gsp-phys: H1 GR ladder - GR0 channel, compute object, GR sem push (default off)

New load-time gsp_phys_rmcall_engine (0=COPY0 default, 1=GR0) parameterizes
the physical ladder: TSG and channel engine_type GR0, one-attempt channel
alloc, TURING_COMPUTE_A engine object (class 0xc5c0, handle 0xcaf0002c),
BIND engineType=1, and a GR method push (SET_OBJECT 0xc5c0 on subchannel 1
plus SET_REPORT_SEMAPHORE) submitted through the existing GPFIFO/USERD
doorbell tail, polling the module semaphore. CE work-forwarding refuses
cleanly while a GR ladder is active. A debugfs trigger re-runs the GR push.
With the parameter at its default the ladder emits byte-identical COPY0
requests (only the state line gains engine=COPY0).

Live (first GR context on the live server): every GR RPC accepted -
channel variant V5, TURING_COMPUTE_A alloc status=0x0 -> hObject=0xcaf0002c,
BIND status=0x0, token=0x1 - and the engine fetched the push (GPGet 0->1),
but raised a GR exception instead of executing the release:
exceptType=0x20, NOCAT faultingEngine="GR", intr1=0x80000000, no rpc_result
errors. The failure is downstream of all RPCs; no mutating retry was made
and the device released cleanly (WPR2 down, rebound, 5 locks, pstore empty,
same boot). A default-engine control cycle stayed green (REAL COPY OK).
Follow-up: bisect the GR alloc params, the release method D word, and the
method order/context init using the drained GR fault records as the oracle.

1 files changed, 26 insertions, 0 deletions

diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index cfa3d4e..227246b 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -316,6 +316,32 @@ bool gsp_phys_fault_inject_enabled(void)
 EXPORT_SYMBOL_GPL(gsp_phys_fault_inject_enabled);
 
 /*
+ * H1 rm-call ladder engine selector (default 0). 0 keeps the existing
+ * COPY0/CE ladder byte-identical: TSG/channel engineType COPY0, the V5
+ * variant walk, BIND engineType 0x9 and the CE copy method block. 1 selects
+ * GR0 (NV2080_ENGINE_TYPE_GRAPHICS): the stage-3 snapshot builds the
+ * TSG/channel with engineType 1, makes one (no-retry) V5 channel attempt,
+ * allocates the TURING_COMPUTE_A (0xc5c0) engine object on the ladder
+ * channel, BIND uses engineType 1 and stage 4 pushes a GR
+ * SET_REPORT_SEMAPHORE release instead of a CE copy. The value is snapshotted
+ * when stage 3 starts; a later sysfs change is logged once and ignored, so a
+ * session can never mix a GR0 channel with a COPY0 BIND. Every CE forwarding
+ * path (P5/P6a selftest/P6b/P6c) refuses cleanly on a GR ladder. One-line
+ * rollback: gsp_phys_rmcall_engine=0.
+ */
+static int gsp_phys_rmcall_engine_param;
+module_param_named(gsp_phys_rmcall_engine, gsp_phys_rmcall_engine_param, int,
+		   0644);
+MODULE_PARM_DESC(gsp_phys_rmcall_engine,
+		 "RM-client ladder engine: 0 = COPY0 (default, existing CE copy ladder), 1 = GR0 (TURING_COMPUTE_A engine object and a GR semaphore release)");
+
+int gsp_phys_rmcall_engine_value(void)
+{
+	return gsp_phys_rmcall_engine_param;
+}
+EXPORT_SYMBOL_GPL(gsp_phys_rmcall_engine_value);
+
+/*
  * One-way power latch (default). Re-enabling runtime PM and D3cold after a
  * claim lets the board power-gate and the host hard-freeze on resume
  * (observed 2026-10-01); keep the pre-claim D0 policy instead and require