vgsp-sema+guest-diag: fix CE USERD discovery for re-registered sessions (ISSUE-0002)

svc_chan_userd now prefers the layout-derived CE USERD
(ring_pa + 0x10000 in the ring aperture) and accepts it while idle, so
a second session cannot latch onto the registered pool-relative offset
when that alias holds a DIFFERENT rank's stale USERD: r40 c2 rank0 read
rank3's stale 1/1 at FB 0xf0000 and the pump never followed rank0's own
GP_PUT (guest GPUT mapping for gpFifoGpuVa proves ring+0x10000).

guest_pin_stream.va_to_pa drops translations outside the registered
guest-RAM windows so BAR1-phys addresses (0x70000xxxxx) are no longer
injected as SYS pins; r40 rank2's ring resolved to the bogus
pa=0x70000c0000 ap=SYS and read 66/66.

1 files changed, 23 insertions, 0 deletions

diff --git a/tools/guest-diag/guest_pin_stream.py b/tools/guest-diag/guest_pin_stream.py
index 14cd526..031271c 100644
--- a/tools/guest-diag/guest_pin_stream.py
+++ b/tools/guest-diag/guest_pin_stream.py
@@ -166,6 +166,9 @@ class Kcore:
                 self._pa_cache[page] = 0
                 return None
             pa = e & 0x000FFFFFFFF000
+        if not _is_ram_pa(pa):
+            self._pa_cache[page] = 0
+            return None
         self._pa_cache[page] = pa
         return pa
 
@@ -178,6 +181,26 @@ def is_gpu_va(v):
     return v and 0x120000000 <= v < 0x200000000
 
 
+# Guest-RAM windows registered with the host (debugfs gsp-phys-guest-ram):
+# low 0..2 GiB and high 4..6 GiB. A CPU mapping of a channel block resolves
+# through the guest page tables to a phys address in one of these windows
+# when the backing is guest sysmem, but to a PCI BAR address (e.g.
+# 0x70000xxxxx, the mdev BAR1 aperture) when the backing is the emulated
+# vidmem. The host pin stream must only carry guest-RAM PAs: a BAR phys fed
+# to sema_map_add as a "sysmem" pin poisoned the ring/USERD lookups (r40:
+# rank2's ring resolved to pa=0x70000c0000 ap=SYS and read 66/66 garbage).
+RAM_WINDOWS = ((0x0, 0x80000000), (0x100000000, 0x180000000))
+
+
+def _is_ram_pa(pa):
+    if not pa:
+        return False
+    for lo, hi in RAM_WINDOWS:
+        if lo <= pa < hi:
+            return True
+    return False
+
+
 def _is_gpu_va_wide(v):
     """GPU VAs above 0x200000000 are the GR share window; accept them too."""
     return v and (is_gpu_va(v) or 0x200000000 <= v < 0x208000000)