vgsp: SVC_MME_PRELUDE_WORDS 1024->3584 + SIGS 2048, 4-page module pushbuffer (VA_PB3/4 at PT slots 0x103/0x104, VA_DST->0x10b, VA_SEM->0x10c, METHOD_WORDS 4096, pb2 chunk 1->3 pages) - SA table extended past slot 12 (55 slots 0..35,37..53,57,58; mission slots [34,39,40,48,51,57] all IN table), prelude doubled (words=2048 ir_end=0x265 covered=34 code_words=1873); still stubbed by one PC (collect_mask [34..57]; slot 34 entry=0x265==ir_end); temporal pattern: window pages valid only inside channel context, new PA per context, zero at resolve time; next: session re-streaming full-SA push (0x402094c ~2min after GL context) then confirm dropped_mask->0 - SESSION 153 r1162-r1165

2 files changed, 67 insertions, 20 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index bf73319..7d861ed 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -1154,8 +1154,23 @@ bool gsp_phys_boot_requested(void)
 #define GSP_PHYS_RMCALL_VA_PB		(GSP_PHYS_RMCALL_VA_BASE + GSP_PHYS_PAGE_SIZE)
 /* SESSION 153-CONTINUED-66: page 2 of the module pushbuffer (same PT line). */
 #define GSP_PHYS_RMCALL_VA_PB2		(GSP_PHYS_RMCALL_VA_BASE + 2 * GSP_PHYS_PAGE_SIZE)
-#define GSP_PHYS_RMCALL_VA_DST		(GSP_PHYS_RMCALL_VA_BASE + 3 * GSP_PHYS_PAGE_SIZE)
-#define GSP_PHYS_RMCALL_VA_SEM		(GSP_PHYS_RMCALL_VA_BASE + 4 * GSP_PHYS_PAGE_SIZE)
+/*
+ * SESSION 153-CONTINUED-77: page 3 of the module pushbuffer (slot 0x103)
+ * so a matured MME prelude (cap 2048 words) plus the largest chunked
+ * window fit one fetch block. The block walk is linear in VA, so the
+ * three pushbuffer VAs must stay contiguous: VA_DST (previously at
+ * base+0x3000, slot 0x103) moves to base+0xB000 (slot 0x10b, free).
+ */
+#define GSP_PHYS_RMCALL_VA_PB3		(GSP_PHYS_RMCALL_VA_BASE + 3 * GSP_PHYS_PAGE_SIZE)
+/*
+ * SESSION 153-CONTINUED-77: page 4 (slot 0x104) after the r1163 cycle
+ * showed the capture cap-limited at 2048 words (ir_end=0x265, 34 slots
+ * covered). VA_SEM moves 0x104 -> 0x10c (free) so the four pushbuffer
+ * pages stay contiguous for the linear fetch.
+ */
+#define GSP_PHYS_RMCALL_VA_PB4		(GSP_PHYS_RMCALL_VA_BASE + 4 * GSP_PHYS_PAGE_SIZE)
+#define GSP_PHYS_RMCALL_VA_DST		(GSP_PHYS_RMCALL_VA_BASE + 0xB000ULL)
+#define GSP_PHYS_RMCALL_VA_SEM		(GSP_PHYS_RMCALL_VA_BASE + 0xC000ULL)
 /* SESSION 153-CONTINUED-66: CE SRC moved off the pushbuffer's second page. */
 #define GSP_PHYS_RMCALL_VA_SRC		(GSP_PHYS_RMCALL_VA_BASE + 0x9000ULL)
 /* SESSION 153-CONTINUED-66: warm-semaphore probe page (own PTE, no sharing). */
@@ -10379,10 +10394,10 @@ static void gsp_phys_rmcall_pdb_build(void)
 	 */
 	if (!boot_stage.rmcall_gr_pb2.pages && boot_stage.pdev) {
 		if (!gsp_phys_chunk_alloc(boot_stage.pdev,
-					  &boot_stage.rmcall_gr_pb2, 1u))
+					  &boot_stage.rmcall_gr_pb2, 3u))
 			gsp_phys_chunk_zero(&boot_stage.rmcall_gr_pb2);
 		else
-			pr_warn("vgsp-boot: rm-call: pushbuffer page2 allocation failed; >4 KB launches keep the single-page block\n");
