vgsp: in-flight MME/fault capture (ds_esr/mme_esr/mme_pc/mac/ir/mth regs at 5ms sked sampler), PB-FAULT-DUMP+WINPROBE+window-dump budgets raised, BLOCKVAL stream validator, subdrop (multi-word runs subchannel!=0 dropped), sema_mme_census - ROOT CAUSE: real MME ILLEGAL_OPCODE on CALL_MME_MACRO(2)=0x3810 with no macro program loaded (mme_esr=80000004 mme_pc=0 mme_ir=1); client's MME setup (0x120 LOAD_MME_START_ADDRESS_RAM, 0x124, 0x3400 scratch) never forwarded; 0x1c00+j*16=SET_VERTEX_STREAM_A_FORMAT(j); next: MME setup prelude injection - SESSION 153 r1073-r1077

2 files changed, 298 insertions, 16 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 74ebbd5..96d4c59 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -4977,7 +4977,14 @@ static u64 gsp_phys_gr_last_push_va;
  * fetch position shows how far the walk got. Read-only MMIO + a racy read
  * of the pb page (best effort, diagnostic only); bounded per boot.
  */
-#define GSP_PHYS_PBDMA_DUMP_MAX 6u
+#define GSP_PHYS_PBDMA_DUMP_MAX 64u
+
+/*
+ * SESSION 153-CONTINUED-52: the published method block's DMA address, so the
+ * PBDMA fault dump can name the exact word the PBDMA stopped on
+ * (offset = PB_FETCH - last block DMA). Set beside gsp_phys_gr_last_words.
+ */
+static u64 gsp_phys_gr_last_pb_dma;
 
 static const char *gsp_phys_pbdma_type_name(u32 t)
 {
@@ -4987,6 +4994,32 @@ static const char *gsp_phys_pbdma_type_name(u32 t)
 	return names[t & 7u];
 }
 
+/*
+ * SESSION 153-CONTINUED-52: MME fault forensics. The C597 replay's dominant
+ * failure on draw-bearing windows is a real MME exception
+ * (NV_PGRAPH_PRI_MME_HWW_ESR 0x404490 latched ILLEGAL_OPCODE /
+ * MISSING_MACRO_DATA / ... - "unknown instruction fetched from the MME
+ * Instruction RAM", see gr_error_gk104.c grErrorLogMmeException). INFO
+ * carries the faulting MME PC and the macro address; INFO2 the instruction
+ * register. Read them post-failure (the latch survives) so the exact macro
+ * fetch point is on record. Read-only; bounded by its call sites.
+ */
+static void gsp_phys_mme_regs_log(void __iomem *bar0, const char *tag)
+{
+	u32 esr, info, info2, trapped;
+
+	if (!bar0)
+		return;
+	esr = ioread32(bar0 + 0x00404490u);
+	info = ioread32(bar0 + 0x00404494u);
+	info2 = ioread32(bar0 + 0x00404498u);
+	trapped = ioread32(bar0 + 0x00400704u);
+	pr_warn("vgsp-gr: MME-REGS %s esr=%08x(pc_valid=%u illegal=%u miss=%u extra=%u) pc=%u macro_addr=0x%x info2_ir=%08x trapped=%08x\n",
+		tag, esr, (info >> 28) & 1u, (esr >> 2) & 1u,
+		(esr >> 0) & 1u, (esr >> 1) & 1u, info & 0xfffu,
+		(info >> 12) & 0xffu, info2, trapped);
+}
+
 static void gsp_phys_pbdma_fault_dump(u32 chid)
 {
 	static u32 dump_n;
@@ -5011,15 +5044,43 @@ static void gsp_phys_pbdma_fault_dump(u32 chid)
 		u32 pbd0 = readl(bar0 + b + 0x08cu);
 		u32 hdrsh = readl(bar0 + b + 0x118u);
 		u32 fetch64 = ((u64)(pbfhi & 0xffu) << 32) | (pbf & ~3u);
+		u32 trig;
+		const char *trig_src;
+		s64 off_words = -1;
 
