sema/boot: r383 kill the blanket bounce copy-out (alias+staleness write surface) + write guards; REPLAY-CAPTURE closes the silent launch-drop hole; CE operand misses feed the pin-demand channel

- bounce copy-out now records staged_hpa[bi] per launch and skips: (a) recs whose hpa != staged slot content (alias/leftover), (b) pages the engine did not change (~955 of 968 per boot launch); the remaining changed pages re-validate via gsp_sema_gr_write_guard before the 4 KiB memcpy. Removes the blanket 968-page write-back that was the remaining boot-corruption lottery vector (guest slab freelist clobbered by a foreign page write).
- new bounded WGUARD-SKIP guards: gr_write_guard (pin-first re-resolution) on copy-out, release-word zero/restore (rel_va plumbed through the submit), stale-recover-zero, counter release; svc_write_guard pin-agreement on 4/8-byte SYS/FB service writes; svc_copy SYS-dst hold on a fresh-pin contradiction.
- svc_qmd_accum replay hole: a trusted replay of an unseen push now captures (REPLAY-CAPTURE) instead of silently dropping; known push -> LAUNCH-SKIP witness; capture history ring prevents double-capture.
- svc_op_translate miss path emits the stalled-VA demand signal for CE operands.

1 files changed, 27 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index 929684d..0f47244 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -371,4 +371,31 @@ struct gsp_sema_gr_reloc {
 
 int gsp_sema_gr_reloc_resolve(u64 va, struct gsp_sema_gr_reloc *out);
 
+/*
+ * r378 write guards. Both re-validate a guest-memory write target that was
+ * resolved earlier (ledger/pin/walk/counter registration, or the GR submit's
+ * per-page resolution) against the CURRENT resolution before the bytes land,
+ * and return false when a positive disagreement proves the target stale:
+ *
+ *   gsp_sema_gr_write_guard(va, hpa, path): GR backend pages. A fresh
+ *   injected pin is checked first (the r372/r376 pin-wins rule - the guest's
+ *   newest statement), then the trusted resolver chain for a pin-less VA.
+ *   The submit-to-copy-out window is seconds wide (the GR poll), and a guest
+ *   buffer freed/re-homed in it would otherwise receive a full page of
+ *   another buffer's content (the boot-corruption class). The landing table
+ *   is deliberately not the authority: our own launches feed it, so it would
+ *   confirm the target by construction.
+ *
+ *   gsp_sema_write_guard(va, pa, ap, path): service-side SYS/FB targets. A
+ *   fresh injected pin is the guest's newest statement about the VA; a pin
+ *   that disagrees with the recorded target means the page moved (the
+ *   r372/r376 pin-wins rule), so the stale write is skipped.
+ *
+ * Both fail OPEN when no current answer exists (the recorded landing is then
+ * the write authority) and log every skip (bounded, 256 lines) with the path
+ * and the VA/target/current values.
+ */
+bool gsp_sema_gr_write_guard(u64 va, u64 hpa, const char *path);
+bool gsp_sema_write_guard(u64 va, u64 pa, u32 ap, const char *path);
+
 #endif /* _GSP_SEMA_SERVICE_H_ */