 0, pre-first-fetch)\n",
+		GSP_PHYS_RMCALL_VA_GOLDEN9_PM, boot_stage.rmcall_pm_pa,
+		boot_stage.rmcall_pm_size);
+
 	if (!boot_stage.rmcall_gr_promote_warned) {
 		boot_stage.rmcall_gr_promote_warned = true;
 		pr_warn("vgsp-boot: rm-call: WARNING: mode 35 sends GPU_PROMOTE_CTX on V7 (one atomic 3-entry MAIN/PM/PATCH PA-only): a failed GR context promote can assert GSP-RM (NOCAT recType=5 errorCode=0x52a8b04) and wedge the device with WPR2 left up and teardown unable to clear it; recovery requires a reboot with human approval - run only when reboot readiness is confirmed\n");