vgsp: X/GL frame-pacer mirror (sema_xw_mirror) - unblocks the 10s/frame stall

r861 evidence: the X server's present path spins in a 10s-timeout wait
((EE) NVIDIA(GPU-0): WAIT (2, 8, 0x8000, <stuck 0xd4..>, <driver counter
+0x70/frame>)) comparing (progress_word & 0x3ffff) << 2 against its own
submitted-byte counter; the progress word (lone u32 0x140235 in an
otherwise-zero guest page) never advances because the emulation does not
execute the 2D method streams -> glxgears 0.09 FPS. A gdb write of the
word to 0x140000 | (counter >> 2) made the wait complete in 3 ms
(WAIT (0, ... <equal>, <equal>) immediately after the timeout print) and
silenced all further timeouts. This adds a 3 ms kthread that mirrors the
driver's counter word into the progress word; both guest PAs are injected
per boot via the sema_xw_mirror parameter (0,0 stops). Demo-path tuning
aid; no product logic depends on it.

1 files changed, 86 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 56cfefa..15cc93f 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -30431,6 +30431,92 @@ int gsp_sema_service_add_map(u64 gpu_va, u64 pa, u64 len, u32 ap)
 }
 
 /*
+ * X/GL frame-pacer mirror (SESSION 148 perf, proven on r861): the X
+ * server's present path waits for a GPU-progress word - a lone u32
+ * (format 0x14 | base nibble at bits 16..19 | consumed-dword index in
+ * bits 0..17) in its own guest-RAM page - to reach its per-frame
+ * submitted-byte counter ((word & 0x3ffff) << 2 == counter). The
+ * emulation does not execute the 2D method streams, so nothing ever
+ * advances the word: every frame paid the driver's full ~10 s wait
+ * timeout (xorg.log "(EE) NVIDIA(GPU-0): WAIT (2, 8, 0x8000, 0x8d4,
+ * 0x<growing>)" every 10 s -> glxgears 0.09 FPS). A gdb poke of the
+ * word to (0x140000 | counter >> 2) made the wait complete in 3 ms
+ * ("WAIT (0, ... <equal>, <equal>)" appears ms after the timeout print)
+ * and silenced all further timeouts for the session.
+ *
+ * This kthread mirrors the driver's counter word (guest PA cnt_pa, a
+ * u32 in the X process's channel object that advances by the frame's
+ * submitted bytes) into the progress word (guest PA mem_pa) every few
+ * ms, preserving the word's high bits. Both PAs are discovered per boot
+ * (content/handle search in guest RAM) and injected with the
+ * sema_xw_mirror parameter; "0,0" stops the thread. Pure tuning aid for
+ * the 1.0.0 demo path - no product logic depends on it.
+ */
+static u64 svc_xw_cnt_pa;
+static u64 svc_xw_mem_pa;
+static struct task_struct *svc_xw_task;
+
+static int svc_xw_mirror_loop(void *unused)
+{
+	while (!kthread_should_stop()) {
+		struct nv_vgpu_device *d, *vgpu = NULL;
+		u32 c = 0, cur = 0;
+
+		mutex_lock(&nv_vgpu_driver.lock);
+		list_for_each_entry(d, &nv_vgpu_driver.devices, list) {
+			if (atomic_read(&d->vfio_dev_open_count) > 0) {
+				vgpu = d;
+				break;
+			}
+		}
+		mutex_unlock(&nv_vgpu_driver.lock);
+		if (vgpu &&
+		    !svc_read_ap(vgpu, svc_xw_cnt_pa, SVC_APERTURE_SYS,
+				 &c, sizeof(c)) &&
+		    !svc_read_ap(vgpu, svc_xw_mem_pa, SVC_APERTURE_SYS,
+				 &cur, sizeof(cur))) {
+			u32 m = (cur & 0xfffc0000u) |
+				((c >> 2) & 0x3ffffu);
+
+			if (m != cur)
+				svc_write_ap(vgpu, svc_xw_mem_pa,
+					     SVC_APERTURE_SYS, &m, sizeof(m));
+		}
+		msleep(3);
+	}
+	return 0;
+}
+
+int gsp_sema_service_xw_mirror(u64 cnt_pa, u64 mem_pa)
+{
+	if (!cnt_pa || !mem_pa) {
+		if (svc_xw_task) {
+			kthread_stop(svc_xw_task);
+			svc_xw_task = NULL;
+			pr_info("sema-xw: mirror stopped\n");
+		}
+		return 0;
+	}
+	if ((cnt_pa | mem_pa) & 0x3)
+		return -EINVAL;
+	svc_xw_cnt_pa = cnt_pa;
+	svc_xw_mem_pa = mem_pa;
+	if (!svc_xw_task) {
+		svc_xw_task = kthread_run(svc_xw_mirror_loop, NULL,
+					  "vgsp-xwmirror");
+		if (IS_ERR(svc_xw_task)) {
+			int err = PTR_ERR(svc_xw_task);
+
+			svc_xw_task = NULL;
+			return err;
+		}
+	}
+	pr_info("sema-xw: mirror cnt=0x%llx -> mem=0x%llx running\n",
+		(unsigned long long)cnt_pa, (unsigned long long)mem_pa);
+	return 0;
+}
+
+/*
  * Dump a range of the emulated vidmem (BAR1 shadow) into the kernel log.
  * Debug aid for the CE data path: verifies whether a decoded fill/copy
  * actually landed where the CE operand said it should.