summaryrefslogtreecommitdiffstats
path: root/kernel/gsp_sema_service.c
Commit message (Collapse)AuthorAge
* vgsp: sema_gr_setup_hold_ms param (default 0) - setup-push detect (>=12288B ↵Arthur Hanson Rasmusson11 hours
| | | | or MME-setup families in scan), hold arm on first unreadable read with 8x4K demand to stalled-VA channel, deadline consult at consume gate; r1079-readable setup captured words=511 (contrast r1083/85/87 zeros = setup-push read lottery root); hold fired but guest resolver covers only 0x120000000-0x121000000 - next: extend resolver to GL pushbuffer VA families - SESSION 153 r1083-r1087
* vgsp: MME setup prelude - capture client MME context-setup runs ↵Arthur Hanson Rasmusson12 hours
| | | | (0x114..0x124/0x234/0x550..0x568/0x3400..0x34fc) verbatim, exact-run dedup, 512-word buf + gen counter (sema_mme_prelude_cap); one-time-per-generation preplay in GR launch build (sema_gl_mme_prelude); capture verified - full macro program 11 SA/IR pairs ~206 code words, MME-PRELUDE emitted gen=5 words=444; no further mme_esr=80000004 after prelude (r1079); remaining: setup push unreadable=1 skip before pin demand; r1082-class content-independent dispatch stall - SESSION 153 r1078-r1082
* vgsp: in-flight MME/fault capture (ds_esr/mme_esr/mme_pc/mac/ir/mth regs at ↵Arthur Hanson Rasmusson12 hours
| | | | 5ms sked sampler), PB-FAULT-DUMP+WINPROBE+window-dump budgets raised, BLOCKVAL stream validator, subdrop (multi-word runs subchannel!=0 dropped), sema_mme_census - ROOT CAUSE: real MME ILLEGAL_OPCODE on CALL_MME_MACRO(2)=0x3810 with no macro program loaded (mme_esr=80000004 mme_pc=0 mme_ir=1); client's MME setup (0x120 LOAD_MME_START_ADDRESS_RAM, 0x124, 0x3400 scratch) never forwarded; 0x1c00+j*16=SET_VERTEX_STREAM_A_FORMAT(j); next: MME setup prelude injection - SESSION 153 r1073-r1077
* vgsp: svc_push_page_heal (beef push all-zero read re-resolves via ↵Arthur Hanson Rasmusson13 hours
| | | | launch-page chain, pin/cache, src=10; sema-pushzero len cap 1024), mme-reloc-rsv (MME-family payload miss resolves via RELOC-FIXED ledger/pin/walk shadow-map), pin_gr_stream pushzero 4K-page bulk demand (48/batch); HW retire only with A+0x34a8+C dropped - draw payloads live in exactly the refused families (0x1c00-0x1c20 MME macro-code uploads / 0x3810 CALL_MME_MACRO); Graphics Exception ChID 0001 Class 0x0000c597 Offset 0 - SESSION 153 r1070-r1072
* vgsp: sema_gl_mme_reloc (CALL_MME_MACRO/DATA payload relocation via launch ↵Arthur Hanson Rasmusson15 hours
| | | | pages, raw-operand fault fix), MME-page collection + 4KB ptr dedup, 0x1b00 pair-relocation, sema_gr_wedge_recover (TSG-preempt re-arm on 0xbadf, revived channel: REAL GR SEM OK 0xc0ffee01), win_drop_auto += 0x1b00 - BEEF LAUNCHES RETIRE (h=0xbeef0100 ch_rel=0xc0ffee02 elapsed_ms=0 ok=6, 3 consecutive); full-perimeter windows still wedge in [0x1200,0x7ffc); client registration 5/5 with keeper - SESSION 153 r1058-r1063
* vgsp: 3D flush gate fix (built-in chunk bound, not bisect knob), pushzero ↵Arthur Hanson Rasmusson18 hours
| | | | zero-content rescue (probe PROMOTE_CTX, src=9), CHUNK1 dump, SET_INDEX_BUFFER+vertex-stream collection; publish GPFIFO entry at engine GP_GET (PUT-GET=1); win_drop 0x parser fix - beef chunks still PBDMA-stop at 0x1160 attr run (hdr=20030458 INC m=0x1160 cnt=3) while X retires ch_rel=0xc0ffee02 same boot - SESSION 153 r1034-r1041
* vgsp: 3D stream chunking for client pushes - GR push words 512->2048, ↵Arthur Hanson Rasmusson19 hours
