vgsp: SURF-PRELUDE (replays captured C597 colour-target bind alias-scanned+pair-relocated ahead of targetless stream3d windows - the NO-STORE cause: windows carry no render target; emitted words=7 window=391), ATTR sanitize (drops active attr words with width=0; r1113 torn 0x81a4 fixed), MME-miss census into MISS-ABORT+demand, MME-IMMATURE-SKIP; r1116: draw reaches engine, trap moved to 0x238c LOAD_CONSTANT_BUFFER_OFFSET Data=0x20020 then PBENTRY; GATE 1 static nz=2551 mean=0.083 DIFF 0 - SESSION 153 r1112-r1116

1 files changed, 148 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index c2f3084..4d32caa 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -14372,6 +14372,103 @@ static void svc_attr_prelude_capture(const u8 *buf, u32 len, u64 push_va,
 	}
 }
 
+/*
+ * SESSION 153-CONTINUED-62: surface (render-target) setup capture. The
+ * replayed beef 3D windows are mid-stream cuts of the client's per-frame
+ * pushes: the C597 colour-target bind (INC 0x800+j*0x40, [upper, lower,
+ * w, h, fmt, blksz]) is sticky context state the client (and the X
+ * server) writes once per context/window, so the draw windows themselves
+ * carry no render target and the replayed draw rasterizes into an
+ * unbound target - every launch retires with 0/N pages changed while
+ * every other witness (index buffers, programs, macros) is in place.
+ * The observed carrier is the X server's 1280x720 X-screen bind (VA
+ * 0x120400000, fmt 0xe6, 900 pages) on its own channel, so this capture
+ * is channel-agnostic (any trusted push) and keeps the LAST surface run
+ * whose shape the booter's alias scan can use. The launch builder
+ * replays it - aliased/relocated exactly like the window - ahead of any
+ * window that carries no usable render-target bind of its own; see
+ * gsp_phys_gr_surf_pre in gsp_phys_booter.c. A/B via sema_surf_prelude_cap.
+ */
+#define SVC_SURF_PRE_WORDS	16u
+static u32 svc_surf_pre_buf[SVC_SURF_PRE_WORDS];
+static u32 svc_surf_pre_n;
+static u32 svc_surf_pre_gen;
+static u64 svc_surf_pre_sig;
+static u32 svc_surf_pre_log;
+static u32 svc_surf_pre_flag = 1;
+module_param_named(sema_surf_prelude_cap, svc_surf_pre_flag, uint, 0644);
+MODULE_PARM_DESC(sema_surf_prelude_cap,
+	"Capture the last C597 colour-target bind (INC 0x800+j*0x40, fmt 0xe6) from trusted pushes so the GR launch builder can replay it ahead of 3D windows that carry no render target (default 1)");
+
+const u32 *gsp_sema_surf_prelude_get(u32 *n, u32 *gen)
+{
+	if (n)
+		*n = READ_ONCE(svc_surf_pre_n);
+	if (gen)
+		*gen = READ_ONCE(svc_surf_pre_gen);
+	return svc_surf_pre_buf;
+}
+
+static void svc_surf_prelude_capture(const u8 *buf, u32 len)
+{
+	u32 off = 0;
+
+	if (!READ_ONCE(svc_surf_pre_flag))
+		return;
+	while (off + 4u <= len) {
+		u32 hdr, op, cnt, addr, span = 1u, k, n;
+		u32 v[5] = { 0, 0, 0, 0, 0 };
+		u64 va, bytes, npages, sig;
+
+		memcpy(&hdr, buf + off, 4);
+		op = (hdr >> 29) & 7u;
+		cnt = (hdr >> 16) & 0xfffu;
+		addr = (hdr & 0x1fffu) << 2;
+		if ((op == 1u || op == 3u || op == 5u) && cnt) {
+			if ((u64)off + 4u + (u64)cnt * 4u > (u64)len)
+				break;
+			span = 1u + cnt;
+		}
+		if (op != 1u || cnt < 5u || cnt >= SVC_SURF_PRE_WORDS ||
+		    addr < 0x800u || addr >= 0xc00u ||
+		    (addr & 0x3fu) != 0u) {
+			off += span * 4u;
+			continue;
+		}
+		for (k = 0; k < 5u; k++)
+			memcpy(&v[k], buf + off + 4u + 4u * k, 4);
+		va = ((u64)(v[0] & 0xffu) << 32) | (u64)(v[1] & 0xfffff000u);
+		bytes = (u64)v[2] * 4ull * (u64)v[3];
+		npages = (bytes + 4095ull) >> 12;
+		if (!va || (va & 0xfffu) || v[4] != 0xe6u || !v[2] || !v[3] ||
+		    v[2] > 8192u || v[3] > 8192u || npages < 2ull ||
+		    npages > 4096ull) {
+			off += span * 4u;
+			continue;
+		}
+		n = span;
+		if (n > SVC_SURF_PRE_WORDS)
+			n = SVC_SURF_PRE_WORDS;
+		sig = svc_mme_run_sig(buf + off, n, hdr);
+		if (n == svc_surf_pre_n && sig == svc_surf_pre_sig) {
+			off += span * 4u;
+			continue;
+		}
+		for (k = 0; k < n; k++)
+			memcpy(&svc_surf_pre_buf[k], buf + off + 4u * k, 4);
+		WRITE_ONCE(svc_surf_pre_n, n);
+		svc_surf_pre_sig = sig;
+		WRITE_ONCE(svc_surf_pre_gen, svc_surf_pre_gen + 1);
+		if (svc_surf_pre_log < 8) {
+			svc_surf_pre_log++;
+			pr_info("sema-surf-pre: captured gen=%u words=%u va=0x%llx %ux%u fmt=0x%x hdr=%08x\n",
+				svc_surf_pre_gen, n, va, v[2], v[3], v[4],
+				hdr);
+		}
+		off += span * 4u;
+	}
+}
+
 static void svc_push_raw_dump(const u8 *buf, u32 len, u64 push_va,
 			      u32 h_object)
 {
@@ -15115,6 +15212,13 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
 	 */
 	if (ch && trusted)
 		svc_attr_prelude_capture(buf, len, push_va, ch->h_object);
+	/*
+	 * SESSION 153-CONTINUED-62: surface (render-target) setup capture -
+	 * channel-agnostic, the X-screen bind lives on the X server's own
+	 * channel. See svc_surf_prelude_capture.
+	 */
+	if (ch && trusted)
+		svc_surf_prelude_capture(buf, len);
 
