vgsp-gr: B-2 planted 64 MiB data-bounce region for large GR operands

Replace the 205-page / 68-pages-per-pointer GR operand window with a
boot-planted 16384-page (64 MiB) region at VA 0x0a000000 (PD0 80..111):
one dual PD0 entry per 2 MB window backed by one fresh 4 KB PT page,
every leaf PTE written at stage 3 before any engine fetch (the GMMU has
no PTE invalidate, so no leaf is rewritten at runtime). The 208-page
window, mail slot 206 and marker 207 stay as-is (mail injection and
copy diagnostics unchanged) but carry no operand data when the grown
region is on.

Sema service: reloc base and page cap derive from the shared header
constants; per-pointer span becomes a 4096-page runaway guard; a total
cap hit is fail-closed (launch stalled for the bounded hold, loud
CAP-HIT log, no silent truncation); the launch's own param/bank pages
are skipped as data candidates (budget hygiene). Copy-in, copy-out,
retirement wait and the window diagnostic index the active region
through one helper/chunk selector; checksum and dedup scratch move off
the kernel stack.

gsp_phys_gr_data_region=0 (insmod, boot-fixed) flips the whole path
back to the legacy 205-page window for A/B trialing.

1 files changed, 19 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h
index 896a436..fb7b2a4 100644
--- a/kernel/gsp_phys_booter.h
+++ b/kernel/gsp_phys_booter.h
@@ -349,6 +349,25 @@ void gsp_phys_backend_relay_counters(u64 *requested, u64 *ok, u64 *verify_fail,
 #define GSP_PHYS_GR_QMD_WORD_NONE	0xffffffffu
 #define GSP_PHYS_GR_RAW_WORDS		256u
 
+/*
+ * B-2 (large-operand data path): the grown, boot-fixed GR data-bounce region.
+ * One PD0 dual entry per 2 MB window (PD0 slots 80..111, immediately above
+ * the m152 extension scratch pool's 32..79) backed by one fresh 4 KB small-PT
+ * page each, every leaf PTE pointing at one of the 16384 pages (64 MiB) of a
+ * single data chunk. The whole map is planted once at stage 3, before any
+ * engine fetch, so the GMMU's no-invalidate 128 B fetch-line rule is
+ * satisfied by construction (no PTE is ever rewritten at runtime). The SVC
+ * assigns operand reloc VAs from VA0 upward; gsp_sema_service.c derives its
+ * reloc base and page cap from these constants so the two sides cannot drift
+ * (the pre-B-2 205-page window below the mail page stays allocated for the
+ * mail injection and diagnostics, it just no longer carries operand data when
+ * gsp_phys_gr_data_region=1, the default).
+ */
+#define GSP_PHYS_RMCALL_GR_DATA_BOUNCE_VA0	0x0A000000ULL
+#define GSP_PHYS_RMCALL_GR_DATA_BOUNCE_SLOT0	80u
+#define GSP_PHYS_RMCALL_GR_DATA_BOUNCE_PT_PAGES	32u
+#define GSP_PHYS_RMCALL_GR_DATA_BOUNCE_PAGES	(32u * 512u)	/* 16384 */
+
 struct gsp_phys_gr_page {
 	u64 guest_va;		/* guest VA (page aligned) */
 	u64 hpa;		/* host PA (page aligned; 0 = unresolved) */