| | | | candidates 4->8, method-aligned <=384-word chunks in ring order with 8-pending backpressure (sema_gl_chunk_words knob), zero-head guard, PBDMA chunk-end fault fix, 3DSTREAM dump; first client src=stream capture (h=0xbeef0100 push=0x54eefd4 len=1580 nprog=2 recs=2), ch_rel=0xc0ffee02 submitted; beef windows still don't retire (scheduler stall vs X retiring same boot) - SESSION 153 r1028-r1033
* vgsp: zero-put-skip for GR chan userd (fixes r1025 poisoned latch; ↵Arthur Hanson Rasmusson20 hours
| | | | submissions regression FIXED 32501/33646), revert op-translate walk-first (oops with flowing submissions; keep fill walk), NEW sema_screen_blit param - present blit PROVEN byte-exact (src=0x130e38000 spitch=1200 w=300 h=300 -> off=0x200000 rows_done=300 rc=0; window md5 b237eb04->4b751df8); remaining: client draws must execute (GR LAUNCH FAILED timeout ch_rel=0x00000000 want=0xc0ffee02, zero src=stream) - SESSION 153 r1026-r1027
* vgsp: op-translate + fill floor walk-first for below-floor (sub-1TiB) VAs ↵Arthur Hanson Rasmusson20 hours
| | | | via guest page tables - kills LOWFILL-REFUSED va=0x120458c00 pa=0x120458c00 that froze DDX screen repaints (fresh boot: fills done=3686400 rc=0, LOWFILL-REFUSED=0); xwd path proven byte-exact vs vidmem 0x200000 fill artifact; window still black (client re-presents static frame; no client content in vidmem); r1025 beef0100 pump regression (GPFIFO va=0xa0d8f54 all-zero, submissions=0 vs 208) - SESSION 153 r1024-r1025
* vgsp: svc_client_slot_sweep - per-pass (~2ms) clear of armed 0xffff ↵Arthur Hanson Rasmusson21 hours
| | | | completion slots for live beef channels; attempts now submit heavily (submissions 29->208, GP_PUT advancing put=14, sema-consume idx=94 put=95, ops_runs=2, copyent total=131068); client shim frames have content (mean_sum=60.8 nz_frac=0.2843); remaining wall = X presentation (DDX black fill va=0x120400000 vs client copy dst=0x4700000) - SESSION 153 r1024
* vgsp: sema_client_slot - clear armed 0xffff completion slots below ↵Arthur Hanson Rasmusson21 hours
| | | | beef-family channel-notifier base in svc_notify_complete; first real client submissions (submissions=29, sema-pushall h=0xbeef0100 va=0x421f758 len=1720 allow=1 trusted=1); attempt still recycles ~12s - SESSION 153 r1023
* vgsp: apply userdOffset[subDeviceId] to channel USERD addr (real control ↵Arthur Hanson Rasmusson23 hours
| | | | page fb 0x20fc00, not 0x18fe00); low-aperture 0x4000000-class entry window; GR-ring USERD probe accepts g>p/put-cap>1024; own-VAS-first counter derive - USERD wall broken (chan h=0xbeef0100 userd=0x20fc00 as=2 ring rc=0 pa=0x233603000); new wall: client never stores GP_PUT (put=0, FB 0x20fc00+0x8c frozen; last RM call ZCULL_BIND 0x20801208) - SESSION 153 r1016
* vgsp: FB USERD scan time-paced (1/25ms, cap 512) + pristine fallback for ↵Arthur Hanson Rasmusson24 hours
| | | | ring_pa==0 - fixes fresh-boot Xorg 10s DMA-init wall (2/2 boots green, DDX channel sub=3402, TWOD fills execute) - SESSION 153 r1014-r1015
* vgsp: svc_shared_hold - kernel keeper clears bit0 of the GL shared-state ↵Arthur Hanson Rasmusson25 hours
| | | | slot word (sema_shared_hold_pa); validated live (held pa=0x279b01000 word -> 0x2); with hold: client allocs c46f (hObject=0xbeef0100/0101/0102), readback err 502->0, window md5 changes (mean 2.69,2.68,4.02, nz_frac=0.0172) - SESSION 153 r1012-r1013
* vgsp: BAR0-shadow aperture userd probe + full PCFG-window (0x88000-0x89000) ↵Arthur Hanson Rasmusson25 hours
| | | | doorbell dispatch - built/live r1011; measurement falsified BAR0-USERD premise for client GP_PUT (shadows static, only pos=0x88704 traps); X channel sub=60 via kick-family RAM watch - SESSION 153 r1011
