vgsp: GR promote mode 23 (hVirtMemory FBMEM server-managed commit shape)

The hVirtMemory no-entry promote backed by the server-owned FBMEM context object (GSP_RM_ALLOC class 0x40) on the server-managed shared V5 channel. A physical memdesc bypasses the server-booked engine-ctx vaList and hands the memdesc straight to the per-buffer commit 0x5b00d2c, the one remaining promote shape on the stable shared+srvctx path. Runs grv23/grv23v6 soft-stop at PROMOTE_CTX hVirtMemory status=0x1f before BIND with clean releases.

2 files changed, 42 insertions, 15 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index af91968..c2d4b95 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -472,8 +472,21 @@ bool gsp_phys_boot_requested(void)
  * virtual-memdesc promote.
  */
 #define GSP_PHYS_RMCALL_GR_PROMOTE_KMD_INIT_HVIRT	22u
+/*
+ * Mode 23 (2026-10-05, untested): the hVirtMemory no-entry promote backed by
+ * a server-owned FBMEM context object (GSP_RM_ALLOC class 0x40), on the
+ * server-managed shared V5 channel (gsp_phys_srv_ctxbuf=1). The mode-6 hVirt
+ * branch requires the server-manages byte (set by srvctx=1) and resolves the
+ * hVirtMemory object's memdesc; 0x5b00d2c then commits that memdesc. A
+ * PHYSICAL (FBMEM) memdesc does not enter the ADDR_VIRTUAL vaList gate that
+ * blocks every client VA promote on the server-booked list, so this is the one
+ * promote shape that can reach the per-buffer commit on the stable
+ * shared+srvctx channel. The FBMEM object handle is
+ * GSP_PHYS_RMCALL_HANDLE_CTX_FB (allocated by the ctx-buffer prep step).
+ */
+#define GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT_FB		23u
 #define GSP_PHYS_RMCALL_GR_PROMOTE_MAX \
-	(GSP_PHYS_RMCALL_GR_PROMOTE_KMD_INIT_HVIRT)
+	(GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT_FB)
 
 /*
  * Work-submit token notifier slot. The default index is
@@ -7840,13 +7853,16 @@ static int gsp_phys_rmcall_gr_ctx_prepare(void __iomem *bar0)
 	/*
 	 * Modes 11/15 back the context buffer with a server-owned FBMEM
 	 * allocation (VIDMEM aperture, the shape the KMD promote path
-	 * expects); every other mode keeps the host sysmem chunk. The PT
+	 * expects); mode 23 uses the same FBMEM object as the hVirtMemory
+	 * promote target; every other mode keeps the host sysmem chunk. The PT
 	 * pages are always host sysmem pages behind the sysmem-aperture PD0.
 	 */
 	if (boot_stage.rmcall_gr_promote ==
 			GSP_PHYS_RMCALL_GR_PROMOTE_OLDIFACE_FB ||
 	    boot_stage.rmcall_gr_promote ==
-			GSP_PHYS_RMCALL_GR_PROMOTE_KMD_FB) {
+			GSP_PHYS_RMCALL_GR_PROMOTE_KMD_FB ||
+	    boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT_FB) {
 		u64 fb_base = 0;
 
