vgsp-sema: re-arm ring/push-buffer discovery latches on channel registration; scanner streams anonymous high-VA buffers

Second-client wedge fix: a new GSP session re-registers the same channel
handles/ranks, but the per-rank one-shot ring/push-buffer discovery latches
stayed set from the previous session, so the new session's ring was never
re-autopinned (ring_auto=0 pb=0/0, nomap growing) and the guest spun in its
channel-creation wait. svc_chan_rearm_rank() clears the latches on every
channel registration; all post-fix cycles launch the second client.

Scanner: guest_pin_stream.py now streams the client's anonymous high-VA
mappings (cudaMalloc buffers were skipped by the old len(parts)<6 check),
so the host can learn their pages.

Diagnostics: PT-window lines, per-window first words, post-OK qmdwin
w48..59. Remaining: the fill-time svc_ipin_lookup miss for the second
client's a/b/c pins (they exist in the pin log but are not seen at fill
time) - next session.

1 files changed, 44 insertions, 2 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index f083c99..72cda10 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -17302,6 +17302,17 @@ gr_page_unmapped:
 					le64_to_cpu(pv[s + 2]), le64_to_cpu(pv[s + 3]),
 					le64_to_cpu(pv[s + 4]), le64_to_cpu(pv[s + 5]),
 					le64_to_cpu(pv[s + 6]), le64_to_cpu(pv[s + 7]));
+			/* m143b: the b (0x130..) and c (0x150..) relocated windows
+			 * and the trailing data window, so an aliased/stale PTE
+			 * that redirects an engine access into another window is
+			 * visible in the same log. */
+			for (s = 0x130; s < 0x180; s += 0x20)
+				pr_info("vgsp-gr: main PT[%03x..%03x]=%016llx %016llx %016llx %016llx %016llx %016llx %016llx %016llx\n",
+					s, s + 7,
+					le64_to_cpu(pv[s]), le64_to_cpu(pv[s + 1]),
+					le64_to_cpu(pv[s + 2]), le64_to_cpu(pv[s + 3]),
+					le64_to_cpu(pv[s + 4]), le64_to_cpu(pv[s + 5]),
+					le64_to_cpu(pv[s + 6]), le64_to_cpu(pv[s + 7]));
 			for (s = 0x190; s < 0x1a0; s += 8)
 				pr_info("vgsp-gr: main PT[%03x..%03x]=%016llx %016llx %016llx %016llx %016llx %016llx %016llx %016llx\n",
 					s, s + 7,
@@ -17909,6 +17920,36 @@ gr_page_unmapped:
 			       GSP_PHYS_PAGE_SIZE);
 			wrote++;
 		}
+		/* m143b: unconditional first words of the first page of each
+		 * 32-page relocation window (a=0x110000, b=0x130000, c=0x150000)
+		 * after the run, so the engine's read/write footprint per window
+		 * is provable without relying on the changed-page counter. */
+		{
+			u32 wi;
+
+			for (wi = 0; wi + 1 < req->n_data; wi += 32) {
+				u32 bi = (u32)((req->data[wi].reloc_va -
+						GSP_PHYS_RMCALL_GR_BOUNCE_VA0) >>
+					       12);
+				const u8 *wp;
+				u32 wc = 0, k;
+
+				if (bi >= GSP_PHYS_RMCALL_GR_MAIL_SLOT)
+					continue;
+				wp = gsp_phys_chunk_page_va(
+					&boot_stage.rmcall_gr_bounce, bi);
+				for (k = 0; k < GSP_PHYS_PAGE_SIZE; k += 4)
+					wc += get_unaligned_le32(wp + k);
+				pr_info("vgsp-gr: window[%u] reloc=0x%llx first=%08x %08x %08x %08x changed=%u\n",
+					bi,
+					req->data[wi].reloc_va,
+					get_unaligned_le32(wp),
+					get_unaligned_le32(wp + 4),
+					get_unaligned_le32(wp + 8),
+					get_unaligned_le32(wp + 12),
+					wc != bounce_csum_in[bi]);
+			}
+		}
 		pr_info("vgsp-gr: bounce copy-out: %u pages written back, %u changed by engine (first bi: %u %u %u %u %u %u %u %u)\n",
 			wrote, changed, chg[0], chg[1], chg[2], chg[3], chg[4],
 			chg[5], chg[6], chg[7]);
@@ -17932,8 +17973,9 @@ gr_page_unmapped:
 			&boot_stage.rmcall_gr_qmdwin, 0);
 
 		if (qw)
-			pr_info("vgsp-gr: post-OK qmdwin w48..51=%08x %08x %08x %08x\n",
-				qw[48], qw[49], qw[50], qw[51]);
+			pr_info("vgsp-gr: post-OK qmdwin w48..59=%08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
+				qw[48], qw[49], qw[50], qw[51], qw[52], qw[53],
+				qw[54], qw[55], qw[56], qw[57], qw[58], qw[59]);
 	}
 	ret = 0;