 		if (!intr0 && !pbf && !hdrsh && !pbhd)
 			continue;
-		pr_info("vgsp-gr: PB-FAULT-DUMP P%u intr0=%08x gpf=%u pbfetch=0x%llx len=%u hdr=%08x(%s m=0x%x cnt=%u sub=%u) cnt=%08x data0=%08x shadow=%08x\n",
-			i, intr0, gpf, fetch64, pbfhi >> 11,
+		/*
+		 * SESSION 153-CONTINUED-52: the real driver's rule for the
+		 * instruction that triggered the PBDMA interrupt: if the
+		 * DECODED header (PB_HEADER) type is IMMD or PB_COUNT's value
+		 * field is zero, the raw instruction is PB_DATA0; otherwise it
+		 * is HDR_SHADOW (fifo_tu102.c: "If the TYPE field of
+		 * NV_PPBDMA_PB_HEADER is IMMD or the VALUE field of
+		 * NV_PPBDMA_PB_COUNT is zero, then the raw PB instruction
+		 * stored in NV_PPBDMA_PB_DATA0 is the one that triggered the
+		 * interrupt. Otherwise ... HDR_SHADOW").
+		 */
+		if (((pbhd >> 29) & 7u) == 4u || (pbcnt & 0x1fffu) == 0u) {
+			trig = pbd0;
+			trig_src = "DATA0";
+		} else {
+			trig = hdrsh;
+			trig_src = "HDRSHADOW";
+		}
+		if (gsp_phys_gr_last_pb_dma &&
+		    fetch64 >= gsp_phys_gr_last_pb_dma &&
+		    fetch64 < gsp_phys_gr_last_pb_dma +
+			      (u64)gsp_phys_gr_last_words * 4u)
+			off_words = (s64)(fetch64 - gsp_phys_gr_last_pb_dma) / 4;
+		pr_info("vgsp-gr: PB-FAULT-DUMP P%u intr0=%08x gpf=%u pbfetch=0x%llx len=%u off=%lld hdr=%08x(%s m=0x%x cnt=%u sub=%u) cnt=%08x data0=%08x shadow=%08x pbhd=%08x(type=%s) TRIG=%08x(%s)\n",
+			i, intr0, gpf, fetch64, pbfhi >> 11, off_words,
 			hdrsh, gsp_phys_pbdma_type_name(hdrsh >> 29),
 			(hdrsh & 0x1fffu) << 2,
 			(hdrsh >> 16) & 0xfffu, (hdrsh >> 13) & 7u,
-			pbcnt, pbd0, hdrsh);
+			pbcnt, pbd0, hdrsh, pbhd,
+			gsp_phys_pbdma_type_name(pbhd >> 29),
+			trig, trig_src);
 	}
 	{
 		struct gsp_phys_boot_chunk *pbch =
@@ -19929,12 +19990,14 @@ static bool gsp_phys_rmcall_gr_win_patch_find(u32 addr, u32 *out_data)
 	return false;
 }
 
+static u32 gsp_phys_rmcall_gr_3d_last_subdrop;
+
 static u32 gsp_phys_rmcall_gr_3d_patch_window(const u32 *in, u32 n, u32 *out,
 					      u32 *out_n, u32 *n_dropped,
 					      const struct gsp_phys_gr_submit *req,
 					      u32 *n_shadow)
 {
-	u32 off = 0, wout = 0, reloc = 0, dropped = 0;
+	u32 off = 0, wout = 0, reloc = 0, dropped = 0, subdrop = 0;
 
 	*out_n = n;
 	*n_dropped = 0;
@@ -19943,11 +20006,38 @@ static u32 gsp_phys_rmcall_gr_3d_patch_window(const u32 *in, u32 n, u32 *out,
 		u32 op = (hdr >> 29) & 0x7u;
 		u32 cnt = (hdr >> 16) & 0xfffu;
 		u32 addr = (hdr & 0x1fffu) << 2;
+		u32 sub = (hdr >> 13) & 0x7u;
 		u32 span = 1u;
 
 		if ((op == 1 || op == 3 || op == 5) && cnt &&
 		    off + 1u + cnt <= n)
 			span = 1u + cnt;
+		/*
+		 * SESSION 153-CONTINUED-52: drop METHOD WRITES aimed at a
+		 * non-zero subchannel. The glcore draw window ends with
+		 * `2001c00d 70000000/68000000` = INC m=0x34 cnt=1 SUBCHANNEL 6
+		 * (channel-class MEM_OP_D lane) two-word runs. The ladder
+		 * channel has nothing bound on subchannel 6, so the physical
+		 * PBDMA hands those methods to its host-software lane and
+		 * raises NV_PPBDMA_INTR_0_METHOD (bit 21): the r1075 relay
+		 * records `Channel ID 00000004 intr 00200000` at every launch,
+		 * and the real host driver's software-method handler answers
+		 * "Invalid host sofware method received" -> rcRequired ->
+		 * robust-channel error recovery kills the channel mid-window
+		 * (fifo_gk104.c). The methods are channel-level barriers whose
+		 * effects the module's own release/fence lanes already author,
+		 * so dropping them from the replay is the same call the 0x10c
+		 * NOTIFY / 0x1b0 LAUNCH_DMA auto-drops make. Only count-
+		 * carrying writes (op 1/3/5) are candidates: the single-word
+		 * TERT encodings (op 0/2/4/7) reuse bits 15:13 as mask/type
+		 * payload.
+		 */
+		if ((op == 1u || op == 3u || op == 5u) && sub != 0u) {
+			dropped++;
+			subdrop++;
+			off += span;
+			continue;
+		}
 		if (gsp_phys_rmcall_gr_win_drop_match(addr) ||
 		    gsp_phys_rmcall_gr_win_drop_auto_match(addr)) {
 			dropped++;
@@ -20213,6 +20303,7 @@ static u32 gsp_phys_rmcall_gr_3d_patch_window(const u32 *in, u32 n, u32 *out,
 	}
 	*out_n = wout;
 	*n_dropped = dropped;
+	gsp_phys_rmcall_gr_3d_last_subdrop = subdrop;
 	return reloc;
 }
 
@@ -20462,8 +20553,8 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 	u32 qmd_rel_off = 0, ch_rel_off = 0;
 	u32 poll = 0, w0 = 0, w1 = 0, grpoll_n = 0;
 	bool sem_gated = false;
-	static u32 sked_prev[14];
-	static u32 sked_sample[14];
+	static u32 sked_prev[20];
+	static u32 sked_sample[20];
 	static u32 sked_tick;
 	static bool sked_first;
 	/*
@@ -21695,8 +21786,9 @@ gr_page_unmapped:
 
 		win3d = stream_patch;
 		win3d_n = win_n;
-		pr_info("vgsp-gr: 3D window relocated %u operand pair(s) to shadow VAs (window=%u shadow=%u dropped=%u)\n",
-			nrel, win3d_n, n_shadow, ndrop);
+		pr_info("vgsp-gr: 3D window relocated %u operand pair(s) to shadow VAs (window=%u shadow=%u dropped=%u subdrop=%u)\n",
+			nrel, win3d_n, n_shadow, ndrop,
+			gsp_phys_rmcall_gr_3d_last_subdrop);
 		if (ndrop) {
 			static u32 gr3d_drop_log;
 
@@ -21719,7 +21811,7 @@ gr_page_unmapped:
 			static u32 gr3d_win_log;
 			u32 wi;
 
