From bcaab155a1318373b6c3a4c83fbfe2d0dbf1f44e Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Wed, 7 Oct 2026 13:12:06 -0400 Subject: vgsp: m91 - gsp_phys_rmcall_gr_ptr_guest: keep QMD pointer pairs at the guest VAs The m90/m91 trap decoded the SM I-fetch failure precisely: GPC0/GPC1 TPC0 SM0 WARP_ESR ERROR=0x20 ADDR_ERROR_TYPE=0xb = MMU_NACK, PC=0x109880 (the rewritten window-0 shadow program VA). The FE reads the same small-PT line fine (the forwarded inline QMD in the qmdwin page is processed to CWD ACTIVE), so the SM walk is not using the channel/ladder VAS the shadow lives in - it appears to use the guest subctx page directory (instance SC_PAGE_DIRECTORY_BASE 0x10956b000), which maps the guest VAs the real client's captured QMD points at, and not our window. Add gr_ptr_guest: when set, the forwarded launch leaves the QMD pointer pairs (param w32/33, program w48/49, prefetch w8/w31) exactly as the guest driver wrote them (as the real driver's captured QMD carries), and only relocates the QMD page itself (qmdwin, a proven FE read). Shadows are still copied for logging but unused. --- kernel/gsp_phys_booter.c | 126 ++++++++++++++++++++++++++++------------------- 1 file changed, 76 insertions(+), 50 deletions(-) (limited to 'kernel/gsp_phys_booter.c') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index c70a79f..9778385 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -16471,58 +16471,84 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, &sh_va); } if (!ret) { + bool keep_guest = + gsp_phys_rmcall_gr_ptr_guest_value(); + /* - * Preserve the original pointer's page - * offset: pg->guest_va is page-based, - * but the QMD pair (still the guest's - * value here) carries the exact entry - * offset (e.g. program +0x800). Without - * it the engine would fetch the wrong - * slot of the copied page. - */ - u64 ptr_va = sh_va | - ((u64)qmd[pg->qmd_word] & - (GSP_PHYS_PAGE_SIZE - 1)); - - n_shadow++; - qmd[pg->qmd_word] = (u32)ptr_va; - qmd[pg->qmd_word + 1] = - (qmd[pg->qmd_word + 1] & - ~0x1ffffu) | - ((u32)(ptr_va >> 32) & 0x1ffffu); - /* - * m68: the program-prefetch pair (w8 - * LO32(prefetch>>8), w31[8:0] - * HI32(prefetch>>8)) still carried the - * guest VA; a prefetch into our unmapped - * VAS may be what cancels the QMD after - * SKED schedules it. If the original - * prefetch address lies in the page we - * just shadowed, point it at the same - * shadow copy (preserving SASS_VERSION / - * prefetch size in w31). + * m91: the SM I-fetch at the shadow VA + * NACKs (ESR MMU_NACK, PC=shadow) while + * the FE reads the same PT line fine - + * the SMs appear to walk the guest + * subctx PDB, which maps the guest VAs + * but not our window VAs. When + * keep_guest is set, leave every QMD + * pointer pair at the guest's original + * value (as the real driver's captured + * QMD carries them) and use only the + * relocated QMD page (qmdwin, a proven + * FE/ladder-VAS read). */ - if (pg->qmd_word == 48) { - u64 orig_pref = - ((u64)(qmd[31] & - 0x1ffu) << 40) | - ((u64)qmd[8] << 8); - - if ((orig_pref & - ~(u64)(GSP_PHYS_PAGE_SIZE - 1)) == - pg_va) { - u64 new_pref = ptr_va | - (orig_pref & - (GSP_PHYS_PAGE_SIZE - 1)); - - qmd[8] = (u32)(new_pref >> 8); - qmd[31] = (qmd[31] & - ~0x1ffu) | - ((u32)((new_pref >> 40)) & - 0x1ffu); - pr_info("vgsp-gr: program prefetch rewritten to shadow 0x%llx (was 0x%llx)\n", - new_pref, - orig_pref); + if (keep_guest) { + pr_info("vgsp-gr: qmd_word %u pointer kept at guest VA 0x%08x%08x (shadow copy at 0x%llx unused)\n", + pg->qmd_word, + qmd[pg->qmd_word + 1], + qmd[pg->qmd_word], + sh_va); + } else { + /* + * Preserve the original pointer's + * page offset: pg->guest_va is + * page-based, but the QMD pair + * (still the guest's value here) + * carries the exact entry offset + * (e.g. program +0x800). Without + * it the engine would fetch the + * wrong slot of the copied page. + */ + u64 ptr_va = sh_va | + ((u64)qmd[pg->qmd_word] & + (GSP_PHYS_PAGE_SIZE - 1)); + + n_shadow++; + qmd[pg->qmd_word] = (u32)ptr_va; + qmd[pg->qmd_word + 1] = + (qmd[pg->qmd_word + 1] & + ~0x1ffffu) | + ((u32)(ptr_va >> 32) & 0x1ffffu); + /* + * m68: the program-prefetch pair (w8 + * LO32(prefetch>>8), w31[8:0] + * HI32(prefetch>>8)) still carried the + * guest VA; a prefetch into our unmapped + * VAS may be what cancels the QMD after + * SKED schedules it. If the original + * prefetch address lies in the page we + * just shadowed, point it at the same + * shadow copy (preserving SASS_VERSION / + * prefetch size in w31). + */ + if (pg->qmd_word == 48) { + u64 orig_pref = + ((u64)(qmd[31] & + 0x1ffu) << 40) | + ((u64)qmd[8] << 8); + + if ((orig_pref & + ~(u64)(GSP_PHYS_PAGE_SIZE - 1)) == + pg_va) { + u64 new_pref = ptr_va | + (orig_pref & + (GSP_PHYS_PAGE_SIZE - 1)); + + qmd[8] = (u32)(new_pref >> 8); + qmd[31] = (qmd[31] & + ~0x1ffu) | + ((u32)((new_pref >> 40)) & + 0x1ffu); + pr_info("vgsp-gr: program prefetch rewritten to shadow 0x%llx (was 0x%llx)\n", + new_pref, + orig_pref); + } } } mapped = true; -- cgit v1.2.3