vgsp: exclude the 0x40706c read sentinel from the pre-replay CWD-clear predicate; add sema_gl_cwd_clear (A/B knob)

FALSIFIED NOTE (eng16, c271/c272): the eng15 lead that the always-fire
CWD-clear rode on the 0x40706c sentinel and caused the zero-store wall is
FALSIFIED. A/B on the same launch shapes (h=0x1000013 push=0x1200107e4
words=50 / push=0x1200106bc words=53):
- c260 (old code, clear fires 7x/boot on the sentinel): wrote=0.
- c272 (clear fully off, sema_gl_cwd_clear=0): wrote=0 both launches,
  pbfetch=block end, intr0=0 - identical to c260.
- c271 (predicate fixed, knob on): 0 CWD-CLEAR all boot (the sentinel no
  longer arms it; esr=80000000 / grfifo pending counts are clean).
The change still lands because the old predicate was a bug either way:
0x40706c reads 0xbadf5040 always (read-only hardware sentinel; eng15
write test 0x0 -> 0xbadf5040), so every stream3d launch ran a TSG
preempt/resched + MME latch wipe before a noQMD replay that never
re-loads context - an unjustified per-launch context reset.

The zero-store wall is unchanged and now localized: the stream3d lane
only replays X DDX setup-only windows (c272 decode: INC6@0x840
SET_COLOR_TARGET_A(1) VA=0x0c000000 1920x1080 X8R8G8B8, INVALIDATE_*,
INC5@0x180 LINE_LENGTH_IN/OFFSET_OUT - no BEGIN 0x1618 / no draw 0xd74 /
no CALL run), while the pbuffer client's own push entry (0xbeef0100
va=0x4000100 len=262144) is unreadable host-side (rc=-2, channel
unregistered, submissions=0) - so no draw reaches any lane.

1 files changed, 21 insertions, 4 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 8e3f25f..d61df37 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -20758,6 +20758,22 @@ static void gsp_phys_gr_ctx_wipe_latches(void)
  * stream3d lane only, so CUDA/QMD and CE submissions are untouched.
  */
 static u32 gsp_phys_gr_cwd_clears;
+/*
+ * eng16: 0x40706c (our "cwd3") is a read-only hardware sentinel - it reads
+ * 0xbadf5040 on every read (305/305 samples, write 0x0 -> readback unchanged;
+ * eng15 receipts). Gating the pre-replay clear on it made the clear fire on
+ * EVERY stream3d launch (7x/boot observed c250-254), running a TSG
+ * preempt/resched + MME latch wipe before each replay while the noQMD replay
+ * lane carries no context re-load - i.e. the clear itself destroyed the
+ * context the incremental chunks ran against. The predicate now uses only
+ * the real poison sources (esr 0x404490, grfifo 0x400504); cwd3 is read for
+ * the log line only. knob sema_gl_cwd_clear (default 1) = A/B switch.
+ */
+static bool gsp_phys_gr_cwd_clear_en = true;
+module_param_named(sema_gl_cwd_clear, gsp_phys_gr_cwd_clear_en, bool, 0644);
+MODULE_PARM_DESC(sema_gl_cwd_clear,
+	"Pre-replay FE priv-error clear on the stream3d lane. Predicate = real poison sources only (esr 0x404490 / grfifo 0x400504; cwd3 0x40706c excluded - hardware read sentinel). 0 = fully off (A/B knob)");
+
 static void gsp_phys_gr_cwd_clear_locked(void __iomem *bar0, u32 h_object,
 					 u64 push_va)
 {
@@ -20766,7 +20782,6 @@ static void gsp_phys_gr_cwd_clear_locked(void __iomem *bar0, u32 h_object,
 	u32 gf = ioread32(bar0 + 0x00400504u);
 
 	if ((esr & 0xffff0000u) != 0xbadf0000u &&
-	    (cwd3 & 0xffff0000u) != 0xbadf0000u &&
 	    (gf & 0xffff0000u) != 0xbadf0000u)
 		return;
 	gsp_phys_gr_cwd_clears++;
@@ -31023,11 +31038,13 @@ gr_page_unmapped:
 	 * CONT.474 CWD-CLEAR: clear a pre-existing 0xbadf FE priv-error latch
 	 * BEFORE this replay is emitted (see gsp_phys_gr_cwd_clear_locked).
 	 * Bounded to one attempt per launch; stream3d lane only, so the
-	 * CUDA/QMD and CE paths never reach this site. Gated by the same
-	 * sema_gr_wedge_recover knob as the mid-launch recovery, which stays
-	 * available for a poison the replay itself causes.
+	 * CUDA/QMD and CE paths never reach this site. Gated by
+	 * sema_gl_cwd_clear (eng16 A/B knob) and the same sema_gr_wedge_recover
+	 * knob as the mid-launch recovery, which stays available for a poison
+	 * the replay itself causes.
 	 */
 	if (stream3d && bar0 && !cwd_clear_done &&
+	    READ_ONCE(gsp_phys_gr_cwd_clear_en) &&
 	    READ_ONCE(gsp_phys_gr_wedge_recover)) {
 		cwd_clear_done = true;
 		gsp_phys_gr_cwd_clear_locked(bar0, req->h_object, req->push_va);