From 090b886004e63f5f95a5bb1caf10d683cd0c3c33 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Wed, 7 Oct 2026 18:20:49 -0400 Subject: vgsp: m129 - mirror relocated data pointers into the guest param page (SM c[0x0] reads the guest page, not the shadow) --- kernel/gsp_phys_booter.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) (limited to 'kernel') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index 3271963..94d143e 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -16310,7 +16310,7 @@ static void gsp_phys_rmcall_gr_gpc_mmu_init(void __iomem *bar0) */ static void gsp_phys_gr_rewrite_data_vars(u32 *w, u32 n_words, const struct gsp_phys_gr_submit *req, - u32 bank) + u32 bank, u32 *mirror) { u32 rew = 0, k; @@ -16344,6 +16344,20 @@ static void gsp_phys_gr_rewrite_data_vars(u32 *w, u32 n_words, v = req->data[x].reloc_va | (v & 0xfffULL); w[k] = (u32)v; w[k + 1] = (u32)(v >> 32); + /* + * m129: mirror the rewritten pair into the guest's own + * copy of the page. The SM's c[0x0] constant reads do + * NOT use the QMD-rewritten shadow VA - p6 proved the + * SM sees the ORIGINAL guest param page (it read the + * guest msg VA 0x71d72ec00200 back while the shadow at + * 0x108000 held 0x110200). Writing the relocated + * pointer into the guest page covers whichever base + * the SM uses for the constant bank. + */ + if (mirror) { + mirror[k] = (u32)v; + mirror[k + 1] = (u32)(v >> 32); + } rew++; break; } @@ -16742,7 +16756,8 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, !(pg->qmd_word & 1)) gsp_phys_gr_rewrite_data_vars((u32 *)sh_page, GSP_PHYS_PAGE_SIZE / 4, req, - (pg->qmd_word - 32) / 2); + (pg->qmd_word - 32) / 2, + (u32 *)__va(pg->hpa)); if (pg->hpa && pg->qmd_word == 40u && gsp_phys_rmcall_gr_mail_patch_value()) { u32 *w = (u32 *)sh_page; -- cgit v1.2.3