vgsp: mode 33 - wired golden sibling A as execution channel (compile-verified, untested)m33

2 files changed, 205 insertions, 29 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index dc8e961..3069fbe 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -666,6 +666,23 @@ bool gsp_phys_boot_requested(void)
  */
 #define GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT	31u
 /*
+ * Mode 33 (2026-10-06): mode 31 with the TSG-parented sibling A upgraded to a
+ * fully-wired, object-carrying execution channel. D still runs the
+ * device-parented golden first-init (alloc 0xcaf00054 -> 9-entry promote,
+ * skip_fecs=false -> TURING_A 0xcaf00058), which initializes the golden
+ * image; V6 is allocated and constructed exactly as mode 31 (commit-carrier
+ * relationship). A is then allocated with the mode-29 wired execution shape
+ * (golden_exec_shape bits 0/1/2/3/4/6/7 - every field the replay's exec-shape
+ * branch applies except bit5, which only selects D's TURING_A skip) while
+ * keeping its own GOLDEN9_SIBLING_A flags and FBMEM instance/RAMFC/mthd
+ * memdescs, runs the 9-entry promote (skip_fecs=true), and gets a
+ * TURING_COMPUTE_A (0xc5c0) object constructed on it after the accepted
+ * promote. boot_stage.rmcall_channel is then swapped to A, so stage 4
+ * BIND/SCHEDULE/token/GR-sem and every forwarded launch execute on the wired
+ * golden sibling instead of V6. Any failure aborts stage 3 with no retry.
+ */
+#define GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC	33u
+/*
  * Mode-28 golden execution channel shape bits (gsp_phys_rmcall_golden_exec_shape,
  * default 7). Every combination keeps the captured flags 0x00200320 and the
  * FBMEM instance/RAMFC/mthd slices; the bits only choose the client-visible
@@ -779,7 +796,7 @@ bool gsp_phys_boot_requested(void)
  */
 #define GSP_PHYS_RMCALL_FWCLIENT_MASK_FECS_SYSMEM	(1u << 16)
 #define GSP_PHYS_RMCALL_GR_PROMOTE_MAX \
-	(GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT)
+	(GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC)
 
 /*
  * Work-submit token notifier slot. The default index is
@@ -1053,6 +1070,12 @@ bool gsp_phys_boot_requested(void)
  */
 #define GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING	0xcaf00084u
 #define GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING_FB	0xcaf00088u
+/*
+ * Mode 33: the TURING_COMPUTE_A (0xc5c0) class object constructed on the
+ * wired sibling A after its 9-entry promote; the forwarded launch's
+ * SET_OBJECT binds this class in A's execution context.
+ */
+#define GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING_GR_OBJ	0xcaf0008cu
 
 /*
  * Golden-image replay sizes (kernel_graphics.c:2058-2060, 2273-2276): the
@@ -7681,6 +7704,8 @@ static const char *gsp_phys_rmcall_gr_promote_name(void)
 		return "mode 30: clean unwired TSG sibling A (promote + TURING_A first-init) + V6 execution";
 	case GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT:
 		return "mode 31: mode-25 D first-init + TSG sibling A 9-entry promote after V6 (explicit TSG commit) + V6 execution";
+	case GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC:
+		return "mode 33: mode 31 with the TSG sibling A wired as the object-carrying execution channel (ring/sysmem USERD/TSG parent, TURING_COMPUTE_A on A, execution swap to A)";
 	default:
 		return "off (PROMOTE_CTX never sent)";
 	}
@@ -7871,7 +7896,9 @@ static int gsp_phys_rmcall_alloc_channel(void __iomem *bar0)
 	     boot_stage.rmcall_gr_promote ==
 			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING ||
 	     boot_stage.rmcall_gr_promote ==
-			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT)) {
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT ||
+	     boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC)) {
 		vars = &gsp_phys_rmcall_channel_variant_skipctx;
 		attempts = 1;
 	}
@@ -8334,7 +8361,9 @@ static int gsp_phys_rmcall_golden_replay(void __iomem *bar0)
 	     boot_stage.rmcall_gr_promote ==
 			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING ||
 	     boot_stage.rmcall_gr_promote ==
-			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT) &&
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT ||
+	     boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) &&