 		ret = gsp_phys_rmcall_alloc_fb_mem(bar0,
@@ -8397,16 +8413,20 @@ static int gsp_phys_rmcall_gr_ctx_promote(void __iomem *bar0)
 	} else if (mode == GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT ||
 		   mode == GSP_PHYS_RMCALL_GR_PROMOTE_BARE_VA ||
 		   mode == GSP_PHYS_RMCALL_GR_PROMOTE_KMD_HVIRT ||
-		   mode == GSP_PHYS_RMCALL_GR_PROMOTE_KMD_BARE_VA) {
+		   mode == GSP_PHYS_RMCALL_GR_PROMOTE_KMD_BARE_VA ||
+		   mode == GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT_FB) {
 		/*
-		 * Modes 6/7/20: the documented no-entry branches. Modes 6/20
+		 * Modes 6/7/20/23: the documented no-entry branches. Modes 6/20
 		 * first reserve the context window with an NV01_MEMORY_VIRTUAL
 		 * object on the ladder VAS and pass it as hVirtMemory
 		 * (hClient is its owner); mode 7 sends the bare
-		 * (virtAddress, size) pair with no hVirtMemory. entryCount=0
-		 * in all, so the server creates the memdesc/vaList entry
-		 * instead of resolving one of our raw-PTE entries. Mode 20 is
-		 * the same shape as mode 6 but on the V6 KMD-managed channel.
+		 * (virtAddress, size) pair with no hVirtMemory. Mode 23 passes
+		 * the server-owned FBMEM context object (class 0x40) allocated
+		 * by the ctx-buffer prep: a physical memdesc reaches 0x5b00d2c
+		 * without the ADDR_VIRTUAL vaList gate. entryCount=0 in all, so
+		 * the server creates/resolves the memdesc instead of resolving
+		 * one of our raw-PTE entries; mode 20 is the same shape as mode
+		 * 6 but on the V6 KMD-managed channel.
 		 */
 		if (mode == GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT ||
 		    mode == GSP_PHYS_RMCALL_GR_PROMOTE_KMD_HVIRT) {
@@ -8418,6 +8438,10 @@ static int gsp_phys_rmcall_gr_ctx_promote(void __iomem *bar0)
 			p->h_client = cpu_to_le32(boot_stage.rmcall_client);
 			p->h_virt_memory =
 				cpu_to_le32(boot_stage.rmcall_gr_hvirt);
+		} else if (mode == GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT_FB) {
+			p->h_client = cpu_to_le32(boot_stage.rmcall_client);
+			p->h_virt_memory =
+				cpu_to_le32(GSP_PHYS_RMCALL_HANDLE_CTX_FB);
 		}
 		p->virt_address = cpu_to_le64(boot_stage.rmcall_ctx_va);
 		p->size = cpu_to_le64(boot_stage.rmcall_ctx_size);
@@ -8428,12 +8452,14 @@ static int gsp_phys_rmcall_gr_ctx_promote(void __iomem *bar0)
 				p, sizeof(*p), 24, NULL, 0,
 				&rpc_result, &status,
 				(mode == GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT ||
-				 mode == GSP_PHYS_RMCALL_GR_PROMOTE_KMD_HVIRT) ?
+				 mode == GSP_PHYS_RMCALL_GR_PROMOTE_KMD_HVIRT ||
+				 mode == GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT_FB) ?
 				"GPU_PROMOTE_CTX (hVirtMemory)" :
 				"GPU_PROMOTE_CTX (bare VA+size)");
 		pr_info("vgsp-boot: rm-call: PROMOTE_CTX %s: entryCount=0 hVirtMemory=0x%x virtAddress=0x%llx size=0x%x status=0x%x rpc_result=0x%x (hClient=0x%x hObject=0x%x hChanClient=0x%x engineType=0x%x gr_promote_param=%u)\n",
 			(mode == GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT ||
-			 mode == GSP_PHYS_RMCALL_GR_PROMOTE_KMD_HVIRT) ?
+			 mode == GSP_PHYS_RMCALL_GR_PROMOTE_KMD_HVIRT ||
+			 mode == GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT_FB) ?
 				"hVirtMemory" : "bare VA+size",
 			le32_to_cpu(p->h_virt_memory),
 			boot_stage.rmcall_ctx_va, boot_stage.rmcall_ctx_size,
@@ -8443,7 +8469,8 @@ static int gsp_phys_rmcall_gr_ctx_promote(void __iomem *bar0)
 		if (ret) {
 			pr_err("vgsp-boot: rm-call: PROMOTE_CTX %s failed (status=0x%x rpc_result=0x%x, %s, ret=%d); the GR context is not committed and the ladder aborts before BIND with no retry\n",
 			       (mode == GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT ||
-				mode == GSP_PHYS_RMCALL_GR_PROMOTE_KMD_HVIRT) ?
+				mode == GSP_PHYS_RMCALL_GR_PROMOTE_KMD_HVIRT ||
+				mode == GSP_PHYS_RMCALL_GR_PROMOTE_HVIRT_FB) ?
 				"hVirtMemory" : "bare VA+size",
 			       status, rpc_result,
 			       gsp_phys_rmcall_status_str(status), ret);
diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index 1bb6f1d..0366380 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -470,8 +470,8 @@ static int gsp_phys_rmcall_gr_promote_set(const char *val,
 		return ret;
 
