vgsp: WIP beef ring VAS promote + widen CB scan to draw channel (CONT.399)

- svc_chan_vas_candidate_promote: fall back to svc_channel_owner_vas when
  the GR client channel declares hVASpace==0 (the helper previously returned
  early for exactly the channel whose ring we need to resolve).
- svc_gl_cb_upload_scan: also scan the 0x01xxxxxx RM-channel family (the
  channel that actually replays the draws), not only beef.

NOT YET VERIFIED to resolve the beef ring: the CE siblings register ~19 ms
after the GR channel, and VAS 0xbeef0300 is already 'known' (registered
UNVERIFIED after 1 ms) by then, so the content-verify is skipped. The beef
ring gpfifo=0x4020000 stays ring_pa=0 and the CB scan never runs. See
CONT.399 in handoff-meta-plan.md for the full diagnosis.

1 files changed, 16 insertions, 1 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 079fce4..a915108 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -16375,7 +16375,14 @@ static void svc_gl_cb_upload_scan(struct nv_vgpu_device *vgpu, u32 h_object,
 	u32 b3800_first = 0xffffffffu;
 
 	(void)vgpu;
-	if ((h_object & 0xfffff000u) != 0xbeef0000u || !buf || len < 16u)
+	/*
+	 * CB-DIAG (2026-11-10): the draws that actually replay ride the
+	 * 0x01xxxxxx RM-channel family (e.g. 0x1000014), not only the beef
+	 * GL channel; widen the scan so the fixed-CB uploads on the draw
+	 * channel are captured too.
+	 */
+	if (((h_object & 0xfffff000u) != 0xbeef0000u &&
+	     (h_object & 0xff000000u) != 0x01000000u) || !buf || len < 16u)
 		return;
 	/*
 	 * A new SET_MME_SHADOW_SCRATCH(0x18) names a new fixed-CB base:
@@ -29317,6 +29324,14 @@ static void svc_chan_vas_candidate_promote(struct nv_vgpu_device *vgpu,
 	u32 h = ch->h_vaspace;
 	int i;
 
+	/*
+	 * X-DMA-FIX: the GR client channel declares hVASpace==0 (attach to
+	 * the TSG); its real VAS is published by its CE siblings. Without
+	 * this fallback the helper returned early for exactly the channel
+	 * whose ring we need to resolve.
+	 */
+	if (!h)
+		h = svc_channel_owner_vas(vgpu, ch->h_object);
 	if (!h || svc_vaspace_known(h) || !ch->gpfifo_va ||
 	    ch->gpfifo_entries < 2)
 		return;