From bcaab155a1318373b6c3a4c83fbfe2d0dbf1f44e Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Wed, 7 Oct 2026 13:12:06 -0400 Subject: vgsp: m91 - gsp_phys_rmcall_gr_ptr_guest: keep QMD pointer pairs at the guest VAs The m90/m91 trap decoded the SM I-fetch failure precisely: GPC0/GPC1 TPC0 SM0 WARP_ESR ERROR=0x20 ADDR_ERROR_TYPE=0xb = MMU_NACK, PC=0x109880 (the rewritten window-0 shadow program VA). The FE reads the same small-PT line fine (the forwarded inline QMD in the qmdwin page is processed to CWD ACTIVE), so the SM walk is not using the channel/ladder VAS the shadow lives in - it appears to use the guest subctx page directory (instance SC_PAGE_DIRECTORY_BASE 0x10956b000), which maps the guest VAs the real client's captured QMD points at, and not our window. Add gr_ptr_guest: when set, the forwarded launch leaves the QMD pointer pairs (param w32/33, program w48/49, prefetch w8/w31) exactly as the guest driver wrote them (as the real driver's captured QMD carries), and only relocates the QMD page itself (qmdwin, a proven FE read). Shadows are still copied for logging but unused. --- kernel/gsp_phys_gpu.h | 3 +++ 1 file changed, 3 insertions(+) (limited to 'kernel/gsp_phys_gpu.h') diff --git a/kernel/gsp_phys_gpu.h b/kernel/gsp_phys_gpu.h index 0b85758..62cc16d 100644 --- a/kernel/gsp_phys_gpu.h +++ b/kernel/gsp_phys_gpu.h @@ -337,6 +337,9 @@ int gsp_phys_rmcall_faultbuf_sys_value(void); * (proven small-PT line) instead of the window-1 scratch range (default 0). */ int gsp_phys_rmcall_gr_shadow_win0_value(void); +/* m91: keep the forwarded QMD pointer pairs at the guest VAs (default 0). */ +int gsp_phys_rmcall_gr_ptr_guest_value(void); + /* m72: append the vendor local-memory context block to the GR prelude so * SKEDCHECK05 LOCAL_MEMORY_TOTAL_SIZE passes (default 0); base VA and * per-TPC size are overridable for A/B runs. */ -- cgit v1.2.3