vgsp: PBENTRY first-sighting watch (all 12 PBDMA intr0 bit18, PB_HEADER/COUNT/DATA0/HDR_SHADOW dump pre-rearm, 8/boot) + PB-FAULT-DUMP voff/tail/past-end; sema_gl_sdm_drop (op-0/2/6 single-word SDM entries from preludes+window); reloc level-2 fallback; sema_gl_miss_abort (pre-doorbell abort on residual MISS, feeds pin demand); gsp_sema_demand_note + attr-prelude ptr pages demand-recorded + sema_attr_settle_ms=8000 - **FIRST BEEF WINDOW RETIRES ON REAL HW** (poll break ch=0xc0ffee02 after 68us, 737-word block) but no-store retire (0/4 pages changed, NO-STORES); residual MISS flood (miss=11..17) blocked by FULL demand set (64/64 MAX) - SESSION 153 r1103-r1106

1 files changed, 77 insertions, 2 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index b7897d8..11f4f46 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -1591,6 +1591,20 @@ static void svc_setup_demand_record(u64 va)
 }
 
 /*
+ * SESSION 153-CONTINUED-59: cross-file entry for the GR launch builder (see
+ * gsp_sema_service.h). Records the page of a VA whose window/attr operand
+ * relocation MISSed, so the pin demand path fetches it before the next
+ * forward; the builder then either resolves it (RELOC level-2 fallback) or
+ * aborts the launch pre-doorbell instead of letting the engine read a raw
+ * unmapped guest VA (the r1104 MMU Fault HUBCLIENT_PD class).
+ */
+void gsp_sema_demand_note(u64 va)
+{
+	if (va)
+		svc_setup_demand_record(va & ~(u64)0xfffu);
+}
+
+/*
  * Read-only view of the setup-hold demand set for the pin tool:
  *   # sema setup-hold demand VAs (page-aligned): N
  *   0x4021000
@@ -14215,6 +14229,18 @@ static void svc_attr_prelude_note_ptr(u64 va)
 			    (va & ~(u64)0xfffu))
 			return;
 	svc_attr_prelude_ptr[svc_attr_prelude_ptr_n++] = va;
+	/*
+	 * SESSION 153-CONTINUED-59: demand the program page NOW. The r1104
+	 * first beat window MISSed its 0x2054 pair operand (va=0x4350900)
+	 * because the page did not resolve at the launch fill; the engine
+	 * read it raw -> MMU Fault HUBCLIENT_PD @0x4350000 -> the guest
+	 * driver reset the channel and the lane died for the boot. Recording
+	 * the page in the pin-demand set here (at capture time, often
+	 * minutes before the first launch) lets pin_gr_stream demand it in
+	 * the guest so the launch fill's note resolves. See also the
+	 * sema_attr_settle_ms launch gate.
+	 */
+	svc_setup_demand_record(va & ~(u64)0xfffu);
 }
 
 static void svc_attr_prelude_capture(const u8 *buf, u32 len, u64 push_va,
@@ -31162,12 +31188,61 @@ static unsigned long svc_gr_prelude_gate_j;
 static u64 svc_gr_prelude_gate_defer;
 static u64 svc_gr_prelude_gate_exp;
 
-static bool svc_gr_prelude_gate_active(const struct svc_channel *ch)
+/*
+ * SESSION 153-CONTINUED-59: attr-program settle gate. The first beat
+ * window of a capture generation binds program pairs (method 0x2014/0x2054)
+ * whose operand pages must be IN the launch page set or the builder's
+ * shadow relocation MISSes and the emitted address stays a raw client VA
+ * the engine cannot fetch (r1104: `pair addr=0x2054 va=0x4350900 -> MISS`
+ * -> MMU Fault HUBCLIENT_PD @0x4350000 -> guest channel reset). The pages
+ * resolve through the pin demand path with a multi-second latency, so a
+ * launch that runs within a second of the attr prelude's program-VA set
+ * last growing races that resolution. This gate withholds beef forwards
+ * for sema_attr_settle_ms after the set last grew (bounded by the same
+ * gate window as the prelude gate), giving the pins time; the busy-defer
+ * keeps the candidate so the launch goes out once settled.
+ */
+static unsigned gsp_sema_attr_settle_ms = 8000u;
+module_param_named(sema_attr_settle_ms, gsp_sema_attr_settle_ms, uint, 0644);
+MODULE_PARM_DESC(sema_attr_settle_ms,
+	"Withhold beef GR forwards for this long after the attr prelude program-VA set last grew, so window pair pages resolve before the first launch (default 8000, 0 = off)");
+static unsigned long svc_attr_settle_j;
+static u32 svc_attr_settle_n;
+
+static bool svc_gr_attr_settle_wait(void)
 {
-	if (!READ_ONCE(svc_mme_prelude_flag) || !gsp_sema_gr_prelude_gate_ms)
+	u32 apn = 0;
+
+	if (!gsp_sema_attr_settle_ms)
+		return false;
+	(void)gsp_sema_attr_prelude_ptrs(&apn);
+	if (!apn)
 		return false;
+	if (apn != svc_attr_settle_n) {
+		svc_attr_settle_n = apn;
+		svc_attr_settle_j = jiffies;
+	}
+	if (!svc_gr_prelude_gate_j)
+		svc_gr_prelude_gate_j = jiffies;
+	if (time_after(jiffies, svc_gr_prelude_gate_j +
+		       msecs_to_jiffies(gsp_sema_gr_prelude_gate_ms)))
+		return false;	/* overall fail-open with the prelude gate */
+	return time_before(jiffies, svc_attr_settle_j +
+			   msecs_to_jiffies(gsp_sema_attr_settle_ms));
+}
+
+static bool svc_gr_prelude_gate_active(const struct svc_channel *ch)
+{
 	if ((ch->h_object & 0xfffff000u) != 0xbeef0000u)
 		return false;
+	/*
+	 * SESSION 153-CONTINUED-59: attr-program settle first (fires even
+	 * with the MME prelude already mature - that is the r1104 state).
+	 */
+	if (svc_gr_attr_settle_wait())
+		return true;
+	if (!READ_ONCE(svc_mme_prelude_flag) || !gsp_sema_gr_prelude_gate_ms)
+		return false;
 	if (gsp_sema_mme_prelude_mature())
 		return false;
 	if (!svc_gr_prelude_gate_j)