vgsp-disp: scan the BAR3 shadow for the display instance table

r1635 live proof: the 32 MiB RM BAR2 aperture is the 64-bit PCI
BAR2/3 pair and is enumerated as resource BAR3 (BAR2 empty), so the
instance block lives in bars[3] (block base +0x3000 in the shadow;
0x10013 target=2 base=0x114103000, 0x10075 target=3
base=0x114138000).  Scan bars[2] and bars[3] in the resolver and log
the bar index; the BAR2-only scan found nothing (0 resolutions).

1 files changed, 15 insertions, 5 deletions

diff --git a/kernel/gsp_display_engine.c b/kernel/gsp_display_engine.c
index e79a9f0..7eeff0f 100644
--- a/kernel/gsp_display_engine.c
+++ b/kernel/gsp_display_engine.c
@@ -584,12 +584,21 @@ static int gsp_disp_find_block_bar2(struct nv_vgpu_device *vgpu, u32 handle,
 				    u64 *base, u64 *pa, u64 *limit,
 				    u32 *target)
 {
-	u8 *bar2 = vgpu->bars[2].vaddr;
-	u64 size = vgpu->bars[2].size;
+	int bar;
+
+	/*
+	 * The 32 MiB RM BAR2 aperture is the 64-bit PCI BAR2/3 pair; on
+	 * this platform it is enumerated as resource BAR3 (BAR2 is empty
+	 * or a low dword), and r1635 proved the instance block lives in
+	 * the bars[3] shadow (offset 0x3000).  Scan both shadows.
+	 */
+	for (bar = 2; bar <= 3; bar++) {
+	u8 *bar2 = vgpu->bars[bar].vaddr;
+	u64 size = vgpu->bars[bar].size;
 	u64 s;
 
 	if (!bar2 || !size)
-		return -ENODEV;
+		continue;
 	for (s = 0; s + 8 <= size; s += 8) {
 		u32 obj, ctx, inst;
 		u64 cand[2];
@@ -634,14 +643,15 @@ static int gsp_disp_find_block_bar2(struct nv_vgpu_device *vgpu, u32 handle,
 			*target = tgt;
 			if (disp.im_logs < 8) {
 				disp.im_logs++;
-				pr_info("inst mem: handle 0x%x via bar2 block 0x%llx -> base=0x%llx limit=0x%llx target=%u\n",
-					handle, (unsigned long long)b,
+				pr_info("inst mem: handle 0x%x via bar%d block 0x%llx -> base=0x%llx limit=0x%llx target=%u\n",
+					handle, bar, (unsigned long long)b,
 					(unsigned long long)base64,
 					(unsigned long long)lim64, tgt);
 			}
 			return 0;
 		}
 	}
+	}	/* bar */
 	return -ENOENT;
 }