vgsp: m117 - 8-byte stride + 256-alignment guard for the pointer rewrite

m116's param dump exposed the m103 4-byte-stride scan corrupting small
adjacent fields (0x40/1 rewritten into relocated-looking values). Use
8-byte stride, require 256-byte-aligned values (all device pointers), and
skip records without a reloc VA.

1 files changed, 11 insertions, 5 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index b03ac30..c2776a0 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -16316,18 +16316,24 @@ static void gsp_phys_gr_rewrite_data_vars(u32 *w, u32 n_words,
 
 	if (!req->n_data)
 		return;
-	/* Scan every 4-byte boundary: the demo's bank-4 base pointer sits at
-	 * a 4-aligned (not 8-aligned) offset, which an 8-stride scan misses. */
-	for (k = 0; k + 1 < n_words; k++) {
+	/*
+	 * m117: 8-byte stride with a 256-byte alignment guard. The m103
+	 * 4-byte stride mis-matched arbitrary adjacent 4-byte words (the
+	 * param page's small fields were corrupted into relocated-looking
+	 * values); device pointers in the param/bank pages are 256-byte
+	 * aligned, and an unaligned pair can no longer spuriously match.
+	 */
+	for (k = 0; k + 1 < n_words; k += 2) {
 		u64 v = (u64)w[k] | ((u64)w[k + 1] << 32);
 		u64 wb;
 		u32 x;
 
-		if (v < 0x10000000ULL || v >= (1ULL << 47) || (v & 3))
+		if (v < 0x10000000ULL || v >= (1ULL << 47) || (v & 0xff))
 			continue;
 		wb = v & ~0xfffULL;
 		for (x = 0; x < req->n_data; x++) {
-			if (req->data[x].va != wb)
+			if (req->data[x].va != wb ||
+			    !req->data[x].reloc_va)
 				continue;
 			v = req->data[x].reloc_va | (v & 0xfffULL);
 			w[k] = (u32)v;