From 1b44cef6c6ae6c9889950f915682b749855fbe6a Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Wed, 7 Oct 2026 13:12:06 -0400 Subject: vgsp: m91 - gsp_phys_rmcall_gr_ptr_guest: keep QMD pointer pairs at the guest VAs The m90/m91 trap decoded the SM I-fetch failure precisely: GPC0/GPC1 TPC0 SM0 WARP_ESR ERROR=0x20 ADDR_ERROR_TYPE=0xb = MMU_NACK, PC=0x109880 (the rewritten window-0 shadow program VA). The FE reads the same small-PT line fine (the forwarded inline QMD in the qmdwin page is processed to CWD ACTIVE), so the SM walk is not using the channel/ladder VAS the shadow lives in - it appears to use the guest subctx page directory (instance SC_PAGE_DIRECTORY_BASE 0x10956b000), which maps the guest VAs the real client's captured QMD points at, and not our window. Add gr_ptr_guest: when set, the forwarded launch leaves the QMD pointer pairs (param w32/33, program w48/49, prefetch w8/w31) exactly as the guest driver wrote them (as the real driver's captured QMD carries), and only relocates the QMD page itself (qmdwin, a proven FE read). Shadows are still copied for logging but unused. --- kernel/gsp_phys_gpu.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) (limited to 'kernel/gsp_phys_gpu.c') diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c index ee6625c..629bd3a 100644 --- a/kernel/gsp_phys_gpu.c +++ b/kernel/gsp_phys_gpu.c @@ -969,6 +969,30 @@ int gsp_phys_rmcall_gr_shadow_win0_value(void) } EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_shadow_win0_value); +/* + * m91: keep the forwarded launch's QMD pointer pairs (param w32/33, program + * w48/49, prefetch w8/w31) at the guest's original VAs instead of rewriting + * them to the window-0 shadow copies (gsp_phys_rmcall_gr_ptr_guest; default + * 0). Rationale: the m90/m91 trap shows the SM I-fetch at the shadow VA is + * refused with WARP_ESR=MMU_NACK while the FE reads the same PT line fine, + * so the SM walk appears to use the guest subctx page directory (which maps + * the guest VAs) rather than the channel/ladder VAS. With this set, the + * shadow copies are still made (for logs/bookkeeping) but unused, and the + * engine sees exactly the pointer values the real driver's captured QMD + * carries. + */ +static int gsp_phys_rmcall_gr_ptr_guest_param; +module_param_named(gsp_phys_rmcall_gr_ptr_guest, + gsp_phys_rmcall_gr_ptr_guest_param, int, 0644); +MODULE_PARM_DESC(gsp_phys_rmcall_gr_ptr_guest, + "Keep forwarded QMD pointer pairs at the guest VAs (SM walk appears to use the guest subctx PDB; default 0)"); + +int gsp_phys_rmcall_gr_ptr_guest_value(void) +{ + return gsp_phys_rmcall_gr_ptr_guest_param; +} +EXPORT_SYMBOL_GPL(gsp_phys_rmcall_gr_ptr_guest_value); + /* * Ladder VAS ownership selector (gsp_phys_rmcall_vas_shared; default 0). * The H1 GR promote wall is a direct consequence of the ladder's -- cgit v1.2.3