 	    gsp_phys_rmcall_engine_is_gr()) {
 		if (gsp_phys_rmcall_fwclient_mask_value() &
 		    GSP_PHYS_RMCALL_GOLDEN9_MASK_LADDER_VAS) {
@@ -8446,7 +8475,9 @@ static int gsp_phys_rmcall_golden_replay(void __iomem *bar0)
 	     boot_stage.rmcall_gr_promote ==
 			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING ||
 	     boot_stage.rmcall_gr_promote ==
-			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT) &&
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT ||
+	     boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) &&
 	    gsp_phys_rmcall_engine_is_gr()) {
 		ch.flags = cpu_to_le32(GSP_PHYS_RMCALL_CHANNEL_FLAG_GOLDEN9);
 		ch.internal_flags = cpu_to_le32(
@@ -8652,7 +8683,9 @@ static int gsp_phys_rmcall_golden_replay(void __iomem *bar0)
 	     boot_stage.rmcall_gr_promote ==
 			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING ||
 	     boot_stage.rmcall_gr_promote ==
-			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT) &&
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT ||
+	     boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) &&
 	    gsp_phys_rmcall_engine_is_gr()) {
 		ret = gsp_phys_rmcall_golden9_promote(bar0);
 		if (ret)
@@ -9571,7 +9604,9 @@ static int gsp_phys_rmcall_gr_ctx_prepare(void __iomem *bar0)
 	    boot_stage.rmcall_gr_promote ==
 			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN9 ||
 	    boot_stage.rmcall_gr_promote ==
-			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT) {
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT ||
+	    boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) {
 		u64 fb_base = 0;
 
 		ret = gsp_phys_rmcall_alloc_fb_mem(bar0,
@@ -9631,7 +9666,9 @@ static int gsp_phys_rmcall_gr_ctx_prepare(void __iomem *bar0)
 	if (boot_stage.rmcall_gr_promote ==
 			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN9 ||
 	    boot_stage.rmcall_gr_promote ==
-			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT) {
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT ||
+	    boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) {
 		ret = gsp_phys_rmcall_golden9_fb_aux_prepare(bar0);
 		if (ret) {
 			pr_err("vgsp-boot: rm-call: GOLDEN9E FBMEM aux prepare failed (%d); aborting the ladder with no retry\n",
@@ -10043,11 +10080,19 @@ static int gsp_phys_rmcall_golden9_promote(void __iomem *bar0)
  * (fifo_gv100.c:1480-1494) commits V6's instance pointer + RAMFC while V6's
  * own promote is suppressed. Two 9-entry promotes total (D and A); V6 gets
  * none.
+ *
+ * Mode 33: the same sibling A, but allocated with the mode-29 wired execution
+ * shape (golden_exec_shape fields; A keeps its own GOLDEN9_SIBLING_A flags and
+ * FBMEM instance/RAMFC/mthd memdescs), and after the accepted promote a
+ * TURING_COMPUTE_A (0xc5c0) class object is constructed on A. The caller then
+ * swaps boot_stage.rmcall_channel to A, so stage 4 and the forwarded launches
+ * execute on A. Any failure aborts stage 3 with no retry.
  */
 static int gsp_phys_rmcall_golden_sibling_alloc(void __iomem *bar0)
 {
 	struct gsp_phys_rmcall_channel_params ch;
 	u32 rpc = 0, status = 0;
+	u32 ch_parent = boot_stage.rmcall_tsg;
 	u64 fb = 0;
 	int ret;
 
@@ -10068,20 +10113,112 @@ static int gsp_phys_rmcall_golden_sibling_alloc(void __iomem *bar0)
 	ch.userd_mem = gsp_phys_rmcall_mem_desc_fb(fb + 0x1000, 0x200);
 	ch.ramfc_mem = gsp_phys_rmcall_mem_desc_fb(fb + 0x2000, 0x1000);
 	ch.mthdbuf_mem = gsp_phys_rmcall_mem_desc_fb(fb + 0x3000, 0x1000);
+	/*
+	 * Mode 33: upgrade A from the unwired mode-31 commit carrier to the
+	 * mode-29 wired execution shape. The golden_exec_shape machinery is
+	 * reused field-for-field (RING -> gpFifoOffset at VA_GPFIFO, ENTRIES8
+	 * -> the shared ring's 8-entry size, USERD_SYSMEM -> the ladder sysmem
+	 * USERD chunk, optional USERD_SIZE200, HOBJ_VAS, TSG_PARENT), except
+	 * bit5 which only selects D's TURING_A skip and must not gate A. A's
+	 * captured-shape flags (GOLDEN9_SIBLING_A, USERD_INDEX_VALUE=4) and
+	 * FBMEM instance/RAMFC/mthd slices stay untouched; the shape bits only
+	 * wire the client submission path. The activation recipe passes
+	 * gsp_phys_rmcall_golden_exec_shape=0xE7 (bit7 = host USERD control
+	 * offset 0, the m14 fetch requirement).
