vgsp-diag: whole-vidmem page-hash bracket - sema_gl_vidmem_bracket hashes every 4KB page of the BAR1 shadow before the GR publish and diffs after the output-retirement wait, reporting any changed page outside the sampled output set; vidmem_hash_snap/vidmem_hash_diff manual module params; default 0 is a strict no-op

1 files changed, 25 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 94d5f5f..9b1294a 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -18092,6 +18092,20 @@ MODULE_PARM_DESC(sema_gl_sdm_drop,
 	"Drop single-word SDM-type entries (SEC_OP 0/2/6) from 3D window replays, the MME prelude and the attr prelude (default 1)");
 
 /*
+ * Whole-vidmem page-hash bracket for the forwarded GR launch path. When set,
+ * hash every 4 KB page of the first open device's BAR1 shadow immediately
+ * before the publish, then re-hash once the output retirement wait returns
+ * and log the pages whose content changed. This proves whether the engine
+ * wrote any vidmem page, not just the output pages the copy-out samples.
+ * Default 0: no allocation, no hashing and no change to the submit path.
+ */
+static bool gsp_phys_gr_vidmem_bracket;
+module_param_named(sema_gl_vidmem_bracket, gsp_phys_gr_vidmem_bracket, bool,
+		   0644);
+MODULE_PARM_DESC(sema_gl_vidmem_bracket,
+	"Hash every vidmem page before and after a forwarded GR launch to report writes outside the sampled output pages (default 0)");
+
+/*
  * SESSION 153-CONTINUED-53: MME context-setup prelude. The r1073-r1077
  * in-flight capture proved the draw-window replay raises a real MME
  * ILLEGAL_OPCODE on CALL_MME_MACRO(2)=0x3810 (mme_pc=0, mme_ir=1, mme_mac
@@ -28941,6 +28955,14 @@ gr_page_unmapped:
 	 */
 	gsp_phys_gr_wit_capture(req);
 
+	if (gsp_phys_gr_vidmem_bracket) {
+		int hret = gsp_sema_service_vidmem_hash_snapshot();
+
+		if (hret)
+			pr_warn_ratelimited("vgsp-gr: VIDMEM-BRACKET snapshot failed rc=%d\n",
+					    hret);
+	}
+
 	ret = gsp_phys_rmcall_publish_locked(bar0, boot_stage.rmcall_va_pb,
 					     words, &sub);
 	mutex_unlock(&gsp_phys_rm_lock);
@@ -30146,6 +30168,9 @@ gr_page_unmapped:
 		u32 wrote = gsp_phys_gr_output_retire_wait(req, bounce_csum_in,
 							   &n_tracked);
 
+		if (gsp_phys_gr_vidmem_bracket)
+			gsp_sema_service_vidmem_hash_diff("launch", 64);
+
 		/* CONT-73: where did the draw write? bounce count above;
 		 * direct guest stores (relocated alias/shadow operands and
 		 * MME shadow-scratch destinations) here. */