vgsp: in-flight MME/fault capture (ds_esr/mme_esr/mme_pc/mac/ir/mth regs at 5ms sked sampler), PB-FAULT-DUMP+WINPROBE+window-dump budgets raised, BLOCKVAL stream validator, subdrop (multi-word runs subchannel!=0 dropped), sema_mme_census - ROOT CAUSE: real MME ILLEGAL_OPCODE on CALL_MME_MACRO(2)=0x3810 with no macro program loaded (mme_esr=80000004 mme_pc=0 mme_ir=1); client's MME setup (0x120 LOAD_MME_START_ADDRESS_RAM, 0x124, 0x3400 scratch) never forwarded; 0x1c00+j*16=SET_VERTEX_STREAM_A_FORMAT(j); next: MME setup prelude injection - SESSION 153 r1073-r1077

1 files changed, 74 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index cf3bf6a..8fd0603 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -13743,14 +13743,84 @@ static u64 svc_pass_hash;	/* r391f: this decode pass's push content hash */
  */
 unsigned gsp_sema_push_raw;
 unsigned gsp_sema_push_raw_small;
+static u32 svc_mme_census_flag;
 module_param_named(sema_push_raw_small, gsp_sema_push_raw_small, uint, 0644);
 MODULE_PARM_DESC(sema_push_raw_small,
 	"Verbatim decode dump for small GR pushes (16..511 B), bounded count (default 0)");
+module_param_named(sema_mme_census, svc_mme_census_flag, uint, 0644);
+MODULE_PARM_DESC(sema_mme_census,
+	"Census MME-family method ids (0x114..0x124, 0x234, 0x550..0x568, 0x3400..0x34fc, 0x3800..0x39fc) in beef pushes, bounded (default 0)");
 static u64 svc_pushraw_last_va;
 static u32 svc_pushraw_last_len;
 static u32 svc_pushraw_n;
 static u32 svc_pushraw_small_n;
 
+/*
+ * SESSION 153-CONTINUED-52: MME-family method census for the beef (GL 3D
+ * client) channel. The replayed draw windows raise a real MME ILLEGAL_OPCODE
+ * (NV_PGRAPH_PRI_MME_HWW_ESR bit 2) - the MME executed a macro whose code it
+ * could not fetch. The macro calls (CALL_MME_MACRO/DATA 0x3800..0x39fc) carry
+ * macro code addresses, so the macro CONTEXT state - the MME Instruction/
+ * Start-address RAM loads (0x114/0x118/0x11c/0x120), the shadow RAM control
+ * (0x124), MME version (0x234), the MME DMA window (0x550..0x568) and the
+ * shadow scratch (0x3400..0x34fc) - must have reached the ladder context too.
+ * If those setup methods never appear in ANY client push the MME can never
+ * have its macro library and the replay is doomed; if they do appear, the
+ * next question is which push forwards them. This census answers that: it
+ * scans every beef push for those method ids and logs a bounded one-line
+ * summary (first-hit offsets + first data word). Read-only; bounded.
+ */
+static u32 svc_mme_census_n;
+
+static void svc_mme_census(const u8 *buf, u32 len, u64 push_va, u32 h_object)
+{
+	u32 off = 0;
+	u32 nhit = 0;
+	char line[512];
+	int lc = 0;
+
+	if (!READ_ONCE(svc_mme_census_flag) || svc_mme_census_n >= 128)
+		return;
+	if ((h_object & 0xfffff000u) != 0xbeef0000u)
+		return;
+	while (off + 4 <= len && nhit < 16) {
+		u32 hdr, op, cnt, addr;
+
+		memcpy(&hdr, buf + off, 4);
+		op = (hdr >> 29) & 7u;
+		cnt = (hdr >> 16) & 0xfffu;
+		addr = (hdr & 0x1fffu) << 2;
+		if (op == 1u || op == 3u || op == 5u)
+			/* multi-word run: classify by its method id */
+			;
+		else if (op == 4u || op == 7u)
+			cnt = 0;
+		else
+			cnt = 0;
+		if ((addr >= 0x114u && addr <= 0x124u) ||
+		    addr == 0x234u ||
+		    (addr >= 0x550u && addr <= 0x568u) ||
+		    (addr >= 0x3400u && addr <= 0x34fcu) ||
+		    (addr >= 0x3800u && addr <= 0x39fcu)) {
+			u32 v0 = 0;
+
+			if (off + 8 <= len)
+				memcpy(&v0, buf + off + 4, 4);
+			lc += scnprintf(line + lc, sizeof(line) - lc,
+					"%s0x%x@0x%x(%08x)",
+					nhit ? "," : "", addr, off, v0);
+			nhit++;
+		}
+		off += (op == 1u || op == 3u || op == 5u) && cnt ?
+			(1u + cnt) * 4u : 4u;
+	}
+	if (nhit) {
+		svc_mme_census_n++;
+		pr_info("sema-mme-census: h=0x%x va=0x%llx len=%u n=%u hits=[%s]\n",
+			h_object, push_va, len, nhit, line);
+	}
+}
+
 static void svc_push_raw_dump(const u8 *buf, u32 len, u64 push_va,
 			      u32 h_object)
 {
@@ -14477,6 +14547,10 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
 		 len >= 16 && len < 512)
 		svc_push_raw_dump(buf, len, push_va, ch->h_object);
 
+	/* SESSION 153-CONTINUED-52: MME-family census for the beef channel. */
+	if (ch)
+		svc_mme_census(buf, len, push_va, ch->h_object);
+
 	memset(&st, 0, sizeof(st));
 	st.push_va = push_va;
 	/*