vgsp: restore reproducible green CUDA (ISSUE-0001) - BAR1 exposure, walk-pin and publish fixes

- Revert m143's BAR1 exposure: report the physical aperture size (256MB)
  again. Every post-m143 build reported BAR1=512MB and stalled the guest in
  its first cudaMalloc; the m140 green reference reported 256MB. barprobe-r2
  (this tree) is green: VADD n=32768 bad=0, STATUS OK ~10s.
- Revert the FORENSICS-grv6-ring walk-authoritative GR ring pin (fix A): it
  gated the guest's GR pushes on every boot since (no-push class).
- Restore the end-of-pass GR counter publish with the pass-computed put
  (m140 behavior); the H3-only early publish read put=0 from the USERD.
Probe branch: probe/no-walkpin (b1694f6a, 82404ad9, a766cc1b).

1 files changed, 15 insertions, 8 deletions

diff --git a/kernel/bar_init.c b/kernel/bar_init.c
index b5703d8..6515613 100644
--- a/kernel/bar_init.c
+++ b/kernel/bar_init.c
@@ -57,15 +57,22 @@ int nv_vgpu_bar_init(struct nv_vgpu_device *vgpu)
 	if (bar_addr && bar_size) {
 		vgpu->bars[1].gpa = bar_addr;
 		/*
-		 * m143 (1.0 VRAM sizes): expose the EMULATED framebuffer size as
-		 * BAR1's size, not the physical aperture. The guest derives its
-		 * BAR1 from the VFIO region info (config-space BAR writes are
-		 * ignored) and every GSCI/PFB report already carries
-		 * fb_emul_size; leaving the physical 256 MB here made 1G/2G types
-		 * tell the guest one size and expose another (the shadow is
-		 * fb_emul_size, so vidmem bounds and mmap math must match it).
+		 * PROBE (2026-10-08, ISSUE-0001): m143 exposed the emulated
+		 * framebuffer size (512 MB for the turing type) as BAR1; every
+		 * build since the green m140 reference reports BAR1=512MB to
+		 * the guest and the client spins in its first cudaMalloc with
+		 * both counter families written (guest RAM verified). The m140
+		 * green run reported BAR1=256MB (physical aperture) with the
+		 * same 512 MiB shadow and reached VADD. Restore the physical
+		 * size here as a single-variable probe: if this goes green,
+		 * m143's exposure is the stall trigger and the 1G/2G feature
+		 * must make the guest work with the larger aperture instead of
+		 * assuming it does. (m143: expose the EMULATED framebuffer size
+		 * as BAR1's size, not the physical aperture - the guest derives
+		 * its BAR1 from the VFIO region info and vidmem bounds/mmap
+		 * math must match the shadow.)
 		 */
-		vgpu->bars[1].size = nv_vgpu_fb_emul_size(vgpu);
+		vgpu->bars[1].size = bar_size;
 		/* Emulated vidmem: a dedicated host-RAM buffer backing the guest's
 		 * VRAM aperture. Do NOT map the host GPU's real BAR1 - guest VRAM
 		 * accesses must hit our own clean buffer, not the (broken) host