boot/gr: r391d post-write witness - read the VA's landing page immediately after the copy-out write

The sum=0 class: OUT-PAGE-WIT shows the changed page's bytes in the bounce
(the correct sum) and the ledger resolution (pa=0x7c00000 ap=FB), the
copy-out writes hpa=0x16f07a000, and the D2H read of the same ledger page
8-34 ms later reads zeros. sema-fbhpa proves __va(hpa) == base+pa at submit
time. This witness reads the page right after the memcpy through the same
path the D2H reader uses, so the next failing run names whether the write
target and the reader's page differ (aperture/staleness) or the write
vanished.

1 files changed, 20 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 5f57370..5206f9b 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -21029,6 +21029,26 @@ gr_page_unmapped:
 			gsp_phys_gr_page_spot_check(
 				(const u8 *)__va(req->data[wbi].hpa), src,
 				req->data[wbi].va, "gr-bounce-copy-out");
+			/*
+			 * r391d post-write witness (sum=0 class): read the VA's
+			 * landing page right after the write through the same
+			 * path the D2H reader uses. If val8 is not first8 the
+			 * write target and the reader's page are different
+			 * (aperture/staleness disagreement), not a lost write.
+			 */
+			if (outwit < GSP_PHYS_GR_COPYWIT_MAX) {
+				u64 rpa2 = 0, rval2 = 0;
+				u32 rap2 = 0;
+
+				if (gsp_sema_gr_va_snap(req->data[wbi].va,
+							&rpa2, &rap2, &rval2)) {
+					outwit++;
+					pr_info("vgsp-gr: OUT-PAGE-POST va=0x%llx hpa=0x%llx res_pa=0x%llx ap=%u val8=%016llx\n",
+						req->data[wbi].va,
+						req->data[wbi].hpa, rpa2,
+						rap2, rval2);
+				}
+			}
 			wrote++;
 		}
 		if ((u64)req->n_data << 12 >= GSP_PHYS_GR_AUDIT_MIN)