vgsp: m134 - re-apply the data-pointer relocation after the inline-data replay (inline records restored the original guest pointers into the engine-mapped page; root cause of the param-read wall)

1 files changed, 18 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index ecf95b6..c2390d6 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -16869,6 +16869,24 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 				       inl->data, len);
 				copied++;
 			}
+			/*
+			 * m134: re-apply the pointer relocation AFTER the inline
+			 * data replay. The inline records carry the driver's own
+			 * parameter block (the original guest pointers) and were
+			 * overwriting the relocated pointers in the page that is
+			 * actually mapped for the engine - the rewrite at 16771
+			 * and every dump before this point looked correct, but
+			 * the win0/win1 copy below copied the restored originals
+			 * (m133: win0 param page held 0x7d8a1ec00000 while the
+			 * +0x150 dump held 0x110000). Idempotent: already
+			 * relocated values no longer match a guest data VA.
+			 */
+			if (pg->hpa && pg->qmd_word >= 32 && pg->qmd_word <= 47 &&
+			    !(pg->qmd_word & 1))
+				gsp_phys_gr_rewrite_data_vars((u32 *)sh_page,
+					GSP_PHYS_PAGE_SIZE / 4, req,
+					(pg->qmd_word - 32) / 2,
+					(u32 *)__va(pg->hpa));
 			if (copied) {
 				u32 sh_line =
 					boot_stage.rmcall_guest_pt_next_line;