+	 */
+	if (boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) {
+		u32 exec_shape = gsp_phys_rmcall_golden_exec_shape_value();
+
+		if (exec_shape & GSP_PHYS_RMCALL_GOLDEN_EXEC_SHAPE_RING)
+			ch.gp_fifo_offset =
+				cpu_to_le64(GSP_PHYS_RMCALL_VA_GPFIFO);
+		if (exec_shape & GSP_PHYS_RMCALL_GOLDEN_EXEC_SHAPE_ENTRIES8)
+			ch.gp_fifo_entries = cpu_to_le32(
+				GSP_PHYS_RMCALL_GPFIFO_ENTRIES);
+		if (exec_shape &
+		    GSP_PHYS_RMCALL_GOLDEN_EXEC_SHAPE_USERD_SYSMEM) {
+			struct gsp_phys_rmcall_mem_desc ud =
+				gsp_phys_rmcall_mem_desc(
+					GSP_PHYS_RMCALL_BUF_USERD);
+
+			if (exec_shape &
+			    GSP_PHYS_RMCALL_GOLDEN_EXEC_SHAPE_USERD_SIZE200)
+				ud.size = cpu_to_le64(0x200);
+			ch.userd_mem = ud;
+		}
+		if (exec_shape &
+		    GSP_PHYS_RMCALL_GOLDEN_EXEC_SHAPE_HOBJ_VAS)
+			ch.h_object_buffer =
+				cpu_to_le32(boot_stage.rmcall_vas);
+		if (exec_shape &
+		    GSP_PHYS_RMCALL_GOLDEN_EXEC_SHAPE_TSG_PARENT) {
+			ch_parent = boot_stage.rmcall_tsg;
+			ch.h_va_space = cpu_to_le32(0);
+		}
+	}
 	ret = gsp_phys_rmcall_alloc(bar0, boot_stage.rmcall_client,
-			boot_stage.rmcall_tsg,
+			ch_parent,
 			GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING,
 			GSP_PHYS_RMCALL_CLASS_CHANNEL, &ch, sizeof(ch),
 			false, NULL,
-			"mode 31 GOLDEN SIBLING A (TSG commit carrier)",
+			(boot_stage.rmcall_gr_promote ==
+				GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) ?
+				"mode 33 GOLDEN SIBLING A (wired execution carrier)" :
+				"mode 31 GOLDEN SIBLING A (TSG commit carrier)",
 			true, &rpc, &status);
 	if (ret)
 		return ret;
+	if (boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC)
+		pr_info("vgsp-boot: rm-call: mode 33 GOLDEN SIBLING A wired shape: shape=0x%x gpFifoOffset=0x%llx gpFifoEntries=%u userd=%s size=0x%llx hObjectBuffer=0x%x hParent=%s hVASpace=0x%x; flags=0x%x instance/ramfc/mthd stay FBMEM\n",
+			gsp_phys_rmcall_golden_exec_shape_value(),
+			le64_to_cpu(ch.gp_fifo_offset),
+			le32_to_cpu(ch.gp_fifo_entries),
+			(ch.userd_mem.address_space ==
+			 cpu_to_le32(GSP_PHYS_RMCALL_ADDR_SYSMEM)) ?
+				"sysmem" : "FBMEM",
+			le64_to_cpu(ch.userd_mem.size),
+			le32_to_cpu(ch.h_object_buffer),
+			ch_parent == boot_stage.rmcall_tsg ?
+				"ladder-TSG" : "device",
+			le32_to_cpu(ch.h_va_space),
+			GSP_PHYS_RMCALL_CHANNEL_FLAG_GOLDEN9_SIBLING_A);
 	gsp_phys_rmcall_ctx_diag_decode("post-V6-constructs pre-A-commit");
 	ret = gsp_phys_rmcall_golden9_promote_on(bar0,
 			GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING, true);
 	if (ret)
 		return ret;
+	/*
+	 * Mode 33: with the promote accepted, construct the TURING_COMPUTE_A
+	 * (0xc5c0) class object on A. The forwarded launch's SET_OBJECT binds
+	 * class 0xc5c0 in the execution channel's context, so the object must
+	 * be a child of A (V6's object 0xcaf0002c belongs to V6's context and
+	 * stays there for the mode-31 commit-carrier relationship). The
+	 * construct runs after the accepted promote by design: every construct
+	 * before/after the promote on the D golden channel deadlocked RM
+	 * (m3a-m3g, m15 -110); this is the first construct on the post-promote
+	 * wired sibling. A failure aborts stage 3 with no retry, exactly like
+	 * a failed promote.
