vgsp-sema: bounded channel rewind (sema_chan_rewind: hex h_object or 'all' -> clears slot_done_epoch + last_get + the per-entry rescue state so entries skipped before the VAS pdb anchor re-decode) + bounded per-chunk push-read failure witness (sema-pushfail: va/chunk/page/last_rc/trusted_rc/ipin/alt/win per failed chunk); wall2: runbook.py (trigger the anchor then rewind). Session 118: the anchor+rewind path is wired; the automated rewind scheduler missed (dmesg churn) and the pushfail trace still needs one clean capture

3 files changed, 98 insertions, 2 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 7bb7440..f21f589 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -13920,6 +13920,9 @@ static u32 svc_pushpg_split_log;
  * validated candidate). Reads stay defensively copied through
  * svc_read_ap()/vfio_dma_rw(), which enforce the aperture bounds.
  */
+/* r707d: bounded push-read failure witness (see below). */
+static u32 svc_pushfail_log;
+
 static int svc_read_va_push_ex(struct nv_vgpu_device *vgpu,
 			       struct svc_channel *ch, u64 va, void *buf,
 			       size_t len, bool skip_ipin)
@@ -13935,6 +13938,7 @@ static int svc_read_va_push_ex(struct nv_vgpu_device *vgpu,
 		bool have_win, done = false;
 		bool first = (p == buf);
 		int last_rc = -ENOENT;
+		int trusted_rc = 0;
 		u32 src;
 
 		have_win = !svc_pb_win_lookup(ch, page_va, &win_pa);
@@ -13988,7 +13992,9 @@ static int svc_read_va_push_ex(struct nv_vgpu_device *vgpu,
 			default:
 				/* learned cache / discovered map / page
 				 * directories / targeted rm_mem resolve */
-				if (svc_lookup_trusted(vgpu, va, &pa, &ap))
+				trusted_rc = svc_lookup_trusted(vgpu, va,
+								&pa, &ap);
+				if (trusted_rc)
 					continue;
 				break;
 			}
@@ -14051,8 +14057,29 @@ static int svc_read_va_push_ex(struct nv_vgpu_device *vgpu,
 				continue;
 			done = true;
 		}
-		if (!done)
+		if (!done) {
+			if (svc_pushfail_log < 96) {
+				u64 ipa = 0, apa = 0;
+				int iap = 0, aap = 0;
+				bool has_ipin =
+					(svc_ipin_lookup(va, &ipa, &iap) == 0);
+				bool has_alt =
+					(svc_ipin_alt_lookup(va, &apa, &aap) == 0);
+
+				svc_pushfail_log++;
+				pr_info("sema-pushfail: va=0x%llx chunk=0x%llx page=0x%llx last_rc=%d trusted_rc=%d ipin=%d pa=0x%llx alt=%d pa=0x%llx win=%d pa=0x%llx\n",
+					(unsigned long long)va,
+					(unsigned long long)chunk,
+					(unsigned long long)page_va,
+					last_rc, trusted_rc, has_ipin,
+					(unsigned long long)ipa,
+					has_alt,
+					(unsigned long long)apa,
+					have_win,
+					(unsigned long long)win_pa);
+			}
 			return last_rc;
+		}
 		p += chunk;
 		va += chunk;
 		len -= chunk;
@@ -15650,6 +15677,29 @@ static u64 svc_pdb_disc_va;
 static u64 svc_pdb_disc_pa;
 static bool svc_pdb_disc_pending;
 
