vgsp: BAR0 0x88000-0x89000 all-writes logging - decisive negative: GL client owns no channel, no command buffer; kicks on 0xbfef0002 are Xorg's (SESSION 153 r983)HEADmaster

1 files changed, 17 insertions, 1 deletions

diff --git a/kernel/main.c b/kernel/main.c
index 509c560..2f35163 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -843,13 +843,25 @@ static ssize_t nv_vgpu_vfio_dev_write(struct vfio_device *vdev, const char __use
 		u8 tmp[8];
 		ssize_t ret;
 		static u32 bar0_log;
+		/*
+		 * SESSION 153-CONTINUED-23: the GL client's draw doorbell, if it
+		 * ever arrives through the trap path at all, must be visible -
+		 * widen the log from the single 0x88704 offset to every trapped
+		 * write in the PCFG window (0x88000..0x89000). Bounded: the BAR0
+		 * shadow is direct-mapped, so trap-path writes are rare; a cap
+		 * keeps a pathological guest from flooding dmesg.
+		 */
+		static u32 pcfg_log;
 
 		if (!vgpu->bar_emul_ctx)
 			return -ENODEV;
 		if (copy_from_user(tmp, buf, count))
 			return -EFAULT;
 
-		if ((u64)pos == 0x88704 || (gsp_sema_dbg && bar0_log < 64)) {
+		if ((u64)pos == 0x88704 ||
+		    ((u64)pos >= 0x88000 && (u64)pos < 0x89000 &&
+		     pcfg_log < 1024) ||
+		    (gsp_sema_dbg && bar0_log < 64)) {
 			static u32 db_log;
 			u64 v = 0;
 
@@ -863,6 +875,10 @@ static ssize_t nv_vgpu_vfio_dev_write(struct vfio_device *vdev, const char __use
 				}
 				if (count == 4)
 					gsp_sema_service_doorbell((u32)v);
+			} else if ((u64)pos >= 0x88000 && (u64)pos < 0x89000) {
+				pr_info("vgsp: PCFG write pos=0x%llx size=%zu val=0x%llx\n",
+					(u64)pos, count, v);
+				pcfg_log++;
 			} else {
 				pr_info("vgsp: BAR0 write pos=0x%llx size=%zu val=0x%llx\n",
 					(u64)pos, count, v);