vgsp-sema: SESSION 134 CE first-submission capture + bounded completion hold - the CE ring latch instrument

The CE-class ring (the SASS-delivery channel's GPFIFO, registered at
gpfifo=0x4100000 on every boot) only ever latched on one boot (r763, the
FB convention matched shadow 0x80000 and the sweep decoded the inline
LAUNCH_DMA entry). On r765-r775 every deterministic source reads a zero
page (the page tables genuinely map the ring VA to an all-zero RAM page -
proven by the per-level walk trace) and the ring never appears in the
shadow (scan_hits=0 at the submission instant; dump_vidmem map shows only
the USERD put words) nor in the guest RAM image (a full 4 GB scan for
consecutive GPFIFO entry pairs around the CE push window finds none).

New bounded instrument, default-inert:
- svc_ce_firstsub_capture: on a CE channel's notifier clear (the one
  instant ring content and USERD are both live), before the clear write:
  reads entry0 through the channel translation and the trusted walk, then
  scans the shadow (0x100 step, 64 MB) for a CE-window ring page
  (1MB-aligned push VA in [0x120000000,0x121000000)) and latches via the
  standard USERD gate at +0x10000/+0x2000/+0x1000/+0x0. Budget 4/channel,
  16 witness rows/boot, reset by svc_session_flush.
- sema_ce_hold_ms (module param, default 0 = off): holds an unlatched CE
  channel's notifier busy for up to N ms so the guest keeps the
  submission in flight (and with it the ring content) while the VAS lands
  and the regular per-pass latch path retries; expires into the old
  clear behaviour.

r774/r775 evidence (sema_ce_hold_ms=8000): sema-cefirst at the first
submission shows rrc=-2 (no VAS yet at +0.2 s), wrc=-1 (walk unresolved),
scan_hits=0 (no shadow ring); 30 s later the walk answers a zero page
(rpa changing per boot, e0=0x0), the hold expires unlatched, and the
client still completes (VKFRAME_DONE) - the hold is safe but the ring's
write path is still not visible to the emulation. Remaining unknown is
named: the driver's ring writes reach neither the shadow nor the
PTE-mapped guest page.

0 files changed, 0 insertions, 0 deletions