vgsp: relocate a CODESRC-SUSPECT GR program page to the engine-mapped window-0 shadow instead of leaving the QMD pointer at an unmapped guest VA (eng33)

The client's MME-expanded draw builds a QMD whose program page (qmd[48])
classifies CODESRC-SUSPECT (empty-page): the engine's GPCCLIENT_GCC I-fetch
then read the guest VA above every engine-PDB window, raised FAULT_PDE and
the FIFO parked for the rest of the boot (the TSG re-arm cannot revive a
parked PBDMA). c361-c368 receipts.

With gsp_phys_gr_codesrc_reloc=1 (default) the builder copies the page into
the window-0 shadow (empty sources only; PTE/module pages are never
republished), overlays the client's own known-good SPH+SASS stage image at
the original QMD program offset (gsp_sema_gl_prog_img, stage-typed from the
section bind; truncated at a 128-bit boundary with a terminal EXIT when the
image is larger than the remaining page), and the existing QMD w48/49 +
prefetch rewrite publishes the shadow VA. If the shadow mapping cannot be
installed the page stays unmapped and the existing refusal drops the launch,
so an unmapped QMD program pointer is never published. 0 restores the old
guest-VA behaviour for a one-flip A/B.

Validation (c373, params-r1624): 31 CODESRC-RELOC events (img_len=384,
off=0xb00, 0 truncations), 51 GR LAUNCH submitted, 11 MME-FAST end
events=3, 79 FETCH-WIT with GP_GET advancing engine-fetched, 0 FAULT_PDE,
0 vgsp-fault, 0 WEDGE-REARM/PARK-RECOVER; work_gr backend_ok=35 fault=0.
The draws still write nothing (NOWRITE, no clear run in the emitted
window), so px0 stays 0 - the store wall is unchanged and is the next
target.

1 files changed, 26 insertions, 0 deletions

diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index f1d72f7..33fae68 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -1333,6 +1333,32 @@ int gsp_phys_rmcall_gr_ptr_guest_value(void)
 EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_ptr_guest_value);
 
 /*
+ * r1625: relocate a CODESRC-SUSPECT program page (gsp_phys_gr_codesrc_reloc;
+ * default 1). The old conservative refusal left the QMD program pointer at
+ * the guest VA when the program page read empty/PTE-shaped. That VA is above
+ * every engine-PDB window, so the GPCCLIENT_GCC I-fetch raised a FAULT_PDE
+ * and the FIFO parked (the c361-c368 wedge). With this set, the builder
+ * instead copies the page into the window-0 shadow and rewrites
+ * qmd[48]/[49] to the shadow VA; an empty/unsafe source is replaced by the
+ * client's own known-good SPH+SASS image at the program offset (a raw
+ * EXIT stub would be rejected by the SPH validation). If the shadow mapping
+ * cannot be installed the launch is refused (fail-closed), so a QMD whose
+ * program pointer is not engine-mapped is never published. 0 restores the
+ * old guest-VA behaviour for a one-flip A/B.
+ */
+static int gsp_phys_gr_codesrc_reloc_param = 1;
+module_param_named(gsp_phys_gr_codesrc_reloc,
+		   gsp_phys_gr_codesrc_reloc_param, int, 0644);
+MODULE_PARM_DESC(gsp_phys_gr_codesrc_reloc,
+		 "Relocate a CODESRC-SUSPECT GR program page to an engine-mapped shadow page and rewrite the QMD pointer (default 1; 0 = keep the old guest-VA behaviour)");
+
+int gsp_phys_gr_codesrc_reloc_value(void)
+{
+	return gsp_phys_gr_codesrc_reloc_param;
+}
+EXPORT_SYMBOL_GPL(gsp_phys_gr_codesrc_reloc_value);
+
+/*
  * m96: KIND (PTE bits 63:56) for the window-0 shadow pool PTEs. On Turing
  * the v2 PTE has no PITCH kind; UVM sets GENERIC_MEMORY (0x06). A kind=0
  * PTE is a candidate for the SM I-fetch MMU_NACK while the FE tolerates it.