vgsp-sema: chunk the discovery scan's guest reads (64 KB) - the rebuild was starving the pump

The full-RAM discovery scan read one 4 KB page per vfio_dma_rw call:
1.5 M guest reads over the 6 GB range, ~10-11 s per rebuild, and the
rebuild runs every 10 s - so the pump got roughly one pass per rebuild.
A client whose resolutions were dropped by a session flush then waited
minutes for the scan to re-find its pages (the observed post-flush
stall: data-VA copies returning -ENOENT with the pump counters frozen).
Reading 64 KB chunks amortizes the iommu walk + pin over 16 pages; the
per-page detection logic is unchanged.

1 files changed, 79 insertions, 56 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 42e8d76..2634220 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -93,6 +93,13 @@ static inline u64 svc_fb_shadow_size(const struct nv_vgpu_device *vgpu)
 #define KVA_HI			0xffffc00000000000ULL
 
 /*
+ * r534: guest-read granularity for the full-RAM discovery scan
+ * (svc_scan_pass). Hoisted here because the scan is defined before the
+ * push-apply window that used to own the define.
+ */
+#define SVC_SCAN_CHUNK	(64 * 1024)	/* 16 pages per guest read */
+
+/*
  * INC_METHOD header for the CE semaphore group. Observed value 0x20038090:
  *   bits [31:28] opcode/const, [23:16] count = 3, lower bits encode
  *   (address >> 2) == 0x240 plus subchannel flags (0x8000 in the observed
@@ -3994,76 +4001,92 @@ static void svc_scan_pass(struct nv_vgpu_device *vgpu, u8 *buf,
 	u64 gpa;
 	u32 nonz = 0;
 
-	for (gpa = 0; gpa < SEMA_PA_MAX; gpa += SEMA_PAGE_SIZE) {
-		u32 off;
+	/*
+	 * r534: read guest RAM in SVC_SCAN_CHUNK (64 KB) blocks instead of
+	 * one 4 KB page per vfio_dma_rw call. The full 6 GB scan is the
+	 * rebuild's whole cost (1.5 M guest reads ~= 10-11 s per rebuild,
+	 * once per 10 s: the pump got one pass per rebuild and the second
+	 * client's resolutions could wait minutes). A 64 KB read amortizes
+	 * the iommu walk + pin over 16 pages, cutting the scan to well under
+	 * a second with identical pair/base detection (the inner page loop
+	 * is byte-for-byte the old per-page body).
+	 */
+	for (gpa = 0; gpa < SEMA_PA_MAX; gpa += SVC_SCAN_CHUNK) {
+		u32 po;
 
 		if (READ_ONCE(svc_sess_flush))
 			break;	/* ISSUE-0002: a flush is waiting on this scan */
-		if (svc_read(vgpu, gpa, buf, SEMA_PAGE_SIZE))
+		if (svc_read(vgpu, gpa, buf, SVC_SCAN_CHUNK))
 			continue;
 
-		for (off = 0; off + 16 <= SEMA_PAGE_SIZE; off += 8) {
-			u64 a, b;
+		for (po = 0; po < SVC_SCAN_CHUNK; po += SEMA_PAGE_SIZE) {
+			u8 *page = buf + po;
+			u64 pg = gpa + po;
+			u32 off;
 
-			memcpy(&a, buf + off, 8);
-			memcpy(&b, buf + off + 8, 8);
+			for (off = 0; off + 16 <= SEMA_PAGE_SIZE; off += 8) {
+				u64 a, b;
 
-			/* (a) self-pointer -> base candidate */
-			if (a >= KVA_LO && a < KVA_HI &&
-			    (a & 0xfff) == ((gpa + off) & 0xfff)) {
-				u64 cb = a - gpa - off;
-				u32 i;
+				memcpy(&a, page + off, 8);
+				memcpy(&b, page + off + 8, 8);
 
-				if ((cb & 0x3fffffffULL) == 0) {
-					for (i = 0; i < *ncand; i++) {
-						if (cands[i].base == cb) {
-							cands[i].count++;
-							break;
+				/* (a) self-pointer -> base candidate */
+				if (a >= KVA_LO && a < KVA_HI &&
+				    (a & 0xfff) == ((pg + off) & 0xfff)) {
+					u64 cb = a - pg - off;
+					u32 i;
+
+					if ((cb & 0x3fffffffULL) == 0) {
+						for (i = 0; i < *ncand; i++) {
+							if (cands[i].base == cb) {
+								cands[i].count++;
+								break;
+							}
+						}
+						if (i == *ncand && *ncand < 8) {
+							cands[*ncand].base = cb;
+							cands[*ncand].count = 1;
+							(*ncand)++;
 						}
-					}
-					if (i == *ncand && *ncand < 8) {
-						cands[*ncand].base = cb;
-						cands[*ncand].count = 1;
-						(*ncand)++;
 					}
 				}
-			}
 