-			if (gr3d_win_log < 10) {
+			if (gr3d_win_log < 48) {
 				gr3d_win_log++;
 				pr_info("vgsp-gr: 3D window dump h=0x%x push=0x%llx words=%u\n",
 					req->h_object, req->push_va, win3d_n);
@@ -21748,6 +21840,59 @@ gr_page_unmapped:
 	WRITE_ONCE(gsp_phys_gr_last_words, words);
 	WRITE_ONCE(gsp_phys_gr_last_h, req->h_object);
 	WRITE_ONCE(gsp_phys_gr_last_push_va, req->push_va);
+	WRITE_ONCE(gsp_phys_gr_last_pb_dma,
+		   (u64)gsp_phys_chunk_page_dma(pb, 0));
+	/*
+	 * SESSION 153-CONTINUED-52: stream validator for the block the engine
+	 * will walk. The r1072 fault class ("Channel ID 4 intr0 00040000" =
+	 * PBDMA PBENTRY, "invalid method encoding used in method",
+	 * fifo_tu102.c) is raised by a method header the PBDMA refuses, or by
+	 * a run whose data is not fully present so the walk desyncs into
+	 * following words. Walk the exact published dwords with the FIFO DMA
+	 * grammar (dev_ram.ref NV_FIFO_DMA_*: SEC_OP 31:29; 1/3/5 carry 1+cnt
+	 * data words, 4/7 and TERT mask ops are single-word, 6 is RESERVED)
+	 * and flag the first occurrences of a reserved encoding or a run
+	 * overrunning the block. Read-only; bounded per boot.
+	 */
+	{
+		static u32 blkval_log;
+		const u32 *bv = methods;
+		u32 bo = 0, nbad = 0;
+
+		if (blkval_log < 48) {
+			while (bo < words && nbad < 4) {
+				u32 h = bv[bo];
+				u32 bop = (h >> 29) & 7u;
+				u32 bcnt = (h >> 16) & 0xfffu;
+				u32 bspan = 1u;
+
+				if (bop == 1u || bop == 3u || bop == 5u)
+					bspan = 1u + bcnt;
+				if (bop == 6u) {
+					nbad++;
+					pr_warn("vgsp-gr: BLOCKVAL reserved-encoding word=%u/%u val=%08x (h=%x push=0x%llx prev=%08x %08x)\n",
+						bo, words, h, req->h_object,
+						req->push_va,
+						bo ? bv[bo - 1] : 0,
+						bo + 1 < words ?
+							bv[bo + 1] : 0);
+				}
+				if (bo + bspan > words) {
+					nbad++;
+					pr_warn("vgsp-gr: BLOCKVAL run-overrun word=%u/%u hdr=%08x span=%u (needs %u more) (h=%x push=0x%llx)\n",
+						bo, words, h, bspan,
+						bo + bspan - words,
+						req->h_object, req->push_va);
+				}
+				bo += bspan;
+			}
+			blkval_log++;
+			if (nbad)
+				pr_warn("vgsp-gr: BLOCKVAL done words=%u bad=%u (h=%x push=0x%llx)\n",
+					words, nbad, req->h_object,
+					req->push_va);
+		}
+	}
 	pr_info("vgsp-gr: qmd w0..3=%08x %08x %08x %08x w4..7=%08x %08x %08x %08x w23..25=%08x %08x %08x w32/33=%08x %08x w48/49=%08x %08x\n",
 		qmd[0], qmd[1], qmd[2], qmd[3], qmd[4], qmd[5], qmd[6], qmd[7],
 		qmd[23], qmd[24], qmd[25], qmd[32], qmd[33], qmd[48], qmd[49]);
@@ -22141,10 +22286,35 @@ gr_page_unmapped:
 			sked_sample[11] = ioread32(bar0 + 0x00409c00u);
 			sked_sample[12] = ioread32(bar0 + 0x00409c18u);
 			sked_sample[13] = ioread32(bar0 + 0x00409008u);
+			/*
+			 * SESSION 153-CONTINUED-52: in-flight fault registers.
+			 * The DS shader-program-header error latch (0x405840),
