1 files changed, 13 insertions, 0 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 764e261..67da749 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -13128,6 +13128,19 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 			if (!sh_page)
 				goto gr_page_unmapped;
 			memset(sh_page, 0, GSP_PHYS_PAGE_SIZE);
+			/*
+			 * R4: a resolved guest page at a high VA window cannot
+			 * take a Tier-1 PDE install (server 0x1f on this VAS).
+			 * Because the caller resolved the HPA on the identity
+			 * domain, copy the full guest page into the shadow and
+			 * rewrite the QMD pointer pair, so no inline coverage
+			 * is needed for pages the engine only reads.
+			 */
+			if (pg->hpa) {
+				memcpy(sh_page, (u8 *)__va(pg->hpa),
+				       GSP_PHYS_PAGE_SIZE);
+				copied++;
+			}
 			for (j = 0; j < req->n_inl; j++) {
 				const struct gsp_phys_gr_inline *inl =
 					&req->inl[j];