kernel: enlarge the pin table and its probe window; tools: bridge client mappings into the service

The pin table became the primary VA->PA store once push-buffer regions and
bridged client mappings started adding thousands of pages per boot; at
8192 slots with an 8-probe window, inserts were silently dropped and
lookups missed at half load. 32768 slots and a 32-probe window keep the
mapped set intact.

tools/guest-diag/{guest_pmap_all.py,bridge_sems.sh} translate the CUDA
client's /dev/nvidia* mappings through the guest's own pagemap and inject
each present page into the service as a sysmem pin. With the client's
semaphore pages pinned the service applies their releases into the page
the client polls (verified: applied 67 -> 109, misses stop growing for
those VAs), where before every write went to the vidmem shadow.

3 files changed, 90 insertions, 3 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 34b9ffd..168e017 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -157,7 +157,14 @@ static u32 svc_map_hash[SEMA_MAP_MAX * 2];
  * (debug injection) and that must not be evicted by the learned cache, which
  * is content-addressed and gets thrashed by the lookup stream.
  */
-#define SVC_PIN_SLOTS		8192
+#define SVC_PIN_SLOTS		32768
+/*
+ * Linear-probe window for the pin table. The table is now the primary
+ * VA->PA store (push-buffer regions and bridged client mappings add
+ * thousands of pages at a time), so a short window would silently drop
+ * inserts and mis-resolve lookups once it is half full.
+ */
+#define SVC_PIN_PROBE		32
 
 struct svc_pin {
 	u64 va_page;
@@ -965,7 +972,7 @@ static int svc_pin_lookup(u64 va, u64 *pa, int *ap)
 	u32 h = (u32)((page >> SEMA_PAGE_SHIFT) * 2654435761u) & mask;
 	u32 probe;
 
-	for (probe = 0; probe < 8; probe++) {
+	for (probe = 0; probe < SVC_PIN_PROBE; probe++) {
 		struct svc_pin *p = &svc.pin[(h + probe) & mask];
 
 		if (!p->va_page)
@@ -986,7 +993,7 @@ static void svc_pin_store(u64 va, u64 pa, int ap)
 	u32 h = (u32)((page >> SEMA_PAGE_SHIFT) * 2654435761u) & mask;
 	u32 probe;
 
-	for (probe = 0; probe < 8; probe++) {
+	for (probe = 0; probe < SVC_PIN_PROBE; probe++) {
 		struct svc_pin *p = &svc.pin[(h + probe) & mask];
 
 		if (!p->va_page || p->va_page == page) {
diff --git a/tools/guest-diag/bridge_sems.sh b/tools/guest-diag/bridge_sems.sh
new file mode 100755
index 0000000..067a9ee
--- /dev/null
+++ b/tools/guest-diag/bridge_sems.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+# bridge_sems.sh - bridge the guest's own page table view into the host service.
+#
+# The emulation cannot (yet) translate the CUDA client's sysmem semaphores
+# (guest RAM pages mapped at VAs above the vidmem window base), so releases
+# for them are counted as misses. This helper translates the client's
+# /dev/nvidia* mappings through the guest's /proc/<pid>/pagemap (the guest
+# kernel owns the mapping) and injects each present page into the service as
+# a sysmem pin.
+#
+# Usage: tools/guest-diag/bridge_sems.sh [iterations] [prefix-hex]
+set -u
+cd "$(dirname "$0")/../.."
+
+ITER=${1:-1}
+START=${2:-0}
+VMEXEC=./scripts/vgpu_vm.py
+
+for i in $(seq 1 "$ITER"); do
+    pid=$(timeout 20 $VMEXEC exec --timeout 15 'pgrep -x cdt | head -1' 2>/dev/null | tail -1)
+    [ -n "$pid" ] || { echo "no cdt pid"; exit 1; }
+
+    b64=$(base64 -w0 tools/guest-diag/guest_pmap_all.py)
+    timeout 30 $VMEXEC exec --timeout 25 "echo '$b64' | base64 -d > /tmp/pmapall.py" >/dev/null 2>&1
+
+    cursor=$START
+    total=0
+    for chunk in $(seq 1 40); do
+        mapfile -t lines < <(timeout 60 $VMEXEC exec --timeout 50 "sudo python3 /tmp/pmapall.py $pid $cursor 100" 2>/dev/null | grep -aE '^0x[0-9a-f]+,0x[0-9a-f]+$')
+        [ "${#lines[@]}" -gt 0 ] || break
+        for l in "${lines[@]}"; do
+            va=${l%%,*}
+            pa=${l##*,}
+            echo "$va,$pa,0x1000,1" | sudo tee /sys/module/open_iov_vfio/parameters/sema_map_add >/dev/null
+        done
+        total=$((total + ${#lines[@]}))
+        last_va=${lines[-1]%%,*}
+        cursor=$(printf '0x%x' $(( 16#${last_va#0x} + 0x1000 )))
+    done
+    echo "iter $i: pinned $total pages (pid $pid)"
+    sleep 2
+done
\ No newline at end of file
diff --git a/tools/guest-diag/guest_pmap_all.py b/tools/guest-diag/guest_pmap_all.py
new file mode 100644
index 0000000..1a4df34
--- /dev/null
+++ b/tools/guest-diag/guest_pmap_all.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+# guest-side helper: dump present pages of the target's /dev/nvidia* mappings
+# as "va,pa" lines (root in the guest), starting at or above va-min and
+# stopping after max-pairs lines so the guest agent's output stays small.
+# Usage: sudo python3 guest_pmap_all.py <pid> [va-min-hex] [max-pairs]
+import os
+import sys
+
+pid = int(sys.argv[1])
+va_min = int(sys.argv[2], 16) if len(sys.argv) > 2 else 0
+maxp = int(sys.argv[3]) if len(sys.argv) > 3 else 300
+
+regions = []
+with open('/proc/%d/maps' % pid) as f:
+    for line in f:
+        parts = line.split()
+        a, b = parts[0].split('-')
+        lo, hi = int(a, 16), int(b, 16)
+        path = parts[5] if len(parts) >= 6 else ''
+        if 'nvidia' in path:
+            regions.append((max(lo, va_min), hi))
+
+fd = os.open('/proc/%d/pagemap' % pid, os.O_RDONLY)
+n = 0
+try:
+    for lo, hi in regions:
+        for va in range(lo, hi, 0x1000):
+            os.lseek(fd, (va // 4096) * 8, 0)
+            e = int.from_bytes(os.read(fd, 8), 'little')
+            if not ((e >> 63) & 1):
+                continue
+            pfn = e & ((1 << 55) - 1)
+            print('0x%x,0x%x' % (va, (pfn << 12)))
+            n += 1
+            if n >= maxp:
+                raise SystemExit
+finally:
+    os.close(fd)
\ No newline at end of file