+			 * the MME exception latch (0x404490) with its PC/macro
+			 * address (0x404494) and instruction register
+			 * (0x404498) are cleared by the real RM within ~ms of
+			 * the fault, so the post-timeout reads are all clean.
+			 * Sampling them every poll tick records the faulting
+			 * values at the first change.
+			 */
+			sked_sample[14] = ioread32(bar0 + 0x00405840u);
+			sked_sample[15] = ioread32(bar0 + 0x00404490u);
+			sked_sample[16] = ioread32(bar0 + 0x00404494u);
+			sked_sample[17] = ioread32(bar0 + 0x00404498u);
+			/*
+			 * SESSION 153-CONTINUED-52: the PBDMA host-software
+			 * METHOD latch (NV_PPBDMA_METHOD0 0x4000c0: ADDR
+			 * 13:2, SUBCH 18:16, INCR 0) - the method whose
+			 * delivery raises NV_PPBDMA_INTR_0_METHOD (bit 21).
+			 * The real driver clears the entry when it processes
+			 * the interrupt, so only an in-flight sample can name
+			 * it.
+			 */
+			sked_sample[18] = ioread32(bar0 + 0x004000c0u);
+			sked_sample[19] = ioread32(bar0 + 0x004000c4u);
 			if (sked_first ||
 			    memcmp(sked_sample, sked_prev,
 				   sizeof(sked_sample))) {
-				pr_info("vgsp-gr: sked rec +%ums cwd0=%08x cwd1=%08x cwd2=%08x info1=%08x info2=%08x act=%08x esr=%08x grfifo=%08x fecs_cur=%08x fecs_new=%08x ctxsw1=%08x fe0=%08x fehost=%08x fecsirq=%08x\n",
+				pr_info("vgsp-gr: sked rec +%ums cwd0=%08x cwd1=%08x cwd2=%08x info1=%08x info2=%08x act=%08x esr=%08x grfifo=%08x fecs_cur=%08x fecs_new=%08x ctxsw1=%08x fe0=%08x fehost=%08x fecsirq=%08x ds_esr=%08x mme_esr=%08x mme_pc=%u mme_mac=0x%x mme_ir=%08x mth0=%08x mth1=%08x(pbaddr=0x%x sub=%u incr=%u)\n",
 					sked_tick *
 						GSP_PHYS_RMCALL_POLL_MS,
 					sked_sample[0], sked_sample[1],
@@ -22153,7 +22323,15 @@ gr_page_unmapped:
 					sked_sample[6], sked_sample[7],
 					sked_sample[8], sked_sample[9],
 					sked_sample[10], sked_sample[11],
-					sked_sample[12], sked_sample[13]);
+					sked_sample[12], sked_sample[13],
+					sked_sample[14], sked_sample[15],
+					sked_sample[16] & 0xfffu,
+					(sked_sample[16] >> 12) & 0xffu,
+					sked_sample[17],
+					sked_sample[18], sked_sample[19],
+					(sked_sample[18] >> 2) << 2,
+					(sked_sample[18] >> 16) & 7u,
+					sked_sample[18] & 1u);
 				memcpy(sked_prev, sked_sample,
 				       sizeof(sked_sample));
 				sked_first = false;
@@ -22179,6 +22357,7 @@ gr_page_unmapped:
 				wedge_recoveries++;
 				pr_warn("vgsp-gr: WEDGE-RECOVER priv-error poison seen (grfifo=0x%08x) h=0x%x push=0x%llx - TSG preempt + resched\n",
 					g0, req->h_object, req->push_va);
+				gsp_phys_mme_regs_log(bar0, "wedge-poison");
 				mutex_lock(&gsp_phys_rm_lock);
 				gsp_phys_gr_wedge_hard_rearm_locked(bar0);
 				mutex_unlock(&gsp_phys_rm_lock);
@@ -22211,7 +22390,7 @@ gr_page_unmapped:
 			static u32 winprobe_log;
 			u32 pi;
 
