From 24c806ffe9dbe1b0a13fc0a8e3dab91a1e8bc448 Mon Sep 17 00:00:00 2001
From: Arthur Hanson Rasmusson <arthur@vgpu.io>
Date: Sun, 18 Oct 2026 07:15:31 -0400
Subject: vgsp: GR relocation completeness - resolve unmatched device-VA words
 via the landing resolver (RELOC-FIXED), param gsp_phys_gr_reloc_resolve
 default 1

---
 kernel/gsp_sema_service.c | 78 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

(limited to 'kernel/gsp_sema_service.c')

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index a045f07..24ec36f 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -14310,6 +14310,84 @@ static const char *svc_gr_src_probe(struct nv_vgpu_device *vgpu, u64 va,
 	return "none";
 }
 
+/*
+ * relfix (agent-A FIX A): rewrite-time GR relocation resolver (see
+ * gsp_sema_service.h). Mirrors the per-page source order of the fill
+ * (svc_gr_data_fill: svc_ipin_lookup -> svc_resolve_va's trusted chain ->
+ * ledger) and of the read-only attribution probe svc_gr_src_probe above,
+ * then applies the m180 ledger in the fill's two roles: fallback when
+ * nothing above answered (the C1 landing path), and the m171 landing
+ * preference for VAs at/above the ledger floor when the ledger disagrees
+ * with the resolver (the skip-ahead class where a walk result is stale but
+ * the landing is authoritative).
+ *
+ * Deliberately excluded versus svc_resolve_va: pin_store/lat_store writes,
+ * svc_pd_discover and the sliced targeted RAM scan - those mutate
+ * service-thread state or can block for seconds, and this runs on the GR
+ * work item (process context; the page-table walks take svc.vas_lock only
+ * for their publication snapshot and may sleep in vfio_dma_rw, exactly the
+ * discipline the walk comment above svc_walk_vaspaces mandates).
+ *
+ * Returns 0 with out filled on a successful translation, -ENOENT on a miss
+ * (caller must leave the word untouched), or a conversion errno.
+ */
+int gsp_sema_gr_reloc_resolve(u64 va, struct gsp_sema_gr_reloc *out)
+{
+	struct nv_vgpu_device *vgpu = svc_fwd_req.vgpu;
+	u64 page = va & ~(u64)(SEMA_PAGE_SIZE - 1);
+	u64 pa = 0, lpa = 0, hpa = 0;
+	int ap = SVC_APERTURE_SYS;
+	u32 lap = 0, off = 0;
+	bool resolved = false;
+	int ret;
+
+	if (!vgpu || !out)
+		return -EINVAL;
+
+	if (!svc_ipin_lookup(page, &pa, &ap))
+		resolved = true;
+	else if (!svc_pin_lookup(page, &pa, &ap))
+		resolved = true;
+	else if (!svc_lat_lookup(page, &pa, &ap))
+		resolved = true;
+	else if (!svc_map_lookup(page, &pa))
+		resolved = true;
+	else if (!svc_walk_vaspaces(vgpu, page, &pa, &ap))
+		resolved = true;
+	else if (!svc_walk_discovered(vgpu, page, &pa, &ap))
+		resolved = true;
+
+	if (!resolved) {
+		/* C1 fallback: a landing is a page the client already backed
+		 * with content even when every resolver missed (r174). */
+		if (svc_ledger_lookup(page, &lpa, &lap))
+			return -ENOENT;
+		pa = lpa;
+		ap = (int)lap;
+	} else if (page >= SVC_VAS_FLOOR) {
+		/* m171: the landing table wins over a disagreeing resolver. */
+		if (!svc_ledger_lookup(page, &lpa, &lap) &&
+		    ((lpa & ~(u64)(SEMA_PAGE_SIZE - 1)) !=
+		       (pa & ~(u64)(SEMA_PAGE_SIZE - 1)) ||
+		     (u32)lap != svc_ap_of(ap))) {
+			pa = lpa;
+			ap = (int)lap;
+		}
+	}
+
+	ret = svc_fwd_operand_hpa(vgpu,
+				  svc_ap_of(ap) == SVC_APERTURE_FB ?
+				  SVC_APERTURE_FB : SVC_APERTURE_SYS,
+				  pa, 0, SEMA_PAGE_SIZE, &hpa, &off);
+	if (ret || off)
+		return ret ? ret : -EFAULT;
+
+	out->pa = pa & ~(u64)(SEMA_PAGE_SIZE - 1);
+	out->ap = svc_ap_of(ap);
+	out->hpa = hpa;
+	return 0;
+}
+
 /*
  * m144 (second-client launch-state divergence): collect device-VA-shaped
  * candidate pointers from the bytes the ENGINE will actually execute.
-- 
cgit v1.2.3