vgsp: m113 - re-register the VAS page directory after planting data (re-commit probe)

All late engine-tree writes are invisible to the SM walker (only the
commit-time snapshot resolves); the mail injection at a main-window fresh
slot also fails (m112). Probe whether UNSET+SET_PAGE_DIRECTORY on the
ladder VAS after planting forces the server walker to re-snapshot the tree;
gated by gr_recommit.

3 files changed, 61 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 772530d..86205d1 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -17113,6 +17113,46 @@ gr_page_unmapped:
 		}
 		pr_info("vgsp-gr: guest data identity-map: %u pages in the engine tree, %u failed (pt pages=%u)\n",
 			dmapped, dfailed, boot_stage.rmcall_gr_data_pt_n);
+		if (gsp_phys_rmcall_gr_recommit_value()) {
+			struct gsp_phys_rmcall_pdb_params rp;
+			struct {
+				__le32 h_va_space;
+				__le32 ch_id;
+				__le32 sub_device_id;
+			} up;
+			u32 rr = 0, st = 0;
+			int rc;
+
+			memset(&rp, 0, sizeof(rp));
+			rp.phys_address = cpu_to_le64((u64)
+				gsp_phys_chunk_page_dma(
+					&boot_stage.rmcall_chunks
+					 [GSP_PHYS_RMCALL_BUF_VASPDB], 0));
+			rp.num_entries = cpu_to_le32(
+				GSP_PHYS_RMCALL_PDB_NUM_ENTRIES);
+			rp.flags = cpu_to_le32(
+				GSP_PHYS_RMCALL_PDB_FLAG_APERTURE_SYSMEM_NONCOH |
+				GSP_PHYS_RMCALL_PDB_FLAG_ALL_CHANNELS);
+			rp.h_va_space = cpu_to_le32(boot_stage.rmcall_vas);
+			memset(&up, 0, sizeof(up));
+			up.h_va_space = cpu_to_le32(boot_stage.rmcall_vas);
+			rc = gsp_phys_rmcall_control(bar0,
+					boot_stage.rmcall_device, 0x801814u,
+					&up, sizeof(up), sizeof(up), NULL, 0,
+					&rr, &st, "DMA_UNSET_PAGE_DIRECTORY");
+			pr_info("vgsp-gr: re-commit UNSET: ret=%d status=0x%x rpc=0x%x\n",
+				rc, st, rr);
+			rr = 0;
+			st = 0;
+			rc = gsp_phys_rmcall_control(bar0,
+					boot_stage.rmcall_device,
+					GSP_PHYS_RMCALL_CTRL_DMA_SET_PAGE_DIRECTORY,
+					&rp, sizeof(rp), sizeof(rp), &rp,
+					sizeof(rp), &rr, &st,
+					"DMA_SET_PAGE_DIRECTORY re-commit");
+			pr_info("vgsp-gr: re-commit SET: ret=%d status=0x%x rpc=0x%x\n",
+				rc, st, rr);
+		}
 	}
 	if (gsp_phys_rmcall_gr_gpc_mmu_init_value())
 		gsp_phys_rmcall_gr_gpc_mmu_init(bar0);
diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index e92e5f1..c5419a5 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -1050,6 +1050,24 @@ int gsp_phys_rmcall_gr_data_prewin_value(void)
 EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_data_prewin_value);
 
 /*
+ * m113: after planting the launch's data mappings, re-register the VAS page
+ * directory (UNSET+SET) to force the server walker to re-snapshot the tree;
+ * all evidence says the SM walker resolves only the commit-time tree, and
+ * late writes (leaf or table) are invisible. Default 0.
+ */
+static int gsp_phys_rmcall_gr_recommit_param;
+module_param_named(gsp_phys_rmcall_gr_recommit,
+		   gsp_phys_rmcall_gr_recommit_param, int, 0644);
+MODULE_PARM_DESC(gsp_phys_rmcall_gr_recommit,
+		 "Re-register the VAS page directory after planting data (default 0)");
+
+int gsp_phys_rmcall_gr_recommit_value(void)
+{
+	return gsp_phys_rmcall_gr_recommit_param;
+}
+EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_recommit_value);
+
+/*
  * m95: program each GPC's MMU_CTRL from the hub's PFB MMU_CTRL (the real RM's
  * grInitGPCMmuPRIRegs matching-fields copy) before a forwarded launch. The
  * GPC-side walker refuses the SM I-fetch with MMU_NACK while hub-side reads
diff --git a/kernel/gsp_phys_gpu.h b/kernel/gsp_phys_gpu.h
index b7c8cd4..f93603c 100644
--- a/kernel/gsp_phys_gpu.h
+++ b/kernel/gsp_phys_gpu.h
@@ -352,6 +352,9 @@ int gsp_phys_rmcall_gr_mail_patch_value(void);
 /* m106: pre-install the data PT window pool in stage 3. */
 int gsp_phys_rmcall_gr_data_prewin_value(void);
 
+/* m113: re-register the VAS page directory after planting data. */
+int gsp_phys_rmcall_gr_recommit_value(void);
+
 /* m72: append the vendor local-memory context block to the GR prelude so
  * SKEDCHECK05 LOCAL_MEMORY_TOTAL_SIZE passes (default 0); base VA and
  * per-TPC size are overridable for A/B runs. */