vgsp: flip-event delivery defaults to assoc+strict (clears Flip event timeout); DDX latch reset clauses

Wall (b) 'Flip event timeout on head 0' fix (validated c171): NVKMS/kernel-
callback events register hSrcResource=0, so every display UPDATE completion
rode the all-events shotgun (6-7 POST_EVENT records each), the guest's
status-queue read cursor fell 20-44 slots behind (rc=-11 ring-full bursts)
and flip records arrived past the 3 s NvDrm window. Default the r1765 pair
ON - gsp_rm_ev_assoc (hSrc==0 -> alloc-parent channel) and
gsp_disp_events_strict (armed UPDATE posts only to that channel's events,
no fallback) - the exact combination r1771 measured as '0 flip WARNs'.
Validating cycle c171: registrations carry real sources (hEvent=0x1007a
hSrc=0x1001b etc.), UPDATE posts are exact 1:1 (posts=27), WARN count 1 for
the boot, serial timeouts=0 (c160 pre-fix: 34). Both stay runtime-writable.

Also stage the gsp_sema_service.c candidates for wall (a) (the later-DMA
0x51 is a consequence of 'Failed to idle DMA' on a recycled channel): the
served-refusal in svc_userd_ddx_reprobe now exempts a latch reset to put==0,
and the put-reset latch keep extends to the DDX family (was kick-only).
These clauses target c171's observed reset/junk-adopt sequence; validation
pending on a roll where wall (a) is otherwise survivable.

3 files changed, 65 insertions, 19 deletions

diff --git a/kernel/gsp_display_engine.c b/kernel/gsp_display_engine.c
index c522a93..bc37a5d 100644
--- a/kernel/gsp_display_engine.c
+++ b/kernel/gsp_display_engine.c
@@ -213,17 +213,25 @@ module_param_named(disp_events, gsp_disp_events, uint, 0644);
 MODULE_PARM_DESC(disp_events, "Post the channel completion event on an armed UPDATE (default 1)");
 
 /*
- * r1765: strict display-event delivery.  Default 0 keeps the legacy
- * behaviour bit-for-bit (full A/B revert); when set, an armed UPDATE posts
- * only to the events registered on that channel (no all-events fallback),
- * and unrelated completions/the 0.5 s hint skip display-channel events
- * (see gsp_disp_engine_owns_object()).  Live A/B: echo 1 >
- * /sys/module/vgsp/parameters/disp_events_strict.
+ * r1765: strict display-event delivery.  An armed UPDATE posts only to the
+ * events registered on that channel (no all-events fallback), and unrelated
+ * completions/the 0.5 s hint skip display-channel events (see
+ * gsp_disp_engine_owns_object()).  Default was 0 (legacy) through the r1771
+ * A/B; r1771 measured: assoc=1 alone -> flip WARNs + burst storms,
+ * assoc=1 + strict=1 -> 0 flip WARNs.  r1780 receipts (eng5 c160): the
+ * legacy non-strict path fell through to the all-events shotgun for every
+ * UPDATE (NVKMS events register hSrc=0), the guest's status-queue read
+ * cursor fell 20-44 slots behind, and the flip event arrived after the
+ * 3 s NvDrm flip window -> "Flip event timeout on head 0".  With the r1780
+ * ev_assoc default the exact match (h_object == alloc-parent of the NVKMS
+ * flip event) succeeds, so strict mode delivers 1:1; a miss returns
+ * -ENOENT and the pump's retry re-posts.  Still runtime-writable for A/B:
+ * echo 0 > /sys/module/vgsp/parameters/disp_events_strict.
  */
-static unsigned gsp_disp_events_strict = 0;
+static unsigned gsp_disp_events_strict = 1;
 module_param_named(disp_events_strict, gsp_disp_events_strict, uint, 0644);
 MODULE_PARM_DESC(disp_events_strict,
-		 "Deliver a display UPDATE completion only to events registered on that channel, no all-events fallback (default 0 = legacy; 1 = r1765 strict)");
+		 "Deliver a display UPDATE completion only to events registered on that channel, no all-events fallback (default 1 = r1780; 0 = legacy)");
 
