vgsp-sema: hold GR launches whose device argument pointers do not translate; derive the CE vmap pairing per allocation

Two second-client zeros/stall countermeasures:

- svc_gr_data_fill now reports when a launch carries high (device-space)
  argument pointers and none of them resolves through any trusted source.
  svc_gr_request refuses to forward such a launch and leaves the capture
  unconsumed; the pump holds the ring entry for one bounded window per
  entry (gsp_sema_gr_grace_ms) and retries it, so a translation that
  appears a pass later (scanner pin, published directory, learned pair)
  is used instead of executing the kernel against unresolved pointers.
  On window expiry the entry is consumed exactly as before (bounded
  zeros, never a hang). Bounded per-session fill diagnostics name the
  source that serves each candidate (ipin/pin/lat/map/vas/disc/win) and
  dump the published vaspace walk results for misses.

- The CE push-buffer kcore chain resolver derives its vmap page offset
  per allocation instead of using a fixed shift: the rm_mem size is read
  from its real offset (570.144 layout) and paired with the vmallocinfo
  area page count, so a leading header page is only skipped when it
  actually exists. With an unreadable size the two candidate offsets are
  content-probed with the host's method-stream plausibility test and an
  ambiguous result keeps the status-quo pairing. This removes the
  off-by-one that fed wrong push pages to the pump (content-rescue
  crawl).

1 files changed, 97 insertions, 11 deletions

diff --git a/tools/guest-diag/guest_pin_stream.py b/tools/guest-diag/guest_pin_stream.py
index 35cbfb9..1da78fb 100644
--- a/tools/guest-diag/guest_pin_stream.py
+++ b/tools/guest-diag/guest_pin_stream.py
@@ -266,11 +266,17 @@ def _vmalloc_pages_for(kc, va):
     return 0
 
 
-def resolve_mem_pins(kc, mem, out, default_pages=16, va_lo=0, va_hi=0):
+def resolve_mem_pins(kc, mem, out, default_pages=16, va_lo=0, va_hi=0,
+                     page_off=0):
     """uvm_rm_mem kptr -> GPU-VA/GPA runs (direct map or page-table walk).
 
     va_lo/va_hi optionally restrict the emitted GPU VA range; the kcore
-    chain resolver targets the CE push-buffer window only.
+    chain resolver targets the CE push-buffer window only. page_off shifts
+    the vmap page paired with GPU data page k: the CE push-buffer vmap is
+    one page longer than its GPU data window on some allocations (a leading
+    header page), so GPU data page k lives at vmap page k + page_off.
+    page_off is derived per allocation (mem_page_off): a fixed offset is
+    wrong (r116/r117 regressed client #1 with a hard +1).
     """
     if not is_kern_ptr(mem):
         return 0
@@ -281,7 +287,7 @@ def resolve_mem_pins(kc, mem, out, default_pages=16, va_lo=0, va_hi=0):
             and (not va_hi or v < va_hi)]
     if not cpu or not gpus:
         return 0
-    size = kc.read64(mem + 0x60) or 0
+    size = _mem_size(kc, mem)
     dm = _direct_map_pa(kc, cpu)
     emitted = 0
     if dm is not None:
@@ -290,14 +296,15 @@ def resolve_mem_pins(kc, mem, out, default_pages=16, va_lo=0, va_hi=0):
             out.append("0x%x,0x%x,%d\n" % (gv, dm, npages))
             emitted += 1
         return emitted
+    area = _vmalloc_pages_for(kc, cpu)
     npages = (max(1, min(size >> 12, 4098)) if size
-              else _vmalloc_pages_for(kc, cpu))
-    if not npages:
-        npages = 1
+              else area or default_pages)
+    if area and page_off + npages > area:
+        npages = max(1, area - page_off)
     runs = []
     cur = None
     for k in range(npages):
-        pa = kc.va_to_pa(cpu + k * 0x1000)
+        pa = kc.va_to_pa(cpu + (k + page_off) * 0x1000)
         if pa is None:
             if cur:
                 runs.append(cur)
@@ -318,6 +325,81 @@ def resolve_mem_pins(kc, mem, out, default_pages=16, va_lo=0, va_hi=0):
     return emitted
 
