From bdeb5637426b17e1e86566cb467b6f7b6eff64f1 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 5 Oct 2026 14:01:30 -0400 Subject: vgsp: GR forwarding static-review fixes (GR/CE slot bit, release VA->PA, shadow refusal) Five defects found in a static review of the default-off GR forwarding path (no hardware test possible; GPU wedged): - clear the shared request slot's GR mode bit when a CE request is filled, so a prior GR request can never make a later CE push run the GR work function with stale fields; - resolve the QMD release0 guest VA to a guest PA on the service thread (counter pin/derive, else the trusted resolver) and only convert PA->HPA in the work item; the previous code fed the VA to the PA-based translator and would write release0 into an unrelated guest page; - take the refusal path (goto gr_page_unmapped) on every Tier-2 shadow failure instead of continuing to submit a half-built method stream; - consume the QMD run on replay passes when the GR forward is enabled so replayed QMD words are never reinterpreted as CE method headers; - only queue a captured GR candidate against the channel that captured it. Build clean (make -C kernel, W=1 only pre-existing warnings). --- kernel/gsp_phys_booter.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'kernel/gsp_phys_booter.c') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index bf70cd5..ebe873b 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -11295,20 +11295,20 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, if (n_shadow >= GSP_PHYS_RMCALL_GR_SHADOW_PAGES) { gsp_phys_gr_pool_exhausted++; - continue; + goto gr_page_unmapped; } if (!sh->pages) { ret = gsp_phys_chunk_alloc(boot_stage.pdev, sh, GSP_PHYS_RMCALL_GR_SHADOW_PAGES); if (ret) { gsp_phys_gr_pool_exhausted++; - continue; + goto gr_page_unmapped; } gsp_phys_chunk_zero(sh); } sh_page = gsp_phys_chunk_page_va(sh, n_shadow); if (!sh_page) - continue; + goto gr_page_unmapped; memset(sh_page, 0, GSP_PHYS_PAGE_SIZE); for (j = 0; j < req->n_inl; j++) { const struct gsp_phys_gr_inline *inl = @@ -11351,6 +11351,7 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, } } } +gr_page_unmapped: if (!mapped) { mutex_unlock(&gsp_phys_rm_lock); gsp_phys_gr_refused++; -- cgit v1.2.3