vgsp: admit short MME preludes and drop the 0x22c init method from replay (stream3d zero-write fixes)

NOWRITE decode (eng11): wrote=0/tracked=1024 is the retire scan; fe_esr=
0x80000000 is the CLEARED FE latch (not a live fault); trap=0x8000022c/...
is PGRAPH_TRAPPED_ADDR naming method 0x22c (C597 SET_GO_IDLE_TIMEOUT,
init-only, emitted once at channel init) - the FE traps on the replay of
that init write and never reaches the draw. The c220 stack also showed a
second defect: 'MME-PRELUDE deferred (window=20 prelude=13 sa=0 cap=2048)'
-> MME-REGS esr=badf1201 miss=1 pc=513 -> grfifo poison -> warm sem rc=-110.
Fixes (gsp_phys_booter.c):
- A: admit a captured prelude shorter than 24 words (pl_room is clamped to
  pl_n, so pl_room >= 24u could never be true for preludes < 24 words and
  they were deferred forever).
- B: add addr == 0x022c to gsp_phys_rmcall_gr_win_drop_auto_match() (knob
  sema_gl_win_drop_auto, default 1): drop the replay-hostile init write like
  the existing 0x10c/0x1b0/0x5e0/0x1b00 triggers.
Validation pending (c221 no-capture lottery, c222 X death before the live
A/B); receipts: eng11-*.

1 files changed, 23 insertions, 3 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 189d8b7..b548b62 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -21275,7 +21275,17 @@ if (gsp_phys_gr_slot_kept(j, sa_mask,
 					WRITE_ONCE(gsp_phys_gr_mme_pack_sa,
 						   false);
 				}
-				if (pl_room >= 24u) {
+				/*
+				 * c220 (eng11): pl_room is clamped to pl_n
+				 * (what fits), so a captured prelude shorter
+				 * than 24 words always failed the >= 24u test
+				 * and was "deferred" forever - the MME code
+				 * never loaded and the first CALL ran macro
+				 * 0xf1 with the IRAM unloaded (MME-REGS
+				 * miss=1 pc=513 mac=0xf1 -> badf1201 poison).
+				 * Emit whenever the WHOLE prelude fits too.
+				 */
+				if (pl_room >= 24u || pl_room == pl_n) {
 					emit_prelude =
 						(pl_gen != READ_ONCE(
 							gsp_phys_gr_mme_prelude_gen) ||
@@ -27020,7 +27030,7 @@ static bool gsp_phys_gr_win_drop_auto = 1;
 module_param_named(sema_gl_win_drop_auto, gsp_phys_gr_win_drop_auto, bool,
 		   0644);
 MODULE_PARM_DESC(sema_gl_win_drop_auto,
-	"Drop the software-emulated trigger methods (0x10c NOTIFY, 0x1b0 LAUNCH_DMA, 0x5e0 TWOD fill) from verbatim 3D replays (default 1)");
+	"Drop the software-emulated trigger methods (0x10c NOTIFY, 0x1b0 LAUNCH_DMA, 0x5e0 TWOD fill, 0x22c SET_GO_IDLE_TIMEOUT trap) from verbatim 3D replays (default 1)");
 
 static bool gsp_phys_rmcall_gr_win_drop_auto_match(u32 addr)
 {
@@ -27047,9 +27057,19 @@ static bool gsp_phys_rmcall_gr_win_drop_auto_match(u32 addr)
 	 * the client actually waits on (the r1061 keep-prefix window
 	 * retired with ch_rel=0xc0ffee02 and the client kept pushing
 	 * frames without any 0x1b00 in the replay).
+	 *
+	 * c222 (eng11): 0x22c SET_GO_IDLE_TIMEOUT <- 0x800 rides the
+	 * captured per-frame window (the client's own channel-init block
+	 * is inside it) and every replay ends with
+	 * `trap=0x8000022c/00000800` (mthd=0x22c mmegen=0) - the FE's
+	 * trapped-method latch names exactly this write and the window
+	 * retires with zero MME-generated methods (pc0=0 gen0=0) and zero
+	 * stores. It is init-only configuration for GO_IDLE (SEND_GO_IDLE
+	 * 0x13c is never replayed), so the replay channel does not need
+	 * it; drop it like the other replay-hostile triggers above.
 	 */
 	return addr == 0x010cu || addr == 0x01b0u || addr == 0x05e0u ||
-	       addr == 0x1b00u;
+	       addr == 0x1b00u || addr == 0x022cu;
 }
 
 /*