From effc633f4a1e17f0d12494f6794e5691420eb8dd Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Wed, 7 Oct 2026 19:53:25 -0400 Subject: vgsp: m135 - never relocate param offsets < 0x100 (header server-VA corrupted vadd blockDim -> one-CTA result); pre-rewrite/final header dumps --- kernel/gsp_phys_booter.c | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) (limited to 'kernel') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index c2390d6..67092b7 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -16335,6 +16335,19 @@ static void gsp_phys_gr_rewrite_data_vars(u32 *w, u32 n_words, u64 wb; u32 x; + /* + * m135: never relocate below offset 0x100. The param-page + * header (grid/block dims and driver bookkeeping at 0x0..0xff) + * can contain server-region VAs (e.g. 0x100000100) that are + * NOT kernel parameters; relocating them corrupted the + * vadd launch's blockDim word (read as 0x170100 instead of + * 0x100, so every CTA past 0 computed out-of-range indices + * and exited: VADD bad=32512 exactly one block correct). + * Kernel parameters live at >= 0x140 (JIT sm_75 layout: + * a/b/c at 0x160/0x168/0x170, n at 0x178). + */ + if (k * 4u < 0x100u) + continue; if (v < 0x10000000ULL || v >= (1ULL << 47) || (v & 0xff)) continue; wb = v & ~0xfffULL; @@ -16766,6 +16779,17 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, GSP_PHYS_PAGE_SIZE); copied++; } + /* m135: dump the raw guest param-page header before the + * rewrite so a corrupted engine-visible header (vadd + * blockDim read as 0x170100 instead of 0x100) can be + * attributed to the guest copy, the rewrite or the + * inline replay. */ + if (pg->hpa && pg->qmd_word == 32u) { + const u32 *g = (const u32 *)sh_page; + + pr_info("vgsp-gr: param shadow pre-rewrite w0..3=%08x %08x %08x %08x\n", + g[0], g[1], g[2], g[3]); + } if (pg->hpa && pg->qmd_word >= 32 && pg->qmd_word <= 47 && !(pg->qmd_word & 1)) gsp_phys_gr_rewrite_data_vars((u32 *)sh_page, @@ -16944,9 +16968,13 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, pr_info("vgsp-gr: qmd_word %u page copied to window-0 shadow VA=0x%llx (proven PT line)\n", pg->qmd_word, sh_va); if (pg->qmd_word == 32u) - pr_info("vgsp-gr: win0 param slot=%u dma=0x%llx w0x160=0x%llx w0x168=0x%llx\n", + pr_info("vgsp-gr: win0 param slot=%u dma=0x%llx w0..3=%08x %08x %08x %08x w0x160=0x%llx w0x168=0x%llx\n", boot_stage.rmcall_gr_shadow_win0_used - 1u, (u64)gsp_phys_chunk_page_dma(&boot_stage.rmcall_gr_shadow_win0, boot_stage.rmcall_gr_shadow_win0_used - 1u), + ((const u32 *)dst)[0], + ((const u32 *)dst)[1], + ((const u32 *)dst)[2], + ((const u32 *)dst)[3], (u64)get_unaligned_le64((u8 *)dst + 0x160u), (u64)get_unaligned_le64((u8 *)dst + 0x168u)); } -- cgit v1.2.3