* vgsp: full-frame strip assembly (origins+per-channel CE state, delta push ↵Arthur Hanson Rasmusson40 hours
| | | | fold), FERMI_TWOD executor (screen fills rc=0), RT-as-screen surface alias + win-drop auto, client replay retires (faulted=0, GR forward failed=0) - SESSION 153 r984-r997
* vgsp: canonical kick-push guard + anchor rescue chain + ring+0x20b0 notify ↵Arthur Hanson Rasmusson47 hours
| | | | targeting + per-handle notify cache - exec lane 48/48 continuous (SESSION 153 r977-r982)
* vgsp: kick USERD watch table 64 + adopt-on-PUT-step + churn monitor + ↵Arthur Hanson Rasmusson2 days
| | | | FB->SYS notify retry - frozen alternation solved (SESSION 153 r974-r976)
* vgsp: kick-family USERD acceptance + ring revalidate + notify event post - ↵Arthur Hanson Rasmusson2 days
| | | | notify lane executes (n=512), client c46f/c597 allocs appear (SESSION 153 r972/r973)
* vgsp: kick NOTIFY execution (sema_kick_notify; completion word authored + ↵Arthur Hanson Rasmusson2 days
| | | | readback verified) + notify2d witness + kick probe (SESSION 153 r971)
* vgsp: chan alloc/refusal diagnostics (PROMOTE_CTX probe benign); ↵Arthur Hanson Rasmusson2 days
| | | | attribution: r958 windows were Xorg init; harness DISPLAY regression fixed; init window retires 2 consecutive cycles (SESSION 153 r962)
* vgsp: per-channel C597 attachment table, sema_gl_win_drop strip knob, ↵Arthur Hanson Rasmusson2 days
| | | | WINPROBE; strip experiment: binds-only windows retire, full draws die in FECS switch-in (SESSION 153 r955-r958)
* vgsp: PB-FAULT-DUMP + pb block preservation (warm-sem probe off=0x800), ↵Arthur Hanson Rasmusson2 days
| | | | attach-on-BEGIN; init replay retires ch_rel=0xc0ffee02; draw windows remain unreleased (SESSION 153 r951-r954)
* vgsp: staged program delivery (V3 SPH accepted by engine, 0 SPH faults/40 ↵Arthur Hanson Rasmusson2 days
| | | | launches), inline bytes 256, per-VA typed slots (SESSION 153 r947-r950)
* vgsp: sticky C597 attachment + BEGIN recognizer + draw-scan window; draws ↵Arthur Hanson Rasmusson2 days
| | | | captured and replayed on 3D lane (engine reaches program header validation); guest-page blob delivery; two mdevs coexist (SESSION 153 r944-r946)
* vgsp: CE_M_PITCH_IN batched fold (pitch_out/line_length from count-3 run) - ↵Arthur Hanson Rasmusson2 days
| | | | 2D copies execute; client draw pushes with real C597 geometry now flow (SESSION 153 r943)
* vgsp: CE semaphore-release decode fix (count>=2 folds v1) - DDX sem-wait ↵Arthur Hanson Rasmusson2 days
| | | | completion authored; xwd -root unblocked (SESSION 153 r942)
* vgsp: USERD allocation-locality gate (ring+/-64MB), sema-sw window, ↵Arthur Hanson Rasmusson2 days
| | | | kick-family pubadv arm - true ring confirmed; no draw submissions exist (SESSION 153 r941)
* vgsp: GL section arrival ledger (sema-glass) + denied-copy serving ↵Arthur Hanson Rasmusson2 days
| | | | (sema_serve_denied); no new GL content after init measured (SESSION 153 r939)
* vgsp: USERD rejection memory + re-arm (kick tracking continuous at 142-153 ↵Arthur Hanson Rasmusson2 days
| | | | FPS; r938) (SESSION 153)
* vgsp: native publish-counter advance (sema_pub_adv; full-RAM content ↵Arthur Hanson Rasmusson2 days
| | | | discovery of publish pages) - glxgears 120-148 FPS with no external pokes (SESSION 153 r936)
* vgsp: native >6GiB client page resolution (PA ceiling to scan_top), kick ↵Arthur Hanson Rasmusson2 days
| | | | 2D-notifier release decode, zero_nop bound (SESSION 153 r933/r934)
