host stability: BAR3 shadow + skip submodule nvidia + teardown-safe garbage handler

Root causes of host GSP crash (WPR2 stuck, 'unexpected WPR2 already up'):
1. stack_manager load-nvidia tried to load our submodule nvidia.ko (610.57.04-base)
   alongside/over apt nvidia 570.211.01 -> GSP crash during driver conflict.
   Fix: skip submodule when apt nvidia is already loaded (not needed for QEMU).
2. BAR3 (32MB instance memory window) was mapped to the physical GPU's real BAR3,
   so guest BAR3 writes could corrupt the host GPU's instance memory.
   Fix: vzalloc'd shadow buffer (like BAR1 emulated vidmem), per-page mmap.
3. GSP-RM garbage element handler declared GSP death on teardown queue garbage,
   preventing driver cleanup frees from completing.
   Fix: stop polling quietly, let Booter-unload kick handle reset.

Verified: full lifecycle (load, mdev create, QEMU guest boot, guest probe,
mdev remove, unload, reload) with host nvidia-smi (apt 570.211.01) stable
throughout. No GSP crash, no WPR2 stuck, no module unload hang.

1 files changed, 17 insertions, 5 deletions

diff --git a/kernel/bar_init.c b/kernel/bar_init.c
index a3ed5fa..9926e2b 100644
--- a/kernel/bar_init.c
+++ b/kernel/bar_init.c
@@ -88,12 +88,18 @@ int nv_vgpu_bar_init(struct nv_vgpu_device *vgpu)
 	if (bar_addr && bar_size) {
 		vgpu->bars[3].gpa = bar_addr;
 		vgpu->bars[3].size = bar_size;
-		vgpu->bars[3].vaddr = ioremap_wc(bar_addr, bar_size);
+		/* Emulated BAR3: dedicated host-RAM shadow. Do NOT ioremap the
+		 * host GPU's real BAR3 - guest writes through this region must
+		 * hit our own clean buffer, not the (running) host GPU's
+		 * instance memory window. 32MB to match the GSCI-reported BAR3. */
+		vgpu->bars[3].vaddr = vzalloc(bar_size);
 		if (!vgpu->bars[3].vaddr) {
-			nv_vgpu_err(vgpu, "Failed to map BAR3");
+			nv_vgpu_err(vgpu, "Failed to allocate emulated BAR3 (%llu bytes)",
+				    (unsigned long long)bar_size);
 			return -ENOMEM;
 		}
-		nv_vgpu_info(vgpu, "BAR3: gpa=0x%llx, size=0x%llx, vaddr=%p", bar_addr, bar_size, vgpu->bars[3].vaddr);
+		nv_vgpu_info(vgpu, "BAR3: gpa=0x%llx, size=0x%llx, emulated shadow=%p",
+			     bar_addr, bar_size, vgpu->bars[3].vaddr);
 	}
 
 	ret = nv_vgpu_bar_emul_init(vgpu);
@@ -130,9 +136,15 @@ void nv_vgpu_bar_cleanup(struct nv_vgpu_device *vgpu)
 		vgpu->bars[1].vaddr = NULL;
 	}
 
+	/* Free the emulated BAR3 shadow (vzalloc'd, not ioremap'd) */
+	if (vgpu->bars[3].vaddr) {
+		vfree(vgpu->bars[3].vaddr);
+		vgpu->bars[3].vaddr = NULL;
+	}
+
 	for (i = 0; i < NV_VGPU_MAX_REGIONS; i++) {
-		if (i == 1)
-			continue; /* vidmem buffer already freed above */
+		if (i == 1 || i == 3)
+			continue; /* shadow buffers already freed above */
 		if (vgpu->bars[i].vaddr) {
 			iounmap(vgpu->bars[i].vaddr);
 			vgpu->bars[i].vaddr = NULL;