From 1216d19c93b390abbd761f3ad817afe69325f1a9 Mon Sep 17 00:00:00 2001
From: Arthur Hanson Rasmusson <arthur@vgpu.io>
Date: Tue, 6 Oct 2026 16:43:42 -0400
Subject: vgsp: preserve the pointer page offset in the shadow QMD rewrite
 (program +0x800)

---
 kernel/gsp_phys_booter.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 159751b..a4d9718 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -14548,8 +14548,17 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 								      n_shadow),
 					&sh_va);
 				if (!ret) {
-					u64 ptr_va = sh_va +
-						(pg->guest_va &
+					/*
+					 * Preserve the original pointer's page
+					 * offset: pg->guest_va is page-based,
+					 * but the QMD pair (still the guest's
+					 * value here) carries the exact entry
+					 * offset (e.g. program +0x800). Without
+					 * it the engine would fetch the wrong
+					 * slot of the copied page.
+					 */
+					u64 ptr_va = sh_va |
+						((u64)qmd[pg->qmd_word] &
 						 (GSP_PHYS_PAGE_SIZE - 1));
 
 					n_shadow++;
-- 
cgit v1.2.3