vgsp: GR forward shadow fallback for high-VA guest pages (R4)

The M1 forward captured the guest's mail launch but was refused at Tier-1:
the guest's UVM program/param pages live at 0x7d6e... VAs whose 2 MiB window
indices are outside this VAS's PDE range, so DMA_UPDATE_PDE_2 returns 0x1f
and the launch fell back (bridge disabled) with the guest polling.

When the page HPA was resolved on the identity domain, copy the full guest
page into the Tier-2 shadow chunk and rewrite the QMD pointer pair, so
pages the engine only reads need no inline coverage. Release/sem pages keep
their existing direct-alias shadow lines.

1 files changed, 13 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 764e261..67da749 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -13128,6 +13128,19 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 			if (!sh_page)
 				goto gr_page_unmapped;
 			memset(sh_page, 0, GSP_PHYS_PAGE_SIZE);
+			/*
+			 * R4: a resolved guest page at a high VA window cannot
+			 * take a Tier-1 PDE install (server 0x1f on this VAS).
+			 * Because the caller resolved the HPA on the identity
+			 * domain, copy the full guest page into the shadow and
+			 * rewrite the QMD pointer pair, so no inline coverage
+			 * is needed for pages the engine only reads.
+			 */
+			if (pg->hpa) {
+				memcpy(sh_page, (u8 *)__va(pg->hpa),
+				       GSP_PHYS_PAGE_SIZE);
+				copied++;
+			}
 			for (j = 0; j < req->n_inl; j++) {
 				const struct gsp_phys_gr_inline *inl =
 					&req->inl[j];