-			if (winprobe_log < 10) {
+			if (winprobe_log < 64) {
 				winprobe_log++;
 				pr_info("vgsp-gr: WINPROBE +%ums push=0x%llx words=%u block_dma=0x%llx grfifo=%08x trapped=%08x trapped_lo=%08x\n",
 					sked_tick * GSP_PHYS_RMCALL_POLL_MS,
@@ -22226,18 +22405,33 @@ gr_page_unmapped:
 					u32 pbf = ioread32(bar0 + b + 0x054u);
 					u32 pbfhi = ioread32(bar0 + b + 0x058u);
 					u32 hdrsh = ioread32(bar0 + b + 0x118u);
+					u32 wbh = ioread32(bar0 + b + 0x084u);
+					u32 wbcnt = ioread32(bar0 + b + 0x088u);
+					u32 wbd0 = ioread32(bar0 + b + 0x08cu);
 					u64 fetch64 =
 						((u64)(pbfhi & 0xffu) << 32) |
 						(u64)(pbf & ~3u);
+					s64 woff = -1;
 
 					if (!intr0 && !gpf && !pbf && !hdrsh)
 						continue;
-					pr_info("vgsp-gr: WINPROBE P%u intr0=%08x gp_put=%u pbfetch=0x%llx hdr=%08x(%s m=0x%x cnt=%u sub=%u)\n",
-						pi, intr0, gpf, fetch64, hdrsh,
+					if (gsp_phys_gr_last_pb_dma &&
+					    fetch64 >= gsp_phys_gr_last_pb_dma &&
+					    fetch64 <
+						    gsp_phys_gr_last_pb_dma +
+							    (u64)gsp_phys_gr_last_words *
+								    4u)
+						woff = (s64)(fetch64 -
+							     gsp_phys_gr_last_pb_dma) /
+							4;
+					pr_info("vgsp-gr: WINPROBE P%u intr0=%08x gp_put=%u pbfetch=0x%llx off=%lld hdr=%08x(%s m=0x%x cnt=%u sub=%u) pbhd=%08x(type=%s) pbcnt=%08x pbd0=%08x\n",
+						pi, intr0, gpf, fetch64, woff, hdrsh,
 						gsp_phys_pbdma_type_name(hdrsh >> 29),
 						(hdrsh & 0x1fffu) << 2,
 						(hdrsh >> 16) & 0xfffu,
-						(hdrsh >> 13) & 7u);
+						(hdrsh >> 13) & 7u, wbh,
+						gsp_phys_pbdma_type_name(wbh >> 29),
+						wbcnt, wbd0);
 				}
 			}
 		}
@@ -22267,6 +22461,7 @@ gr_page_unmapped:
 			pr_err("vgsp-gr: GR LAUNCH FAILED: wait budget crossed (qmd_rel=0x%08x want=0x%08x ch_rel=0x%08x want=0x%08x) h=0x%x push=0x%llx; ladder stopped\n",
 			       w0, want_qmd, w1, want_ch, req->h_object,
 			       req->push_va);
+			gsp_phys_mme_regs_log(bar0, "wait-max");
 			ret = -ETIMEDOUT;
 			goto out;
 		}
@@ -22278,6 +22473,7 @@ gr_page_unmapped:
 			pr_err("vgsp-gr: GR LAUNCH FAILED: timeout after %u ms (qmd_rel=0x%08x want=0x%08x ch_rel=0x%08x want=0x%08x) h=0x%x push=0x%llx\n",
 			       poll_ms, w0, want_qmd, w1,
 			       want_ch, req->h_object, req->push_va);
+			gsp_phys_mme_regs_log(bar0, "timeout");
 			/*
 			 * F4-b: one-shot deposit readback at the FIRST timeout
 			 * (the old post-mortem only ran after attempt 3, which
@@ -25979,6 +26175,18 @@ static int gsp_phys_reg_probe_show(struct seq_file *m, void *unused)
 					  0x0040070cu);
 	fe_hww_esr = gsp_phys_reg_probe_line(m, bar0, "FE_HWW_ESR",
 					     0x00404000u);
+	/*
+	 * SESSION 153-CONTINUED-52: MME exception latches (see
+	 * gsp_phys_mme_regs_log).
+	 */
+	(void)gsp_phys_reg_probe_line(m, bar0, "PGRAPH_PRI_MME_HWW_ESR",
+				      0x00404490u);
+	(void)gsp_phys_reg_probe_line(m, bar0,
+				      "PGRAPH_PRI_MME_HWW_ESR_INFO",
+				      0x00404494u);
+	(void)gsp_phys_reg_probe_line(m, bar0,
+				      "PGRAPH_PRI_MME_HWW_ESR_INFO2",
+				      0x00404498u);
 	fe_chip_def = gsp_phys_reg_probe_line(m, bar0, "FE_CHIP_DEF_INFO",
 					      0x00404030u);
 	fe_go_idle = gsp_phys_reg_probe_line(m, bar0, "FE_GO_IDLE_INFO",
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index cf3bf6a..8fd0603 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -13743,14 +13743,84 @@ static u64 svc_pass_hash;	/* r391f: this decode pass's push content hash */
  */
 unsigned gsp_sema_push_raw;
 unsigned gsp_sema_push_raw_small;
+static u32 svc_mme_census_flag;
 module_param_named(sema_push_raw_small, gsp_sema_push_raw_small, uint, 0644);
 MODULE_PARM_DESC(sema_push_raw_small,
 	"Verbatim decode dump for small GR pushes (16..511 B), bounded count (default 0)");
+module_param_named(sema_mme_census, svc_mme_census_flag, uint, 0644);
+MODULE_PARM_DESC(sema_mme_census,
+	"Census MME-family method ids (0x114..0x124, 0x234, 0x550..0x568, 0x3400..0x34fc, 0x3800..0x39fc) in beef pushes, bounded (default 0)");
 static u64 svc_pushraw_last_va;
 static u32 svc_pushraw_last_len;
 static u32 svc_pushraw_n;
 static u32 svc_pushraw_small_n;
 
