From d2f142a1d217023fe3e866324a9421f732e9c75f Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Wed, 7 Oct 2026 19:45:49 -0400 Subject: vgsp: m134 - re-apply the data-pointer relocation after the inline-data replay (inline records restored the original guest pointers into the engine-mapped page; root cause of the param-read wall) --- kernel/gsp_phys_booter.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'kernel') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index ecf95b6..c2390d6 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -16869,6 +16869,24 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, inl->data, len); copied++; } + /* + * m134: re-apply the pointer relocation AFTER the inline + * data replay. The inline records carry the driver's own + * parameter block (the original guest pointers) and were + * overwriting the relocated pointers in the page that is + * actually mapped for the engine - the rewrite at 16771 + * and every dump before this point looked correct, but + * the win0/win1 copy below copied the restored originals + * (m133: win0 param page held 0x7d8a1ec00000 while the + * +0x150 dump held 0x110000). Idempotent: already + * relocated values no longer match a guest data VA. + */ + if (pg->hpa && pg->qmd_word >= 32 && pg->qmd_word <= 47 && + !(pg->qmd_word & 1)) + gsp_phys_gr_rewrite_data_vars((u32 *)sh_page, + GSP_PHYS_PAGE_SIZE / 4, req, + (pg->qmd_word - 32) / 2, + (u32 *)__va(pg->hpa)); if (copied) { u32 sh_line = boot_stage.rmcall_guest_pt_next_line; -- cgit v1.2.3