vgsp: sema_gl_mme_reloc (CALL_MME_MACRO/DATA payload relocation via launch pages, raw-operand fault fix), MME-page collection + 4KB ptr dedup, 0x1b00 pair-relocation, sema_gr_wedge_recover (TSG-preempt re-arm on 0xbadf, revived channel: REAL GR SEM OK 0xc0ffee01), win_drop_auto += 0x1b00 - BEEF LAUNCHES RETIRE (h=0xbeef0100 ch_rel=0xc0ffee02 elapsed_ms=0 ok=6, 3 consecutive); full-perimeter windows still wedge in [0x1200,0x7ffc); client registration 5/5 with keeper - SESSION 153 r1058-r1063

1 files changed, 69 insertions, 2 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 4d497d9..789cf27 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -8022,8 +8022,24 @@ static void svc_gl_add_ptr(u64 va)
 
 	if (!va)
 		return;
+	/*
+	 * SESSION 153-CONTINUED-48: dedup by 4 KB page, not exact VA.
+	 * The QMD pointer region holds only seven pairs (words 34..47,
+	 * SVC_GR_POINTER_MAX - 1); a window that binds several different
+	 * offsets of one buffer (r1058 chunk1: five index-buffer VAs
+	 * across three pages) used to consume one slot per exact VA and
+	 * hit the cap, so no later operand page (the raw CALL_MME_MACRO
+	 * payload VAs 0x43545f0/0xb94f700) could join the set and the
+	 * shadow relocation left them raw - the raw operand the engine
+	 * faulted on (grfifo=0xbadf1201). One pointer per page carries
+	 * the same page set with slots left for the remaining operand
+	 * families; the first VA seen for a page is kept so the value
+	 * stays a real client VA (the fill resolves pages, and the
+	 * relocation matches by page).
+	 */
 	for (k = 0; k < svc_gl.n_ptr; k++)
-		if (svc_gl.ptr[k] == va)
+		if (svc_gl.ptr[k] == va ||
+		    (svc_gl.ptr[k] & ~(u64)0xfffu) == (va & ~(u64)0xfffu))
 			return;
 	if (svc_gl.n_ptr < SVC_GR_POINTER_MAX - 1)
 		svc_gl.ptr[svc_gl.n_ptr++] = va;
@@ -8049,6 +8065,26 @@ static void svc_gl_field(u32 addr, u32 count, const u8 *data, u32 dlen)
 	 * [ENABLE(0) | TYPE(7:4)]. Collected per slot so a bound program VA
 	 * can be typed (VTG vs PS) for the program-bytes delivery.
 	 */
+	/*
+	 * SESSION 153-CONTINUED-48: NVC597_SET_REPORT_SEMAPHORE_A..D = 0x1b00,
+	 * observed as 4-word runs [A=upper(7:0), B=lower(31:0), C=payload,
+	 * D=flags] at the end of every glcore draw window (payload = the
+	 * client's frame counter, e.g. 0x4f9f6; VA e.g. 0x4181bb0/0xc91e6c0).
+	 * These are the engine's own completion writes; with the VA raw the
+	 * replayed engine writes a client VA the GPC engines cannot reach -
+	 * the same VIRT_WRITE fault class the 0x10c NOTIFY drop exists for
+	 * (r1061: the kept [0,0x2000) window that still faults is exactly
+	 * the one carrying these raw 0x1b00 VAs). Collect the semaphore page
+	 * so the window relocation can rewrite the pair to a shadow VA: the
+	 * write then lands in the SAME HPA and the client's wait sees the
+	 * real hardware completion.
+	 */
+	if (addr == 0x1b00) {
+		if (count >= 2)
+			svc_gl_add_ptr(((u64)(v[0] & 0xffu) << 32) |
+				       (u64)(v[1] & 0xfffffffcu));
+		return;
+	}
 	if (addr >= 0x2000 && addr < 0x2800 && (addr & 0x3f) == 0) {
 		u32 j = (addr - 0x2000) / 0x40;
 
@@ -8056,6 +8092,37 @@ static void svc_gl_field(u32 addr, u32 count, const u8 *data, u32 dlen)
 			svc_gl_shader_type[j] = (u8)((v[0] >> 4) & 0xf);
 		return;
 	}
+	/*
+	 * SESSION 153-CONTINUED-48: CALL_MME_MACRO(j)=0x3800+j*8 /
+	 * CALL_MME_DATA(j)=0x3804+j*8 runs carry raw 32-bit client VAs as
+	 * macro arguments (r1058 chunk1: the macro(2) run payloads
+	 * 0x44ff800/0x44ff000 relocated only because the page set already
+	 * held 0x44ff000 via the index bind; the sibling payloads
+	 * 0x43545f0/0x4353f60/0xb94f700/0xb941578 stayed raw because their
+	 * pages missed the capped pointer list - the raw operand class the
+	 * GR faulted on). Collect every VA-shaped payload word so the page
+	 * set - and therefore the 3D-window shadow relocation - covers the
+	 * macro arguments too. This must run before the 0x2014..0x3fff
+	 * program-pair recognizer below, whose (addr & 0x3f) == 0x14 shape
+	 * would otherwise swallow a CALL_MME_DATA(2)=0x3814 run. Shape
+	 * gates: 4-byte aligned; >= 64 KB excludes the method/flag scalars
+	 * (0x0c/0x53/0x338); < 512 MB excludes the float constants the
+	 * macro(57) runs carry (1.0f=0x3f800000) while keeping every
+	 * observed client operand VA (max 0xb94f700).
+	 */
+	if (addr >= 0x3800 && addr < 0x3a00) {
+		for (k = 0; k < count; k++) {
+			u32 w;
+
+			if (4 * (k + 1) > dlen)
+				break;
+			memcpy(&w, data + 4 * k, 4);
+			if (w >= 0x10000u && w < 0x20000000u &&
+			    !(w & 3u))
+				svc_gl_add_ptr((u64)w);
+		}
+		return;
+	}
 	/* SET_PIPELINE_PROGRAM_ADDRESS_A/B(j), A=upper(7:0), B=lower(31:0).
 	 * Observed: 0x20020815 (j=1) [00000001 21201b00] -> 0x121201b00.
 	 * SESSION 153-CONTINUED-11: EVERY pair is recorded (the engine
@@ -8905,7 +8972,7 @@ static void svc_gl_stream_chunks(struct svc_channel *ch, const u8 *buf,
 	{
 		static u32 chunkdump_log;
 
-		if (chunkdump_log < 4 && svc_gl.start_off + 8u <= at_off) {
+		if (chunkdump_log < 8 && svc_gl.start_off + 8u <= at_off) {
 			u32 cur2 = svc_gl.start_off, end2, k2, wcnt;
 			u32 cw2 = svc_gl_chunk_words_param ?
 				svc_gl_chunk_words_param :