+			pr_warn("vgsp-boot: rm-call: pushbuffer page2/3/4 allocation failed; >4 KB launches keep the single-page block\n");
 	}
 	if (!boot_stage.rmcall_gr_probe.pages && boot_stage.pdev) {
 		if (!gsp_phys_chunk_alloc(boot_stage.pdev,
@@ -10393,6 +10408,8 @@ static void gsp_phys_rmcall_pdb_build(void)
 	}
 	if (boot_stage.rmcall_gr_pb2.pages && boot_stage.rmcall_gr_probe.pages) {
 		u32 pb2_idx = (u32)((GSP_PHYS_RMCALL_VA_PB2 >> 12) & 0x1ffu);
+		u32 pb3_idx = (u32)((GSP_PHYS_RMCALL_VA_PB3 >> 12) & 0x1ffu);
+		u32 pb4_idx = (u32)((GSP_PHYS_RMCALL_VA_PB4 >> 12) & 0x1ffu);
 		u32 pr_idx = (u32)((GSP_PHYS_RMCALL_VA_GR_PROBE >> 12) &
 				   0x1ffu);
 
@@ -10401,6 +10418,18 @@ static void gsp_phys_rmcall_pdb_build(void)
 					&boot_stage.rmcall_gr_pb2, 0)),
 			(u8 *)gsp_phys_chunk_page_va(pt, 0) +
 			(size_t)pb2_idx * 8);
+		if (boot_stage.rmcall_gr_pb2.pages >= 2u)
+			put_unaligned_le64(gsp_phys_rmcall_pte(
+					(u64)gsp_phys_chunk_page_dma(
+						&boot_stage.rmcall_gr_pb2, 1)),
+				(u8 *)gsp_phys_chunk_page_va(pt, 0) +
+				(size_t)pb3_idx * 8);
+		if (boot_stage.rmcall_gr_pb2.pages >= 3u)
+			put_unaligned_le64(gsp_phys_rmcall_pte(
+					(u64)gsp_phys_chunk_page_dma(
+						&boot_stage.rmcall_gr_pb2, 2)),
+				(u8 *)gsp_phys_chunk_page_va(pt, 0) +
+				(size_t)pb4_idx * 8);
 		put_unaligned_le64(gsp_phys_rmcall_pte(
 				(u64)gsp_phys_chunk_page_dma(
 					&boot_stage.rmcall_gr_probe, 0)),
@@ -10408,9 +10437,10 @@ static void gsp_phys_rmcall_pdb_build(void)
 			(size_t)pr_idx * 8);
 		dma_wmb();
 		boot_stage.rmcall_gr_pb2_planted = true;
-		pr_info("vgsp-boot: rm-call: GR launch pb page2 + warm-sem probe planted VA=0x%llx/0x%llx ptSlots=0x%x/0x%x (two-page block; before first fetch)\n",
-			GSP_PHYS_RMCALL_VA_PB2, GSP_PHYS_RMCALL_VA_GR_PROBE,
-			pb2_idx, pr_idx);
+		pr_info("vgsp-boot: rm-call: GR launch pb page2/3/4 + warm-sem probe planted VA=0x%llx/0x%llx/0x%llx/0x%llx ptSlots=0x%x/0x%x/0x%x/0x%x (up to four-page block; before first fetch)\n",
+			GSP_PHYS_RMCALL_VA_PB2, GSP_PHYS_RMCALL_VA_PB3,
+			GSP_PHYS_RMCALL_VA_PB4, GSP_PHYS_RMCALL_VA_GR_PROBE,
+			pb2_idx, pb3_idx, pb4_idx, pr_idx);
 	}
 	/*
 	 * m69: plant the window-0 shadow pool PTEs (current win0 slot range) in the
@@ -17075,7 +17105,7 @@ EXPORT_SYMBOL_GPL(gsp_phys_backend_guest_ce_copy);
  * vs the bound) dropped it on every launch; the block now spans the module
  * pushbuffer's TWO 4 KB pages (VA_PB..VA_PB2) and is copied page-wise by
  * gsp_phys_gr_pb_copy(). */
-#define GSP_PHYS_RMCALL_GR_METHOD_WORDS		2048u
+#define GSP_PHYS_RMCALL_GR_METHOD_WORDS		4096u
 
 static u64 gsp_phys_gr_submitted;
 static u64 gsp_phys_gr_ok;
@@ -22186,6 +22216,17 @@ static void gsp_phys_gr_pb_copy(const u32 *methods, u32 words)
 		else
 			return;
 		dst = gsp_phys_chunk_page_va(c, 0);
+		if (page == 2u || page == 3u) {
+			/*
+			 * SESSION 153-CONTINUED-77: pages 1 and 2 of the pb2
+			 * chunk are the third/fourth pushbuffer pages
+			 * (VA_PB3 slot 0x103, VA_PB4 slot 0x104).
