vgsp: re-arm on MISS-ABORT (candidate re-offered unwon, releases re-parked, 1500ms tick, 55s/64-try episode bound; GSP_PHYS_GR_RC_MISSABORT -ENOMSG), junk-operand filter (0x10000000..0x100000000 reloc misses not demanded - float constants), MME prelude latch cleared on WEDGE-RECOVER - **FIRST-EVER nonzero beef submit+retire** (GR LAUNCH submitted push=0xcf3d724 len=5016 pages=9 words=389, poll break ch=0xc0ffee02 after 64us, 12 poll breaks, 0 poisons; client 0.077->287-436 FPS); still NO-STORES (bounce 0 pages changed by engine); next: SKED CTA counters for prove dispatch-vs-degenerate + fix vertex/index operand state - SESSION 153 r1109-r1111

1 files changed, 66 insertions, 5 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 6f3898f..4c2b460 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -17204,6 +17204,19 @@ MODULE_PARM_DESC(sema_gl_mme_prelude,
 	"Preplay the captured client MME context-setup runs once per capture generation ahead of the first 3D window replay (default 1)");
 
 /*
+ * SESSION 153-CONTINUED-61: generation of the MME prelude already emitted
+ * into the engine context (0 = none). The r1110 evidence: the prelude was
+ * emitted once on the first beef launch (gen=1, 512 words), that launch
+ * priv-errored (grfifo=0xbadf1201) and WEDGE-RECOVER ran TSG preempt +
+ * resched - which resets the engine context and with it the resident MME
+ * program - yet the latch kept suppressing re-emission, so every later
+ * window replay ran its macros against an unloaded MME (mme_pc=513 class
+ * stall, no retire). The recovery clears the latch so the next launch
+ * re-preloads the context.
+ */
+static u32 gsp_phys_gr_mme_prelude_gen;
+
+/*
  * SESSION 153-CONTINUED-57: attr/pipeline state prelude. The r1091
  * full-MME-prelude boot cleared MME (mme_esr=80000000) but the first beef
  * window then latched a draw-shader program-header error
@@ -17286,7 +17299,6 @@ static u32 gsp_phys_rmcall_build_gr_launch(u32 *pb,
 		 * to also carry the prelude replays without it (logged) - the
 		 * emission then happens on the next launch that fits.
 		 */
-		static u32 mme_prelude_emitted_gen;
 		bool emit_prelude = false;
 		const u32 *pl = NULL;
 		u32 pl_n = 0, pl_gen = 0;
@@ -17294,7 +17306,7 @@ static u32 gsp_phys_rmcall_build_gr_launch(u32 *pb,
 		if (READ_ONCE(gsp_phys_rmcall_gr_mme_prelude)) {
 			pl = gsp_sema_mme_prelude_get(&pl_n, &pl_gen);
 			if (pl && pl_n && pl_gen &&
-			    pl_gen != READ_ONCE(mme_prelude_emitted_gen)) {
+			    pl_gen != READ_ONCE(gsp_phys_gr_mme_prelude_gen)) {
 				if (win3d_n + 2u + 8u + pl_n <=
 				    GSP_PHYS_RMCALL_GR_METHOD_WORDS) {
 					emit_prelude = true;
@@ -17350,7 +17362,7 @@ static u32 gsp_phys_rmcall_build_gr_launch(u32 *pb,
 			 * emitted (the copy may be a torn prefix). */
 			gsp_sema_mme_prelude_get(NULL, &g1);
 			if (g1 == g0) {
-				WRITE_ONCE(mme_prelude_emitted_gen, g0);
+				WRITE_ONCE(gsp_phys_gr_mme_prelude_gen, g0);
 				pr_info("vgsp-gr: MME-PRELUDE emitted gen=%u words=%u window=%u h=0x%x push=0x%llx sdm_drop=%u\n",
 					g0, pwords, win3d_n, req->h_object,
 					req->push_va, sdrop);
@@ -19921,6 +19933,7 @@ static u64 gsp_phys_gr_surf_dummy_dma_locked(void)
  * sema_gl_miss_abort=0 restores the historical submit-anyway behaviour.
