r679: 0x2080a097 handler with runtime-tunable reply words (wall-2 session 75)

The guest Vulkan client (libnvidia-eglcore) issues RM control 0x2080a097 in a
~1.8 s retry loop while its engine-readiness check stays negative; the
bare-metal oracle (same client on the host with the real driver) never issues
it, so it is a vGPU-only path (engine type 0xe00101). The handler echoes the
1168-byte in/out record block and applies three module parameters -
wall2_a097_flag/v488/v48c - so one boot can sweep reply variants without
rebuilding (the client reads params +0x204, +0x488, +0x48c back; file offsets
0xecd45f..0xecd475 in libnvidia-eglcore.so.570.144).

Sweep result so far: flag=1 with v488=0 or 1 does not stop the retry; the
readiness wait lives in the client's engine loop (0xd6ef40..0xd6f0ab polling
byte +0x1b038 of the engine object, recomputed by a91ea0 from engine-state
fields), so the missing state is deeper than the reply words.

1 files changed, 71 insertions, 0 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index 2e47f98..55bd6ff 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -3440,6 +3440,24 @@ MODULE_PARM_DESC(gsp_rm_binapi07_fwd,
 	"Forward only the guest GL core's BINAPI 0x20810107 query to the live GSP session (default 0; diagnostic/experiment)");
 
 /*
+ * session 75: reply words for the client-pending control 0x2080a097 (the
+ * libnvidia-eglcore engine-readiness poll). Runtime-tunable so one boot can
+ * sweep reply variants: the client reads +0x204, +0x488 and +0x48c back
+ * (file offsets 0xecd45f..0xecd475) before its engine loop re-issues the
+ * control. Defaults: flag=1 (the request sets it to 0), the other words 0.
+ */
+static uint gsp_rm_a097_flag = 1;
+module_param_named(wall2_a097_flag, gsp_rm_a097_flag, uint, 0644);
+MODULE_PARM_DESC(wall2_a097_flag, "0x2080a097 reply word at params+0x204 (default 1)");
+static uint gsp_rm_a097_v488;
+module_param_named(wall2_a097_v488, gsp_rm_a097_v488, uint, 0644);
+MODULE_PARM_DESC(wall2_a097_v488, "0x2080a097 reply word at params+0x488 (default 0)");
+static uint gsp_rm_a097_v48c;
+module_param_named(wall2_a097_v48c, gsp_rm_a097_v48c, uint, 0644);
+MODULE_PARM_DESC(wall2_a097_v48c, "0x2080a097 reply word at params+0x48c (default 0)");
+
+
+/*
  * The live session's oracle client/object for the 0x20810107 experiment,
  * created on demand; 0 until the first query builds it. One device per module
  * load, so file-statics are enough; reset by unload.
@@ -4215,6 +4233,59 @@ static void gsp_rm_handle_rm_control(struct gsp_emu_context *ctx,
 		break;
 	}
 
+	case 0x2080a097: { /* client-pending engine-context query (session 75)
+			   *
+			   * libnvidia-eglcore issues this via NVOS54 and then
+			   * POLLS the reply's params words: the request sets
+			   * +0x204 = 0, and the caller re-issues the whole
+			   * control every ~1.8 s while its readiness check
+			   * stays negative (observed: 32-36 polls against the
+			   * generic all-zero reply, then the client gives up
+			   * and vkCreateDevice returns -4). The params are an
+			   * in/out record block: u32 count at +0, then count
+			   * 16-byte records, then +0x204, and the client reads
+			   * back +0, +0x204, +0x488 and +0x48c after the call
+			   * (libnvidia-eglcore.so.570.144 file offsets
+			   * 0xecd45f..0xecd475). The readiness wait itself
+			   * lives in the client's engine loop
+			   * (0xd6ef40..0xd6f0ab polling byte +0x1b038 of the
+			   * engine object, which a91ea0 recomputes from many
+			   * state fields), so the reply words below are
+			   * runtime-tunable for a single-cycle sweep without
+			   * rebuilding: the wall2_a097_* module parameters.
+			   *
+			   * Reply: verbatim echo (the request records are the
+			   * client's own query data) with the tunable words
+			   * applied. Defaults keep the completion-style flag. */
+		u8 *rp = reply + GSP_RM_CTRL_HDR_SIZE;
+		const u8 *pp = req_data + GSP_RM_CTRL_HDR_SIZE;
+
+		if (req.paramsSize >= 0x490 &&
+		    req.paramsSize + GSP_RM_CTRL_HDR_SIZE <=
+				GSPRM_MAX_SINGLE_ELEM_DATA) {
+			u32 count = 0, flag;
+
+			memcpy(rp, pp, req.paramsSize);
+			memcpy(&count, pp, 4);
+			memcpy(&flag, pp + 0x204, 4);
+			*(u32 *)(rp + 0x204) = gsp_rm_a097_flag;
+			*(u32 *)(rp + 0x488) = gsp_rm_a097_v488;
+			*(u32 *)(rp + 0x48c) = gsp_rm_a097_v48c;
+			if (gsp_sema_dbg)
+				nv_vgpu_info(ctx->vgpu,
+					     "vgsp-rm: ctrl 0x2080a097: echoed %u bytes (count=%u, req flag=%u) -> flag=%u v488=0x%x v48c=0x%x",
+					     req.paramsSize, count, flag,
+					     gsp_rm_a097_flag, gsp_rm_a097_v488,
+					     gsp_rm_a097_v48c);
+			out_status = 0;
+			out_params_size = req.paramsSize;
+		} else {
+			out_status = 0;
+			out_params_size = 0;
+		}
+		break;
+	}
+
 	default:
 		/* Unknown control command - return success with zeroed params.
 		 * Do NOT echo the request: pure queries pass uninitialized