+	 */
+	if (boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) {
+		pr_info("vgsp-boot: rm-call: mode 33: TURING_COMPUTE_A on sibling A\n");
+		ret = gsp_phys_rmcall_alloc_gr_object_class(bar0,
+				GSP_PHYS_RMCALL_CLASS_COMPUTE,
+				GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING_GR_OBJ,
+				GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING,
+				"TURING_COMPUTE_A on sibling A (mode 33)",
+				&rpc, &status);
+		if (ret) {
+			pr_err("vgsp-boot: rm-call: mode 33: TURING_COMPUTE_A on sibling A (0xc5c0, hObject=0x%x) failed (status=0x%x rpc_result=0x%x ret=%d); A has no class object and the ladder aborts with no retry\n",
+				GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING_GR_OBJ,
+				status, rpc, ret);
+			return ret;
+		}
+		boot_stage.rmcall_gr_object =
+			GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING_GR_OBJ;
+	}
 	gsp_phys_rmcall_ctx_diag_dump("INSTANCE (post-A-commit pre-BIND)",
 		&boot_stage.rmcall_chunks[GSP_PHYS_RMCALL_BUF_INSTANCE]);
 	gsp_phys_rmcall_ctx_diag_dump("RAMFC (post-A-commit pre-BIND)",
@@ -10276,14 +10413,15 @@ static int gsp_phys_rmcall_gr_ctx_promote(void __iomem *bar0)
 	     mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_EXEC ||
 	     mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_EXEC_LAST ||
 	     mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING ||
-	     mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT) &&
+	     mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT ||
+	     mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) &&
 	    (!gsp_phys_rmcall_golden_enabled() || !gsp_phys_gpu_enabled())) {
 		pr_err("vgsp-boot: rm-call: mode %u requires gsp_phys_rmcall_golden=1 and gsp_phys_gpu=1 (the golden replay did not run); no PROMOTE_CTX is sent and the ladder aborts with no retry\n",
 		       mode);
 		return -EINVAL;
 	}
 	/*
-	 * Mode 30/31: the sibling A's 9-entry promote carries the group
+	 * Mode 30/31/33: the sibling A's 9-entry promote carries the group
 	 * context commit; nothing is sent on the V6 channel. A multi-entry
 	 * promote containing MAIN is refused for a SKIP-ctx channel
 	 * (graphics_context.c: bKMDVirtualContext -> NV_ERR_INVALID_ARGUMENT)
@@ -10291,11 +10429,16 @@ static int gsp_phys_rmcall_gr_ctx_promote(void __iomem *bar0)
 	 * shapes never establish, so a V6 promote would abort stage 3 on 0x1f.
 	 */
 	if (mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING ||
-	    mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT) {
+	    mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT ||
+	    mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) {
 		if (mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING)
 			pr_info("vgsp-boot: rm-call: mode 30: no PROMOTE_CTX on V6; the sibling A carries the group context commit (config_group ppEngCtxDesc), V6 inherits via the TSG commit/channel setup\n");
-		else
+		else if (mode == GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT)
 			pr_info("vgsp-boot: rm-call: mode 31: no PROMOTE_CTX on V6; sibling A's 9-entry promote ran after V6's alloc and the TSG loop (fifo_gv100.c:1480-1494) already committed V6\n");
+		else
+			pr_info("vgsp-boot: rm-call: mode 33: no PROMOTE_CTX on V6; wired sibling A's 9-entry promote ran (TSG commit) and A carries both the class object and the execution (hChannel=0x%x, hGr=0x%x)\n",
+				GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING,
+				GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING_GR_OBJ);
 		boot_stage.rmcall_gr_promote_step = 1;
 		return 0;
 	}
@@ -12133,7 +12276,9 @@ static int gsp_phys_rmcall_stage3(void __iomem *bar0)
 			     boot_stage.rmcall_gr_promote ==
 					GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING ||
 			     boot_stage.rmcall_gr_promote ==
-					GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT) &&
+					GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT ||
+			     boot_stage.rmcall_gr_promote ==
+					GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) &&
 			    gsp_phys_rmcall_engine_is_gr()) {
 				pr_err("vgsp-boot: rm-call: stage 3 aborted: mode-%u golden replay failed (%d); the golden construct is atomic and is not retried\n",
 				       boot_stage.rmcall_gr_promote, ret);
@@ -12178,9 +12323,9 @@ static int gsp_phys_rmcall_stage3(void __iomem *bar0)
 		return ret;
 
 	/*
-	 * Mode 30/31 readback point 1: V6's instance/RAMFC right after the
+	 * Mode 30/31/33 readback point 1: V6's instance/RAMFC right after the
 	 * channel alloc (mode 30: A's replay contains the 9-entry promote and
-	 * A's TURING_A first-init by now; mode 31: D's replay ran and the
+	 * A's TURING_A first-init by now; modes 31/33: D's replay ran and the
 	 * sibling A commit plus V6's constructs are still ahead), so the
 	 * commit effect can be separated from the later BIND/GPFIFO_SCHEDULE.