  */
 static u32 gsp_phys_rmcall_gr_3d_miss_n;
+static u64 gsp_phys_rmcall_gr_3d_junk_n;
 static bool gsp_phys_rmcall_gr_miss_abort = true;
 static u64 gsp_phys_gr_miss_abort_n;
 module_param_named(sema_gl_miss_abort, gsp_phys_rmcall_gr_miss_abort, bool,
@@ -20005,6 +20018,35 @@ static bool gsp_phys_rmcall_gr_3d_reloc(u32 *up_w, u32 *lo_w,
 		}
 	}
 	/*
+	 * SESSION 153-CONTINUED-61: junk-operand filter. The window
+	 * recognizer is byte-shape based, so float/immediate DATA words in
+	 * the method stream also parse as address pairs. The observed junk
+	 * class sits in the 256 MB..4 GB numeric range (0x3d000000..0xc2......
+	 * float bit patterns: 0x3f800000 = 1.0f, 0xbf800000 = -1.0f, ...)
+	 * and can NEVER resolve - r1109 measured miss=20 constant across
+	 * every attempt, all of it this class, which pinned the abort census
+	 * nonzero forever and blocked every submit. Real client VAs of this
+	 * driver live below 0x5000000 (the 64-80 MB GL/heap range, e.g.
+	 * 0x4250000/0x4350000/0x462fc40) or at/above 0x1_00000000 (the 4G+
+	 * push-buffer/UVM ranges). A miss outside both is a data-word
+	 * misidentification, not a raw client VA the engine would read as an
+	 * address: it is neither demanded (the demand set was 60 % junk by
+	 * r1109, diverting the pin cycle) nor counted toward the pre-doorbell
+	 * abort. Witnessed per class, bounded.
+	 */
+	if (page >= 0x10000000ULL && page < 0x100000000ULL) {
+		static u32 gr_missjunk_log;
+
+		gsp_phys_rmcall_gr_3d_junk_n++;
+		if (gr_missjunk_log < 24 ||
+		    !(gsp_phys_rmcall_gr_3d_junk_n % 512u)) {
+			gr_missjunk_log++;
+			pr_info("vgsp-gr: MISS-JUNK va=0x%llx (data-word class; not demanded, not counted toward the abort) n=%llu\n",
+				page, (u64)gsp_phys_rmcall_gr_3d_junk_n);
+		}
+		return false;
+	}
+	/*
 	 * Unresolvable: demand the page for the pin path and count the miss
 	 * (the submit path aborts pre-doorbell while the count is nonzero).
 	 */
@@ -22340,7 +22382,15 @@ gr_page_unmapped:
 			}
 			mutex_unlock(&gsp_phys_rm_lock);
 			gsp_phys_gr_refused++;
-			ret = -EAGAIN;
+			/*
+			 * SESSION 153-CONTINUED-61: the dedicated verdict lets
+			 * the sema service keep the captured candidate armed
+			 * and re-forward it (re-arm) instead of consuming it
+			 * with a software completion: the demanded pages
+			 * resolve through the pin path and the retry then runs
+			 * the real launch.
+			 */
+			ret = GSP_PHYS_GR_RC_MISSABORT;
 			goto out;
 		}
 		/*
@@ -22996,7 +23046,18 @@ gr_page_unmapped:
 				gsp_phys_gr_wedge_hard_rearm_locked(bar0);
 				mutex_unlock(&gsp_phys_rm_lock);
 				g1 = ioread32(bar0 + 0x00400504u);
-				pr_warn("vgsp-gr: WEDGE-RECOVER after re-arm grfifo=0x%08x (%s); recovery #%u this boot\n",
+				/*
+				 * SESSION 153-CONTINUED-61: the TSG preempt +
+				 * resched above resets the engine context, so
+				 * the MME program the emitted prelude loaded is
+				 * gone. Clear the emission latch: the next
+				 * launch that can carry the prelude re-preloads
+				 * it (without this every later replay ran its
+				 * macros against an unloaded MME and stalled
+				 * pre-retire - the r1110 mme_pc=513 class).
+				 */
+				WRITE_ONCE(gsp_phys_gr_mme_prelude_gen, 0);
+				pr_warn("vgsp-gr: WEDGE-RECOVER after re-arm grfifo=0x%08x (%s); recovery #%u this boot; MME prelude latch cleared (context re-preload owed)\n",
 					g1,
 					(g1 & 0xffff0000u) == 0xbadf0000u ?
 						"still poisoned" : "cleared",