+/*
+ * SESSION 153-CONTINUED-52: MME-family method census for the beef (GL 3D
+ * client) channel. The replayed draw windows raise a real MME ILLEGAL_OPCODE
+ * (NV_PGRAPH_PRI_MME_HWW_ESR bit 2) - the MME executed a macro whose code it
+ * could not fetch. The macro calls (CALL_MME_MACRO/DATA 0x3800..0x39fc) carry
+ * macro code addresses, so the macro CONTEXT state - the MME Instruction/
+ * Start-address RAM loads (0x114/0x118/0x11c/0x120), the shadow RAM control
+ * (0x124), MME version (0x234), the MME DMA window (0x550..0x568) and the
+ * shadow scratch (0x3400..0x34fc) - must have reached the ladder context too.
+ * If those setup methods never appear in ANY client push the MME can never
+ * have its macro library and the replay is doomed; if they do appear, the
+ * next question is which push forwards them. This census answers that: it
+ * scans every beef push for those method ids and logs a bounded one-line
+ * summary (first-hit offsets + first data word). Read-only; bounded.
+ */
+static u32 svc_mme_census_n;
+
+static void svc_mme_census(const u8 *buf, u32 len, u64 push_va, u32 h_object)
+{
+	u32 off = 0;
+	u32 nhit = 0;
+	char line[512];
+	int lc = 0;
+
+	if (!READ_ONCE(svc_mme_census_flag) || svc_mme_census_n >= 128)
+		return;
+	if ((h_object & 0xfffff000u) != 0xbeef0000u)
+		return;
+	while (off + 4 <= len && nhit < 16) {
+		u32 hdr, op, cnt, addr;
+
+		memcpy(&hdr, buf + off, 4);
+		op = (hdr >> 29) & 7u;
+		cnt = (hdr >> 16) & 0xfffu;
+		addr = (hdr & 0x1fffu) << 2;
+		if (op == 1u || op == 3u || op == 5u)
+			/* multi-word run: classify by its method id */
+			;
+		else if (op == 4u || op == 7u)
+			cnt = 0;
+		else
+			cnt = 0;
+		if ((addr >= 0x114u && addr <= 0x124u) ||
+		    addr == 0x234u ||
+		    (addr >= 0x550u && addr <= 0x568u) ||
+		    (addr >= 0x3400u && addr <= 0x34fcu) ||
+		    (addr >= 0x3800u && addr <= 0x39fcu)) {
+			u32 v0 = 0;
+
+			if (off + 8 <= len)
+				memcpy(&v0, buf + off + 4, 4);
+			lc += scnprintf(line + lc, sizeof(line) - lc,
+					"%s0x%x@0x%x(%08x)",
+					nhit ? "," : "", addr, off, v0);
+			nhit++;
+		}
+		off += (op == 1u || op == 3u || op == 5u) && cnt ?
+			(1u + cnt) * 4u : 4u;
+	}
+	if (nhit) {
+		svc_mme_census_n++;
+		pr_info("sema-mme-census: h=0x%x va=0x%llx len=%u n=%u hits=[%s]\n",
+			h_object, push_va, len, nhit, line);
+	}
+}
+
 static void svc_push_raw_dump(const u8 *buf, u32 len, u64 push_va,
 			      u32 h_object)
 {
@@ -14477,6 +14547,10 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
 		 len >= 16 && len < 512)
 		svc_push_raw_dump(buf, len, push_va, ch->h_object);
 
+	/* SESSION 153-CONTINUED-52: MME-family census for the beef channel. */
+	if (ch)
+		svc_mme_census(buf, len, push_va, ch->h_object);
+
 	memset(&st, 0, sizeof(st));
 	st.push_va = push_va;
 	/*