vgsp-sema: SESSION 138 GR request-builder page-list + fill-candidate witness (sema_dbg-gated, bounded)

The dstpend/n_data frontier needed the launch's actual wiring. Prints, once
per launch within a bounded budget: the candidate handle, param_va, prog_va,
n_pointer + the QMD pointer pairs, the inline-rec count, and the resolved
gr_pages list (va/pa/ap/qmd_word); then in the fill, the built candidate
set with the arg flag.

First capture (r788, Vulkan launch h=0xbeec0100): param=0x4b86000 ->
page pa=0x386000 ap=2 qmd_word=32; prog=0xdff0feb900 -> page
pa=0x56b000 ap=2 qmd_word=48; ptr[0]=0xdff0febc00 word=34 (DEDUPED into
the qmd_word=48 page - same 4K page - and that page is never scanned by
the fill's word-32/32..47-even passes); the fill's only candidate is
0x43f00000 (arg=1, from the inline bytes) which resolves in NO vaspace
(rc=-2 in all four) -> n_data=0 -> the backend's min_data=2 refusal. The
param/prog/QMD-window pages read all-zero in the vidmem shadow on this
boot, so the launch's data/code bytes exist in no host-visible source.

1 files changed, 31 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 3ff38b6..4c54e0b 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -789,6 +789,9 @@ static unsigned long svc_gr_ring_done;	/* GR ranks whose ring is pinned */
 /* SESSION 133: ranks that already consumed their one shadow ring scan. */
 static unsigned long svc_gr_ring_scan_done;
 static unsigned long svc_gr_ring_scan_last;	/* rate limit for the scan */
+/* SESSION 138: bounded witness for the GR request builder's page list and
+ * the fill's candidate set (one launch's wiring printed per budget slice). */
+static u32 svc_gr_pages_log;
 
 static bool svc_pb_first_push(const u8 *buf)
 {
@@ -22237,6 +22240,15 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu,
 		 * inline-captured bytes as well (see svc_gr_scan_inline). */
 		svc_gr_scan_inline(wins, &n_cand, pp->va);
 	}
+	if (gsp_sema_dbg && svc_gr_pages_log < 48) {
+		svc_gr_pages_log++;
+		pr_info("sema-gr: fill cand n=%u pages=%u push=0x%llx\n",
+			n_cand, svc_fwd_req.gr_n_pages,
+			svc_fwd_req.gr_push_va);
+		for (w = 0; w < n_cand && w < 12; w++)
+			pr_info("sema-gr:   win[%u] va=0x%llx arg=%u\n",
+				w, wins[w], is_arg[w]);
+	}
 	/*
 	 * r635: the launch-level CONTENT anchor for the host-side fallback,
 	 * computed BEFORE the span loop so candidate order cannot decide.
@@ -22947,6 +22959,25 @@ static int svc_gr_req_fill(struct nv_vgpu_device *vgpu,
 	for (i = 0; i < svc_gr_cand.n_inline; i++)
 		svc_gr_page_note(vgpu, svc_gr_cand.inline_recs[i].dst_va,
 				 SVC_GR_QMD_WORD_NONE);
+	if (gsp_sema_dbg && svc_gr_pages_log < 24) {
+		svc_gr_pages_log++;
+		pr_info("sema-gr: cand h=0x%x param=0x%llx prog=0x%llx n_ptr=%u inline=%u n_pages=%u push=0x%llx\n",
+			svc_gr_cand.h_object, svc_gr_cand.param_va,
+			svc_gr_cand.prog_va, svc_gr_cand.n_pointer,
+			svc_gr_cand.n_inline, svc_fwd_req.gr_n_pages,
+			svc_gr_cand.push_va);
+		for (i = 0; i < svc_gr_cand.n_pointer && i < 8; i++)
+			pr_info("sema-gr:   ptr[%u] va=0x%llx word=%u\n", i,
+				svc_gr_cand.pointer_va[i],
+				svc_gr_cand.pointer_word[i]);
+		for (i = 0; i < svc_fwd_req.gr_n_pages && i < 12; i++) {
+			const struct svc_gr_page *pg =
+				&svc_fwd_req.gr_pages[i];
+
+			pr_info("sema-gr:   page[%u] va=0x%llx pa=0x%llx ap=%u qmd_word=%u\n",
+				i, pg->va, pg->pa, pg->ap, pg->qmd_word);
+		}
+	}
 	if (svc_fwd_req.gr_page_overflow || !svc_fwd_req.gr_n_pages)
 		return -E2BIG;
 	for (i = 0; i < svc_fwd_req.gr_n_pages; i++) {