vgsp: m66 - host-readable TSG fault buffers + post-mortem dump

m65 proved the scheduled QMD never writes its release anywhere (module sem
stays 0, guest page stays 5) - the engine dies or is cancelled before
completion. The TSG fault-method buffers (0xa06c010a) are the hardware's
record of why; force them to host sysmem (the captured aperture, param
gsp_phys_rmcall_faultbuf_sys=1) and dump both buffers' first 8 words in the
post-mortem so an engine fault entry (faulting address/engine) is visible.

3 files changed, 45 insertions, 1 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 5aac73c..8d865c3 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -12561,7 +12561,8 @@ static int gsp_phys_rmcall_tsg_fault_buffers(void __iomem *bar0)
 	for (i = 0; i < 2; i++) {
 		u64 fb = 0;
 
-		ret = gsp_phys_rmcall_alloc_fb_mem(bar0, fb_handles[i],
+		ret = gsp_phys_rmcall_faultbuf_sys_value() ? -EOPNOTSUPP :
+			gsp_phys_rmcall_alloc_fb_mem(bar0, fb_handles[i],
 				GSP_PHYS_RMCALL_TSG_FAULT_BUF_SIZE, &fb,
 				"TSG fault buffer");
 		if (!ret) {
@@ -16305,6 +16306,25 @@ gr_page_unmapped:
 						get_unaligned_le32((u8 *)__va(req->rel_hpa) + req->rel_off),
 						get_unaligned_le32((u8 *)__va(req->rel_hpa)),
 						get_unaligned_le32((u8 *)__va(req->rel_hpa) + 4));
+				{
+					struct gsp_phys_boot_chunk *f0 =
+						&boot_stage.rmcall_user_lane_fault[0];
+					struct gsp_phys_boot_chunk *f1 =
+						&boot_stage.rmcall_user_lane_fault[1];
+					const u32 *p0 = f0->pages ?
+						gsp_phys_chunk_page_va(f0, 0) : NULL;
+					const u32 *p1 = f1->pages ?
+						gsp_phys_chunk_page_va(f1, 0) : NULL;
+
+					if (p0)
+						pr_info("vgsp-gr: post-mortem faultbuf0 (sysmem) w0..7 = %08x %08x %08x %08x %08x %08x %08x %08x\n",
+							p0[0], p0[1], p0[2], p0[3],
+							p0[4], p0[5], p0[6], p0[7]);
+					if (p1)
+						pr_info("vgsp-gr: post-mortem faultbuf1 (sysmem) w0..7 = %08x %08x %08x %08x %08x %08x %08x %08x\n",
+							p1[0], p1[1], p1[2], p1[3],
+							p1[4], p1[5], p1[6], p1[7]);
+				}
 				if (bar0)
 					pr_info("vgsp-gr: FE readback raw 0x40a500..0x40a50c = %08x %08x %08x %08x (subctx-1 control at 0x40a504)\n",
 						ioread32(bar0 + 0x0040a500u),
diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index f323c6c..3429507 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -726,6 +726,26 @@ int gsp_phys_rmcall_gr_rel_mod_value(void)
 EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_rel_mod_value);
 
 /*
+ * m66 fault-buffer aperture (gsp_phys_rmcall_faultbuf_sys; default 0). When
+ * set, the mode-35 TSG fault-method buffers are registered host sysmem chunks
+ * (the aperture the capture itself used) instead of server FBMEM, so engine
+ * fault entries written by the hardware after a launch are host-readable and
+ * can be dumped in the post-mortem. Diagnostic only; the promote shape is
+ * otherwise identical.
+ */
+static int gsp_phys_rmcall_faultbuf_sys_param;
+module_param_named(gsp_phys_rmcall_faultbuf_sys,
+		   gsp_phys_rmcall_faultbuf_sys_param, int, 0644);
+MODULE_PARM_DESC(gsp_phys_rmcall_faultbuf_sys,
+		 "Register the mode-35 TSG fault buffers as host sysmem (captured aperture; default 0 = FBMEM first)");
+
+int gsp_phys_rmcall_faultbuf_sys_value(void)
+{
+	return gsp_phys_rmcall_faultbuf_sys_param;
+}
+EXPORT_SYMBOL_GPL(gsp_phys_rmcall_faultbuf_sys_value);
+
+/*
  * Ladder VAS ownership selector (gsp_phys_rmcall_vas_shared; default 0).
  * The H1 GR promote wall is a direct consequence of the ladder's
  * externally-owned FERMI_VASPACE_A: with IS_EXTERNALLY_OWNED the RM treats
diff --git a/kernel/gsp_phys_gpu.h b/kernel/gsp_phys_gpu.h
index 84461e8..5c1207c 100644
--- a/kernel/gsp_phys_gpu.h
+++ b/kernel/gsp_phys_gpu.h
@@ -329,6 +329,10 @@ int gsp_phys_rmcall_gr_qmdwin_value(void);
  * semaphore so engine completion is always observable (default 0). */
 int gsp_phys_rmcall_gr_rel_mod_value(void);
 
+/* m66: register the mode-35 TSG fault buffers as host sysmem so engine fault
+ * entries are host-readable (default 0 = server FBMEM first). */
+int gsp_phys_rmcall_faultbuf_sys_value(void);
+
 /*
  * Ladder VAS ownership selector (gsp_phys_rmcall_vas_shared; default 0).
  * 0 = FERMI_VASPACE_A is allocated IS_EXTERNALLY_OWNED (historical ladder