From b7c1cff5f290ae19ceca47f4d0bb9024eb45146c Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Sun, 18 Oct 2026 15:10:58 -0400 Subject: vgsp: fail4 r229 - REC-DUMP per-rec VA->HPA->reloc census at submit The r229 ctaid_probe came back as: PROBE1 (coordinate map) perfect, PROBE2 (flat A read) wrong at every element - band 0 read A's own values at wildly wrong offsets (16382/16383 = A's last elements), bands >= 1 read float-typed data. Writes are flawless; the engine's READ of a freshly H2D'd 64 KB buffer returned foreign content, so before anything else the next capture needs the exact (va, hpa, reloc_va) triples the engine will read for that launch. REC-DUMP logs the submit's rec table at launch build time: all recs for small launches (n_data <= 64, the probe class), first/last 8 for larger ones, gated by gsp_phys_gr_copyout_dump. Comparing the A buffer's recs against the H2D landing (and against each other: distinct VAs collapsing onto one HPA, or HPAs outside the uploaded range) names the wrong-read source directly. Logging-only; greens safe. (cherry picked from commit f83ef995c17fba896950cc7f1818c65ac8839ac4) --- kernel/gsp_phys_booter.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) (limited to 'kernel/gsp_phys_booter.c') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index d32d588..7b6a1bf 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -18726,6 +18726,28 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, qmd[4], qmd[5], qmd[8], qmd[12], qmd[13], qmd[14], qmd[15], qmd[17], qmd[18], qmd[19]); + /* + * REC-DUMP (r229): the probe-class launches (small data sets) get + * their full rec table logged - every (va, hpa, reloc_va) the engine + * will read/write - so the next capture can compare the resolved + * HPAs against the buffer the client actually uploaded (distinct + * VAs collapsing onto one HPA, or HPAs in a foreign range, are + * visible directly). Big launches log the first/last 8 recs only. + */ + if (gsp_phys_gr_copywit_enabled() && req->n_data) { + u32 d; + + for (d = 0; d < req->n_data; d++) { + if (req->n_data > 64u && d >= 8u && + d < req->n_data - 8u) + continue; + pr_info_ratelimited("vgsp-gr: REC-DUMP[%u/%u] va=0x%llx hpa=0x%llx reloc=0x%llx\n", + d, req->n_data, req->data[d].va, + req->data[d].hpa, + req->data[d].reloc_va); + } + } + /* * Pages: Tier 1 maps the resolved HPA at the guest VA; a page without * a usable Tier-1 mapping falls to Tier 2 when captured inline bytes -- cgit v1.2.3