r427 idempotent fast-accept: a zero-write launch whose identity (QMD minus release0 + staged content checksums) matches an earlier writing launch accepts immediately (no retries, no quiet holds); recorded for every writing launch; wedge diagnostics retained

1 files changed, 104 insertions, 2 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 9cf2072..3a4abc9 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -17913,6 +17913,82 @@ static bool gsp_phys_gr_qmd_fetched(const u8 *qmd_mem)
 }
 
 /*
+ * r427 idempotent fast-accept (CONT.86 §6.1). A zero-write launch is either
+ * the no-execute wedge OR a legitimate idempotent re-launch (the same QMD
+ * content with the same staged inputs, whose result is already in place) -
+ * the host cannot tell them apart, and both burn the 40 s + 80 s quiet holds.
+ * The launch identity below (QMD minus the per-launch release0 address and
+ * payload, folded with the staged content checksums of every tracked page) is
+ * recorded for every launch that WROTE; a zero-write launch whose identity
+ * matches an entry accepts immediately, with no retries and no quiet window.
+ * Safe by construction: identical code + identical staged content + a prior
+ * execution that produced this launch's own footprint means the correct
+ * result is already in the buffers; a side-effecting kernel's re-launch is
+ * equally wrong under the current accept (the client sees the stale result
+ * either way) - this only removes the stall.
+ */
+#define GSP_PHYS_GR_IDEM_SLOTS	64u
+static u64 gsp_phys_gr_idem_fp[GSP_PHYS_GR_IDEM_SLOTS];
+static u32 gsp_phys_gr_idem_n;
+
+static u64 gsp_phys_gr_launch_fp(const u32 *qmd,
+				 const struct gsp_phys_gr_submit *req,
+				 const u32 *csum_in)
+{
+	u64 h = 1469598103934665603ULL;
+	u32 i;
+
+	for (i = 0; i < GSP_PHYS_GR_QMD_WORDS; i++) {
+		/* Skip release0's address (w23/w24) and payload (w25): the
+		 * driver allocates a fresh release slot per launch, so they
+		 * differ even for an identical re-launch. */
+		u32 w;
+
+		if (i == 23u || i == 24u || i == 25u)
+			continue;
+		w = qmd[i];
+		h ^= w;
+		h *= 1099511628211ULL;
+	}
+	for (i = 0; i < req->n_data; i++) {
+		u32 bi = gsp_phys_gr_data_bi(req->data[i].reloc_va);
+
+		if (bi == GSP_PHYS_GR_DATA_BI_NONE)
+			continue;
+		h ^= csum_in[bi];
+		h *= 1099511628211ULL;
+	}
+	return h;
+}
+
+static bool gsp_phys_gr_idem_match(u64 fp)
+{
+	u32 i;
+
+	for (i = 0; i < gsp_phys_gr_idem_n; i++)
+		if (gsp_phys_gr_idem_fp[i] == fp)
+			return true;
+	return false;
+}
+
+static void gsp_phys_gr_idem_record(u64 fp)
+{
+	u32 i;
+
+	for (i = 0; i < gsp_phys_gr_idem_n; i++)
+		if (gsp_phys_gr_idem_fp[i] == fp)
+			return;
+	if (gsp_phys_gr_idem_n < GSP_PHYS_GR_IDEM_SLOTS) {
+		gsp_phys_gr_idem_fp[gsp_phys_gr_idem_n++] = fp;
+	} else {
+		/* ring: drop the oldest */
+		memmove(&gsp_phys_gr_idem_fp[0], &gsp_phys_gr_idem_fp[1],
+			(GSP_PHYS_GR_IDEM_SLOTS - 1u) * sizeof(u64));
+		gsp_phys_gr_idem_fp[GSP_PHYS_GR_IDEM_SLOTS - 1u] = fp;
+	}
+}
+
+/*
  * COPYAUDIT (2026-10-18 copy-completeness audit): per-copy sighting of the
  * GR operand staging copies. Every staged page is spot-checked (16 bytes
  * at the start and end of the page, source vs destination, right after the
@@ -20587,6 +20663,7 @@ gr_page_unmapped:
 	if (req->n_data && gsp_phys_gr_data_chunk()->pages) {
 		u32 n_tracked = 0;
 		u32 nw_attempts = 0;
+		bool idem = false;
 		u32 wrote = gsp_phys_gr_output_retire_wait(req, bounce_csum_in,
 							   &n_tracked);
 
@@ -20606,7 +20683,24 @@ gr_page_unmapped:
 				ff ? "OK" : "NONE",
 				ff ? "overwritten" : "intact", n_tracked);
 		}
-		if (wrote == 0 && n_tracked &&
+		/*
+		 * r427 idempotent fast-accept: a zero-write launch whose identity
+		 * (QMD minus release0 + staged content checksums) matches an
+		 * earlier WRITING launch of this boot is a legitimate idempotent
+		 * re-launch - the result is already in place. Accept immediately:
+		 * no retries, no quiet holds. (See gsp_phys_gr_launch_fp.)
+		 */
+		if (wrote == 0 && n_tracked) {
+			u64 fp = gsp_phys_gr_launch_fp(qmd, req, bounce_csum_in);
+
+			if (gsp_phys_gr_idem_match(fp)) {
+				pr_warn("vgsp-gr: IDEMPOTENT-ACCEPT h=0x%x push=0x%llx fp=0x%llx tracked=%u (same QMD+content as an earlier writing launch; no retries, no hold)\n",
+					req->h_object, req->push_va, fp,
+					n_tracked);
+				idem = true;
+			}
+		}
+		if (wrote == 0 && n_tracked && !idem &&
 		    gsp_phys_rmcall_gr_nowrite_retry_value()) {
 			u32 nw_retries =
 				(u32)gsp_phys_gr_nowrite_retries_value();
@@ -20972,7 +21066,7 @@ gr_page_unmapped:
 		 * loop is disabled (gsp_phys_rmcall_gr_nowrite_retry=0) so a
 		 * zero-write outcome is never silent.
 		 */
-		if (wrote == 0 && n_tracked) {
+		if (wrote == 0 && n_tracked && !idem) {
 			bool restored = false;
 			bool fetched = gsp_phys_gr_qmd_fetched(qmd_dst_mem);
 
@@ -21142,6 +21236,14 @@ gr_page_unmapped:
 					want_qmd, want_ch);
 		}
 		/*
+		 * r427: record the launch identity of every launch that WROTE,
+		 * so a later idempotent re-launch (zero writes, same identity)
+		 * can accept immediately (see gsp_phys_gr_launch_fp).
+		 */
+		if (wrote && n_tracked)
+			gsp_phys_gr_idem_record(
+				gsp_phys_gr_launch_fp(qmd, req, bounce_csum_in));
+		/*
 		 * r410: streak bookkeeping for the quiet-window trigger. A
 		 * launch with tracked data that wrote nothing extends the
 		 * zero-write streak; any launch that wrote resets it. Runs