vgsp: CONT-94 - svc_init_push_scan (per-beef-push census of SET_SHADER_LOCAL_MEMORY_A..D 0x790-0x79c + host-side verbatim capture first >=4KiB beef push per boot INIT-CAP) + gsp-phys-init-push debugfs - lmem lead REFUTED 4 ways: INIT-CAP h=0xbeef0100 va=0x4021004 len=60216 lmem_runs=0; 60216B init push decodes to words:15054 distinct methods:2 = pure MME microcode (0x114x213/0x11c x213), 0 lmem hits; addr=0x79[0-9a-c] in 64 pushraw dumps = 0; whole-RAM scans no genuine run (x86 code bytes only); driver emission point exists (gf100Init.c:1344 gf100program.c:1479) but 570.144 never pushes it here; per-window latch unchanged ds=a6000e20 x5 + first a2000a00 sph=0,00600900,00600200,0,0,00600000 rr=0,0; oracle DS_HWW_ESR 80000000 DS_REPORT_MASK 0 DS_SPH_REGION_A/B 0/0 GR_FIFO 00000001; wedge persists (PARK-RECOVER #11 rc=-110); next: prove client's promoted GR context buffer engine-visible on replay channel at launch - instrument PROMOTE_CTX engine=1 entry[0] pa=0x234200000/va=0x120420000 size=0x133000 bInitialize=1 binding; if absent install it (SPH validation vs zero context matches rr=0/0); parallel decode fwimage DS_HWW_ESR handler (off 0x11a908 SPH0..30) w/ risc-v-gsp-rm-debugger - SESSION 153 r1321

1 files changed, 82 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index e96b929..c30cc22 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -14637,6 +14637,84 @@ static void svc_mme_census(const u8 *buf, u32 len, u64 push_va, u32 h_object)
 }
 
 /*
+ * SESSION 153-CONTINUED-94: client init-push capture + local-memory census.
+ *
+ * CONT-93's "single most concrete next fix" was that the GL driver's
+ * download-state LOCAL MEMORY push (SET_SHADER_LOCAL_MEMORY_A/B/C/D,
+ * 0x790-0x79c) is the last channel-init class missing from the replayed
+ * context. The claim is directly decidable at this decode site: every
+ * client push that reaches the service is walked once, so any INC run at
+ * 0x790..0x79c is counted and logged with its values (bounded). The
+ * guest-RAM scrape alone cannot settle it: the client's pushbuffer is
+ * transient (the staging copies observed at init read back all-zero
+ * minutes later), so the first large beef push of a boot is preserved
+ * host-side and dumped through the gsp-phys-init-push debugfs file.
+ * Read-only instrumentation; beef channels only.
+ */
+#define SVC_INIT_CAP_BYTES (64u * 1024u)
+static u8 svc_init_cap[SVC_INIT_CAP_BYTES];
+static u32 svc_init_cap_len;
+static u32 svc_init_cap_h;
+static u64 svc_init_cap_va;
+static bool svc_init_cap_done;
+static u32 svc_lmem_hits;
+static u32 svc_lmem_seen;
+
+static void svc_init_push_scan(const u8 *buf, u32 len, u64 push_va, u32 h_object)
+{
+	u32 off = 0;
+
+	if ((h_object & 0xfffff000u) != 0xbeef0000u)
+		return;
+	while (off + 4u <= len) {
+		u32 hdr, op, cnt, m;
+
+		memcpy(&hdr, buf + off, 4);
+		op = (hdr >> 29) & 7u;
+		cnt = (hdr >> 16) & 0xfffu;
+		m = (hdr & 0x1fffu) << 2;
+		if (m >= 0x790u && m <= 0x79cu &&
+		    (op == 1u || op == 3u || op == 5u) &&
+		    cnt >= 1u && cnt <= 8u && off + 4u + cnt * 4u <= len) {
+			svc_lmem_seen++;
+			if (svc_lmem_hits < 16u) {
+				u32 k, v[4] = {0, 0, 0, 0};
+
+				for (k = 0; k < cnt && k < 4u; k++)
+					memcpy(&v[k], buf + off + 4u + k * 4u, 4);
+				svc_lmem_hits++;
+				pr_info("vgsp-sema: INIT-LMEM h=0x%x va=0x%llx m=0x%x cnt=%u vals=%08x,%08x,%08x,%08x\n",
+					h_object, push_va, m, cnt,
+					v[0], v[1], v[2], v[3]);
+			}
+		}
+		if ((op == 1u || op == 3u || op == 5u) && cnt && cnt <= 0xfffu)
+			off += 4u + cnt * 4u;
+		else
+			off += 4u;
+	}
+	if (!svc_init_cap_done && len >= 4096u &&
+	    memchr_inv(buf, 0, min_t(u32, len, 64u))) {
+		svc_init_cap_len = min_t(u32, len, SVC_INIT_CAP_BYTES);
+		memcpy(svc_init_cap, buf, svc_init_cap_len);
+		svc_init_cap_h = h_object;
+		svc_init_cap_va = push_va;
+		svc_init_cap_done = true;
+		pr_info("vgsp-sema: INIT-CAP h=0x%x va=0x%llx len=%u lmem_runs=%u (gsp-phys-init-push)\n",
+			h_object, push_va, svc_init_cap_len, svc_lmem_seen);
+	}
+}
+
+const u8 *gsp_sema_init_cap_get(u32 *len, u32 *h, u64 *va, u32 *lmem_seen)
+{
+	*len = svc_init_cap_len;
+	*h = svc_init_cap_h;
+	*va = svc_init_cap_va;
+	*lmem_seen = svc_lmem_seen;
+	return svc_init_cap;
+}
+
+/*
  * SESSION 153-CONTINUED-53: MME context-setup prelude buffer.
  *
  * The draw-window replay raises a real MME ILLEGAL_OPCODE
@@ -16062,6 +16140,10 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
 	if (ch)
 		svc_mme_census(buf, len, push_va, ch->h_object);
 
+	/* SESSION 153-CONTINUED-94: init-push capture + local-memory census. */
+	if (ch)
+		svc_init_push_scan(buf, len, push_va, ch->h_object);
+
 	/*
 	 * SESSION 153-CONTINUED-53: MME context-setup prelude capture. Only a
 	 * trusted resolution feeds the buffer (the bytes are replayed into a