vgsp: m104 - inject the mail_kernel module-data base when bank-4 is empty

The forwarded mail_kernel reads __device__ kMail through c[0x4][0x0] (the
driver-provided module-data base), but the guest's bank-4 page content is
zero in the launch (the driver's value never lands in the resolved page).
With gr_mail_patch set, when bank 4's first 8 bytes are zero, allocate a
module page holding the demo message, map it at server-managed VA
0x11ff00000 (UPDATE_PDE_2, inside [0x100000000,0x11fffffff)) and point
c[0x4][0x0] there. The kernel then reads the message from device memory and
writes out[i] through the already-relocated bank-0 pointer; vadd (params
only) becomes the real relocated-data acceptance test.

1 files changed, 18 insertions, 0 deletions

diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index 37eff49..a350ed9 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -1012,6 +1012,24 @@ int gsp_phys_rmcall_gr_pte_kind_value(void)
 EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_pte_kind_value);
 
 /*
+ * m104: when the forwarded launch's bank-4 (c[0x4]) page is empty, inject the
+ * demo message page (module chunk) at a server-managed VA and point
+ * c[0x4][0x0] at it, so the mail_kernel's __device__ kMail read resolves.
+ * Default 0.
+ */
+static int gsp_phys_rmcall_gr_mail_patch_param;
+module_param_named(gsp_phys_rmcall_gr_mail_patch,
+		   gsp_phys_rmcall_gr_mail_patch_param, int, 0644);
+MODULE_PARM_DESC(gsp_phys_rmcall_gr_mail_patch,
+		 "Inject the mail_kernel message page when bank-4 is empty (default 0)");
+
+int gsp_phys_rmcall_gr_mail_patch_value(void)
+{
+	return gsp_phys_rmcall_gr_mail_patch_param;
+}
+EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_mail_patch_value);
+
+/*
  * m95: program each GPC's MMU_CTRL from the hub's PFB MMU_CTRL (the real RM's
  * grInitGPCMmuPRIRegs matching-fields copy) before a forwarded launch. The
  * GPC-side walker refuses the SM I-fetch with MMU_NACK while hub-side reads