vgsp: svc_lat_drop + trust sub-source tag (sub= in sema-pushdec) + SVC_ZRW zero-streak table (src>=2 all-zero x2 -> drop lat/re-walk, pin when src==2), gl_win_start arms only on hdr!=0 (root cause of 5-boot capture drought: window armed on zero no-op), svc_gl_flush zero-lead advance, svc_push_pa_ceiling from gsp_phys_guest_ram_top - capture drought BROKEN (r1131 win=1429 words, 1007 section captures, 0 zero-head refusals); MME-PRELUDE ships in one launch FIRST TIME (gen=4 words=901 + window=390 -> GR LAUNCH words=1348); stores still 0 (engine fetch NONE, MISSING_MACRO_DATA ESR 0x80000001; 8.8s fallback); next: one-variable attribution (sa_stub=0 then surf_prelude=0) + same-generation SA/program capture - SESSION 153 r1129-r1131

1 files changed, 35 insertions, 0 deletions

diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index e9c0c5a..f1d72f7 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -1954,6 +1954,41 @@ bool gsp_phys_guest_ram_active(void)
 EXPORT_SYMBOL_GPL(gsp_phys_guest_ram_active);
 
 /*
+ * Highest GPA any registered guest-RAM range covers. Conservative global
+ * bound (max across the legacy and every per-mdev record) for consumers that
+ * only need to reject translations pointing past RAM - e.g. the sema push
+ * read's PA ceiling (r1127: a stale VAS walk answered 0x23921d000 = 8.89 GB
+ * for the beef setup push; with the 8/10 GB guest layout the answer is
+ * inside the registered ranges and reads padding zeros, so no bound alone
+ * fixes it - the repeated-zero invalidation does - but any answer ABOVE
+ * this top can never read content). 0 when nothing is registered.
+ */
+u64 gsp_phys_guest_ram_top(void)
+{
+	u64 top = 0;
+	unsigned int i, j;
+
+	mutex_lock(&guest_ram_lock);
+	for (i = 0; i < GSP_PHYS_GUEST_RAM_MDEVS + 1; i++) {
+		const struct gsp_phys_guest_ram_rec *rec =
+			(i == 0) ? &guest_ram_legacy : &guest_ram_mdevs[i - 1];
+
+		if (!rec->file)
+			continue;
+		for (j = 0; j < rec->ranges_n; j++) {
+			u64 end = rec->ranges[j].gpa_base +
+				  rec->ranges[j].size;
+
+			if (end > top)
+				top = end;
+		}
+	}
+	mutex_unlock(&guest_ram_lock);
+	return top;
+}
+EXPORT_SYMBOL_GPL(gsp_phys_guest_ram_top);
+
+/*
  * Lock-safe one-line snapshot for the gsp-phys-state dump: active flag,
  * path, range count and every range (gpa/offset/size). With only the legacy
  * record configured (the one-mdev campaign) the output is byte-identical to