vgsp: fail4 discrimination tooling - copy-out page witnesses + full-boot bigcopy resolution budget

Four guest CUDA clients fail all-bad while four pass; the aggregate
counters cannot separate 'engine result never produced' from 'produced
but written to a different guest page than the client's read resolves'.
Add the two per-page witnesses that correlate the write side with the
read side:

- gsp_phys_gr_copyout_dump (booter, default 1): per-changed-page
  OUT-PAGE-WIT va=<device VA> hpa=<guest PA written> first8/last8=<bytes
  shipped>, bounded 12 pages per launch, plus one RELOC-CENSUS line per
  launch (gaps vs late-resolved words vs late pages).
- sema_bigcopy_log (sema service, default 24, was a hardcoded per-boot
  budget): the svc_copy large-copy proof already logs both operands'
  resolved VA -> pa/aperture/provenance and the first 16 bytes each side;
  raising the budget past the boot's head makes the failing clients'
  H2D/D2H resolutions visible.

Discrimination test for the next cycle: same device VA on OUT-PAGE-WIT
(copy-out HPA) and sema-bigcopy (D2H source pa) with different PAs proves
the produced-but-misplaced class; equal PAs redirects to the readback
content/engine-input path.

(cherry picked from commit 78ea8b7807231ac418a17b85c29ed1845e1b0062)

1 files changed, 13 insertions, 1 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index fb00685..b354437 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -5265,7 +5265,8 @@ static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total,
 	 * these copies; this separates a wrong resolution from a wrong copy.
 	 */
 	if ((total >= (1u << 20) ||
-	     (dst_virt && dst_orig >= SVC_VAS_FLOOR)) && bigcopy_log < 24) {
+	     (dst_virt && dst_orig >= SVC_VAS_FLOOR)) &&
+	    bigcopy_log < gsp_sema_bigcopy_log_max) {
 		u8 sb[16] = {0}, db[16] = {0};
 
 		bigcopy_log++;
@@ -10838,6 +10839,17 @@ bool gsp_sema_copy_dst_pin_guard = 1;
  * just-built client table is fresh), logged loudly.
  */
 unsigned gsp_sema_copy_dst_guard_ms = 3000;
+
+/*
+ * COPYWIT fail4: per-boot budget for the sema-bigcopy resolution witnesses
+ * (svc_copy's large-copy proof: both operands' VA -> pa/aperture/provenance
+ * plus the first 16 bytes each side). The shipped default kept the boot's
+ * head only; a failing-client run happens minutes later, so the budget is a
+ * module parameter now - raise it for a discrimination cycle and correlate
+ * each D2H's resolved source PA with the booter's OUT-PAGE-WIT copy-out PA
+ * for the same device VA. 0 disables the lines.
+ */
+unsigned gsp_sema_bigcopy_log_max = 24;
 #define SVC_DST_GUARD_SLOTS	16
 struct svc_dst_guard {
 	u64		va_page;