vgsp: m160 reliability wave: fresh-ack outcome retries (zero release words, fresh qmdwin bank + rebuilt PB, restore-on-no-write), event-table slot reclaim (free-slot reuse + loud full log), GR capture trust for fresh plausibility-verified ring entries

1 files changed, 65 insertions, 36 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index 2ffc8ac..0afb013 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -2444,51 +2444,80 @@ static void gsp_rm_handle_rm_alloc(struct gsp_emu_context *ctx,
 	 * notifyIndex, data}). The driver allocates one per channel and waits
 	 * for the GPU to post the event before it considers submitted work
 	 * complete - remember them so completed work can be signalled back.
+	 *
+	 * The table is append+retire: FREE retires records (valid=false) but
+	 * never shrinks events_n, so long-lived boots with many client
+	 * create/destroy cycles would otherwise exhaust the 128 slots and
+	 * SILENTLY drop new registrations - after which the completion
+	 * wake-ups (post_channel_event / post_all_events) fail with EINVAL
+	 * and a later client waits forever for a completion that can no
+	 * longer be notified (observed r162: `completion hint rc=-22`
+	 * repeating from the first post-teardown client onward). Reclaim the
+	 * first retired slot for a new registration, and log loudly when the
+	 * table is genuinely full of live entries.
 	 */
-	if (class_id == 0x79 && params_size >= 24 && rm->events_n < GSPRM_MAX_EVENTS) {
+	if (class_id == 0x79 && params_size >= 24) {
 		u32 h_src = 0, notify_index = 0, hclass = 0;
 		u64 data64 = 0;
 		int hc_off = -1, i;
+		u32 slot = rm->events_n;
 
-		/*
-		 * Locate hClass (0x79) inside the params instead of trusting a
-		 * fixed offset: NV0005_ALLOC_PARAMETERS is
-		 * {hParentClient, hSrcResource, hClass, notifyIndex, data},
-		 * with hSrcResource immediately before hClass.
-		 */
-		for (i = 0; i + 4 <= (int)params_size; i += 4) {
-			u32 v;
-
-			memcpy(&v, params + i, 4);
-			if (v == 0x79) {
-				hc_off = i;
+		for (i = 0; i < (int)rm->events_n; i++) {
+			if (!rm->events[i].valid) {
+				slot = (u32)i;
 				break;
 			}
 		}
-		if (hc_off >= 4) {
-			memcpy(&h_src, params + hc_off - 4, 4);
-			memcpy(&hclass, params + hc_off, 4);
-			if (hc_off + 8 <= (int)params_size)
-				memcpy(&notify_index, params + hc_off + 4, 4);
-			if (hc_off + 16 <= (int)params_size)
-				memcpy(&data64, params + hc_off + 8, 8);
-		} else {
-			memcpy(&h_src, params + 4, 4);
-			memcpy(&notify_index, params + 12, 4);
-			memcpy(&data64, params + 16, 8);
+		if (slot >= GSPRM_MAX_EVENTS)
+			nv_vgpu_err(ctx->vgpu,
+				    "vgsp-rm: event table full (%u live records); dropping registration hObject=0x%x - completion wake-ups will not reach this client",
+				    rm->events_n, ho);
+		else {
+			/*
+			 * Locate hClass (0x79) inside the params instead of
+			 * trusting a fixed offset: NV0005_ALLOC_PARAMETERS is
+			 * {hParentClient, hSrcResource, hClass, notifyIndex,
+			 * data}, with hSrcResource immediately before hClass.
+			 */
+			for (i = 0; i + 4 <= (int)params_size; i += 4) {
+				u32 v;
+
+				memcpy(&v, params + i, 4);
+				if (v == 0x79) {
+					hc_off = i;
+					break;
+				}
+			}
+			if (hc_off >= 4) {
+				memcpy(&h_src, params + hc_off - 4, 4);
+				memcpy(&hclass, params + hc_off, 4);
+				if (hc_off + 8 <= (int)params_size)
+					memcpy(&notify_index,
+					       params + hc_off + 4, 4);
+				if (hc_off + 16 <= (int)params_size)
+					memcpy(&data64,
+					       params + hc_off + 8, 8);
+			} else {
+				memcpy(&h_src, params + 4, 4);
+				memcpy(&notify_index, params + 12, 4);
+				memcpy(&data64, params + 16, 8);
+			}
+			rm->events[slot].h_src = h_src;
+			rm->events[slot].h_event = ho;
+			rm->events[slot].h_client = hc;
+			rm->events[slot].notify_index = notify_index;
+			rm->events[slot].data = (u32)data64;
+			rm->events[slot].valid = true;
+			if (slot == rm->events_n)
+				rm->events_n++;
+			if (gsp_sema_dbg)
+				nv_vgpu_info(ctx->vgpu,
+					     "vgsp-rm: event registered hEvent=0x%x hSrc=0x%x notifyIndex=%u (off %d, slot %u) params=%*phN",
+					     ho, h_src, notify_index, hc_off,
+					     slot,
+					     (int)min(params_size, (u32)24),
+					     params);
 		}
-		rm->events[rm->events_n].h_src = h_src;
-		rm->events[rm->events_n].h_event = ho;
-		rm->events[rm->events_n].h_client = hc;
-		rm->events[rm->events_n].notify_index = notify_index;
-		rm->events[rm->events_n].data = (u32)data64;
-		rm->events[rm->events_n].valid = true;
-		rm->events_n++;
-		if (gsp_sema_dbg)
-			nv_vgpu_info(ctx->vgpu,
-				     "vgsp-rm: event registered hEvent=0x%x hSrc=0x%x notifyIndex=%u (off %d) params=%*phN",
-				     ho, h_src, notify_index, hc_off,
-				     (int)min(params_size, (u32)24), params);
 	}
 
 	/* Echo the fixed alloc header + as many param bytes as are contiguous