sema/boot: r391c OUT-PAGE-WIT resolution witness for the sum=0 readback class

The GR copy-out now prints, per changed page, the landing-table resolution
of the VA (the exact source the D2H reader's ledger-first branch uses) and
its first 8 bytes beside the write target hpa - a launch/readback
disagreement (write landed on another page/aperture than the reader
resolves) becomes one line instead of a forensics session.

Diagnostic only (bounded by the existing copywit budget).

1 files changed, 30 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 97cbf57..2fb4fe1 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -17471,6 +17471,36 @@ bool gsp_sema_write_guard(u64 va, u64 pa, u32 ap, const char *path)
 }
 
 /*
+ * r391 diagnostic (sum=0 class): the landing-table resolution of a GR data VA
+ * plus the first 8 bytes read through it - the exact page the D2H reader's
+ * ledger-first branch will use. Printed by the GR copy-out next to the write
+ * target, so a launch/readback disagreement is visible in one line.
+ */
+bool gsp_sema_gr_va_snap(u64 va, u64 *pa, u32 *ap, u64 *val8)
+{
+	u64 lpa = 0;
+	u32 lap = 0;
+
+	if (svc_ledger_lookup(va, &lpa, &lap))
+		return false;
+	*pa = lpa & ~(u64)(SEMA_PAGE_SIZE - 1);
+	*ap = lap;
+	*val8 = 0;
+	if (!svc_fwd_req.vgpu)
+		return true;
+	if (lap == SVC_APERTURE_FB) {
+		u8 *base = svc_fwd_req.vgpu->bars[1].vaddr;
+		size_t size = svc_fb_shadow_size(svc_fwd_req.vgpu);
+
+		if (base && *pa + 8 <= size)
+			memcpy(val8, base + *pa, 8);
+	} else {
+		svc_read(svc_fwd_req.vgpu, *pa, val8, 8);
+	}
+	return true;
+}
+
+/*
  * m144 (second-client launch-state divergence): collect device-VA-shaped
  * candidate pointers from the bytes the ENGINE will actually execute.
  *