vgsp: m104 - inject the mail_kernel module-data base when bank-4 is empty

The forwarded mail_kernel reads __device__ kMail through c[0x4][0x0] (the
driver-provided module-data base), but the guest's bank-4 page content is
zero in the launch (the driver's value never lands in the resolved page).
With gr_mail_patch set, when bank 4's first 8 bytes are zero, allocate a
module page holding the demo message, map it at server-managed VA
0x11ff00000 (UPDATE_PDE_2, inside [0x100000000,0x11fffffff)) and point
c[0x4][0x0] there. The kernel then reads the message from device memory and
writes out[i] through the already-relocated bank-0 pointer; vadd (params
only) becomes the real relocated-data acceptance test.

3 files changed, 56 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 8cc09e4..f3efb00 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -2150,6 +2150,8 @@ static struct gsp_phys_boot_stage {
 	 */
 	struct gsp_phys_boot_chunk rmcall_gr_qmdwin;
 	u64 rmcall_gr_qmdwin_va;	/* planted VA; 0 = guest destination */
+	/* m104: module page holding the injected mail_kernel message. */
+	struct gsp_phys_boot_chunk rmcall_gr_mail;
 	/* m99: guest data identity-map table branches (see the PD*_MAX block). */
 	struct gsp_phys_boot_chunk
 		rmcall_gr_data_pd1[GSP_PHYS_RMCALL_GR_DATA_PD1_MAX];
@@ -16545,6 +16547,39 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 				gsp_phys_gr_rewrite_data_vars((u32 *)sh_page,
 					GSP_PHYS_PAGE_SIZE / 4, req,
 					(pg->qmd_word - 32) / 2);
+			if (pg->hpa && pg->qmd_word == 40u &&
+			    gsp_phys_rmcall_gr_mail_patch_value()) {
+				u32 *w = (u32 *)sh_page;
+
+				if (!w[0] && !w[1]) {
+					static const char mail[] =
+						"the little gpu man says you've got mail";
+					u64 mva = 0x11ff00000ULL;
+
+					if (!boot_stage.rmcall_gr_mail.pages &&
+					    !gsp_phys_chunk_alloc(boot_stage.pdev,
+							&boot_stage.rmcall_gr_mail,
+							1)) {
+						gsp_phys_chunk_zero(
+							&boot_stage.rmcall_gr_mail);
+						memcpy(gsp_phys_chunk_page_va(
+							&boot_stage.rmcall_gr_mail,
+							0), mail, sizeof(mail));
+						dma_wmb();
+					}
+					if (boot_stage.rmcall_gr_mail.pages &&
+					    !gsp_phys_rmcall_gr_map_va_locked(
+						    bar0, mva,
+						    (u64)gsp_phys_chunk_page_dma(
+							&boot_stage.rmcall_gr_mail, 0),
+						    boot_stage.rmcall_gr_submit_epoch)) {
+						w[0] = (u32)mva;
+						w[1] = (u32)(mva >> 32);
+						pr_info("vgsp-gr: bank4 mail base injected: c[0x4][0x0]=0x%llx (message page mapped)\n",
+							mva);
+					}
+				}
+			}
 			/*
 			 * m98: dump the program prologue (qmd_word 48, from
 			 * the QMD's in-page entry offset) and the param/const-0
diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index 37eff49..a350ed9 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -1012,6 +1012,24 @@ int gsp_phys_rmcall_gr_pte_kind_value(void)
 EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_pte_kind_value);
 
 /*
+ * m104: when the forwarded launch's bank-4 (c[0x4]) page is empty, inject the
+ * demo message page (module chunk) at a server-managed VA and point
+ * c[0x4][0x0] at it, so the mail_kernel's __device__ kMail read resolves.
+ * Default 0.
+ */
+static int gsp_phys_rmcall_gr_mail_patch_param;
+module_param_named(gsp_phys_rmcall_gr_mail_patch,
+		   gsp_phys_rmcall_gr_mail_patch_param, int, 0644);
+MODULE_PARM_DESC(gsp_phys_rmcall_gr_mail_patch,
+		 "Inject the mail_kernel message page when bank-4 is empty (default 0)");
+
+int gsp_phys_rmcall_gr_mail_patch_value(void)
+{
+	return gsp_phys_rmcall_gr_mail_patch_param;
+}
+EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_mail_patch_value);
+
+/*
  * m95: program each GPC's MMU_CTRL from the hub's PFB MMU_CTRL (the real RM's
  * grInitGPCMmuPRIRegs matching-fields copy) before a forwarded launch. The
  * GPC-side walker refuses the SM I-fetch with MMU_NACK while hub-side reads
diff --git a/kernel/gsp_phys_gpu.h b/kernel/gsp_phys_gpu.h
index 7df30cb..e83220a 100644
--- a/kernel/gsp_phys_gpu.h
+++ b/kernel/gsp_phys_gpu.h
@@ -346,6 +346,9 @@ int gsp_phys_rmcall_gr_gpc_mmu_init_value(void);
 /* m96: KIND (63:56) for window-0 shadow PTEs (0 = historical kind 0). */
 int gsp_phys_rmcall_gr_pte_kind_value(void);
 
+/* m104: inject the mail_kernel message page when bank-4 is empty. */
+int gsp_phys_rmcall_gr_mail_patch_value(void);
+
 /* m72: append the vendor local-memory context block to the GR prelude so
  * SKEDCHECK05 LOCAL_MEMORY_TOTAL_SIZE passes (default 0); base VA and
  * per-TPC size are overridable for A/B runs. */