sema: add walk_probe - trace the page-table walk for a VA

New module parameter walk_probe <va> runs the recorded-va-space walks and
the discovered-directory walk directly (pin/lat/pair map bypassed) with
per-level tracing, and prints the result of each. This separates 'the
page tables are not walkable' from 'the VA->PA pair map already answers'
when a translation is missing. Baseline on a live boot: root PDB entries
are zero (L0 e=0 idx=0) so the writes UVM issues into the level pages
have no parent entry yet.

3 files changed, 93 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 734fb1d..0578d3c 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -3428,6 +3428,76 @@ int gsp_sema_service_probe(u64 gpu_va, u32 count)
 }
 
 /*
+ * Diagnostic: run the page-table walks directly for one VA (pin/lat/map
+ * bypassed), with per-level tracing. Answers "are the written page tables
+ * walkable?" independently of the discovered VA->PA pair map, which is the
+ * only way to tell whether the GPU page tables in vidmem actually work.
+ */
+static struct completion walk_probe_done;
+static u64 walk_probe_va;
+static bool walk_probe_pending;
+
+static void svc_handle_walk_probe(struct nv_vgpu_device *vgpu)
+{
+	u64 va;
+	int i;
+
+	if (!walk_probe_pending)
+		return;
+
+	va = walk_probe_va & ~(u64)(SEMA_PAGE_SIZE - 1);
+	pr_info("sema-walk-probe: va=0x%llx discovered pdb=0x%llx ap=%d entries=%u found=%u\n",
+		va, svc_pd_base, svc_pd_ap, svc_pd_entries, svc_pd_found);
+
+	for (i = 0; i < SVC_MAX_VASPACES; i++) {
+		u64 addr = 0;
+		int ap = SVC_APERTURE_SYS;
+		int rc;
+
+		if (!svc.vas[i].valid)
+			continue;
+		pr_info("sema-walk-probe: vas[%d] h=0x%x pdb=0x%llx ent=%u ap=%d\n",
+			i, svc.vas[i].h_vaspace, svc.vas[i].pdb,
+			svc.vas[i].entries, svc.vas[i].ap);
+		rc = svc_gmmu_walk(vgpu, svc.vas[i].pdb,
+				   svc.vas[i].entries, va, svc.vas[i].ap,
+				   &addr, &ap, true);
+		pr_info("sema-walk-probe:   rc=%d pa=0x%llx aperture=%s\n",
+			rc, addr,
+			ap == SVC_APERTURE_FB ? "vidmem" : "ram");
+	}
+
+	{
+		u64 addr = 0;
+		int ap = SVC_APERTURE_SYS;
+		int rc = svc_walk_discovered(vgpu, va, &addr, &ap);
+
+		pr_info("sema-walk-probe: discovered rc=%d pa=0x%llx aperture=%s\n",
+			rc, addr,
+			ap == SVC_APERTURE_FB ? "vidmem" : "ram");
+	}
+
+	walk_probe_pending = false;
+	complete(&walk_probe_done);
+}
+
+int gsp_sema_service_walk_probe(u64 gpu_va)
+{
+	if (!svc.task)
+		return -ENODEV;
+
+	init_completion(&walk_probe_done);
+	walk_probe_va = gpu_va;
+	walk_probe_pending = true;
+
+	if (!wait_for_completion_timeout(&walk_probe_done, 3 * HZ)) {
+		walk_probe_pending = false;
+		return -ETIMEDOUT;
+	}
+	return 0;
+}
+
+/*
  * Diagnostic dump of the service's channel table: GPFIFO/USERD state, the
  * pending-entry expectation and the two NvNotification slots the client polls
  * (status + info32). Runs in the service thread (guest-DMA reads need a
@@ -3615,6 +3685,7 @@ static int svc_thread(void *arg)
 		}
 
 		svc_handle_probe(vgpu);
+		svc_handle_walk_probe(vgpu);
 		svc_handle_map_add();
 		svc_handle_chan_dump(vgpu);
 
diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index f652ffd..e67f0ba 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -57,6 +57,7 @@ void gsp_sema_service_vaspace_del(u32 h_vaspace);
 int  gsp_sema_service_start(void);
 void gsp_sema_service_stop(void);
 int  gsp_sema_service_probe(u64 gpu_va, u32 count);
+int  gsp_sema_service_walk_probe(u64 gpu_va);
 int  gsp_sema_service_dump_channels(void);
 int  gsp_sema_service_add_map(u64 gpu_va, u64 pa, u64 len, u32 ap);
 void gsp_sema_service_doorbell(u32 token);
diff --git a/kernel/main.c b/kernel/main.c
index 4f7f9ee..dcfdeed 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -2248,6 +2248,27 @@ module_param_cb(sema_probe, &nv_vgpu_sema_probe_ops, NULL, 0200);
 MODULE_PARM_DESC(sema_probe, "Dump sema-service map + slot values for a GPU VA");
 
 /*
+ * Debug: run the page-table walks for a GPU VA with per-level tracing,
+ * bypassing the pin/lat/pair map (see gsp_sema_service_walk_probe):
+ *   echo 0x20400f000 > .../parameters/walk_probe
+ */
+static int nv_vgpu_walk_probe_set(const char *val, const struct kernel_param *kp)
+{
+	u64 va = 0;
+
+	if (kstrtoull(val, 0, &va))
+		return -EINVAL;
+	return gsp_sema_service_walk_probe(va);
+}
+
+static const struct kernel_param_ops nv_vgpu_walk_probe_ops = {
+	.set = nv_vgpu_walk_probe_set,
+};
+
+module_param_cb(walk_probe, &nv_vgpu_walk_probe_ops, NULL, 0200);
+MODULE_PARM_DESC(walk_probe, "Trace the page-table walks for a GPU VA (hex)");
+
+/*
  * Debug: dump the semaphore service's channel table (GPFIFO/USERD state and
  * the two NvNotification slots each channel exposes):
  *   echo 1 > .../parameters/chan_dump