 static unsigned long long gsp_disp_notifier_pa;
 module_param_named(disp_notifier_pa, gsp_disp_notifier_pa, ullong, 0644);
diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index 0cef9e7..957729b 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -818,16 +818,26 @@ unsigned gsp_rm_ev_cl;
  */
 unsigned gsp_rm_ev_func;
 /*
- * r1767: gate the r1765 flip-event association (hSrcResource == 0 ->
- * alloc-header hParent). Default 0 keeps the pre-r1766 event semantics;
- * the RCA exonerated the association from the r1766 soft-locks but not
- * from the r1766 ISR crash class, so it stays off until validated
- * end-to-end.
+ * r1765 flip-event association (hSrcResource == 0 -> alloc-header hParent).
+ * Default was 0 (pre-r1766 semantics) pending through r1771 A/B validation;
+ * r1771 measured on the live stack: assoc=1 alone -> flip WARNs + burst
+ * storms, assoc=1 + disp_events_strict=1 -> 0 flip WARNs (the r1771 X death
+ * was the separate DDX channel-idle wall, since fixed by 13a0c5d6/acb51d53).
+ * r1780 rationale (c160 receipts, eng5 session): NVKMS/kernel-callback
+ * events register hSrc=0, so every completion rode the all-events shotgun
+ * (6-7 POST_EVENT records per completion).  The guest stat-queue read
+ * cursor sat 20-44 slots behind our write pointer, rc=-11 (ring full)
+ * refusals burst during X starts, and flip-event records reached the guest
+ * long after the 3 s NvDrm flip window -> "Flip event timeout on head 0"
+ * x7 per X start with zero nvidia-modeset kthread delivery.  With the
+ * association the display UPDATE post (h_object=0x1001b) exact-matches only
+ * the NVKMS flip events registered on that channel: 1:1 delivery, no flood.
+ * Still runtime-writable for A/B.
  */
-static bool gsp_rm_ev_assoc;	/* default 0: pre-r1766 event semantics */
+static bool gsp_rm_ev_assoc = true;	/* r1780: default 1 (validated r1771+r1780) */
 module_param_named(ev_assoc, gsp_rm_ev_assoc, bool, 0644);
 MODULE_PARM_DESC(ev_assoc,
-	"associate hSrcResource==0 events with their alloc parent (r1765 flip-event fix; default 0)");
+	"associate hSrcResource==0 events with their alloc parent (r1765 flip-event fix; default 1)");
 
 static void gsp_rm_fill_ev_payload(const struct gsp_rm_emu *rm, u32 i,
 				   u8 *payload)
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index ced815d..6f4e387 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -43992,8 +43992,18 @@ static bool svc_userd_ddx_reprobe(struct nv_vgpu_device *vgpu,
 	 * validated block inside the client's ~10 s DMA-test window. The
 	 * pump's confirm/reject/defer ladder still owns the latch's lifetime
 	 * (defer bound 32, then reject -> the RAM scan re-adopts fresh).
-	 */
-	if (ch->submissions != ch->gr_ram_userd_latch_sub)
+	 *
+	 * r1780 (eng5 c171): EXCEPT when the served latch has been RESET to
+	 * put==0 - the client recycled the control block (the DDX's next
+	 * push-on-demand generation). A block at put==0 is not "serving"
+	 * anything, so the switch to a freshly validated live block must be
+	 * allowed; without this the served-refusal kept the zeroed block and
+	 * the channel stayed dark (c171: "Failed to idle DMA" t=88.3). The
+	 * keep path in the pump's judge re-arms latch_put to 0 on the reset,
+	 * so this exception only fires for recycled blocks.
+	 */
+	if (ch->submissions != ch->gr_ram_userd_latch_sub &&
+	    ch->gr_ram_userd_latch_put != 0)
 		return false;
 	if (!svc_gr_ram_userd_scan(vgpu, ch, &npa, &nput, &nget))
 		return false;
@@ -44952,8 +44962,9 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 				pr_info("sema-chan: GR USERD h=0x%x pa=0x%llx speculative latch CONFIRMED (put %u -> %u)\n",
 					ch->h_object, ch->userd_pa,
 					ch->gr_ram_userd_latch_put, put);
-			} else if (kfam && (gsp_sema_kick_latch_keep ||
-					    ch->gr_ram_userd_confirmed) &&
+			} else if ((kfam || svc_userd_ddx_family(ch)) &&
+				   (gsp_sema_kick_latch_keep ||
+				    ch->gr_ram_userd_confirmed) &&
 				   put == 0 &&
 				   ch->gr_ram_userd_latch_put != 0 &&
 				   ch->gr_ram_userd_keeps < 64) {
@@ -44975,6 +44986,23 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 				 * after; the ADOPT itself was ring-entry-
 				 * validated). sema_kick_latch_keep=0 restores
 				 * the pre-fix condition for A/B.
+				 *
+				 * r1780 (eng5 c171, later-DMA instance): the
+				 * same put-reset applies to the DDX family's
+				 * served latch. The X channel 0x1000013 had
+				 * served 7698 slots, the DDX's next push-on-
+				 * demand generation recycled the control block
+				 * (put 7698 -> 0), and because the reset sets
+				 * `moved` the DEFERRED clause below did not
+				 * apply -> REJECT -> the FB shape scan adopted
+				 * a garbage block ("found by VRAM shape scan
+				 * at fb 0x960000 (put=1 get=917535, idle,
+				 * ring-validated)", reads 0/0) -> "Failed to
+				 * idle DMA" at Xorg t=88.3. Keep the reset
+				 * block re-armed; the 2 s re-probe (with the
+				 * zeroed-latch exception in
+				 * svc_userd_ddx_reprobe) finds the real new
+				 * generation.
 				 */
 				ch->gr_ram_userd_keeps++;
 				if (ch->gr_ram_userd_keep_log < 8) {