 	if (gsp_phys_rmcall_gr_promote_param < 0 ||
-	    gsp_phys_rmcall_gr_promote_param > 22) {
-		pr_warn("vgsp: gsp_phys_rmcall_gr_promote=%d is outside 0..22; clamping to 0 (no PROMOTE_CTX)\n",
+	    gsp_phys_rmcall_gr_promote_param > 23) {
+		pr_warn("vgsp: gsp_phys_rmcall_gr_promote=%d is outside 0..23; clamping to 0 (no PROMOTE_CTX)\n",
 			gsp_phys_rmcall_gr_promote_param);
 		gsp_phys_rmcall_gr_promote_param = 0;
 	}
@@ -490,7 +490,7 @@ module_param_cb(gsp_phys_rmcall_gr_promote,
 		&gsp_phys_rmcall_gr_promote_ops,
 		&gsp_phys_rmcall_gr_promote_param, 0644);
 MODULE_PARM_DESC(gsp_phys_rmcall_gr_promote,
-		 "GR context-promote bisection (default 0: never send PROMOTE_CTX; 1: single entry init+nonmapped=0 size=raw+subctx, the p6h1b shape; 2: two-phase PA-only nonmapped then VA-only with the same fields; 3: single entry size=raw; 4: two-phase with a zero-field VA-only step; 5: batched entryCount=2 PA-only init + zero-field VA-only; 6: no-entry hVirtMemory, NV01_MEMORY_VIRTUAL (class 0x70) on the VAS at the context window + PROMOTE_CTX entryCount=0; 7: no-entry bare virtAddress+size, entryCount=0; 8: single MAIN entry like 1 on the KMD-managed channel (V6 SKIP_CTXBUFFER_ALLOC), server creates the virtual context memdesc itself; 9: same V6 channel with the stock client's zero-field VA-only MAIN entry, bInitialize=0; 10: same V6 channel, GPU_INITIALIZE_CTX (0x2080012d) installs the physical context memdesc then PROMOTE_CTX entryCount=0 bare virtAddress+size; 11: mode 10 with a server FBMEM context buffer, VIDMEM physAttr 0x4; 12: V5 UVM/vGPU-faithful PA-only MAIN entry (bInitialize=1 bNonmapped=1, no VA) and continue to BIND/SCHEDULE/submit; 13: mode 12 plus a PATCH PA-only promote first, sized from GET_ENGINE_CONTEXT_PROPERTIES engineId 0x10; 14: KMD channel (V6) + PATCH PA-only then the single-entry MAIN init+VA (the flow that books the context VA and commits ENG_CTX_VALID); 15: mode 14 with a server FBMEM MAIN context buffer and VIDMEM physAttr 0x4; 16: mode 14 plus a PM ctxsw PA-only promote first; 17: no client PROMOTE_CTX, paired with gsp_phys_srv_ctxbuf=1 so the GSP-RM server-manages and commits the context; 18: mode 8 shape plus a client FERMI_CONTEXT_SHARE_A on the TSG (hContextShare) whose construct allocates the GraphicsSubcontext; 19: the stock guest's exact 9-entry promote set (MAIN 2 MB PA+VA, PATCH, global buffers, FECS event, private access maps) on V5; 20: mode 6's no-entry hVirtMemory promote on the KMD-managed V6 channel (SKIP_CTXBUFFER_ALLOC), untested - the combination the V5 refusal (0x1f) points at); values outside 0..20 clamp to 0 with a warning");
+		 "GR context-promote bisection (default 0: never send PROMOTE_CTX; 1: single entry init+nonmapped=0 size=raw+subctx, the p6h1b shape; 2: two-phase PA-only nonmapped then VA-only with the same fields; 3: single entry size=raw; 4: two-phase with a zero-field VA-only step; 5: batched entryCount=2 PA-only init + zero-field VA-only; 6: no-entry hVirtMemory, NV01_MEMORY_VIRTUAL (class 0x70) on the VAS at the context window + PROMOTE_CTX entryCount=0; 7: no-entry bare virtAddress+size, entryCount=0; 8: single MAIN entry like 1 on the KMD-managed channel (V6 SKIP_CTXBUFFER_ALLOC), server creates the virtual context memdesc itself; 9: same V6 channel with the stock client's zero-field VA-only MAIN entry, bInitialize=0; 10: same V6 channel, GPU_INITIALIZE_CTX (0x2080012d) installs the physical context memdesc then PROMOTE_CTX entryCount=0 bare virtAddress+size; 11: mode 10 with a server FBMEM context buffer, VIDMEM physAttr 0x4; 12: V5 UVM/vGPU-faithful PA-only MAIN entry (bInitialize=1 bNonmapped=1, no VA) and continue to BIND/SCHEDULE/submit; 13: mode 12 plus a PATCH PA-only promote first, sized from GET_ENGINE_CONTEXT_PROPERTIES engineId 0x10; 14: KMD channel (V6) + PATCH PA-only then the single-entry MAIN init+VA (the flow that books the context VA and commits ENG_CTX_VALID); 15: mode 14 with a server FBMEM MAIN context buffer and VIDMEM physAttr 0x4; 16: mode 14 plus a PM ctxsw PA-only promote first; 17: no client PROMOTE_CTX, paired with gsp_phys_srv_ctxbuf=1 so the GSP-RM server-manages and commits the context; 18: mode 8 shape plus a client FERMI_CONTEXT_SHARE_A on the TSG (hContextShare) whose construct allocates the GraphicsSubcontext; 19: the stock guest's exact 9-entry promote set (MAIN 2 MB PA+VA, PATCH, global buffers, FECS event, private access maps) on V5; 20: mode 6's no-entry hVirtMemory promote on the KMD-managed V6 channel (SKIP_CTXBUFFER_ALLOC), untested - the combination the V5 refusal (0x1f) points at; 21: mode 7's no-entry bare (virtAddress, size) promote on the V6 KMD-managed channel; 22: GPU_INITIALIZE_CTX then mode 20's no-entry hVirtMemory promote; 23: the hVirtMemory no-entry promote backed by the server-owned FBMEM context object (GSP_RM_ALLOC class 0x40) on the server-managed shared V5 channel - a physical memdesc reaches the per-buffer commit without the ADDR_VIRTUAL vaList gate); values outside 0..23 clamp to 0 with a warning");
 
 int gsp_phys_rmcall_gr_promote_value(void)
 {