vgsp: fail4 r254-r257 - small-fill hold + copy landing ledger + per-launch reloc half

Three fixes on top of 54cf842c, targeting the big-buffer clients:

1. m163 parity for fills: a small failing FILL op with a virtual device
   destination is now held/retried like the small copies (-ENOENT with
   the pins still landing was silently counted nomap and the release
   applied - the 8 MB cudaMemset landed only partially). Verified:
   memcpy_roundtrip now reaches STATUS OK (RT1 bad=0 csum exact,
   MSET bad=0, h_m all 0x5A).

2. svc_copy landing ledger parity with svc_fill: a large virtual-dst
   copy records its landing pages so the GR rec build (m171 ledger
   preference) follows the page the copy actually wrote. streams2's
   c1 moved from a stale-page mix ([28.0, 28.625, 29.25]) to the
   correct-page values ([0.0, 0.125, 0.25]).

3. Per-launch relocated-data base: concurrent forwarded launches
   (streams2's vadd pair) shared one base and their bounce windows
   overlapped; the base now alternates across the grown region's two
   halves keyed to the capture push (retries keep their half), cap
   halved accordingly. Also raise the per-page data attribution budget
   (16 -> 192 pages) for span forensics.

Remaining on streams2/victory_multikernel: the single-slot svc_gr_cand
capture is overwritten by the second concurrent launch before the work
item consumes it - ctaid-probe evidence: c1 == a2+b2 exactly (the
stream-2 result in the stream-1 output) with the in-tree
candidate-overwrite witness present. Next: make the capture a small
FIFO drained in order by the gsp-phys-work item.

1 files changed, 53 insertions, 5 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 6dd83c9..b1ad7ba 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -5875,6 +5875,24 @@ static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total,
 		pr_info("vgsp: COPYAUDIT path=ce-soft-copy va=0x%llx len=0x%llx done=0x%llx\n",
 			dst_orig, (u64)total, (u64)o);
 	}
+	/*
+	 * m180 parity with svc_fill: a large virtual-destination copy is a
+	 * write/read pair with the launch rec-build readers - record its
+	 * landing pages so the GR fill follows the page the copy actually
+	 * wrote. Without this, a rec table built before the pins landed
+	 * kept the stale pre-pin pages while the copy landed on the pinned
+	 * page (streams2 r254: the b1 rec range carried the a2 pages and
+	 * the vadd read a2's pattern as its second input).
+	 */
+	if (!dst_phys && dst_virt && dst_orig >= SVC_VAS_FLOOR &&
+	    total >= (64u << 10)) {
+		u32 cap = (dst_aperture == CE_APERTURE_VID) ?
+			SVC_APERTURE_FB : SVC_APERTURE_SYS;
+		size_t po;
+
+		for (po = 0; po < total; po += SEMA_PAGE_SIZE)
+			svc_ledger_store(dst_orig + po, dst + po, cap);
+	}
 	if (done_out)
 		*done_out = (u64)o;	/* o == total on the success path */
 	return 0;
@@ -6156,7 +6174,8 @@ static void svc_run_ops(struct nv_vgpu_device *vgpu, struct svc_memset_op *ops,
 		 */
 		if (rc != 0 && rc != SVC_COPY_FORWARDED &&
 		    (m->bytes >= (256u << 10) ||
-		     (m->type == 1 && m->dst >= SVC_VAS_FLOOR)))
+		     (m->type == 1 && m->dst >= SVC_VAS_FLOOR) ||
+		     (m->type == 0 && !m->phys && m->dst >= SVC_VAS_FLOOR)))
 			svc.op_tr_pending = 1;
 		if (gsp_sema_dbg && m->bytes == 256 && svc.sem256_log < 64) {
 			svc.sem256_log++;
@@ -15169,7 +15188,12 @@ static bool svc_gr_page_inline_covers(u64 page)
  * reach the engine. The legacy value is the pre-B-2 window below the mail
  * page (GSP_PHYS_RMCALL_GR_MAIL_SLOT = 206).
  */
-#define SVC_GR_DATA_BOUNCE_MAX		GSP_PHYS_RMCALL_GR_DATA_BOUNCE_PAGES
+/*
+ * fail4: each launch may relocate up to half of the grown region - the
+ * other half is the alternate base of a concurrently in-flight launch
+ * (see the per-capture base flip in svc_gr_data_fill).
+ */
+#define SVC_GR_DATA_BOUNCE_MAX		(GSP_PHYS_RMCALL_GR_DATA_BOUNCE_PAGES / 2u)
 #define SVC_GR_DATA_BOUNCE_MAX_OLD	205u
 
 static u32 svc_gr_data_log;	/* m142: bounded per-page attribution log */
@@ -15516,8 +15540,32 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu,
 	 * window below the mail page for A/B trialing.
 	 */
 	bool region_on = gsp_phys_gr_data_region_value() != 0;
-	u64 reloc_base = region_on ? SVC_GR_DATA_RELOC_BASE :
-				     SVC_GR_DATA_RELOC_BASE_OLD;
+	/*
+	 * fail4: two concurrent forwarded launches (streams2's vadd pair)
+	 * both relocated their operands from the same base, so the second
+	 * launch's copy-in overwrote the first's bounce windows and each
+	 * engine read the other's inputs (c1 came out as a2+b2). Alternate
+	 * the per-launch base across the grown region's two halves (32 MB
+	 * each, above any single launch's span), keyed to the capture push
+	 * so a retried launch keeps its half, so concurrent launches
+	 * cannot collide.
+	 */
+	static u64 svc_gr_reloc_half_key;
+	static u8 svc_gr_reloc_half;
+	u64 reloc_off = 0;
+
+	if (region_on) {
+		if (svc_gr_cand.push_va != svc_gr_reloc_half_key) {
+			svc_gr_reloc_half_key = svc_gr_cand.push_va;
+			svc_gr_reloc_half ^= 1;
+		}
+		if (svc_gr_reloc_half)
+			reloc_off = (u64)(GSP_PHYS_RMCALL_GR_DATA_BOUNCE_PAGES /
+					  2u) * SEMA_PAGE_SIZE;
+	}
+	u64 reloc_base = region_on ?
+		SVC_GR_DATA_RELOC_BASE + reloc_off :
+		SVC_GR_DATA_RELOC_BASE_OLD;
 	u32 per_ptr = region_on ? SVC_GR_DATA_PAGES_PER_PTR :
 				  SVC_GR_DATA_PAGES_PER_PTR_OLD;
 	u32 bounce_max = region_on ? SVC_GR_DATA_BOUNCE_MAX :
@@ -15938,7 +15986,7 @@ static void svc_gr_data_fill(struct nv_vgpu_device *vgpu,
 			 * lines let a post-mortem compare the chosen PA against
 			 * the guest's own mapping.
 			 */
-			if (svc_gr_data_log < 16) {
+			if (svc_gr_data_log < 192) {
 				svc_gr_data_log++;
 				pr_info("vgsp-sema: svc-gr data page va=0x%llx -> pa=0x%llx ap=%u\n",
 					va, rec->pa, rec->ap);