+			 */
+			if (boot_stage.rmcall_gr_pb2.pages < page)
+				return;
+			dst = gsp_phys_chunk_page_va(&boot_stage.rmcall_gr_pb2,
+						     page - 1u);
+		}
 		if (!dst)
 			return;
 		memcpy(dst + (size_t)off * 4u, methods + done, (size_t)n * 4u);
@@ -29022,11 +29063,12 @@ static_assert(((GSP_PHYS_RMCALL_VA_BASE >> 47) & 0x3) == 0 &&
 	      ((GSP_PHYS_RMCALL_VA_BASE >> 21) & 0xff) == 0 &&
 	      ((GSP_PHYS_RMCALL_VA_SEM >> 21) & 0xff) == 0,
 	      "the channel PDB VA window must sit in root/PD2/PD1/PD0 index 0 (GP10X 48:47/46:38/37:29/28:21 splits)");
-static_assert(((GSP_PHYS_RMCALL_VA_GPFIFO >> 12) & 0x1ff) !=
-	      ((GSP_PHYS_RMCALL_VA_PB >> 12) & 0x1ff) &&
-	      (((GSP_PHYS_RMCALL_VA_GPFIFO >> 12) & 0x1ff) + 4) ==
-	      ((GSP_PHYS_RMCALL_VA_SEM >> 12) & 0x1ff),
-	      "the GPFIFO, pushbuffer and CE src/dst/semaphore VAs must take the five consecutive small-PT slots 0x100..0x104");
+static_assert(((GSP_PHYS_RMCALL_VA_GPFIFO >> 12) & 0x1ff) == 0x100 &&
+	      ((GSP_PHYS_RMCALL_VA_PB >> 12) & 0x1ff) == 0x101 &&
+	      ((GSP_PHYS_RMCALL_VA_PB2 >> 12) & 0x1ff) == 0x102 &&
+	      ((GSP_PHYS_RMCALL_VA_PB3 >> 12) & 0x1ff) == 0x103 &&
+	      ((GSP_PHYS_RMCALL_VA_PB4 >> 12) & 0x1ff) == 0x104,
+	      "the GPFIFO + four pushbuffer pages must occupy the consecutive small-PT slots 0x100..0x104 for the engine's linear fetch walk (SESSION 153-CONTINUED-77: CE src/dst/sem moved off the walk to 0x109/0x10b/0x10c)");
 /*
  * SESSION 153-CONTINUED-66: the two-page pushbuffer and the moved CE SRC /
  * probe pages must stay inside the same 2 MB PD0 slot and the same 128 B PTE
@@ -29089,8 +29131,8 @@ static_assert(GSP_PHYS_RMCALL_GR_INIT_WORDS +
 	      GSP_PHYS_RMCALL_GR_METHOD_WORDS,
 	      "the verbatim GR launch block minimum (compute init + window + PCAS + REPORT_SEMAPHORE) must fit the bound; the per-launch runtime check bounds raw_qmd_hdr for larger preludes");
 static_assert(GSP_PHYS_RMCALL_GR_METHOD_WORDS * 4u <=
-	      2u * GSP_PHYS_RMCALL_COPY_SIZE,
-	      "the GR launch method block may span the two module pushbuffer pages (SESSION 153-CONTINUED-66: the matured MME prelude no longer fits one page)");
+	      4u * GSP_PHYS_RMCALL_COPY_SIZE,
+	      "the GR launch method block may span the four module pushbuffer pages (SESSION 153-CONTINUED-77: prelude cap 3584 + largest chunked window)");
 
 /*
  * GspSystemInfo wire ABI, pinned against the reference header compile
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 8f194e9..29d28d6 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -14279,11 +14279,16 @@ static void svc_mme_census(const u8 *buf, u32 len, u64 push_va, u32 h_object)
  * (svc_mme_ir_cov, instruction granularity) records exactly which IR
  * instructions the REPLAY holds so the launch builder can stub every
  * called slot whose entry is outside that set (see
- * gsp_sema_mme_ir_covered). The buffer cap itself stays 1024 words: the
- * launch method block is 2048 words and must also carry the window.
- */
-#define SVC_MME_PRELUDE_WORDS	1024u
-#define SVC_MME_PRELUDE_SIGS	512u
+ * gsp_sema_mme_ir_covered). SESSION 153-CONTINUED-77: the buffer cap
+ * rose 1024 -> 2048 -> 3584 words (with the launch method block raised
+ * to 4096 words / four pushbuffer pages) because the fully captured
+ * client prelude exceeded each cap and was silently truncated;
+ * truncation leaves called slots outside the coverage set and keeps
+ * them stubbed. 3584 keeps the worst-case block (cap + 448-word chunk
+ * + init + SA stubs) inside 4096.
+ */
+#define SVC_MME_PRELUDE_WORDS	3584u
+#define SVC_MME_PRELUDE_SIGS	2048u
 static u32 svc_mme_prelude_buf[SVC_MME_PRELUDE_WORDS];
 static u32 svc_mme_prelude_n;
 static u32 svc_mme_prelude_gen;