 	 * The decode line prints the decisive fields (instance WFI pointer
@@ -12190,7 +12335,9 @@ static int gsp_phys_rmcall_stage3(void __iomem *bar0)
 	    (boot_stage.rmcall_gr_promote ==
 			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING ||
 	     boot_stage.rmcall_gr_promote ==
-			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT)) {
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT ||
+	     boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC)) {
 		gsp_phys_rmcall_ctx_diag_dump(
 			"INSTANCE (post-V6-alloc pre-A-commit)",
 			&boot_stage.rmcall_chunks[GSP_PHYS_RMCALL_BUF_INSTANCE]);
@@ -12268,24 +12415,45 @@ static int gsp_phys_rmcall_stage3(void __iomem *bar0)
 			return -EOPNOTSUPP;
 		}
 		/*
-		 * Mode 31: allocate the TSG-parented sibling A and run its
+		 * Mode 31/33: allocate the TSG-parented sibling A and run its
 		 * 9-entry promote here, after V6's own constructs, so the
 		 * server's TSG-wide commit walk sees V6 in its group; V6's
 		 * own promote is suppressed in gsp_phys_rmcall_gr_ctx_promote.
+		 * Mode 33 allocates A with the wired execution shape, gets a
+		 * TURING_COMPUTE_A object on A after the accepted promote and
+		 * then swaps boot_stage.rmcall_channel to A, so stage 4
+		 * BIND/SCHEDULE/token/GR-sem and every forwarded launch run on
+		 * A instead of V6 (the mode-28/29 swap shape, applied here so
+		 * V6's own constructs keep running on V6 first).
 		 */
 		if (boot_stage.rmcall_gr_promote ==
-				GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT) {
+				GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_COMMIT ||
+		    boot_stage.rmcall_gr_promote ==
+				GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) {
 			if (!gsp_phys_rmcall_golden_enabled() ||
 			    !gsp_phys_gpu_enabled()) {
-				pr_err("vgsp-boot: rm-call: mode 31 requires gsp_phys_rmcall_golden=1 and gsp_phys_gpu=1 (the golden replay did not run); sibling A is not allocated and no promote is sent; the ladder aborts with no retry\n");
+				pr_err("vgsp-boot: rm-call: mode %u requires gsp_phys_rmcall_golden=1 and gsp_phys_gpu=1 (the golden replay did not run); sibling A is not allocated and no promote is sent; the ladder aborts with no retry\n",
+				       boot_stage.rmcall_gr_promote);
 				return -EINVAL;
 			}
 			ret = gsp_phys_rmcall_golden_sibling_alloc(bar0);
 			if (ret) {
-				pr_err("vgsp-boot: rm-call: mode 31 sibling A commit failed (%d); no V6 promote follows; the ladder aborts with no retry\n",
-				       ret);
+				pr_err("vgsp-boot: rm-call: mode %u sibling A commit failed (%d); no V6 promote follows; the ladder aborts with no retry\n",
+				       boot_stage.rmcall_gr_promote, ret);
 				return ret;
 			}
+			if (boot_stage.rmcall_gr_promote ==
+					GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) {
+				pr_info("vgsp-boot: rm-call: mode 33: execution channel switched from V6 0x%x to wired golden sibling A 0x%x (client ring gpFifoVa=0x%llx sysmem USERD shape=0x%x, TSG-parented, TURING_COMPUTE_A 0x%x on A); the V6 channel stays unscheduled\n",
+					boot_stage.rmcall_channel,
+					GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING,
+					GSP_PHYS_RMCALL_VA_GPFIFO,
+					gsp_phys_rmcall_golden_exec_shape_value(),
+					GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING_GR_OBJ);
+				boot_stage.rmcall_channel =
+					GSP_PHYS_RMCALL_HANDLE_GOLDEN_SIBLING;
+				boot_stage.rmcall_channel_server_mem = false;
+			}
 		}
 		ret = gsp_phys_rmcall_gr_ctx_promote(bar0);
 		if (ret) {
@@ -12484,17 +12652,25 @@ struct gsp_phys_rmcall_ce_submit {
  * 0x8c/0x88 of the chunk. Mode 28 keeps the captured golden channel flags
  * (USERD_INDEX_VALUE=3 within a fixed USERD page), so the hardware control
  * block sits at userd+0x600 and every host USERD touch must use the same
- * offset or host and hardware would poll different words.
