gsp-phys: P6a debug triggers resolve the guest page HPA at trigger time

Triggers 6 (W2G) and 7 (G2H) previously used page-table slots pre-built once
during the ladder's stage 3. A guest page's host physical address can change
between translations (observed 0x13a591000 -> 0x3b8318000 for the same GPA),
and a runtime PTE rewrite into an already-fetched 128-byte line is invisible
(no invalidate path), so the later write-direction trigger validated against
the wrong page and failed its data check.

Both triggers now translate at trigger time and run through the same
fresh-scratch-line path as forwarding, via a shared internal copy body; the
exported forwarding API is unchanged and still requires
gsp_phys_work_forward. A changed HPA is now an informational once-per-boot
note rather than a failure; the probe-pattern guard still refuses stale pages.
Trigger 8 and the stage-3 pre-built slots are unchanged.

Live (run p6w3): GUEST G2H COPY OK gpa=0x12423d000 hpa=0x56ab3a000;
GUEST W2G COPY OK with verify_ok=1; PTE selftest OK; guest SEEN_W2G; ladder
REAL COPY OK; clean latched release (5 power-domain locks, rebound, WPR2 down,
no rail cycles, pstore empty, same boot). The full smoke run hit the known
guest cuInit/WPR2-already-up wedge at cdt; the trigger path itself is green.

1 files changed, 10 insertions, 7 deletions

diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h
index cc3b935..ada3280 100644
--- a/kernel/gsp_phys_booter.h
+++ b/kernel/gsp_phys_booter.h
@@ -317,13 +317,16 @@ int gsp_phys_boot_rm_unload(void __iomem *bar0);
  *     gsp_phys_guest_mem=1 and a GPA pinned through gsp-phys-guest-gpa,
  *     writing 7 (G2H, guest read) and then 6 (W2G, guest write) additionally
  *     run one 4 KB CE copy each against that guest RAM page: the GPA is
- *     translated through the active mdev's VFIO type-1 domain, the physical
- *     device's domain must be identity, the corresponding channel PDB slot
- *     (0x106 read / 0x105 write) is programmed with the translated HPA, and
- *     the result is verified with a direct-map memcmp. Both directions are
- *     gated on a live READY claim, ladder stage >= 3 and the pinned GPA;
- *     every refusal is a logged no-op and no guest byte is touched unless
- *     G2H already proved the translation.
+ *     re-translated through the active mdev's VFIO type-1 domain at trigger
+ *     time, the physical device's domain must be identity, and the copy runs
+ *     through the P6b fresh 128 B scratch-line path (one never-reused line
+ *     per pair; the internal trigger variant of the guest-copy backend, so
+ *     gsp_phys_work_forward is not required), so a host PA that changed since
+ *     the pin cannot be shadowed by an engine-cached PTE fetch. The result is
+ *     verified with a direct-map memcmp. Both directions are gated on a live
+ *     READY claim, ladder stage >= 3 and the pinned GPA; every refusal is a
+ *     logged no-op and no guest byte is touched unless G2H already proved
+ *     the translation.
  *   - "gsp-phys-guest-gpa" (write-only, mode 0200): pin the one guest RAM
  *     GPA ("0x<hex>", 4 KB page-aligned) that the rm-call guest directions
  *     may touch. One GPA per boot (a second different GPA is refused: