r586: demanded staging VAs resolve via the client pagemap; fail-closed at the r543 argument defer cap

Two halves of the staging-pin coverage class (r584/r585 boots):

1. guest_pin_stream demand handler: resolve_va_by_content rejects any VA
   outside the CE pushbuffer window (PB_CE_LO..PB_CE_HI), so the demands
   for the GRFILL dropped staging pages (high client VAs like
   0x703304e00000) were silent no-ops - no pin ever landed and the fills
   kept dropping them. r586 falls back to the client's own pagemap
   (scan_range on the exact page), the same walk the window scans use.

2. vgsp-work: the r543 argument-defer cap expiry now takes the r583
   fail-closed path instead of forwarding: the r585 boot's saxpy was
   forwarded with n_data=969 dropped=7 partial=1 at the cap and read
   stale operands (bad=1047527 csum=130523290); the r584 matmul
   (n_data=2 dropped=18) reached the r564 degenerate refusal. Refuse,
   author the QMD release in software (rel_done latched), consume,
   witness. The dropped pages were demanded first (r585), so the retry
   window had its chance; a launch that would run with unresolved
   operands is never silently forwarded.

1 files changed, 26 insertions, 0 deletions

diff --git a/tools/guest-diag/guest_pin_stream.py b/tools/guest-diag/guest_pin_stream.py
index b56f79d..175ed23 100644
--- a/tools/guest-diag/guest_pin_stream.py
+++ b/tools/guest-diag/guest_pin_stream.py
@@ -1819,6 +1819,32 @@ def main():
                             except Exception:
                                 ok = False
                                 got = []
+                            # r586: a demanded VA outside the CE
+                            # pushbuffer window (the GRFILL staging pages,
+                            # high client VAs) is a plain client mapping
+                            # page: resolve it through the client's own
+                            # pagemap. Without this the demand for those
+                            # VAs was a silent no-op (resolve_va_by_content
+                            # rejects anything outside PB_CE_LO..PB_CE_HI)
+                            # and the fills kept dropping them.
+                            if not ok and not got and pid:
+                                try:
+                                    pfd = os.open('/proc/%d/pagemap' % pid,
+                                                  os.O_RDONLY)
+                                    try:
+                                        sub = {}
+                                        vpg = wv & ~0xFFF
+                                        scan_range(pfd, vpg, vpg + 0x1000,
+                                                   sub)
+                                    finally:
+                                        os.close(pfd)
+                                    if sub:
+                                        for v, p in sub.items():
+                                            got.append('0x%x,0x%x,1\n'
+                                                       % (v, p))
+                                        ok = True
+                                except OSError:
+                                    pass
                         if ok and got:
                             lines.extend(got)
                             _want_state["done"].add(wv)