+ * offset or host and hardware would poll different words. Mode 29 (shape
+ * bit7) and mode 33's wired sibling A write the host control block at
+ * offset 0: m14 proved the server applies the sysmem userd_mem base
+ * directly and ignores the captured USERD_INDEX_VALUE, and the PBDMA
+ * consumed the entry at +0x0 (GP_GET advanced) while +0x600 stayed dead.
  */
 static u32 gsp_phys_rmcall_userd_ctl_off(void)
 {
 	if ((boot_stage.rmcall_gr_promote ==
 			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_EXEC ||
 	     boot_stage.rmcall_gr_promote ==
-			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_EXEC_LAST) &&
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_EXEC_LAST ||
+	     boot_stage.rmcall_gr_promote ==
+			GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) &&
 	    gsp_phys_rmcall_engine_is_gr()) {
-		if (boot_stage.rmcall_gr_promote ==
-				GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_EXEC_LAST &&
+		if ((boot_stage.rmcall_gr_promote ==
+				GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_EXEC_LAST ||
+		     boot_stage.rmcall_gr_promote ==
+				GSP_PHYS_RMCALL_GR_PROMOTE_GOLDEN_SIBLING_EXEC) &&
 		    (gsp_phys_rmcall_golden_exec_shape_value() &
 		     GSP_PHYS_RMCALL_GOLDEN_EXEC_SHAPE_USERD_INDEX0))
 			return 0;
diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index 5ec97e2..528caeb 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -551,8 +551,8 @@ static int gsp_phys_rmcall_gr_promote_set(const char *val,
 		return ret;
 
 	if (gsp_phys_rmcall_gr_promote_param < 0 ||
-	    gsp_phys_rmcall_gr_promote_param > 31) {
-		pr_warn("vgsp: gsp_phys_rmcall_gr_promote=%d is outside 0..31; clamping to 0 (no PROMOTE_CTX)\n",
+	    gsp_phys_rmcall_gr_promote_param > 33) {
+		pr_warn("vgsp: gsp_phys_rmcall_gr_promote=%d is outside 0..33; clamping to 0 (no PROMOTE_CTX)\n",
 			gsp_phys_rmcall_gr_promote_param);
 		gsp_phys_rmcall_gr_promote_param = 0;
 	}
@@ -571,7 +571,7 @@ module_param_cb(gsp_phys_rmcall_gr_promote,
 		&gsp_phys_rmcall_gr_promote_ops,
 		&gsp_phys_rmcall_gr_promote_param, 0644);
 MODULE_PARM_DESC(gsp_phys_rmcall_gr_promote,
-		 "GR context-promote bisection (default 0: never send PROMOTE_CTX; 1: single entry init+nonmapped=0 size=raw+subctx, the p6h1b shape; 2: two-phase PA-only nonmapped then VA-only with the same fields; 3: single entry size=raw; 4: two-phase with a zero-field VA-only step; 5: batched entryCount=2 PA-only init + zero-field VA-only; 6: no-entry hVirtMemory, NV01_MEMORY_VIRTUAL (class 0x70) on the VAS at the context window + PROMOTE_CTX entryCount=0; 7: no-entry bare virtAddress+size, entryCount=0; 8: single MAIN entry like 1 on the KMD-managed channel (V6 SKIP_CTXBUFFER_ALLOC), server creates the virtual context memdesc itself; 9: same V6 channel with the stock client's zero-field VA-only MAIN entry, bInitialize=0; 10: same V6 channel, GPU_INITIALIZE_CTX (0x2080012d) installs the physical context memdesc then PROMOTE_CTX entryCount=0 bare virtAddress+size; 11: mode 10 with a server FBMEM context buffer, VIDMEM physAttr 0x4; 12: V5 UVM/vGPU-faithful PA-only MAIN entry (bInitialize=1 bNonmapped=1, no VA) and continue to BIND/SCHEDULE/submit; 13: mode 12 plus a PATCH PA-only promote first, sized from GET_ENGINE_CONTEXT_PROPERTIES engineId 0x10; 14: KMD channel (V6) + PATCH PA-only then the single-entry MAIN init+VA (the flow that books the context VA and commits ENG_CTX_VALID); 15: mode 14 with a server FBMEM MAIN context buffer and VIDMEM physAttr 0x4; 16: mode 14 plus a PM ctxsw PA-only promote first; 17: no client PROMOTE_CTX, paired with gsp_phys_srv_ctxbuf=1 so the GSP-RM server-manages