vgsp: USERD allocation-locality gate (ring+/-64MB), sema-sw window, kick-family pubadv arm - true ring confirmed; no draw submissions exist (SESSION 153 r941)

1 files changed, 66 insertions, 1 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index f095adc..7773efe 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -1140,6 +1140,7 @@ struct sema_svc {
 	u64			copy_dst_log;		/* sema_copy_dst log budget */
 	u32			op_tr_src;		/* provenance of last svc_op_translate */
 	u32			sem_sw_log;		/* sema-sw release-write log budget */
+	u32			sem_sw_xg_log;		/* sema-sw X/GL-window budget */
 	u64			push_pat_log;		/* push-content pattern budget */
 	u64			dma_skip_log;		/* unrecognized-DMA budget */
 	u64			xfer_raw_log;		/* operandless transfer raw-dump budget */
@@ -4913,9 +4914,23 @@ static int svc_sem_write(struct nv_vgpu_device *vgpu, u32 h, u64 va, u32 val)
 	 */
 	if (((va >= 0x79240000000ULL && va < 0x79260000000ULL &&
 	      svc.sem_sw_log < 8192) ||
-	     (va >= 0x200000000ULL && !is_pool && sem_sw_dev_log < 4096))) {
+	     (va >= 0x200000000ULL && !is_pool && sem_sw_dev_log < 4096) ||
+	     /*
+	      * SESSION 153-CONT-7 (GL client attribution): the X/GL lanes'
+	      * semaphore window. The X server's progress-tracker release
+	      * (va=0x120001000, kernel progress semaphore) and the GL
+	      * channels' low-aperture objects sit below 0x200000000, so
+	      * their write attempts were invisible (no sema-sw line) while
+	      * the client's polled word stayed zero - the r939 boot left
+	      * no trace of WHERE such a write landed. Bounded like the
+	      * other windows so a hot loop cannot flood dmesg.
+	      */
+	     (va >= 0x120000000ULL && va < 0x120600000ULL &&
+	      svc.sem_sw_xg_log < 2048))) {
 		if (va >= 0x79240000000ULL && va < 0x79260000000ULL)
 			svc.sem_sw_log++;
+		else if (va >= 0x120000000ULL && va < 0x120600000ULL)
+			svc.sem_sw_xg_log++;
 		else
 			sem_sw_dev_log++;
 		pr_info("sema-sw: h=0x%x va=0x%llx pa=0x%llx ap=%d src=%s val=0x%x rc=%d rb_ok=%d back=0x%x pool=%d\n",
@@ -18645,6 +18660,30 @@ static bool svc_gr_ram_userd_scan(struct nv_vgpu_device *vgpu,
 		u64 wpa = ch->gr_ram_userd_watch[wi];
 		u32 hp = 0, hg = 0, last;
 
+		/*
+		 * SESSION 153-CONT-7 (ownership by allocation locality):
+		 * drop a watched candidate that sits far outside the
+		 * channel's ring allocation. r939 measured: the ring at pa
+		 * 0x1225ac000, the client's sysmem blocks (memfd) at pa
+		 * 0x136b9c000..0x136eca000 (~21 MB away), while the
+		 * latched pair at pa 0x106e8xxxx sat ~460 MB from the ring,
+		 * mapped by NO process, and never advanced on any pass
+		 * (two frozen snapshots that cost a 15 s reject/re-latch
+		 * cycle all boot). A control block this far from its own
+		 * ring is not this channel's USERD.
+		 */
+		if (ring_pa &&
+		    (wpa < ring_pa - (SVC_GR_RAM_WIN << 5) ||
+		     wpa > ring_pa + (SVC_GR_RAM_WIN << 5))) {
+			ch->gr_ram_userd_watch_n--;
+			ch->gr_ram_userd_watch[wi] =
+				ch->gr_ram_userd_watch[ch->gr_ram_userd_watch_n];
+			ch->gr_ram_userd_watch_put[wi] =
+				ch->gr_ram_userd_watch_put[ch->gr_ram_userd_watch_n];
+			ch->gr_ram_userd_watch_hits[wi] =
+				ch->gr_ram_userd_watch_hits[ch->gr_ram_userd_watch_n];
+			continue;
+		}
 		if (svc_read(vgpu, wpa + SVC_USERD_GP_PUT, &hp,
 			     sizeof(hp)) || !hp || hp > 0x100000) {
 			ch->gr_ram_userd_watch_n--;
@@ -18757,6 +18796,17 @@ static bool svc_gr_ram_userd_scan(struct nv_vgpu_device *vgpu,
 			if (ring_pa && (gpa + o) ==
 			    (ring_pa & ~(u64)(SEMA_PAGE_SIZE - 1)))
 				continue;
+			/*
+			 * SESSION 153-CONT-7: allocation-locality gate - the
+			 * same 64 MB ring neighbourhood as the watch loop
+			 * above. Excludes the r936-r939 nine-decoy pair
+			 * (~460 MB from the ring) before it can occupy a
+			 * watch slot and burn a reject/re-latch cycle.
+			 */
+			if (ring_pa &&
+			    (gpa + o < ring_pa - (SVC_GR_RAM_WIN << 5) ||
+			     gpa + o > ring_pa + (SVC_GR_RAM_WIN << 5)))
+				continue;
 			for (k = 0; k < hp && k < 8; k++) {
 				u8 e[8];
 				u64 eva;
@@ -29635,6 +29685,21 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 		if (gsp_sema_gr_util_scan && gsp_sema_gr_xlate)
 			svc_gr_util_sweep(vgpu, ch);
 
+		/*
+		 * SESSION 153-CONT-7: a kick-family channel whose USERD
+		 * stays unresolved (the r939/r940 decoys are excluded by
+		 * the allocation-locality gate and no in-window control
+		 * block exists) still owes its pace publication: the GL
+		 * client polls the publish words to pace its render loop,
+		 * and the publish advance was otherwise reachable only
+		 * through the decoy consume path. Author it per pass while
+		 * the USERD is missing; once a userd exists the normal
+		 * retire path carries it again.
+		 */
+		if (!ch->engine_type && !ch->userd_ok &&
+		    ch->h_object >= 0xbfef0000u &&
+		    ch->h_object <= 0xbfef00ffu)
+			svc_pub_advance(ch);
 		if (!ch->userd_ok) {
 			if (svc_chan_userd(vgpu, ch, rrc ? 0 : ring_pa,
 					   rrc ? -1 : ring_ap, &put, &get,