vgsp: GR data path - pre-publish bounce fill, engine-change proof, ipin-first data resolution

Two fixes and one diagnostic for the all-zero-results class (r89: smiley's
4 vadd launches reported GUEST GR LAUNCH OK yet every output word read 0):

- gsp_phys_booter: copy the guest data pages into the bounce window BEFORE
  gsp_phys_rmcall_publish_locked() rings the doorbell. The fill used to run
  after the kick; the engine front end starts within ~7 ms, so the kernel
  could read the window before it was filled.
- gsp_phys_booter: per-page checksums at copy-in, compared at copy-out;
  the copy-out log now reports 'N changed by engine'. An all-unchanged
  window after a reported completion is the front-end-ran/grid-never-
  dispatched signature (completion semaphores are front-end authored).
  The first 3 data (va,hpa,reloc) triples are logged per launch.
- gsp_sema_service: svc_gr_data_fill resolves data pages through
  svc_ipin_lookup() first (guest-truth pins), falling back to
  svc_resolve_va, mirroring the pool resolver order; a wrong page here
  silently runs the kernel on zeros. First 16 resolved (va,pa,ap) triples
  are logged for post-mortem comparison against the guest's own mapping.

1 files changed, 33 insertions, 2 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index ee73027..ec269c5 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -12127,6 +12127,8 @@ static bool svc_gr_page_inline_covers(u64 page)
  * the mail message). */
 #define SVC_GR_DATA_BOUNCE_MAX	100u
 
+static u32 svc_gr_data_log;	/* m142: bounded per-page attribution log */
+
 static void svc_gr_data_fill(struct nv_vgpu_device *vgpu)
 {
 	u64 wins[16];
@@ -12237,8 +12239,26 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu)
 					break;
 			if (x < svc_fwd_req.gr_n_data)
 				continue;	/* already mapped */
-			if (svc_resolve_va(vgpu, va, &pa, &ap))
-				break;
+			/*
+			 * m142: guest-truth injected pins first, the same order
+			 * the pool resolver uses (svc_pool_pa_resolve). The
+			 * learned/scanned sources can hold a stale page for a
+			 * VA a previous client mapped (the dual-PA class proven
+			 * on the pool semaphore, r88); a bounce built from the
+			 * wrong page silently runs the kernel on zeros while
+			 * every launch still reports OK.
+			 */
+			{
+				u64 ipa = 0;
+				int iap = SVC_APERTURE_SYS;
+
+				if (!svc_ipin_lookup(va, &ipa, &iap)) {
+					pa = ipa;
+					ap = (u32)iap;
+				} else if (svc_resolve_va(vgpu, va, &pa, &ap)) {
+					break;
+				}
+			}
 			if (svc_fwd_req.gr_n_data >= SVC_GR_DATA_BOUNCE_MAX) {
 				pr_info("vgsp-sema: svc-gr data fill: %u candidate ptrs, %u pages resolved (reloc 0x%llx+) CAP-HIT\n",
 					n_cand, svc_fwd_req.gr_n_data,
@@ -12252,6 +12272,17 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu)
 					((u64)svc_fwd_req.gr_n_data << 12);
 			rec->ap = (u8)svc_ap_of(ap);
 			svc_fwd_req.gr_n_data++;
+			/*
+			 * m142: bounded per-page attribution log. A wrong data
+			 * page is invisible in the aggregate counters; these
+			 * lines let a post-mortem compare the chosen PA against
+			 * the guest's own mapping.
+			 */
+			if (svc_gr_data_log < 16) {
+				svc_gr_data_log++;
+				pr_info("vgsp-sema: svc-gr data page va=0x%llx -> pa=0x%llx ap=%u\n",
+					va, rec->pa, rec->ap);
+			}
 		}
 		(void)base;
 		pr_info("vgsp-sema: svc-gr candidate[%u] base=0x%llx -> %u new pages (total %u)\n",