sema: r384b narrow the fill pin-demand hold to SYS (guest RAM) resolutions + FILL-EXEC witness

- The r384 boot held a large fill whose walk resolution was VID (the
  emulated vidmem shadow) - the hold was pointless overhead there and
  the re-decode re-resolves (the resolver is non-deterministic), so the
  hold now applies only when the fill would land in guest RAM (SYS
  aperture), the class that zeroed the guest's page-table pages. Shadow
  resolutions stay immediate.
- FILL-EXEC witness (bounded 64/boot): va, pa, aperture, provenance and
  pattern of every >= 4 KiB virtual fill execution - the decisive line
  for the boot-corruption forensics; the large zero fills were invisible
  until now.

1 files changed, 21 insertions, 5 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index d02b789..419a54a 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -4651,6 +4651,7 @@ static struct {
 static u32 svc_fill_guard_next;
 static u32 svc_fill_held;
 static u32 svc_fill_pt_refused;
+static u32 svc_fill_exec_log;	/* r384 FILL-EXEC witness budget */
 
 /* true = the guard may hold this fill; false = fail-open, run it. */
 static bool svc_fill_guard_hold(u64 va)
@@ -4825,16 +4826,19 @@ static int svc_fill(struct nv_vgpu_device *vgpu, u64 addr, u64 value, u32 elem,
 		/*
 		 * r384 net 1 (pin-demand hold for unproven large fills): a
 		 * >= 64 KiB virtual fill whose only authority is the
-		 * walk/scan resolver (no pin, no landing-table entry) is the
-		 * class that zeroed the guest's page-table pages (see the
-		 * guard commentary above svc_fill_guard_hold). Demand the VA
+		 * walk/scan resolver (no pin, no landing-table entry) AND
+		 * which would land in GUEST RAM (SYS aperture) is the class
+		 * that zeroed the guest's page-table pages (see the guard
+		 * commentary above svc_fill_guard_hold). Demand the VA
 		 * through the pin channel and hold the op through a short
 		 * bounded window so the retried decode resolves through the
 		 * guest's own pagemap; fail open with the historical
-		 * behaviour after the bound.
+		 * behaviour after the bound. Vidmem-shadow resolutions are
+		 * the emulation's own memory and stay immediate.
 		 */
 		if (gsp_sema_fill_guard && va0 >= SVC_VAS_FLOOR && !shadow &&
-		    total >= (64u << 10) && prov >= 3) {
+		    total >= (64u << 10) && prov >= 3 &&
+		    aperture == CE_APERTURE_SYS) {
 			svc_log_stalled_va(va0);
 			if (svc_fill_guard_hold(va0)) {
 				svc_fill_held++;
@@ -4868,6 +4872,18 @@ static int svc_fill(struct nv_vgpu_device *vgpu, u64 addr, u64 value, u32 elem,
 			svc_log_stalled_va(va0);
 			return -ENOENT;
 		}
+		/*
+		 * r384 witness: where every >= 4 KiB virtual fill actually
+		 * lands (va, pa, aperture, resolution provenance, pattern) -
+		 * the decisive line for the boot-corruption forensics (the
+		 * large zero fills were invisible until now). Bounded.
+		 */
+		if (va0 >= SVC_VAS_FLOOR && !shadow &&
+		    total >= SEMA_PAGE_SIZE && svc_fill_exec_log < 64) {
+			svc_fill_exec_log++;
+			pr_info("sema-svc: FILL-EXEC va=0x%llx pa=0x%llx ap=%u prov=%u total=%zu value=0x%llx\n",
+				va0, addr, aperture, prov, total, value);
+		}
 	}
 
 	if (gsp_sema_dbg && !shadow && svc_dst_watched(addr) &&