* vgsp: 3D method-stream replay lane (verbatim C597 window + shadow relocation ↵Arthur Hanson Rasmusson2 days
| | | | + release tail; engine retires real 3D methods, no QMD) (SESSION 153 r932)
* vgsp: mode-35 plan-F 3D class object accepted on V7; GL client C597 ↵Arthur Hanson Rasmusson3 days
| | | | section-open + draw-synth path; push dumps (SESSION 153 r923-r926)
* vgsp: USERD liveness latch (speculative+confirm/reject), push content-anchor ↵Arthur Hanson Rasmusson3 days
| | | | scan, PA ceiling to scan_top, release-group matching (SESSION 153: M-GL1.2 PASS r922)
* vgsp: sysmem GR USERD RAM scan (sliced, ring-entry validated) + ↵Arthur Hanson Rasmusson3 days
| | | | unreadable-push demand regex (SESSION 153 WIP: liveness latch pending)
* vgsp: GL ring scan fixed (ring-own-offset entries, either-side window, ↵Arthur Hanson Rasmusson3 days
| | | | va1==va0; scan top param) + ring VA demand regex (SESSION 153)
* vgsp: engine executes synthesized GL launches - inline upload applies + real ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | SASS path (SESSION 149 r891) - svc_gl_flush applies the section read upload list via svc_grce_inline_write; walker pairs subch0 0x180->0x1b0 runs on eng==0 channels and applies on sight (19/19 applied; once-only (push,hash,dst,bytes) dedupe). - sema_gl_prog_hex param + source priority trusted VA read > prog-hex > bounded LID fallback (12 B). - Evidence (r891): code64 = real sm_75 SASS (nvcc-assembled EXIT;NOP cubin); engine writes qmd_rel=0x600df00d ~500 ms after submit (executed + retired); 0 Illegal-Instruction lines (r890: 7). Completion still declared failed (rc=-110; ch_rel witness unwritten) -> SYNTH-FAULT + SW release; bounded. Feature gated by sema_gl_xlate (default off).
* vgsp: synthesized GL launch passes SKEDCHECK - bounded LID blob + QMD ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | scheduling fields (SESSION 149 r889) - svc_gl_field 0x1b0: skip LAUNCH_DMA cfg word; bound the inline blob by the run's own word count (blob 64 -> 12 B, no over-read of following methods). - svc_gl_flush QMD fields: CTA dims 1/1/1 (w12-14), w18=0x00010023, w19=0x00010001, w20=0x00001a00 (REGISTER_COUNT from the stream's own REGISTER_COUNT(1) method), barrier bit w29, SASS_VERSION 7.5 (w31), driver cache-control block (w5). - Evidence (r889): SKEDCHECK06/16 zero occurrences; 'GR LAUNCH submitted shadow=1 words=239'; SM decodes; FAULT-CAP code_src=win0 ok=1; bounded action=proceed + SW release (no stall). Next wall: Illegal Instruction Encoding (program content not yet materialized). Gated by sema_gl_xlate.
* vgsp: GL section capture + synthesized launch reaches the engine (SESSION ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | 149 r888) - M1.1a: preserve the bracketing release across the section-open reset; allow hash-verified replay capture (exactly-once guard). First trusted pass now captures the GL setup section (push=0x120010004, prog=0x121201b00, rel=0x120001000, replay=0). - M1.1b: per-channel ring scan 16->24 slices + put-triggered keep-alive. - M2-S1: booter skips w48 Tier-1 when shadow_win0 is set; flush attaches the observed LID payload as an inline record. - Evidence (r888): 'qmd_word 48 page copied to window-0 shadow'; 'GR LAUNCH submitted pages=5 shadow=1 qmdwin=0x108000'; FAULT-CAP code_src=win0, code64 non-zero, FAULT_PDE count=0 (engine fetched the shadowed code). - Remaining wall: SKEDCHECK06_REGISTER_COUNT + SKEDCHECK16_CTA_THREAD_DIM_ZERO (synthesized QMD scheduling fields) -> bounded fail + SW release. Feature gated by sema_gl_xlate (default off).