 	memset(&st, 0, sizeof(st));
 	st.push_va = push_va;
@@ -31530,6 +31634,26 @@ static u64 svc_gr_prelude_gate_defer;
 static u64 svc_gr_prelude_gate_exp;
 
 /*
+ * SESSION 153-CONTINUED-62: immature-MME skip. The prelude gate above
+ * HOLDS the forward while the client's macro program is missing, but its
+ * bounded fail-open window used to forward anyway - and a window whose
+ * CALL_MME_MACRO runs have no program poisons the engine on contact
+ * (r1094 and r1114: `MME-PRELUDE emitted gen=1 words=9` ->
+ * mme_esr=0x80000004 ILLEGAL_OPCODE -> grfifo=0xbadf1201, whole lane
+ * wedged for the boot). The client needs no engine action to advance
+ * (the software release lanes author every completion it waits on), so an
+ * immature-MME beef window is CONSUMED with the software release instead
+ * of being forwarded into the poison. The moment the setup push lands the
+ * capture matures and the launches proceed normally. Default 1; A/B with
+ * 0 (the historical fail-open forward).
+ */
+static unsigned gsp_sema_mme_immature_skip = 1u;
+module_param_named(sema_mme_immature_skip, gsp_sema_mme_immature_skip,
+		   uint, 0644);
+MODULE_PARM_DESC(sema_mme_immature_skip,
+	"Software-complete a beef 3D window instead of forwarding it while the captured MME prelude has no macro program yet (avoids the ILLEGAL_OPCODE engine poison the fail-open forward causes; default 1)");
+
+/*
  * SESSION 153-CONTINUED-59: attr-program settle gate. The first beat
  * window of a capture generation binds program pairs (method 0x2014/0x2054)
  * whose operand pages must be IN the launch page set or the builder's
@@ -32144,6 +32268,30 @@ static bool svc_gr_request(struct nv_vgpu_device *vgpu,
 		return false;
 	}
 	/*
+	 * SESSION 153-CONTINUED-62: the gate's fail-open edge (see
+	 * gsp_sema_mme_immature_skip). Past the gate window a beef window
+	 * whose macro program is STILL missing must not be forwarded - the
+	 * engine poisons on the first CALL_MME_MACRO without a program.
+	 * Consume it with the software release instead; the client advances,
+	 * and the lane survives until the setup push matures the capture.
+	 */
+	if (READ_ONCE(gsp_sema_mme_immature_skip) &&
+	    (ch->h_object & 0xfffff000u) == 0xbeef0000u &&
+	    READ_ONCE(svc_mme_prelude_flag) &&
+	    !gsp_sema_mme_prelude_mature()) {
+		clear_bit_unlock(SVC_FWD_INFLIGHT, &svc_fwd_state);
+		mutex_unlock(&svc_fwd_lock);
+		svc.fwd_gr_refused++;
+		svc_gr_prelude_gate_defer++;
+		if (svc_gr_prelude_gate_defer <= 24 ||
+		    (svc_gr_prelude_gate_defer & 0xFF) == 1)
+			pr_info("vgsp-work: MME-IMMATURE-SKIP h=0x%x push=0x%llx (macro program not captured yet; window software-completed, no engine contact) n=%llu\n",
+				ch->h_object, svc_gr_cand.push_va,
+				svc_gr_prelude_gate_defer);
+		svc_gr_bridge_fallback(vgpu);
+		return false;
+	}
+	/*
 	 * m143: drain the host injection queue before resolving the launch's
 	 * pages. The watcher's pins for the client's a/b/c buffers can land
 	 * between the service loop's map_add drain and this capture; the fill