 
+def _mem_size(kc, mem):
+    """uvm_rm_mem size (bytes) from the 570.144 layout, with a fallback.
+
+    The struct is type(4)+pad(4)+mask(8)+vas[33] (264 B)+proxy_vas+
+    gpu_owner+size, so size lives at +0x128; +0x60 (inside vas[]) reads 0
+    for unused processors and is kept only as a fallback.
+    """
+    for off in (0x128, 0x60):
+        v = kc.read64(mem + off) or 0
+        if 0 < v <= (256 << 20):
+            return v
+    return 0
+
+
+def _push_prefix_ok(buf):
+    """First-4KB method-stream plausibility, mirroring the host's check."""
+    off = 0
+    while off + 4 <= len(buf):
+        hdr = struct.unpack_from('<I', buf, off)[0]
+        if hdr:
+            break
+        off += 4
+    if off + 4 > len(buf):
+        return True		# all zeros: not refutable
+    op = (hdr >> 29) & 0x7
+    if op in (4, 7):
+        return True
+    if op not in (1, 3, 5):
+        return False
+    return ((hdr >> 16) & 0xfff) != 0
+
+
+def _page_content(kc, va):
+    pa = kc.va_to_pa(va & ~0xFFF)
+    if pa is None:
+        return None
+    return kc.read(kc.page_offset_base + pa, 64)
+
+
+def mem_page_off(kc, mem):
+    """Per-allocation vmap offset for a uvm_rm_mem's GPU data pages.
+
+    Derived, never fixed: the vmap area's page count (vmallocinfo) minus
+    the rm_mem's data page count (size at +0x128). A 4097-page area with
+    4096 data pages means one leading header page (offset 1); an area that
+    exactly matches the data means offset 0. When the size is unreadable,
+    the two candidate offsets are content-probed with the host's method-
+    stream plausibility test and the decisively-passing one wins; an
+    ambiguous result keeps 0 (the status-quo pairing).
+    """
+    vas = [kc.read64(mem + 0x10 + i * 8) for i in range(16)]
+    cpu = next((v for v in vas if is_kern_ptr(v)), None)
+    if not cpu or _direct_map_pa(kc, cpu) is not None:
+        return 0
+    area = _vmalloc_pages_for(kc, cpu)
+    if area <= 1:
+        return 0
+    size = _mem_size(kc, mem)
+    if size:
+        data = min(size >> 12, 4098)
+        if 0 <= area - data <= 2:
+            return area - data
+        return 0
+    g = []
+    for off in (0, 1):
+        if off >= area:
+            g.append(0)
+            continue
+        buf = _page_content(kc, cpu + off * 0x1000)
+        g.append(1 if (buf is not None and _push_prefix_ok(buf)) else 0)
+    if g[0] != g[1]:
+        return 0 if g[0] else 1
+    return 0
+
+
 def _emit_ring_pins(kc, gpu_va, entries_cpu, entries, out):
     """Pin the GPFIFO ring pages (and the pages after it, where the GPPUT
     buffer usually sits) from the ring's CPU mapping."""
@@ -444,7 +526,8 @@ def resolve_pb_pins(kc, pb, out):
     mem = kc.read64(pb + 8)
     if not mem:
         return 0
-    return resolve_mem_pins(kc, mem, out, default_pages=64)
+    return resolve_mem_pins(kc, mem, out, default_pages=64,
+                            page_off=mem_page_off(kc, mem))
 
 
 # The CE push-buffer window is the one UVM region the client never maps into
@@ -509,13 +592,16 @@ def resolve_pb_chain(kc, sem, out):
             if mem in RESOLVED_KC_PB:
                 continue
             RESOLVED_KC_PB.add(mem)
+            off = mem_page_off(kc, mem)
             n = resolve_mem_pins(kc, mem, out, default_pages=64,
-                                 va_lo=PB_CE_LO, va_hi=PB_CE_HI)
+                                 va_lo=PB_CE_LO, va_hi=PB_CE_HI,
+                                 page_off=off)
             try:
                 with open('/tmp/guest_pin_stream.log', 'a') as f:
                     f.write('%s kc-chain CE push-buffer mem=0x%x sem=0x%x '
-                            'pin-runs=%d\n'
-                            % (time.strftime('%T'), mem, sem, n))
+                            'pin-runs=%d off=%d size=%d\n'
+                            % (time.strftime('%T'), mem, sem, n, off,
+                               _mem_size(kc, mem)))
             except OSError:
                 pass
     return found