* vgsp: GL pushbuffer readability - eng==0 ring-window pairing + bounded ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | sysmem PDB probe (SESSION 149 r882) - svc_pb GR namespace + svc_pb_gr_done: pair eng==0 (GL/X) channel ring windows from the content-verified ring pair; entries consumed only by the untrusted read source (src=3, last resort). CE/CUDA paths untouched. - Bounded sysmem phase added to the X-VAS PDB discover probe (vidmem sweep unchanged); accepted but inert on r882 (map cap; no candidate root). - Evidence (r882): GL channel h=0x1000013 rc=-2 572 -> 0; ring window paired va=0x120090000 -> pa=0x104ad7000; drain pb=2/48 (was 0/48); decoded bytes byte-identical to the vidmem shadow; no CE/CUDA regressions; host clean.
* vgsp: xw-mirror page-reuse guards + submit-status clearer scaffold (SESSION ↵Arthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | 148 r873) The unguarded 3 ms mirror loop kept writing the count law into its latched page after the guest had reused it (r872 evidence: guest 'Bad page map ... pmd:102656067' pointing at exactly the mirrored page's PA as another process's PTE table). The loop now latches the progress word's base bits and stops permanently when they change or are zeroed, and re-checks the counter object's signature every 64th tick. New sema_xw_comp parameter + vgsp-xwcomp kthread can clear a submit member's armed 0x8000 status (value 0 pattern only); r874 proved an unverified clear into a false member kills Xorg within seconds, so it stays uninjected until the member address is watched live.
* vgsp: xw-mirror back to plain tracking law (r867 ahead-mode rejected)Arthur Hanson Rasmusson4 days
| | | | | | | | | r867 with member = counter + learned-delta: every check is a permanent +0x70 mismatch (the mirror re-advances right after each counter change), xorg.log shows '(2, ..., 0xa8c, 0xa1c)' timeouts and the GL client gets nothing. Plain member = counter is the correct law; the driver's re-probe cadence gives the mirror room to settle between the driver's counter increment and its next probe.
* vgsp: xw-mirror writes one learned frame-step ahead of the counterArthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | r866: the mirror tracked perfectly yet every wait still paid the driver's ~3 s re-check sleep (one '(0)' success print every 20-80 s; the GL client hung minutes on its X socket). Cause: the driver increments its counter and then enters the wait; a member that only tracks the counter always loses that entry-check race (mirror wakes <=3 ms after the change; the driver probes within microseconds), so the check fails and the driver sleeps out its retry interval. Writing member = counter + last-observed- delta (learned from each counter change, 0 until the first) makes the driver's own increment land exactly on the pre-written member value, so the first probe after submission succeeds and frames complete at the driver's pace.
* vgsp: notify keepalive on registered notifier slots + 8GB demo guestArthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | | | r864 ground truth while wedged: both the RC-watchdog channel (0x31415900) and the X/GL channel (0x1000013) sit with their class2d notification ARMED (u16 status 0xFFFF at notifier_pa + 0x3E = slot-3 struct status) and nothing ever clears them (X notified=0 after 459 submissions), so the guest krcWatchdog fires 'GPU is probably locked' every ~8.2 s and the whole X/GL stack wedges (glxgears poll() never returns; late XOOM death). Under the mirrored flow the watchdog ring reads go unreadable (rc=-2), so the decode-time ack and the notify2d_va path both miss. svc_notify2d_keepalive(): every pass, every GR channel with a registered notifier PA, read slots 0..3; for each slot armed exactly 0xFFFF write the zeroed 16-byte NvNotification and post the channel event - the same effects as svc_notify_complete without any ring read. Also bump the demo harness guest RAM to 8GB (launch_qemu_rootport.sh) to survive the observed emulation-path allocation growth during accelerated runs.