+/*
+ * r707r: bounded channel rewind (debug). After the VAS pdb anchor lands,
+ * entries skipped before it never re-decode on their own (their unread
+ * window expires into a skip), so the release they carry would be lost for
+ * that put epoch. A host tool asks for a rewind (sema_chan_rewind: a hex
+ * h_object, or "all"); the pump re-processes the channel from slot 0 with
+ * the consumed-slot bitmap and the per-entry rescue state cleared.
+ */
+static u32 svc_rewind_h;
+static bool svc_rewind_all;
+static bool svc_rewind_pending;
+
+int gsp_sema_service_chan_rewind(u32 h_object)
+{
+	if (!svc.task)
+		return -ENODEV;
+	svc_rewind_h = h_object;
+	svc_rewind_all = (h_object == 0xffffffffu);
+	svc_rewind_pending = true;
+	wake_up_process(svc.task);
+	return 0;
+}
+
 int gsp_sema_service_pdb_discover(u64 ring_va, u64 ring_pa)
 {
 	if (!svc.task)
@@ -23597,6 +23647,27 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 	bool stalled = false;
 
 	spin_lock_irqsave(&svc.chan_lock, flags);
+	if (svc_rewind_pending) {
+		svc_rewind_pending = false;
+		for (i = 0; i < SVC_MAX_CHANNELS; i++) {
+			struct svc_channel *c = &svc.chan[i];
+
+			if (!c->valid || c->vgpu != vgpu)
+				continue;
+			if (!svc_rewind_all && c->h_object != svc_rewind_h)
+				continue;
+			pr_info("sema-chan: rewind h=0x%x last_get=%u put=%u (slot bitmap + rescue state cleared)\n",
+				c->h_object,
+				(unsigned int)c->last_get,
+				(unsigned int)c->put_prev);
+			bitmap_zero(c->slot_done_epoch, SVC_GPFIFO_MAX_BITS);
+			c->last_get = 0;
+			c->rescue_fail = 0;
+			c->unread_va = 0;
+			c->unread_until = 0;
+			c->defer_since = 0;
+		}
+	}
 	/*
 	 * r507o stream-order: walk the CE channels BEFORE the GR channels.
 	 * The client's stream order places its H2D copies before the kernel
diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index 534e38d..8d63a72 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -111,6 +111,7 @@ int  gsp_sema_service_add_map(u64 gpu_va, u64 pa, u64 len, u32 ap);
 int  gsp_sema_service_dump_vidmem(u64 addr, u64 len);
 int  gsp_sema_service_find_vidmem(u64 pattern, u64 max_hits);
 int  gsp_sema_service_pdb_discover(u64 ring_va, u64 ring_pa);
+int  gsp_sema_service_chan_rewind(u32 h_object);
 int  gsp_sema_service_counter_add(u32 h_object, u64 pa);
 void gsp_sema_service_doorbell(u32 token);
 
diff --git a/kernel/main.c b/kernel/main.c
index 5ff5047..7af236d 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -2991,6 +2991,30 @@ module_param_cb(sema_pdb_discover, &nv_vgpu_sema_pdb_discover_ops, NULL, 0200);
 MODULE_PARM_DESC(sema_pdb_discover, "Retrigger the VAS pdb discovery with a verified ring pair (hex va,hex pa)");
 
 /*
+ * Debug: bounded channel rewind. Clears the consumed-slot bitmap and the
+ * per-entry rescue state for one channel (hex h_object) or every channel
+ * ("all"), so the pump re-processes its ring from slot 0 - used after the
+ * VAS pdb anchor lands so entries skipped before it re-decode (the release
+ * they carry would otherwise be lost for that put epoch).
+ */
+static int nv_vgpu_sema_chan_rewind_set(const char *val,
+					const struct kernel_param *kp)
+{
+	u32 h = 0xffffffffu;
+
+	if (strncmp(val, "all", 3) && kstrtouint(val, 0, &h))
+		return -EINVAL;
+	return gsp_sema_service_chan_rewind(h);
+}
+
+static const struct kernel_param_ops nv_vgpu_sema_chan_rewind_ops = {
+	.set = nv_vgpu_sema_chan_rewind_set,
+};
+
+module_param_cb(sema_chan_rewind, &nv_vgpu_sema_chan_rewind_ops, NULL, 0200);
+MODULE_PARM_DESC(sema_chan_rewind, "Rewind a channel's ring (hex h_object or 'all')");
+
+/*
  * Debug: register a channel's GPU completion counter (guest PA of the u32
  * tracking counter the GPU would write when a push completes):
  *   echo <h_object>,<pa> > .../parameters/sema_counter