vgsp+diag: strict replay/hold plumbing + pushfail/unread diagnostics + demand-record ex; guest_pin_stream vmap full-sweep resolver (unknown-family anchors), zero-head first-page acceptance, strict retry throttles - MME-PRELUDE MATURED (gen=4 words=901) but replay DROPS it (window=390 prelude=901 sa=47 exceeds block; replaying window alone) -> every launch prelude=0 timeout; GR-DEC data produced (5657 lines); retirement 0/900 no writes; next: raise replay/block capacity or two-pass prelude - SESSION 153 r1126

1 files changed, 64 insertions, 7 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 11549ce..2b435c4 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -22745,16 +22745,58 @@ unsigned gsp_sema_gr_setup_hold_ms;
 static unsigned long svc_gr_ring_tried;	/* ranks that got a diagnostic line */
 
 /*
+ * SESSION 153-CONTINUED-65: per-boot map of every DISTINCT beacon
+ * (0xbeef0xxx) GPFIFO entry the pump walks - (idx, va, len), first
+ * sighting order, dedup table of 512 triples (the ring re-walks entries
+ * every pass, so without dedup this floods). The r1124 setup-hold bound
+ * itself to entries 8 (0x4001004, 60216 B) and 15 (0x3200000, 153600 B);
+ * the client's 0x114 instruction-RAM program lives in the 0x3200000
+ * family window, so binding the hold/demand/capture class to the ENTRY
+ * (not a size heuristic) starts from this map. Service-thread only.
+ */
+static void svc_beef_entry_note(u32 h, u32 idx, u64 va, u32 len)
+{
+	static u64 sva[512];
+	static u32 sidx[512];
+	static u32 slen[512];
+	static u32 n;
+	u32 i;
+
+	for (i = 0; i < n; i++)
+		if (sva[i] == va && sidx[i] == idx && slen[i] == len)
+			return;
+	if (n >= 512u)
+		return;
+	sva[n] = va;
+	sidx[n] = idx;
+	slen[n] = len;
+	n++;
+	pr_info("sema-chan: beef entry h=0x%x idx=%u va=0x%llx len=%u\n",
+		h, idx, va, len);
+}
+
+/*
  * Is this a GR push whose readability the MME-setup capture depends on?
  * The client's C597 setup push is 12288 B; any GR push of that size is a
  * candidate. A smaller push qualifies only when it is READABLE and its
  * method runs hit the MME setup families (the unreadable case has no bytes
  * to scan, hence the length rule alone).
+ *
+ * SESSION 153-CONTINUED-65: the MME macro-upload family (0x3200000..)
+ * is setup-class by VA alone. The r1124 entry 15 (va=0x3200000,
+ * len=153600) carries the client's 0x114 instruction-RAM program - the
+ * guest RAM image of its window measures code=712 words with an exact-end
+ * stream walk - and the ubounded-tail demand must follow the ENTRY, not a
+ * size heuristic: the class match is what keeps the hold, the 4K-page
+ * demand and the strict pin anchored on the entry that actually feeds
+ * svc_mme_prelude_capture the 0x114 runs.
  */
-static bool svc_gr_setup_push(u32 len, const u8 *buf)
+static bool svc_gr_setup_push(u64 va, u32 len, const u8 *buf)
 {
 	u32 off = 0;
 
+	if (va >= 0x3200000u && va < 0x3300000u)
+		return true;
 	if (len >= 12288u)
 		return true;
 	if (!buf)
@@ -22788,8 +22830,14 @@ static bool svc_gr_setup_push(u32 len, const u8 *buf)
  * observed setup push is 60216 B (16 pages); pages 1..8 were demanded but
  * pages 9..15 never were, so the host's per-chunk read of the entry had no
  * source for the tail chunks and the whole read failed (unreadable=1, the
- * hold re-armed forever). 0x10000 covers the full 60216 B push within the
- * stalled-VA budget.
+ * hold re-armed forever). 0x10000 covered that push within the stalled-VA
+ * budget.
+ *
+ * SESSION 153-CONTINUED-65: the macro-upload carrier (r1124 entry 15,
+ * va=0x3200000) is 153600 B = 38 pages; 0x10000 demanded only 16 of them,
+ * so even a resolved window could never be read whole. Raise to 0x40000
+ * (256 pages) - bounded by the 512-slot demand ring and the 256-entry
+ * stalled-VA table, both of which keep their own eviction.
  */
 static void svc_gr_setup_hold_arm(struct svc_channel *ch, u64 va, u32 idx,
 				  u32 len)
@@ -22807,7 +22855,7 @@ static void svc_gr_setup_hold_arm(struct svc_channel *ch, u64 va, u32 idx,
 		pr_info("sema-chan: GR setup hold h=0x%x entry=%u va=0x%llx len=%u armed (demanding 4K pages; pending until the pin lands, window %u ms)\n",
 			ch->h_object, idx, va, len, gsp_sema_gr_setup_hold_ms);
 	}
-	for (poff = 0; poff < len && poff < 0x10000u; poff += SEMA_PAGE_SIZE) {
+	for (poff = 0; poff < len && poff < 0x40000u; poff += SEMA_PAGE_SIZE) {
 		svc_log_stalled_va(page + poff);
 		/*
 		 * SESSION 153-CONTINUED-56: also publish the page in the
@@ -35894,6 +35942,15 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 			}
 
 			/*
+			 * SESSION 153-CONTINUED-65: per-boot map of every
+			 * distinct beacon entry (see svc_beef_entry_note) -
+			 * the setup-hold/capture binding reads this list.
+			 */
+			if ((ch->h_object & 0xfffff000u) == 0xbeef0000u)
+				svc_beef_entry_note(ch->h_object, (u32)idx,
+						    va, len);
+
+			/*
 			 * r829: a zero-length / zero-VA entry is a bad read
 			 * (a stale or wrong translation), never work. The old
 			 * path consumed it as an empty push and advanced
@@ -37317,7 +37374,7 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 									 * same 4K-page demand + pending
 									 * hold as the unreadable one.
 									 */
-									if (svc_gr_setup_push(len, pb))
+									if (svc_gr_setup_push(va, len, pb))
 										svc_gr_setup_hold_arm(ch,
 												      va,
 												      (u32)idx,
@@ -37327,7 +37384,7 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 								u32 nocap_ms =
 									gsp_sema_gr_nocap_hold_ms;
 
-								if (svc_gr_setup_push(len, pb) &&
+								if (svc_gr_setup_push(va, len, pb) &&
 								    gsp_sema_gr_setup_hold_ms >
 								    nocap_ms)
 									nocap_ms =
@@ -37627,7 +37684,7 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 						 * pages and hold it pending.
 						 */
 						if (!ch->engine_type &&
-						    svc_gr_setup_push(len, NULL))
+						    svc_gr_setup_push(va, len, NULL))
 							svc_gr_setup_hold_arm(ch, va,
 									      (u32)idx,
 									      len);