sema-svc: sema_vidmem_find pattern search (CE data-path ground truth)

1 files changed, 49 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 4d3f6ef..8a60b6e 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -5127,6 +5127,55 @@ int gsp_sema_service_dump_vidmem(u64 addr, u64 len)
 }
 
 /*
+ * Search the whole emulated vidmem for an 8-byte pattern and log where it
+ * lands. The CE data-path ground truth: after a copy that should have
+ * written `pattern`, either it is somewhere or it never arrived.
+ */
+int gsp_sema_service_find_vidmem(u64 pattern, u64 max_hits)
+{
+	struct nv_vgpu_device *vgpu = NULL;
+	struct nv_vgpu_device *d;
+	u8 *base;
+	u64 off, size, hits = 0;
+
+	mutex_lock(&nv_vgpu_driver.lock);
+	list_for_each_entry(d, &nv_vgpu_driver.devices, list) {
+		if (atomic_read(&d->vfio_dev_open_count) > 0) {
+			vgpu = d;
+			break;
+		}
+	}
+	mutex_unlock(&nv_vgpu_driver.lock);
+	if (!vgpu)
+		return -ENODEV;
+
+	base = vgpu->bars[1].vaddr;
+	size = vgpu->bars[1].size;
+	if (!base)
+		return -EINVAL;
+	if (!max_hits)
+		max_hits = 16;
+
+	for (off = 0; off + 8 <= size; off += 8) {
+		u64 v;
+
+		memcpy(&v, base + off, 8);
+		if (v != pattern)
+			continue;
+		pr_info("sema-vidmem: found 0x%llx at 0x%llx\n",
+			(unsigned long long)pattern, (unsigned long long)off);
+		if (++hits >= max_hits) {
+			pr_info("sema-vidmem: stopping after %llu hits\n",
+				(unsigned long long)hits);
+			break;
+		}
+	}
+	pr_info("sema-vidmem: search 0x%llx done, %llu hit(s)\n",
+		(unsigned long long)pattern, (unsigned long long)hits);
+	return 0;
+}
+
+/*
  * Register a channel's GPU completion counter (guest PA of the u32 the GPU
  * would advance as pushes complete). Called from the sema_counter debug
  * parameter; plain state update, so it runs in the caller's context.