vgsp: svc_shared_hold - kernel keeper clears bit0 of the GL shared-state slot word (sema_shared_hold_pa); validated live (held pa=0x279b01000 word -> 0x2); with hold: client allocs c46f (hObject=0xbeef0100/0101/0102), readback err 502->0, window md5 changes (mean 2.69,2.68,4.02, nz_frac=0.0172) - SESSION 153 r1012-r1013

1 files changed, 45 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 9c7d92c..4ec75d6 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -7291,6 +7291,50 @@ MODULE_PARM_DESC(sema_pub_pa,
 	"Force the publish page PA for sema_pub_adv (0 = content-discover per boot)");
 
 /*
+ * SESSION 153-CONTINUED-36: the GL shared-state keeper (automates the
+ * slot-word handshake that gsp-phys-shared-bit0 previously did by hand).
+ *
+ * Every direct GLX client receives a shared page from the X driver whose
+ * word at +8 is a state field; glcore's device init reads it and SKIPS its
+ * own class-0xc46f channel creation while bit 0 is set. The emulated X
+ * driver publishes 3 (bits 0+1), so direct clients never allocate a
+ * channel and never render (witness: no c46f alloc in the RM log, glClear
+ * a no-op, err@ReadPixels=0x502). Clearing bit 0 while the client inits
+ * lets the channel alloc proceed (r999-r1002 by hand, r1012 by the
+ * debugfs write). The page moves per boot and is named here by guest PA;
+ * the keeper clears bit 0 on every service pass (up to ~1 kHz while the
+ * pump is active) so the client cannot re-publish 3 fast enough to block
+ * a later client's init. The PA is discovered by content (cookie word
+ * 0xc0b43fec at +4 / word5 0xcaf00006) with the host helper slot_hold.py
+ * or by hand, then written to this parameter; witness is bounded.
+ */
+static u64 gsp_sema_shared_hold_pa;
+module_param_named(sema_shared_hold_pa, gsp_sema_shared_hold_pa, ullong, 0644);
+MODULE_PARM_DESC(sema_shared_hold_pa,
+	"Guest PA of the GL shared-state page; clear bit 0 of its +8 word every pass (0 = off)");
+static u32 svc_shared_hold_log;
+
+static void svc_shared_hold(struct nv_vgpu_device *vgpu)
+{
+	u32 w[2];
+
+	if (!gsp_sema_shared_hold_pa)
+		return;
+	if (svc_read(vgpu, gsp_sema_shared_hold_pa + 8, w, sizeof(w)))
+		return;
+	if (!(w[0] & 1u))
+		return;
+	w[0] &= ~1u;
+	if (svc_write(vgpu, gsp_sema_shared_hold_pa + 8, w, 4))
+		return;
+	svc_shared_hold_log++;
+	if (svc_shared_hold_log <= 16 ||
+	    (svc_shared_hold_log % 4096) == 0)
+		pr_info("sema-shared: held pa=0x%llx word -> 0x%x (n=%u)\n",
+			gsp_sema_shared_hold_pa, w[0], svc_shared_hold_log);
+}
+
+/*
  * SESSION 149 R17 (M4): one recorded section upload command. The 3D-class
  * i2m shape is a 0x180 (LINE_LENGTH_IN) run naming the destination followed
  * by a 0x1b0 (LAUNCH_DMA + LOAD_INLINE_DATA) run carrying the payload.
@@ -36682,6 +36726,7 @@ static int svc_thread(void *arg)
 			u64 done_before;
 
 			vgpu = vgpus[g];
+			svc_shared_hold(vgpu);	/* CONT.36: GL slot-word keeper */
 			svc_handle_probe(vgpu);
 			svc_handle_walk_probe(vgpu);
 			svc_handle_chan_dump(vgpu);