From bcd74c1cd3dafd375c22a99a70b29e57b1c005c3 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Sat, 31 Oct 2026 05:38:39 -0400 Subject: vgsp: re-arm on MISS-ABORT (candidate re-offered unwon, releases re-parked, 1500ms tick, 55s/64-try episode bound; GSP_PHYS_GR_RC_MISSABORT -ENOMSG), junk-operand filter (0x10000000..0x100000000 reloc misses not demanded - float constants), MME prelude latch cleared on WEDGE-RECOVER - **FIRST-EVER nonzero beef submit+retire** (GR LAUNCH submitted push=0xcf3d724 len=5016 pages=9 words=389, poll break ch=0xc0ffee02 after 64us, 12 poll breaks, 0 poisons; client 0.077->287-436 FPS); still NO-STORES (bounce 0 pages changed by engine); next: SKED CTA counters for prove dispatch-vs-degenerate + fix vertex/index operand state - SESSION 153 r1109-r1111 --- kernel/gsp_phys_booter.c | 71 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 66 insertions(+), 5 deletions(-) (limited to 'kernel/gsp_phys_booter.c') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index 6f3898f..4c2b460 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -17203,6 +17203,19 @@ module_param_named(sema_gl_mme_prelude, gsp_phys_rmcall_gr_mme_prelude, bool, MODULE_PARM_DESC(sema_gl_mme_prelude, "Preplay the captured client MME context-setup runs once per capture generation ahead of the first 3D window replay (default 1)"); +/* + * SESSION 153-CONTINUED-61: generation of the MME prelude already emitted + * into the engine context (0 = none). The r1110 evidence: the prelude was + * emitted once on the first beef launch (gen=1, 512 words), that launch + * priv-errored (grfifo=0xbadf1201) and WEDGE-RECOVER ran TSG preempt + + * resched - which resets the engine context and with it the resident MME + * program - yet the latch kept suppressing re-emission, so every later + * window replay ran its macros against an unloaded MME (mme_pc=513 class + * stall, no retire). The recovery clears the latch so the next launch + * re-preloads the context. + */ +static u32 gsp_phys_gr_mme_prelude_gen; + /* * SESSION 153-CONTINUED-57: attr/pipeline state prelude. The r1091 * full-MME-prelude boot cleared MME (mme_esr=80000000) but the first beef @@ -17286,7 +17299,6 @@ static u32 gsp_phys_rmcall_build_gr_launch(u32 *pb, * to also carry the prelude replays without it (logged) - the * emission then happens on the next launch that fits. */ - static u32 mme_prelude_emitted_gen; bool emit_prelude = false; const u32 *pl = NULL; u32 pl_n = 0, pl_gen = 0; @@ -17294,7 +17306,7 @@ static u32 gsp_phys_rmcall_build_gr_launch(u32 *pb, if (READ_ONCE(gsp_phys_rmcall_gr_mme_prelude)) { pl = gsp_sema_mme_prelude_get(&pl_n, &pl_gen); if (pl && pl_n && pl_gen && - pl_gen != READ_ONCE(mme_prelude_emitted_gen)) { + pl_gen != READ_ONCE(gsp_phys_gr_mme_prelude_gen)) { if (win3d_n + 2u + 8u + pl_n <= GSP_PHYS_RMCALL_GR_METHOD_WORDS) { emit_prelude = true; @@ -17350,7 +17362,7 @@ static u32 gsp_phys_rmcall_build_gr_launch(u32 *pb, * emitted (the copy may be a torn prefix). */ gsp_sema_mme_prelude_get(NULL, &g1); if (g1 == g0) { - WRITE_ONCE(mme_prelude_emitted_gen, g0); + WRITE_ONCE(gsp_phys_gr_mme_prelude_gen, g0); pr_info("vgsp-gr: MME-PRELUDE emitted gen=%u words=%u window=%u h=0x%x push=0x%llx sdm_drop=%u\n", g0, pwords, win3d_n, req->h_object, req->push_va, sdrop); @@ -19921,6 +19933,7 @@ static u64 gsp_phys_gr_surf_dummy_dma_locked(void) * sema_gl_miss_abort=0 