sema: r384 fill-destination guards - pin-demand hold for large unproven fills + page-table-shape refusal for zero fills (the boot-corruption lottery root-caused to zero writes landing on guest page-table pages)

Forensics from the r383 boot (guest panic at t=216 during victory_strided):
the guest kernel's direct map had TWO 2 MiB holes (phys 0x105000000 and
0x131800000) because their PTE pages at gpa 0x12d3c2000/0x3000 - two
adjacent 4 KiB page-table pages - were found all-zero. Kernel objects
(the kprobe nodes UVM registers at module load) lived in those regions;
the first access after the zeroing faulted (Oops #1 get_kprobe from
uvm_init_entry), cascading to the t=230 panic. The zeroing is an 8 KiB
all-zero write, the exact shape of the guest's window page-table clear
(LINE_LENGTH=8192, value=0), and the emulation's virtual fill resolver
is demonstrably non-deterministic: four executions of that same 8 KiB
fill resolved to four different guest pages (0x126af8000, 0x12d8e4000,
0x12f20c000, 0x1187fb000 - every one refused by the below-floor guard).
The below-floor guard covers window VAs only; a >= 1 TiB VA fill that
resolves through the walk/scan had no guard at all.

Two nets in svc_fill, both default-on (sema_fill_guard=1) and both
fail-open/histed:
- net 1: a >= 64 KiB virtual fill whose only authority is the walk/scan
  (no pin, no landing-table entry) is held through a bounded 800 ms
  window (sema_fill_guard_ms) while its VA is demanded through the pin
  channel (the userspace pin stream injects the guest-pagemap truth), so
  the retried decode resolves through a real pin. Mirrors the m169/r378
  copy guards; releases with the historical behaviour after the bound.
- net 2: a ZERO fill about to land in guest RAM on a page whose first 64
  qwords are all present+NX+in-range PTEs is REFUSED loudly
  (FILL-PT-REFUSED) - a page table page is never a legitimate zero-fill
  destination. Pin-backed resolutions are exempt (guest pagemap truth).

New witnesses: FILL-HOLD (held fills) and FILL-PT-REFUSED (refused
page-table targets), both bounded.

0 files changed, 0 insertions, 0 deletions