gr: record the launch's resolved operand pages in the ledger - fixes the D2H readback reading a stale page (victory_reduce sum=0 class); add GMMU walk trace + fwd-hpa diagnostics

1 files changed, 72 insertions, 1 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 8623f07..f6e85ec 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -1820,6 +1820,9 @@ static int svc_gmmu_walk(struct nv_vgpu_device *vgpu, u64 pdb, u32 entries,
 	 * index error.
 	 */
 	idx = (va >> 21) & 0xff;
+	if (trace)
+		pr_info("sema-walk:   PD0 table=0x%llx idx=%u va=0x%llx tap=%d\n",
+			table, idx, va, tap);
 	if (svc_read_ap(vgpu, table + 16 * idx,
 			tap == SVC_APERTURE_FB ? SVC_APERTURE_FB
 					       : SVC_APERTURE_SYS,
@@ -1829,6 +1832,9 @@ static int svc_gmmu_walk(struct nv_vgpu_device *vgpu, u64 pdb, u32 entries,
 					       : SVC_APERTURE_SYS,
 			&small, sizeof(small)))
 		return -ENOENT;
+	if (trace)
+		pr_info("sema-walk:   PD0 big=0x%016llx small=0x%016llx\n",
+			big, small);
 
 	/* Small half: 4 KB page table under it. */
 	sap = svc_pde_aperture(((small >> 1) & 0x3));
@@ -1840,6 +1846,12 @@ static int svc_gmmu_walk(struct nv_vgpu_device *vgpu, u64 pdb, u32 entries,
 			*addr += va & 0xfff;
 			return 0;
 		}
+		if (trace)
+			pr_info("sema-walk:   small miss sap=%d t=0x%llx\n",
+				sap, t);
+	} else if (trace) {
+		pr_info("sema-walk:   small skip sap=%d small&1=%llu\n",
+			sap, small & 1);
 	}
 
 	/* Big half: a 2 MB page here, or a large (64 KB) page table. */
@@ -1872,6 +1884,9 @@ static int svc_gmmu_walk(struct nv_vgpu_device *vgpu, u64 pdb, u32 entries,
 			return 0;
 		}
 	}
+	if (trace)
+		pr_info("sema-walk:   no leaf va=0x%llx big=0x%llx small=0x%llx\n",
+			va, big, small);
 	return -ENOENT;
 }
 
@@ -5404,6 +5419,10 @@ static void svc_copy_snap_capture(struct nv_vgpu_device *vgpu, u64 dst,
 			    total >= 16 ? *(const u32 *)(buf + 12) : 0);
 }
 
+static int svc_fwd_operand_hpa(struct nv_vgpu_device *vgpu, u8 kind,
+			       u64 pa, u32 off, u32 bytes, u64 *hpa,
+			       u32 *out_off);
+
 static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total,
 		    u32 dst_phys, u32 dst_aperture, u32 src_phys, u32 src_aperture,
 		    u64 *done_out)
@@ -5636,6 +5655,25 @@ static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total,
 			dst_orig, dst, dst_aperture, dst_prov, dst_shadow,
 			src_orig, src, src_aperture, src_prov, src_shadow,
 			total);
+		/*
+		 * r348 diagnostic: for a high-VA SYS source name the exact
+		 * host PA this read will touch (gpa_to_hpa) - the direct
+		 * comparison against the svc-fwd-hpa writeback line.
+		 */
+		if (src_orig >= SVC_VAS_FLOOR &&
+		    src_aperture == CE_APERTURE_SYS) {
+			u64 shpa = 0;
+			u32 soff = 0;
+
+			if (!svc_fwd_operand_hpa(vgpu, SVC_APERTURE_SYS,
+						 src, 0, SEMA_PAGE_SIZE,
+						 &shpa, &soff) && !soff)
+				pr_info("sema-bigcopy: src-hpa va=0x%llx gpa=0x%llx -> hpa=0x%llx\n",
+					src_orig, src, shpa);
+			else
+				pr_info("sema-bigcopy: src-hpa va=0x%llx gpa=0x%llx -> UNMAPPED\n",
+					src_orig, src);
+		}
 		pr_info("sema-bigcopy: src16=%16phN dst16_before=%16phN\n",
 			sb, db);
 		/*
@@ -12032,6 +12070,14 @@ unsigned gsp_phys_gr_hold_max_ms = 3000;
 unsigned gsp_phys_gr_fill_hold;	/* default 0: log-only, never hold */
 
 /*
+ * r346: trace GMMU walks for unresolved high-VA operands (the arg-miss
+ * diagnostic re-walks each published vaspace for a failing base). When
+ * nonzero, those walks print the per-level entries (L0..L2, PD0 halves)
+ * so a failing VA shows exactly where the walk dies.
+ */
+unsigned gsp_sema_walk_trace;
+
+/*
  * F1-b: GR release-word authorship gate (default 1). While a forwarded GR
  * launch is in flight, the RAM-content sweep must not author the very QMD
  * completion release the backend poll is waiting for: a sweep write could
@@ -15559,6 +15605,16 @@ static void svc_fwd_gr_work(void)
 		data[gs.n_data].hpa = dhpa;
 		data[gs.n_data].reloc_va = dg->reloc_va;
 		/*
+		 * r348 diagnostic: the last 32 high-VA data pages (the output
+		 * operands live there) with the exact (gpa, ap) -> hpa the
+		 * writeback will use - comparable against the D2H read's
+		 * resolution line (sema-bigcopy) for the same VA.
+		 */
+		if (dg->va >= SVC_VAS_FLOOR &&
+		    i + 32 >= svc_fwd_req.gr_n_data)
+			pr_info("svc-fwd-hpa: va=0x%llx gpa=0x%llx ap=%u hpa=0x%llx bi=%u\n",
+				dg->va, dg->pa, dg->ap, dhpa, i);
+		/*
 		 * GRVAUDIT (diagnostic only): audit the m180 landing
 		 * authority against the PA this submit will put on the wire
 		 * for every tracked data page - the data[]/n_data set the
@@ -16886,6 +16942,21 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu,
 			rec->ap = (u8)svc_ap_of(ap);
 			svc_fwd_req.gr_n_data++;
 			/*
+			 * r349: record the launch's own resolution as the
+			 * ledger's landing authority for this VA. The read
+			 * path's m171 read-after-write rule follows the
+			 * ledger when it disagrees with the live translation,
+			 * and the engine writeback below writes exactly this
+			 * (pa, ap). Without the store the ledger kept a stale
+			 * page for engine-written outputs (victory_reduce:
+			 * the launch wrote FB 0x7c00000 while the ledger
+			 * said SYS 0x7c00000; the D2H read followed the
+			 * ledger and returned zeros while the correct sum
+			 * sat on the written page).
+			 */
+			if (va >= SVC_VAS_FLOOR)
+				svc_ledger_store(va, rec->pa, rec->ap);
+			/*
 			 * m142: bounded per-page attribution log. A wrong data
 			 * page is invisible in the aggregate counters; these
 			 * lines let a post-mortem compare the chosen PA against
@@ -16946,7 +17017,7 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu,
 				wrc = svc_gmmu_walk(vgpu, svc.vas[vi].pdb,
 						    svc.vas[vi].entries, base,
 						    svc.vas[vi].ap, &wa, &wap,
-						    false);
+						    gsp_sema_walk_trace != 0);
 				o += snprintf(vb + o, sizeof(vb) - o,
 					      " vas[%d] pdb=0x%llx ent=%u ap=%d rc=%d pa=0x%llx",
 					      vi, svc.vas[vi].pdb,