vgsp: BAR0-shadow aperture userd probe + full PCFG-window (0x88000-0x89000) doorbell dispatch - built/live r1011; measurement falsified BAR0-USERD premise for client GP_PUT (shadows static, only pos=0x88704 traps); X channel sub=60 via kick-family RAM watch - SESSION 153 r1011

1 files changed, 23 insertions, 28 deletions

diff --git a/kernel/main.c b/kernel/main.c
index 2f35163..b5c7105 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -843,47 +843,42 @@ static ssize_t nv_vgpu_vfio_dev_write(struct vfio_device *vdev, const char __use
 		u8 tmp[8];
 		ssize_t ret;
 		static u32 bar0_log;
-		/*
-		 * SESSION 153-CONTINUED-23: the GL client's draw doorbell, if it
-		 * ever arrives through the trap path at all, must be visible -
-		 * widen the log from the single 0x88704 offset to every trapped
-		 * write in the PCFG window (0x88000..0x89000). Bounded: the BAR0
-		 * shadow is direct-mapped, so trap-path writes are rare; a cap
-		 * keeps a pathological guest from flooding dmesg.
-		 */
-		static u32 pcfg_log;
 
 		if (!vgpu->bar_emul_ctx)
 			return -ENODEV;
 		if (copy_from_user(tmp, buf, count))
 			return -EFAULT;
 
-		if ((u64)pos == 0x88704 ||
-		    ((u64)pos >= 0x88000 && (u64)pos < 0x89000 &&
-		     pcfg_log < 1024) ||
-		    (gsp_sema_dbg && bar0_log < 64)) {
+		if ((u64)pos >= 0x88000 && (u64)pos < 0x89000) {
+			/*
+			 * SESSION 153-CONTINUED-34: ANY write in the PCFG
+			 * window is a submission doorbell, not only the
+			 * virtual-function doorbell at 0x88704 the old code
+			 * dispatched. Feed every 4-byte write to the doorbell
+			 * path so the pump is woken for the client's channel
+			 * kicks no matter which register the driver poked
+			 * (the service thread also watches the mmap'd shadow
+			 * for writes that never trap). Logging stays bounded.
+			 */
 			static u32 db_log;
 			u64 v = 0;
 
 			memcpy(&v, tmp, count);
-
-			if ((u64)pos == 0x88704) {
-				if (gsp_sema_dbg && db_log < 512) {
-					pr_info("vgsp: DOORBELL write pos=0x%llx size=%zu val=0x%llx\n",
-						(u64)pos, count, v);
-					db_log++;
-				}
-				if (count == 4)
-					gsp_sema_service_doorbell((u32)v);
-			} else if ((u64)pos >= 0x88000 && (u64)pos < 0x89000) {
+			if (gsp_sema_dbg && db_log < 512) {
 				pr_info("vgsp: PCFG write pos=0x%llx size=%zu val=0x%llx\n",
 					(u64)pos, count, v);
-				pcfg_log++;
-			} else {
-				pr_info("vgsp: BAR0 write pos=0x%llx size=%zu val=0x%llx\n",
-					(u64)pos, count, v);
-				bar0_log++;
+				db_log++;
 			}
+			if (count == 4)
+				gsp_sema_service_doorbell((u32)v);
+		} else if ((u64)pos == 0x88704 ||
+			   (gsp_sema_dbg && bar0_log < 64)) {
+			u64 v = 0;
+
+			memcpy(&v, tmp, count);
+			pr_info("vgsp: BAR0 write pos=0x%llx size=%zu val=0x%llx\n",
+				(u64)pos, count, v);
+			bar0_log++;
 		}
 
 		ret = nv_vgpu_bar_emul_write(vgpu, 0, (u64)pos, tmp, count);