* vgsp: X/GL frame-pacer mirror (sema_xw_mirror) - unblocks the 10s/frame stallArthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | r861 evidence: the X server's present path spins in a 10s-timeout wait ((EE) NVIDIA(GPU-0): WAIT (2, 8, 0x8000, <stuck 0xd4..>, <driver counter +0x70/frame>)) comparing (progress_word & 0x3ffff) << 2 against its own submitted-byte counter; the progress word (lone u32 0x140235 in an otherwise-zero guest page) never advances because the emulation does not execute the 2D method streams -> glxgears 0.09 FPS. A gdb write of the word to 0x140000 | (counter >> 2) made the wait complete in 3 ms (WAIT (0, ... <equal>, <equal>) immediately after the timeout print) and silenced all further timeouts. This adds a 3 ms kthread that mirrors the driver's counter word into the progress word; both guest PAs are injected per boot via the sema_xw_mirror parameter (0,0 stops). Demo-path tuning aid; no product logic depends on it.
* vgsp: extend notifier-derived ring pin to all GR channelsArthur Hanson Rasmusson4 days
| | | | | | | | | r859: the X channel never resolved its ring all boot (garbage entries va=0x41c000/0x2017a20/0x10104, unreadable/skipped, ~11 s per frame). Rule verified on the RC watchdog across r848/r853/r858: ring = notifier page + 0x400. Widened to every GR channel with a registered notifier PA; the standard entry0+USERD candidate probe still content-gates each derivation, so a wrong guess costs a failed probe (the current state).
* vgsp: notifier-derived RC-watchdog ring pin (client-init determinism)Arthur Hanson Rasmusson4 days
| | | | | | | | | | The RC-watchdog channel's ring page sits at (notifier_pa page + 0x400) in every observed boot (r848/r853/r858 data points). The trusted walk resolved the same ring 14 s late on r858, inside the driver's DMA-test window on the failing boots, where the ring read zeros/garbage - 'Failed to initialize DMA' plus guest vmap-lock livelocks followed. Deriving the ring from the registered notifier PA (guest truth from the channel alloc) removes the race; the standard entry0+USERD candidate probe still content-gates it.
* vgsp: perf tracing + map-verified rescue + us RPC quanta (session 148)Arthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | | | - sema_trace_h + sema-perf logs: per-second channel state (put/last/armed/ counter) and publish-gate reasons, plus maprescue attempt outcomes. Instrument added after window tuning failed to move the 22.4 s/frame glxgears cadence; it located the real blocker in one run. - svc_rescue_push_page: content-verified full-chain map rescue (works for GR channels, whose rescue was previously refused outright). - gsp_phys_booter: RPC reply waits now usleep_range(150-350us) instead of msleep(5) (termbin review suggestion, in-tree constant verified; no FPS change measured, kept as correctness-neutral latency reduction). Evidence: r843-r847 dmesg_live logs; measured constant 22.4 s/frame for glxgears across all param windows (grace/poll/first-poll), showing the pacer is elsewhere - traced to client pushbuffer pages (va=0x3f06270-class) failing svc_lookup (-ENOENT) while the client is alive.
* vgsp: client-session boundary fixes - WD ring scan gate + forced session flushArthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | | | | | | | | | Two changes from the r839/r840 multi-client forensics (session 147): 1. The guest-RAM content scan for a GR ring must not run for the kernel RC-watchdog channel (h=0x31415900). Its ring is a plain kernel allocation always resolvable through the driver-published VAS walk; on r840 the walk lost a registration race, the scan latched a foreign garbage page, and the bad latch poisoned the driver's DMA test ('Failed to initialize DMA', Xorg died). Gated, the walk retries per pass; r841 Xorg#1 passes DMA (DMAFAIL=0) where r840 failed. 2. sema_force_flush module parameter + gsp_sema_service_sess_flush_force(): execute the ISSUE-0002 client-session flush even with live channels. The channel-close trigger never fires on real boots (driver-global channels stay valid), so later client sessions inherited stale discovery state. Verified on r841: flush executes mid-boot, Xorg survives it and re-registers its channels. Remaining wall (addendum 9): GR client channels' pushbuffer reads return all-zero through the trusted translation (va=0x4000000-class, src=4), so first entries never complete and GL clients never render.
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-31 16:31:05 +0000