vgsp-gl: scope client inline writes to the authoring VAS and receipt surface ownershipHEADmaster

The captured 1280x720 colour-target bind is the X server's screen
(VA 0x120400000, 900 contiguous FB pages from 0x200000 to 0x583000 in
the emitting VAS 0x10005). The GL client uses the same 0x1200xxxxx VAs
for its own allocations; its fixed-CB write (0x120700000) was resolved
through the X VAS by the global cross-VAS walk and overwrote screen
page 0x500000 with the CB matrix. Resolve client inline writes through
the authoring channel's own VAS (GR handle 0xbeef0100 inherits its CE
siblings' VAS 0xbeef0300) and refuse cross-VAS translation for a
channel-owned page whose own VAS does not map it (VA shadow instead).
Receipts: SURF-OWNER (emitting channel, VAS span coverage first/mid/last
PA, retarget) and GRCE owner-vas. Add viewport mode 7 (the client's
800x600 window viewport) and a VP-METHOD census of viewport-family runs
in trusted pushes; a bounded BAR1 screen-range write witness.

r1506: the CB no longer touches the screen (vidmem 0x500000 reads the
black clear), screen ownership proven. r1507/r1508: the active indexed
draw's vertex/index pages are all-zero in its own FB shadow in those
boots, so no fragments; the client never emits a real 0x0a00 viewport
block (the 0xa00 hits are misaligned vertex floats), so the viewport
stays synthesized.

1 files changed, 22 insertions, 0 deletions

diff --git a/kernel/main.c b/kernel/main.c
index 458ba36..6902b48 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -907,6 +907,28 @@ static ssize_t nv_vgpu_vfio_dev_write(struct vfio_device *vdev, const char __use
 
 		if (copy_from_user(vgpu->bars[1].vaddr + bar1_off, buf, count))
 			return -EFAULT;
+		/*
+		 * SESSION 154 r1506: the X screen (VA 0x120400000, 900 pages)
+		 * is the BAR1 FB shadow at 0x200000. Guest CPU writes into
+		 * that range are either the X server's own fills (expected)
+		 * or another client's BAR1 upload that overlaps the screen
+		 * allocation (the shader-cache collision). Name them so the
+		 * owner of the pollution is measured, not inferred.
+		 */
+		{
+			static u32 bar1_scr_log;
+
+			if (bar1_off >= 0x200000u && bar1_off < 0x600000u &&
+			    bar1_scr_log < 64u && count <= 8) {
+				u64 v = 0;
+
+				memcpy(&v, vgpu->bars[1].vaddr + bar1_off,
+				       count);
+				pr_info("vgsp: BAR1-SCREEN-WRITE off=0x%llx size=%zu val=0x%llx (screen range 0x200000-0x584000)\n",
+					bar1_off, count, v);
+				bar1_scr_log++;
+			}
+		}
 		*ppos += count;
 		return count;
 	}