-			/* (b) {cpu_va, gpu_va} pair (page aligned: real mappings) */
-			if (a >= KVA_LO && a < KVA_HI &&
-			    b >= SEMA_VA_LO && b < SEMA_VA_HI &&
-			    (a & 0xfff) == 0 && (b & 0xfff) == 0 &&
-			    *npairs < PAIR_MAX) {
-				u8 ok = 0;
+				/* (b) {cpu_va, gpu_va} pair (page aligned: real mappings) */
+				if (a >= KVA_LO && a < KVA_HI &&
+				    b >= SEMA_VA_LO && b < SEMA_VA_HI &&
+				    (a & 0xfff) == 0 && (b & 0xfff) == 0 &&
+				    *npairs < PAIR_MAX) {
+					u8 ok = 0;
 
-				/*
-				 * UVM's uvm_rm_mem_t stores vas[UVM_ID_CPU]
-				 * (offset 48) directly before vas[UVM_ID_GPU0]
-				 * (offset 56), so a pair taken from a live rm_mem
-				 * is preceded by the header {u32 type; bitmap
-				 * mapped_on}. Validate it when it fits in the same
-				 * page: freed allocations and unrelated tables
-				 * that happen to hold KVA/VA pairs do not match,
-				 * and a stale entry for the same VA must not
-				 * shadow the live one.
-				 */
-				if (off >= 48) {
-					u32 type;
-					u64 mapped_on;
-
-					memcpy(&type, buf + off - 48, 4);
-					memcpy(&mapped_on, buf + off - 40, 8);
-					if ((type == 0 || type == 1) &&
-					    (mapped_on & 0x3) == 0x3)
-						ok = 1;
+					/*
+					 * UVM's uvm_rm_mem_t stores vas[UVM_ID_CPU]
+					 * (offset 48) directly before vas[UVM_ID_GPU0]
+					 * (offset 56), so a pair taken from a live rm_mem
+					 * is preceded by the header {u32 type; bitmap
+					 * mapped_on}. Validate it when it fits in the same
+					 * page: freed allocations and unrelated tables
+					 * that happen to hold KVA/VA pairs do not match,
+					 * and a stale entry for the same VA must not
+					 * shadow the live one.
+					 */
+					if (off >= 48) {
+						u32 type;
+						u64 mapped_on;
+
+						memcpy(&type, page + off - 48, 4);
+						memcpy(&mapped_on, page + off - 40, 8);
+						if ((type == 0 || type == 1) &&
+						    (mapped_on & 0x3) == 0x3)
+							ok = 1;
+					}
+					pairs[*npairs].cpu_va = a;
+					pairs[*npairs].gpu_va = b;
+					pairs[*npairs].valid_hdr = ok;
+					(*npairs)++;
 				}
-				pairs[*npairs].cpu_va = a;
-				pairs[*npairs].gpu_va = b;
-				pairs[*npairs].valid_hdr = ok;
-				(*npairs)++;
 			}
+			nonz++;
 		}
-		nonz++;
 	}
 }
 
@@ -4372,7 +4395,8 @@ static void svc_rebuild(struct nv_vgpu_device *vgpu)
 		return;
 
 	if (!buf) {
-		buf = kmalloc(SEMA_PAGE_SIZE, GFP_KERNEL);
+		/* r534: sized for svc_scan_pass's 64 KB chunked guest reads. */
+		buf = kmalloc(SVC_SCAN_CHUNK, GFP_KERNEL);
 		if (!buf)
 			return;
 	}
@@ -12282,7 +12306,6 @@ static u32 svc_apply_page(struct nv_vgpu_device *vgpu, u8 *buf, u64 pa_page)
  * *semaphore* address inside a release needs to resolve through the map.
  */
 #define SVC_SCAN_WINDOW	(32ULL << 20)	/* 32 MB per pass */
-#define SVC_SCAN_CHUNK	(64 * 1024)	/* 16 pages per guest read */
 #define SVC_MBUF_MAX	6		/* rescue pin candidates */
 
 /*