vgsp: m91 - gsp_phys_rmcall_gr_ptr_guest: keep QMD pointer pairs at the guest VAs

The m90/m91 trap decoded the SM I-fetch failure precisely: GPC0/GPC1 TPC0
SM0 WARP_ESR ERROR=0x20 ADDR_ERROR_TYPE=0xb = MMU_NACK, PC=0x109880 (the
rewritten window-0 shadow program VA). The FE reads the same small-PT line
fine (the forwarded inline QMD in the qmdwin page is processed to CWD
ACTIVE), so the SM walk is not using the channel/ladder VAS the shadow
lives in - it appears to use the guest subctx page directory (instance
SC_PAGE_DIRECTORY_BASE 0x10956b000), which maps the guest VAs the real
client's captured QMD points at, and not our window.

Add gr_ptr_guest: when set, the forwarded launch leaves the QMD pointer
pairs (param w32/33, program w48/49, prefetch w8/w31) exactly as the guest
driver wrote them (as the real driver's captured QMD carries), and only
relocates the QMD page itself (qmdwin, a proven FE read). Shadows are still
copied for logging but unused.

1 files changed, 24 insertions, 0 deletions

diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index ee6625c..629bd3a 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -970,6 +970,30 @@ int gsp_phys_rmcall_gr_shadow_win0_value(void)
 EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_shadow_win0_value);
 
 /*
+ * m91: keep the forwarded launch's QMD pointer pairs (param w32/33, program
+ * w48/49, prefetch w8/w31) at the guest's original VAs instead of rewriting
+ * them to the window-0 shadow copies (gsp_phys_rmcall_gr_ptr_guest; default
+ * 0). Rationale: the m90/m91 trap shows the SM I-fetch at the shadow VA is
+ * refused with WARP_ESR=MMU_NACK while the FE reads the same PT line fine,
+ * so the SM walk appears to use the guest subctx page directory (which maps
+ * the guest VAs) rather than the channel/ladder VAS. With this set, the
+ * shadow copies are still made (for logs/bookkeeping) but unused, and the
+ * engine sees exactly the pointer values the real driver's captured QMD
+ * carries.
+ */
+static int gsp_phys_rmcall_gr_ptr_guest_param;
+module_param_named(gsp_phys_rmcall_gr_ptr_guest,
+		   gsp_phys_rmcall_gr_ptr_guest_param, int, 0644);
+MODULE_PARM_DESC(gsp_phys_rmcall_gr_ptr_guest,
+		 "Keep forwarded QMD pointer pairs at the guest VAs (SM walk appears to use the guest subctx PDB; default 0)");
+
+int gsp_phys_rmcall_gr_ptr_guest_value(void)
+{
+	return gsp_phys_rmcall_gr_ptr_guest_param;
+}
+EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_ptr_guest_value);
+
+/*
  * Ladder VAS ownership selector (gsp_phys_rmcall_vas_shared; default 0).
  * The H1 GR promote wall is a direct consequence of the ladder's
  * externally-owned FERMI_VASPACE_A: with IS_EXTERNALLY_OWNED the RM treats