From 1cbe3d79d8f8d0bc81c81eecf3ca364ed3084f24 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 2 Oct 2026 07:10:28 -0400 Subject: gsp-phys: P6a debug triggers resolve the guest page HPA at trigger time Triggers 6 (W2G) and 7 (G2H) previously used page-table slots pre-built once during the ladder's stage 3. A guest page's host physical address can change between translations (observed 0x13a591000 -> 0x3b8318000 for the same GPA), and a runtime PTE rewrite into an already-fetched 128-byte line is invisible (no invalidate path), so the later write-direction trigger validated against the wrong page and failed its data check. Both triggers now translate at trigger time and run through the same fresh-scratch-line path as forwarding, via a shared internal copy body; the exported forwarding API is unchanged and still requires gsp_phys_work_forward. A changed HPA is now an informational once-per-boot note rather than a failure; the probe-pattern guard still refuses stale pages. Trigger 8 and the stage-3 pre-built slots are unchanged. Live (run p6w3): GUEST G2H COPY OK gpa=0x12423d000 hpa=0x56ab3a000; GUEST W2G COPY OK with verify_ok=1; PTE selftest OK; guest SEEN_W2G; ladder REAL COPY OK; clean latched release (5 power-domain locks, rebound, WPR2 down, no rail cycles, pstore empty, same boot). The full smoke run hit the known guest cuInit/WPR2-already-up wedge at cdt; the trigger path itself is green. --- kernel/gsp_phys_booter.h | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) (limited to 'kernel/gsp_phys_booter.h') diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h index cc3b935..ada3280 100644 --- a/kernel/gsp_phys_booter.h +++ b/kernel/gsp_phys_booter.h @@ -317,13 +317,16 @@ int gsp_phys_boot_rm_unload(void __iomem *bar0); * gsp_phys_guest_mem=1 and a GPA pinned through gsp-phys-guest-gpa, * writing 7 (G2H, guest read) and then 6 (W2G, guest write) additionally * run one 4 KB CE copy each against that guest RAM page: the GPA is - * translated through the active mdev's VFIO type-1 domain, the physical - * device's domain must be identity, the corresponding channel PDB slot - * (0x106 read / 0x105 write) is programmed with the translated HPA, and - * the result is verified with a direct-map memcmp. Both directions are - * gated on a live READY claim, ladder stage >= 3 and the pinned GPA; - * every refusal is a logged no-op and no guest byte is touched unless - * G2H already proved the translation. + * re-translated through the active mdev's VFIO type-1 domain at trigger + * time, the physical device's domain must be identity, and the copy runs + * through the P6b fresh 128 B scratch-line path (one never-reused line + * per pair; the internal trigger variant of the guest-copy backend, so + * gsp_phys_work_forward is not required), so a host PA that changed since + * the pin cannot be shadowed by an engine-cached PTE fetch. The result is + * verified with a direct-map memcmp. Both directions are gated on a live + * READY claim, ladder stage >= 3 and the pinned GPA; every refusal is a + * logged no-op and no guest byte is touched unless G2H already proved + * the translation. * - "gsp-phys-guest-gpa" (write-only, mode 0200): pin the one guest RAM * GPA ("0x", 4 KB page-aligned) that the rm-call guest directions * may touch. One GPA per boot (a second different GPA is refused: -- cgit v1.2.3