and commits the context; 18: mode 8 shape plus a client FERMI_CONTEXT_SHARE_A on the TSG (hContextShare) whose construct allocates the GraphicsSubcontext; 19: the stock guest's exact 9-entry promote set (MAIN 2 MB PA+VA, PATCH, global buffers, FECS event, private access maps) on V5; 20: mode 6's no-entry hVirtMemory promote on the KMD-managed V6 channel (SKIP_CTXBUFFER_ALLOC), untested - the combination the V5 refusal (0x1f) points at; 21: mode 7's no-entry bare (virtAddress, size) promote on the V6 KMD-managed channel; 22: GPU_INITIALIZE_CTX then mode 20's no-entry hVirtMemory promote; 23: the hVirtMemory no-entry promote backed by the server-owned FBMEM context object (GSP_RM_ALLOC class 0x40) on the server-managed shared V5 channel - a physical memdesc reaches the per-buffer commit without the ADDR_VIRTUAL vaList gate; 24: the reference FWCLIENT non-3D set {MAIN, PM, PATCH, FECS_EVENT, PRIV_ACCESS_MAP, UNRESTRICTED_PRIV_ACCESS_MAP} as one control on the V6 KMD-managed channel, combined PA+VA entries where the ladder has a VA (MAIN PDB-mapped; PATCH/FECS/UNRESTRICTED booking-only), PM and PRIV_ACCESS_MAP init-only (no VA source), unsourceable buffers omitted and logged); 25: the real golden-client construct on the golden replay handles (captured channel flags 0x00200320 + single atomic 9-entry PROMOTE_CTX on the golden channel), then the V6 FWCLIENT follow-on promote on the golden-initialized GR-instance state; requires gsp_phys_rmcall_golden=1 and gsp_phys_rmcall_engine=1; 26/27: golden9 promote on the V6 execution channel (dead ends); 28: the golden execution lane - the golden channel gets a client GPFIFO ring (VA_GPFIFO), a sysmem host-writable USERD and the ladder TSG as parent, keeps the 9-entry promote, and the ladder switches execution to it (V6 stays unscheduled); 29: mode 28 minus the TURING_COMPUTE_A (0xc5c0) object construct on the client-wired golden channel (every GR object construct there deadlocks RM), i.e. the construct-last golden execution lane; 30: the TSG-sibling split: a clean unwired golden sibling A (captured shape, TSG-parented) runs the 9-entry promote and its own TURING_A first-init while V6 stays the execution channel (no swap) with its FWCLIENT promote suppressed; 31: mode-25's device-parented golden first-init (9-entry promote + TURING_A) followed by a clean TSG-parented sibling A whose 9-entry promote runs after V6's own constructs, so the TSG-wide server commit sets V6's instance pointer + RAMFC while V6 stays the execution channel and its own promote is suppressed; values outside 0..31 clamp to 0 with a warning");
+		 "GR context-promote bisection (default 0: never send PROMOTE_CTX; 1: single entry init+nonmapped=0 size=raw+subctx, the p6h1b shape; 2: two-phase PA-only nonmapped then VA-only with the same fields; 3: single entry size=raw; 4: two-phase with a zero-field VA-only step; 5: batched entryCount=2 PA-only init + zero-field VA-only; 6: no-entry hVirtMemory, NV01_MEMORY_VIRTUAL (class 0x70) on the VAS at the context window + PROMOTE_CTX entryCount=0; 7: no-entry bare virtAddress+size, entryCount=0; 8: single MAIN entry like 1 on the KMD-managed channel (V6 SKIP_CTXBUFFER_ALLOC), server creates the virtual context memdesc itself; 9: same V6 channel with the stock client's zero-field VA-only MAIN entry, bInitialize=0; 10: same V6 channel, GPU_INITIALIZE_CTX (0x2080012d) installs the physical context memdesc then PROMOTE_CTX entryCount=0 bare virtAddress+size; 11: mode 10 with a server FBMEM context buffer, VIDMEM physAttr 0x4; 12: V5 UVM/vGPU-faithful PA-only MAIN entry (bInitialize=1 bNonmapped=1, no VA) and continue to