vgsp: m181 relocation-page unification - launch-internal pages (param/program/banks) resolve through the landing table; zero-write diagnosticsHEADmaster

Audit of the QMD relocation/mirror path vs the m180 landing table (r210
evidence: /tmp dmesg, 0 ledger DIVERGE, four multi-page clients still
wrong, 3 zero-write NO-STORES accepts):

The relocation itself does NOT pick PAs: gsp_phys_gr_rewrite_data_vars()
matches a device-VA-shaped 8-byte value against req->data[x].va (the
fill's gr_data list, which m180 fed through the ledger) and rewrites it to
req->data[x].reloc_va. The bounce page for reloc_va is the same page the
tracking wait and the copy-out use, so a *matched* pointer is ledger-
consistent by construction. The un-unified halves of that path are the
page the relocation READS and the page the m129 mirror PATCHES: both come
from pg->pa, resolved by svc_gr_page_note() with the independent sources
(pin/lat/map/walks/scan), never the landing table. The CE inline writes
that author those launches' param/program/bank pages go through
svc_grce_inline_write(), which (m180) records its landing and diverges to
it; svc_gr_page_note could still hand the win0 shadow copy and the mirror
a stale page. Consequences, both observed classes: relocation matches
nothing (the page holds another session's pointers) -> the engine runs
against unrelocated guest VAs it cannot walk -> grid aborts with zero
stores while the ack still lands; or the engine executes on a previous
client's parameter block -> plausible-but-wrong results invisible to the
ledger.

Fix (kernel/gsp_sema_service.c):
- svc_gr_page_note() consults svc_ledger_lookup() first for every
  launch-internal page. On a hit it uses the recorded landing (and pins
  it, so later resolves and the win0 copy path agree); when the
  independent sources would answer differently it logs (bounded)
  "sema-ledger: RELOC-DIVERGE va=... ledger_pa=... <src>_pa=... (ledger
  wins)" - the requested relocation-vs-ledger witness. Non-hit pages keep
  the historical svc_resolve_va path unchanged.

Diagnostics (kernel/gsp_phys_booter.c):
- the m135 below-0x100 guard now shape-checks first and logs
  "bank N RELOC-SKIP @off: value is operand page ... (left guest-VA)".
  r210 shows the same offset-0 bank pointer in EVERY client (green ones
  included: the driver control block), so the guard is unchanged until a
  dereferenced pointer in that range is proven; the log makes that
  provable in one cycle.
- the zero-write accept now also dumps the deposit QMD words
  (gsp_phys_gr_deposit_rb_log) so the next NO-STORES event shows whether
  the engine consumed the header words, and the dual-bank sentinel line
  is reworded to state facts only (the other bank is normally the
  previous launch's legitimately-consumed deposit; the earlier "older
  deposit consumed" reading was misleading). r210 classification: all
  three NO-STORES events had THIS deposit fetched (sentinel overwritten)
  and 0/968..0/967 stores even at +1 s, i.e. engine-side non-execution of
  a fetched deposit - consistent with the stale-launch-page abort
  mechanism above; the deposit-readback words will discriminate further.

Not changed (deliberate): the m135 guard semantics, the relocation
targets, the sentinel contract, retry/accept policy, and every semaphore
path (mm2/gate/rewind effects untouched).

make kernel -j green (srcversion DAB7E3AA75D364382DD6A3C; only the
pre-existing gsp_phys_rmcall_stage3 printf warning). Main tree untouched;
nothing pushed.

0 files changed, 0 insertions, 0 deletions