vgsp-gr r595b: bound the stream-order guard to a settle window, then forward (never refuse)

With r595 the relocation copies execute within 0.5-1.5 s, but the r590b
watermark deferred through the shared 15 s cap; by then the r541/r583
dstpend guard took its fail-closed branch and refused a launch whose
data was already on its way (r596 mail MAILDUMP zeros, 2 refusals).

Track the settle start per push VA and defer only for
gsp_phys_gr_cewm_settle_ms (default 2000). Each deferral is one pump
pass and the pump drains the copy rings before the launching channel, so
the window is enough for the r595 copies; after it the launch forwards
with a witness. The guard can no longer reach any cap-refusal branch.

3 files changed, 44 insertions, 5 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 1e549a0..033bded 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -21172,6 +21172,16 @@ static bool svc_ce_stream_backlog(struct nv_vgpu_device *vgpu,
 unsigned gsp_phys_gr_dec_log_max;
 static unsigned svc_gr_dec_log;
 
+/*
+ * r595b: the stream-order settle window (ms). A launch whose device rings
+ * still hold unconsumed entries is deferred for at most this long (one pump
+ * pass per deferral; the pump drains the copy rings first), then forwarded.
+ * Default 2000 ms: the r595 relocation copies execute within 0.5-1.5 s.
+ */
+unsigned gsp_phys_gr_cewm_settle_ms = 2000;
+static u64 svc_gr_cewm_push;		/* push currently inside its settle */
+static unsigned long svc_gr_cewm_since;	/* settle window start */
+
 static void svc_gr_dec_dump(const struct svc_channel *ch)
 {
 	bool dstpend, copypend, ceback;
@@ -21413,24 +21423,43 @@ static bool svc_gr_request(struct nv_vgpu_device *vgpu,
 	 * it never refuses one, so it cannot recreate r588's mail refusal.
 	 */
 	if (svc_ce_stream_backlog(vgpu, ch)) {
-		if (!svc_gr_defer_expired(svc_gr_cand.push_va)) {
+		/*
+		 * r595b: the settle window. Since r595 runs a plausible GR
+		 * push's own copies, the driver's relocation/H2D copies now
+		 * execute within ~0.5-1.5 s of submission; deferring through
+		 * the shared 15 s cap let the r541/r583 dstpend guard reach
+		 * its fail-closed branch and refuse a launch whose data was
+		 * already on its way. Give the pump a short bounded window to
+		 * drain the rings (each deferral is one pump pass, and the
+		 * pump drains the copy rings before the launching channel),
+		 * then forward regardless - never a refusal.
+		 */
+		if (svc_gr_cewm_push != svc_gr_cand.push_va) {
+			svc_gr_cewm_push = svc_gr_cand.push_va;
+			svc_gr_cewm_since = jiffies;
+		}
+		if (time_before(jiffies, svc_gr_cewm_since +
+				msecs_to_jiffies(gsp_phys_gr_cewm_settle_ms))) {
 			clear_bit_unlock(SVC_FWD_INFLIGHT, &svc_fwd_state);
 			mutex_unlock(&svc_fwd_lock);
 			svc_gr_busy_defer = true;
 			svc.fwd_gr_refused++;
 			svc.fwd_gr_dstpend++;
+			svc.fwd_gr_cewm++;
 			if (svc.fwd_gr_dstpend_log < 32) {
 				svc.fwd_gr_dstpend_log++;
-				pr_info("vgsp-work: GR forward deferred h=0x%x push=0x%llx (CE ring has unconsumed entries; stream-order watermark)\n",
-					ch->h_object, svc_gr_cand.push_va);
+				pr_info("vgsp-work: GR forward deferred h=0x%x push=0x%llx (CE ring has unconsumed entries; stream-order settle %ums)\n",
+					ch->h_object, svc_gr_cand.push_va,
+					gsp_phys_gr_cewm_settle_ms);
 			}
 			return false;
 		}
 		svc.fwd_gr_cewm_cap++;
 		if (svc.fwd_gr_cewm_log < 32) {
 			svc.fwd_gr_cewm_log++;
-			pr_warn("vgsp-work: GR forward at defer cap h=0x%x push=0x%llx (CE ring still has unconsumed entries; historical forward)\n",
-				ch->h_object, svc_gr_cand.push_va);
+			pr_warn("vgsp-work: GR forward after settle h=0x%x push=0x%llx (CE ring still has unconsumed entries after %ums; historical forward)\n",
+				ch->h_object, svc_gr_cand.push_va,
+				gsp_phys_gr_cewm_settle_ms);
 		}
 	}
 	/*
diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index 31512ef..fcdc15c 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -259,6 +259,7 @@ extern u64 gsp_sema_copy_dst2;
 
 /* CE pending-entry grace window in ms before the release fallback fires. */
 extern unsigned gsp_sema_ce_grace_ms;
+extern unsigned gsp_phys_gr_cewm_settle_ms;
 
 /*
  * Bounded work-before-release hold (ms) for an unreadable CE entry whose
diff --git a/kernel/main.c b/kernel/main.c
index d821762..88dda02 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -2756,6 +2756,15 @@ module_param_named(sema_ce_grace_ms, gsp_sema_ce_grace_ms, uint, 0644);
 MODULE_PARM_DESC(sema_ce_grace_ms, "CE pending-entry grace window in ms (default 25000)");
 
 /*
+ * r595b: bounded stream-order settle for a GR launch whose device rings
+ * still hold unconsumed entries (0 disables the guard's deferral).
+ */
+module_param_named(gsp_phys_gr_cewm_settle_ms, gsp_phys_gr_cewm_settle_ms,
+		   uint, 0644);
+MODULE_PARM_DESC(gsp_phys_gr_cewm_settle_ms,
+		 "GR launch stream-order settle window in ms (default 2000)");
+
+/*
  * Bounded work-before-release hold (ms) for an unreadable CE entry; the
  * deferred retry probe shows translations/pins land 0.5-2 s late. Absolute
  * per-entry deadline, never reset; 0 disables.