BIND/SCHEDULE/submit; 13: mode 12 plus a PATCH PA-only promote first, sized from GET_ENGINE_CONTEXT_PROPERTIES engineId 0x10; 14: KMD channel (V6) + PATCH PA-only then the single-entry MAIN init+VA (the flow that books the context VA and commits ENG_CTX_VALID); 15: mode 14 with a server FBMEM MAIN context buffer and VIDMEM physAttr 0x4; 16: mode 14 plus a PM ctxsw PA-only promote first; 17: no client PROMOTE_CTX, paired with gsp_phys_srv_ctxbuf=1 so the GSP-RM server-manages and commits the context; 18: mode 8 shape plus a client FERMI_CONTEXT_SHARE_A on the TSG (hContextShare) whose construct allocates the GraphicsSubcontext; 19: the stock guest's exact 9-entry promote set (MAIN 2 MB PA+VA, PATCH, global buffers, FECS event, private access maps) on V5; 20: mode 6's no-entry hVirtMemory promote on the KMD-managed V6 channel (SKIP_CTXBUFFER_ALLOC), untested - the combination the V5 refusal (0x1f) points at; 21: mode 7's no-entry bare (virtAddress, size) promote on the V6 KMD-managed channel; 22: GPU_INITIALIZE_CTX then mode 20's no-entry hVirtMemory promote; 23: the hVirtMemory no-entry promote backed by the server-owned FBMEM context object (GSP_RM_ALLOC class 0x40) on the server-managed shared V5 channel - a physical memdesc reaches the per-buffer commit without the ADDR_VIRTUAL vaList gate; 24: the reference FWCLIENT non-3D set {MAIN, PM, PATCH, FECS_EVENT, PRIV_ACCESS_MAP, UNRESTRICTED_PRIV_ACCESS_MAP} as one control on the V6 KMD-managed channel, combined PA+VA entries where the ladder has a VA (MAIN PDB-mapped; PATCH/FECS/UNRESTRICTED booking-only), PM and PRIV_ACCESS_MAP init-only (no VA source), unsourceable buffers omitted and logged); 25: the real golden-client construct on the golden replay handles (captured channel flags 0x00200320 + single atomic 9-entry PROMOTE_CTX on the golden channel), then the V6 FWCLIENT follow-on promote on the golden-initialized GR-instance state; requires gsp_phys_rmcall_golden=1 and gsp_phys_rmcall_engine=1; 26/27: golden9 promote on the V6 execution channel (dead ends); 28: the golden execution lane - the golden channel gets a client GPFIFO ring (VA_GPFIFO), a sysmem host-writable USERD and the ladder TSG as parent, keeps the 9-entry promote, and the ladder switches execution to it (V6 stays unscheduled); 29: mode 28 minus the TURING_COMPUTE_A (0xc5c0) object construct on the client-wired golden channel (every GR object construct there deadlocks RM), i.e. the construct-last golden execution lane; 30: the TSG-sibling split: a clean unwired golden sibling A (captured shape, TSG-parented) runs the 9-entry promote and its own TURING_A first-init while V6 stays the execution channel (no swap) with its FWCLIENT promote suppressed; 31: mode-25's device-parented golden first-init (9-entry promote + TURING_A) followed by a clean TSG-parented sibling A whose 9-entry promote runs after V6's own constructs, so the TSG-wide server commit sets V6's instance pointer + RAMFC while V6 stays the execution channel and its own promote is suppressed; 33: mode 31 with the TSG sibling A wired as the object-carrying execution channel (mode-29 golden_exec_shape wiring: ring at VA_GPFIFO, 8 GPFIFO entries, ladder sysmem USERD, TSG parent, host USERD control offset 0 via shape bit7), A's 9-entry promote (skip_fecs), a TURING_COMPUTE_A (0xc5c0) object constructed on A after the accepted promote, and boot_stage.rmcall_channel swapped to A for stage 4 and all forwarded launches; requires gsp_phys_rmcall_golden=1, gsp_phys_gpu=1 and gsp_phys_rmcall_golden_exec_shape=0xE7; values outside 0..33 clamp to 0 with a warning");
 
 int gsp_phys_rmcall_gr_promote_value(void)
 {