restores the historical submit-anyway behaviour. */ static u32 gsp_phys_rmcall_gr_3d_miss_n; +static u64 gsp_phys_rmcall_gr_3d_junk_n; static bool gsp_phys_rmcall_gr_miss_abort = true; static u64 gsp_phys_gr_miss_abort_n; module_param_named(sema_gl_miss_abort, gsp_phys_rmcall_gr_miss_abort, bool, @@ -20004,6 +20017,35 @@ static bool gsp_phys_rmcall_gr_3d_reloc(u32 *up_w, u32 *lo_w, return true; } } + /* + * SESSION 153-CONTINUED-61: junk-operand filter. The window + * recognizer is byte-shape based, so float/immediate DATA words in + * the method stream also parse as address pairs. The observed junk + * class sits in the 256 MB..4 GB numeric range (0x3d000000..0xc2...... + * float bit patterns: 0x3f800000 = 1.0f, 0xbf800000 = -1.0f, ...) + * and can NEVER resolve - r1109 measured miss=20 constant across + * every attempt, all of it this class, which pinned the abort census + * nonzero forever and blocked every submit. Real client VAs of this + * driver live below 0x5000000 (the 64-80 MB GL/heap range, e.g. + * 0x4250000/0x4350000/0x462fc40) or at/above 0x1_00000000 (the 4G+ + * push-buffer/UVM ranges). A miss outside both is a data-word + * misidentification, not a raw client VA the engine would read as an + * address: it is neither demanded (the demand set was 60 % junk by + * r1109, diverting the pin cycle) nor counted toward the pre-doorbell + * abort. Witnessed per class, bounded. + */ + if (page >= 0x10000000ULL && page < 0x100000000ULL) { + static u32 gr_missjunk_log; + + gsp_phys_rmcall_gr_3d_junk_n++; + if (gr_missjunk_log < 24 || + !(gsp_phys_rmcall_gr_3d_junk_n % 512u)) { + gr_missjunk_log++; + pr_info("vgsp-gr: MISS-JUNK va=0x%llx (data-word class; not demanded, not counted toward the abort) n=%llu\n", + page, (u64)gsp_phys_rmcall_gr_3d_junk_n); + } + return false; + } /* * Unresolvable: demand the page for the pin path and count the miss * (the submit path aborts pre-doorbell while the count is nonzero). @@ -22340,7 +22382,15 @@ gr_page_unmapped: } mutex_unlock(&gsp_phys_rm_lock); gsp_phys_gr_refused++; - ret = -EAGAIN; + /* + * SESSION 153-CONTINUED-61: the dedicated verdict lets + * the sema service keep the captured candidate armed + * and re-forward it (re-arm) instead of consuming it + * with a software completion: the demanded pages + * resolve through the pin path and the retry then runs + * the real launch. + */ + ret = GSP_PHYS_GR_RC_MISSABORT; goto out; } /* @@ -22996,7 +23046,18 @@ gr_page_unmapped: gsp_phys_gr_wedge_hard_rearm_locked(bar0); mutex_unlock(&gsp_phys_rm_lock); g1 = ioread32(bar0 + 0x00400504u); - pr_warn("vgsp-gr: WEDGE-RECOVER after re-arm grfifo=0x%08x (%s); recovery #%u this boot\n", + /* + * SESSION 153-CONTINUED-61: the TSG preempt + + * resched above resets the engine context, so + * the MME program the emitted prelude loaded is + * gone. Clear the emission latch: the next + * launch that can carry the prelude re-preloads + * it (without this every later replay ran its + * macros against an unloaded MME and stalled + * pre-retire - the r1110 mme_pc=513 class). + */ + WRITE_ONCE(gsp_phys_gr_mme_prelude_gen, 0); + pr_warn("vgsp-gr: WEDGE-RECOVER after re-arm grfifo=0x%08x (%s); recovery #%u this boot; MME prelude latch cleared (context re-preload owed)\n", g1, (g1 & 0xffff0000u) == 0xbadf0000u ? "still poisoned" : "cleared", -- cgit v1.2.3