sema/boot: r391e print the shadow base pointer in the copy-out and bigcopy witnesses

Rule in/out a stale or duplicate vgpu->bars[1] shadow between the launch
copy-out (svc_fwd_req.vgpu) and the D2H reader (svc_copy's vgpu): the sum=0
runs show the write landing (OUT-PAGE-POST val8 = the sum) and the reader
of the same ledger page reading zeros 8 ms later with no logged writer in
between. Diagnostic only.

3 files changed, 16 insertions, 6 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 5206f9b..d01bcf3 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -20959,7 +20959,7 @@ gr_page_unmapped:
 						&rap, &rval);
 
 					outwit++;
-					pr_info("vgsp-gr: OUT-PAGE-WIT va=0x%llx hpa=0x%llx bi=%u first8=%016llx last8=%016llx pre=%08x post=%08x res=%s pa=0x%llx ap=%u val8=%016llx\n",
+					pr_info("vgsp-gr: OUT-PAGE-WIT va=0x%llx hpa=0x%llx bi=%u first8=%016llx last8=%016llx pre=%08x post=%08x res=%s pa=0x%llx ap=%u val8=%016llx vbase=%px\n",
 						req->data[wbi].va,
 						req->data[wbi].hpa, bi, f8,
 						(u64)get_unaligned_le64(
@@ -20967,7 +20967,8 @@ gr_page_unmapped:
 							8),
 						bounce_csum_in[bi], csum,
 						rhave ? "ledger" : "none",
-						rpa, rap, rval);
+						rpa, rap, rval,
+						(void *)gsp_sema_gr_shadow_base());
 				}
 				/*
 				 * OUT-ALIAS-WIT: identical first 8 bytes as
@@ -21043,10 +21044,11 @@ gr_page_unmapped:
 				if (gsp_sema_gr_va_snap(req->data[wbi].va,
 							&rpa2, &rap2, &rval2)) {
 					outwit++;
-					pr_info("vgsp-gr: OUT-PAGE-POST va=0x%llx hpa=0x%llx res_pa=0x%llx ap=%u val8=%016llx\n",
+					pr_info("vgsp-gr: OUT-PAGE-POST va=0x%llx hpa=0x%llx res_pa=0x%llx ap=%u val8=%016llx vbase=%px\n",
 						req->data[wbi].va,
 						req->data[wbi].hpa, rpa2,
-						rap2, rval2);
+						rap2, rval2,
+						(void *)gsp_sema_gr_shadow_base());
 				}
 			}
 			wrote++;
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 2fb4fe1..40a8867 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -6213,10 +6213,10 @@ static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total,
 		} else {
 			svc_read(vgpu, dst, db, sizeof(db));
 		}
-		pr_info("sema-bigcopy: dst_va=0x%llx -> pa=0x%llx ap=%u prov=%u shadow=%u | src_va=0x%llx -> pa=0x%llx ap=%u prov=%u shadow=%u | bytes=%zu\n",
+		pr_info("sema-bigcopy: dst_va=0x%llx -> pa=0x%llx ap=%u prov=%u shadow=%u | src_va=0x%llx -> pa=0x%llx ap=%u prov=%u shadow=%u | bytes=%zu vbase=%px\n",
 			dst_orig, dst, dst_aperture, dst_prov, dst_shadow,
 			src_orig, src, src_aperture, src_prov, src_shadow,
-			total);
+			total, (void *)vgpu->bars[1].vaddr);
 		/*
 		 * r348 diagnostic: for a high-VA SYS source name the exact
 		 * host PA this read will touch (gpa_to_hpa) - the direct
@@ -17500,6 +17500,13 @@ bool gsp_sema_gr_va_snap(u64 va, u64 *pa, u32 *ap, u64 *val8)
 	return true;
 }
 
+/* r391 diagnostic: the shadow base this service resolves through (compare
+ * against the CE copy path's own vgpu->bars[1].vaddr in the same run). */
+u8 *gsp_sema_gr_shadow_base(void)
+{
+	return svc_fwd_req.vgpu ? svc_fwd_req.vgpu->bars[1].vaddr : NULL;
+}
+
 /*
  * m144 (second-client launch-state divergence): collect device-VA-shaped
  * candidate pointers from the bytes the ENGINE will actually execute.
diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index cef7b0a..ea025ca 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -417,5 +417,6 @@ bool gsp_sema_write_guard(u64 va, u64 pa, u32 ap, const char *path);
  * resolves) is one line instead of a forensics session.
  */
 bool gsp_sema_gr_va_snap(u64 va, u64 *pa, u32 *ap, u64 *val8);
+u8 *gsp_sema_gr_shadow_base(void);
 
 #endif /* _GSP_SEMA_SERVICE_H_ */