vgsp: demand set 64->512 + ring-overwrite (no silent drop; head/total/evicted in debugfs sema_setup_demand), EBADMSG return authors software release (suppresses synth), ZEROWIN-SKIP (all-zero 3D window software-released, no engine submit) - verified: demand 197 VAs past cap, MISS-ABORT convergence (submit only at miss=0), ZEROWIN-SKIP no-poison; store-bearing window still not achieved (r1106 retire root-caused zero window); r1108 slow-death (Wait for channel idle timed out + red screen on SKIP edge); next: re-arm candidate on MISS-ABORT (not consume) - SESSION 153 r1107-r1108

1 files changed, 43 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 7f41df6..6f3898f 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -16841,6 +16841,14 @@ static u64 gsp_phys_gr_submitted;
 static u64 gsp_phys_gr_ok;
 static u64 gsp_phys_gr_refused;
 static u64 gsp_phys_gr_timed_out;
+/*
+ * SESSION 153-CONTINUED-60: 3D-stream launches whose window was all-zero
+ * (the client's push page caught mid-rewrite). They are never handed to the
+ * engine: the zero method stream trips the PBDMA (trap 0x1168 -> priv-error
+ * poison, see the ZEROWIN-SKIP site). Counted so a boot's zero-window rate
+ * is visible without dmesg archaeology.
+ */
+static u64 gsp_phys_gr_zerowin_skips;
 static u64 gsp_phys_gr_retries;	/* fresh-entry launch retries published */
 static u64 gsp_phys_gr_pool_exhausted;
 /* m156 (E5): zero-write retries where the warm sem push proved the engine
@@ -21139,6 +21147,41 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 		ret = -EIO;
 		goto out;
 	}
+	/*
+	 * SESSION 153-CONTINUED-60: all-zero 3D-window skip. The client's push
+	 * page is cyclically zeroed/rewritten (CONT-45); a capture that lands
+	 * on the zero phase still forwards an all-zero method window. Live
+	 * r1107: such a window launched (3D raw dump words=252, every word 0),
+	 * the engine trapped SET_VERTEX_ATTRIBUTE_A(2) (trap=00001168
+	 * data_lo=0x50) and escalated to a priv-error poison (grfifo=
+	 * 0xbadf1201, mme_pc=513) that wedged the GR lane for the rest of the
+	 * boot; r1031 had already seen the same class fault the PBDMA on the
+	 * zero lead (PB-FAULT-DUMP P0). A zero window carries no method to
+	 * execute and nothing to store: skip the hardware handoff entirely -
+	 * no shadow relocation, no engine contact, no wedge - and return the
+	 * distinct rc -EBADMSG so the service authors the software release and
+	 * suppresses the synthetic fault (a frame with no content deserves no
+	 * client-visible engine error).
+	 */
+	if (stream3d) {
+		u32 zwi;
+		bool zerowin = req->stream_n != 0;
+
+		for (zwi = 0; zwi < req->stream_n; zwi++) {
+			if (req->stream[zwi]) {
+				zerowin = false;
+				break;
+			}
+		}
+		if (zerowin) {
+			gsp_phys_gr_zerowin_skips++;
+			pr_warn_ratelimited("vgsp-gr: ZEROWIN-SKIP h=0x%x push=0x%llx window=%u all-zero (no engine submit; software release) n=%llu\n",
+				req->h_object, req->push_va, req->stream_n,
+				gsp_phys_gr_zerowin_skips);
+			ret = -EBADMSG;
+			goto out;
+		}
+	}
 
 	gsp_phys_gr_submitted++;
 	gsp_phys_gr_override_apply_param();