vgsp-gr: enlarge the data bounce window to 208 pages (256 KB operands)

victory_matmul (256x256 float: 256 KB per operand) failed with all-wrong
results while 128 KB workloads passed: the relocation bounce window was
112 pages with a 100-page data cap and 33 pages per pointer, so each 64-page
operand was truncated and the engine ran on partial/mismatched windows.

Grow the planted bounce window to 208 pages (main-PT slots 0x110..0x1df),
move the mail page to the last data-free slot (206, marker 207), and raise
the per-pointer cap to 68 pages and the data cap to 205 (three 256 KB
operands = 3x68 = 204 <= 205). Operands larger than 256 KB still hit the cap
and need a chunked data path (documented at the define).

1 files changed, 16 insertions, 8 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 0c3e829..110731d 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -2188,19 +2188,27 @@ static struct gsp_phys_boot_stage {
 	/* m104: module page holding the injected mail_kernel message. */
 	struct gsp_phys_boot_chunk rmcall_gr_mail;
 	/*
-	 * m114: pre-commit bounce window. 112 pages planted into the main
-	 * small-PT at slots 0x110..0x17f during stage 3 (the proven win0
-	 * pattern: the SM walker resolves the commit-time tree only). The
-	 * launch copies the kernel's data pages in, rewrites the pointers to
-	 * these VAs (reloc base 0x110000), and copies the results back after
-	 * the release; page 100 (VA 0x174000) carries the mail message.
+	 * m114: pre-commit bounce window, planted into the main small-PT at
+	 * slots 0x110..0x1df during stage 3 (the proven win0 pattern: the SM
+	 * walker resolves the commit-time tree only). The launch copies the
+	 * kernel's data pages in, rewrites the pointers to these VAs (reloc
+	 * base 0x110000), and copies the results back after the release.
+	 *
+	 * The window is 208 pages so the data region below the mail page can
+	 * carry the operand pages of kernels whose buffers exceed the old
+	 * 128 KB (victory_matmul's 256 KB buffers need 64 pages each; three
+	 * of them plus argument/bank candidates exceed the old 100-page /
+	 * 33-pages-per-pointer caps and the engine then ran on truncated
+	 * windows). The mail page is the LAST data-free page (slot 206) and
+	 * the m132 marker sits at 207; the main PT page deliberately covers
+	 * the whole 0x110000..0x1df000 range with nothing else planted there.
 	 */
 	struct gsp_phys_boot_chunk rmcall_gr_bounce;
 	u32 rmcall_gr_bounce_used;
-#define GSP_PHYS_RMCALL_GR_BOUNCE_PAGES	112u
+#define GSP_PHYS_RMCALL_GR_BOUNCE_PAGES	208u
 #define GSP_PHYS_RMCALL_GR_BOUNCE_SLOT0	0x110u
 #define GSP_PHYS_RMCALL_GR_BOUNCE_VA0	0x110000ULL
-#define GSP_PHYS_RMCALL_GR_MAIL_SLOT	100u
+#define GSP_PHYS_RMCALL_GR_MAIL_SLOT	206u
 	/* m99: guest data identity-map table branches (see the PD*_MAX block). */
 	struct gsp_phys_boot_chunk
 		rmcall_gr_data_pd1[GSP_PHYS_RMCALL_GR_DATA_PD1_MAX];