kernel: fn-10 timing-race mitigation (2ms reply delay) + remove seqNum-poison

The fn-10 FREE timeout is a driver-side reply-matching TIMING RACE, not
a content bug. seqNum-poison experiment PROVED the driver's rxSeqNum
matches our stat_seq exactly ('Expected 75 got 175'); checksum folds to
0; function=10; writePtr/readPtr land; driver drains 1:1. A 2ms udelay
before fn-10/47 replies eliminates timeouts in most runs (matches real
GSP-RM's natural reply latency). Removed the seqNum-poison diagnostic
(served its purpose) and fn10 wire-bytes debug dumps. Race is not 100%
eliminated - intermittently recurs during unload/cleanup cycles.

1 files changed, 0 insertions, 36 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index 18bc2d7..d1f17cb 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -259,22 +259,6 @@ static int gsp_rm_send(struct gsp_emu_context *ctx, u32 function,
 		return -EOVERFLOW;
 	}
 
-	/* EXPERIMENT: poison every 17th fn-10 reply's seqNum (and recompute
-	 * the checksum so it stays valid) to elicit the driver's
-	 * "Bad sequence number. Expected X got Y" log - reveals the driver's
-	 * rxSeqNum expectation vs our stat_seq. */
-	if (function == 10) {
-		u32 bad = rm->stat_seq + 100;
-		u32 msg_len = GSPRM_ELEM_HDR_SIZE + sizeof(struct gsprm_rpc_header) + data_len;
-		u32 aligned = (msg_len + 7) & ~7U;
-
-		memcpy(buf + 0x24, &bad, 4);
-		*(u32 *)(buf + 0x20) = 0;
-		*(u32 *)(buf + 0x20) = gsp_rm_checksum32(buf, aligned);
-		nv_vgpu_warn(ctx->vgpu, "GSPRM: poisoned fn10 wire seq -> %u (stat_seq=%u)",
-			     bad, rm->stat_seq + 1);
-	}
-
 	/* Check we don't overflow the status queue */
 	if (elem_count > rm->stat_msgcount) {
 		nv_vgpu_err(ctx->vgpu, "GSPRM: record too large: %u elements > queue %u",
@@ -341,26 +325,6 @@ static int gsp_rm_send(struct gsp_emu_context *ctx, u32 function,
 	 * drain while a poller waits for it (same as real GSP-RM). */
 	gsp_emu_inject_completion_interrupt(ctx, rm->stat_seq);
 
-	/* DEBUG: read back a fn-10 reply record and verify the wire bytes */
-	if (function == 10) {
-		u8 dbg[0x50];
-		u32 slot = (rm->stat_write + rm->stat_msgcount - 1) %
-			   rm->stat_msgcount;
-		u64 off = rm->stat_off + rm->entry_off +
-			  (u64)slot * GSPRM_QUEUE_ELEMENT_SIZE;
-		u32 wp = 0;
-
-		if (!gsp_rm_read_buf(ctx, off, dbg, sizeof(dbg)))
-			print_hex_dump(KERN_INFO, "GSPRM fn10 reply: ",
-				       DUMP_PREFIX_OFFSET, 16, 8, dbg,
-				       sizeof(dbg), false);
-
-		/* confirm our writePtr update landed at stat_off+0x10 */
-		gsp_rm_read_buf(ctx, rm->stat_off + 0x10, &wp, sizeof(wp));
-		nv_vgpu_info(ctx->vgpu, "GSPRM fn10: stat_write=%u hdr_writePtr=0x%x drv_rp_cmd=0x%x",
-			     rm->stat_write, wp, 0);
-	}
-
 	return 0;
 }