vgsp-sema r584: the vidmem-window fill decoder - resolve window VAs structurally (the last per-draw GREEN blocker)

The r583 boot's fail-closed refusal traced to a fill that never executes:
the CE channel-setup push's 8 KB zero fill to out=0x204820000 decoded fine
(type=0 op, dma=0x586, line=8192, value=0) but its EXECUTION resolved the
window VA through the generic chain (pin -> ledger -> translate), which
answered SYS with a stale landing pa=0x1300b0000; the r369 below-floor
guard then refused it ("LOWFILL-REFUSED ... below-floor fill resolved
outside vidmem"), the fill never ran, its DSTPEND note stayed live
("DSTPEND note va=0x204820000 type=0", dma-trace denied every pass), and
every GR launch touching that page deferred to the r556 cap and (since
r583) took the fail-closed no-write path.

The vidmem window is offset-mapped by construction (SVC_VIDMEM_VA_BASE
0x200080000 rationale: the client's vidmem VAs are its window base plus
the vidmem offset into the emulated BAR1 buffer; the same convention
svc_lookup already applies). svc_fill_1d now resolves a VID-aperture fill
whose destination is a window VA structurally - addr = VA - window base,
aperture VID - so the existing contiguous shadow-write block executes it.
Witnessed once per boot ("sema-lowfill-window va=... -> fb offset ...").
No guest page table can express the window offset; the structural rule is
faster AND safer than the stale-looking generic chain.

1 files changed, 28 insertions, 1 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 151d8bf..6e0d88b 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -5448,7 +5448,34 @@ static int svc_fill_1d(struct nv_vgpu_device *vgpu, u64 addr, u64 value, u32 ele
 		u32 aper;
 		u32 prov = 0;	/* r384: 1 pin, 2 ledger, 3 walk/scan */
 
-		if (svc_vas_has(addr)) {
+		/*
+		 * r584: a VID-aperture fill whose destination is a vidmem
+		 * WINDOW VA (the guest's 0x2xxxxxxxx family) is offset-
+		 * mapped by construction: VA - SVC_VIDMEM_VA_BASE is the
+		 * FB offset into the emulated BAR1 shadow (the svc_lookup
+		 * window convention; see also the 0x200080000 rationale at
+		 * SVC_VIDMEM_VA_BASE). The generic chain below (pin ->
+		 * ledger -> translate) answered SYS for the r583 boot's CE
+		 * channel-setup fill to 0x204820000 (a stale landing), the
+		 * r369 below-floor guard refused it, the fill never ran,
+		 * and its DSTPEND note stalled GR launches to the fail-
+		 * closed cap. Window VAs resolve structurally - no guest
+		 * page table can express an "engineering window" offset.
+		 */
+		if (aperture == CE_APERTURE_VID &&
+		    va0 >= SVC_VIDMEM_VA_BASE &&
+		    va0 - SVC_VIDMEM_VA_BASE + total <=
+			    svc_fb_shadow_size(vgpu)) {
+			addr = va0 - SVC_VIDMEM_VA_BASE;
+			/* aperture stays CE_APERTURE_VID: the whole-range
+			 * contiguity block below writes it into the shadow */
+			prov = 4;	/* structural window convention */
+			if (svc_lowfill_log < 64) {
+				svc_lowfill_log++;
+				pr_info("sema-lowfill-window va=0x%llx -> fb offset 0x%llx (vidmem window convention) elem=%u count=%u value=0x%llx\n",
+					va0, addr, elem, count, value);
+			}
+		} else if (svc_vas_has(addr)) {
 			shadow = true;
 		} else if (!svc_pin_lookup_any(addr, &pa, &aper)) {
 			u64 lpa = 0;