vgsp-rm: answer the NV04_VID_HEAP_CONTROL enumeration pair 0x90960106/0x90960107 (legacy NVOS32 VidHeap API) - libnvidia-eglcore walks three heaps and treats an all-zero reply as 'no memory' (the flag byte at entry+0x30 == 0 skips every heap), so vkAllocateMemory failed -2 without any alloc reaching the emulation; replies are runtime-tunable (wall2_9096_lo/hi/ent_addr/ent_size/ent_type/ent_flag) for a one-boot sweep

1 files changed, 75 insertions, 0 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index b8a3e37..1855908 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -3505,6 +3505,40 @@ MODULE_PARM_DESC(wall2_a097_rec6, "0x2080a097 reply word at params+0x1c (0xfffff
 module_param_named(wall2_a097_rec7, gsp_rm_a097_rec7, uint, 0644);
 MODULE_PARM_DESC(wall2_a097_rec7, "0x2080a097 reply word at params+0x20 (0xffffffff = echo)");
 
+/*
+ * m112b: the NV04_VID_HEAP_CONTROL enumeration pair 0x90960106/0x90960107
+ * (legacy NVOS32 VidHeap API, class 0x9096). libnvidia-eglcore (file offset
+ * 0x586d80) walks three heaps: per heap it queries 0x90960106 (12 bytes:
+ * {u32 firstIdx, u32 lastIdx}; the client then enumerates the heap's memory
+ * blocks by index via 0x90960107 (56 bytes) while firstIdx+1 <= idx <=
+ * lastIdx). The 56-byte block entry is read at +0x00/+0x08 (two u64s), +0x28
+ * (a u32 type compared against a table at eglcore 0x101b1c0) and +0x30 (a
+ * flag BYTE: when 0 the heap/block is skipped). The generic zero reply makes
+ * every heap look empty, the client concludes out-of-device-memory and
+ * vkAllocateMemory fails -2 WITHOUT any alloc reaching the emulation
+ * (dmesg-corroborated: only 0x9096* controls + a class 0xc5c0 alloc).
+ * Runtime-tunable so one boot can sweep reply variants (same pattern as the
+ * wall2_a097_* words).
+ */
+static uint gsp_rm_9096_lo;		/* 0x90960106 firstIdx */
+static uint gsp_rm_9096_hi = 1;		/* 0x90960106 lastIdx */
+module_param_named(wall2_9096_lo, gsp_rm_9096_lo, uint, 0644);
+MODULE_PARM_DESC(wall2_9096_lo, "0x90960106 reply firstIdx (default 0)");
+module_param_named(wall2_9096_hi, gsp_rm_9096_hi, uint, 0644);
+MODULE_PARM_DESC(wall2_9096_hi, "0x90960106 reply lastIdx (default 1)");
+static uint gsp_rm_9096_ent_addr;	/* 0x90960107 entry +0x00 (u64) */
+module_param_named(wall2_9096_ent_addr, gsp_rm_9096_ent_addr, uint, 0644);
+MODULE_PARM_DESC(wall2_9096_ent_addr, "0x90960107 entry word at +0x00 (default 0)");
+static uint gsp_rm_9096_ent_size = 0x80000000u;	/* entry +0x08 (u64) */
+module_param_named(wall2_9096_ent_size, gsp_rm_9096_ent_size, uint, 0644);
+MODULE_PARM_DESC(wall2_9096_ent_size, "0x90960107 entry word at +0x08 (default 0x80000000)");
+static uint gsp_rm_9096_ent_type = 3;	/* entry +0x28 (u32) */
+module_param_named(wall2_9096_ent_type, gsp_rm_9096_ent_type, uint, 0644);
+MODULE_PARM_DESC(wall2_9096_ent_type, "0x90960107 entry word at +0x28 (default 3)");
+static uint gsp_rm_9096_ent_flag = 1;	/* entry +0x30 (u8) */
+module_param_named(wall2_9096_ent_flag, gsp_rm_9096_ent_flag, uint, 0644);
+MODULE_PARM_DESC(wall2_9096_ent_flag, "0x90960107 entry flag byte at +0x30 (default 1)");
+
 
 /*
  * The live session's oracle client/object for the 0x20810107 experiment,
@@ -4348,6 +4382,47 @@ static void gsp_rm_handle_rm_control(struct gsp_emu_context *ctx,
 		break;
 	}
 
+	case 0x90960106: { /* NV04_VID_HEAP_CONTROL block-index range (m112b) */
+		u8 *rp = reply + GSP_RM_CTRL_HDR_SIZE;
+		const u8 *pp = req_data + GSP_RM_CTRL_HDR_SIZE;
+
+		if (req.paramsSize >= 12) {
+			memcpy(rp, pp, req.paramsSize);
+			*(u32 *)(rp + 0) = gsp_rm_9096_lo;
+			*(u32 *)(rp + 4) = gsp_rm_9096_hi;
+			if (gsp_sema_dbg)
+				nv_vgpu_info(ctx->vgpu,
+					     "vgsp-rm: ctrl 0x90960106 -> first=%u last=%u",
+					     gsp_rm_9096_lo, gsp_rm_9096_hi);
+		}
+		out_status = 0;
+		out_params_size = req.paramsSize;
+		break;
+	}
+
+	case 0x90960107: { /* NV04_VID_HEAP_CONTROL block entry by index (m112b) */
+		u8 *rp = reply + GSP_RM_CTRL_HDR_SIZE;
+		const u8 *pp = req_data + GSP_RM_CTRL_HDR_SIZE;
+
+		if (req.paramsSize >= 56) {
+			memcpy(rp, pp, req.paramsSize);
+			*(u64 *)(rp + 0x00) = (u64)gsp_rm_9096_ent_addr;
+			*(u64 *)(rp + 0x08) = (u64)gsp_rm_9096_ent_size;
+			*(u32 *)(rp + 0x28) = gsp_rm_9096_ent_type;
+			*(u8 *)(rp + 0x30) = (u8)gsp_rm_9096_ent_flag;
+			if (gsp_sema_dbg)
+				nv_vgpu_info(ctx->vgpu,
+					     "vgsp-rm: ctrl 0x90960107 -> addr=0x%x size=0x%x type=%u flag=%u",
+					     gsp_rm_9096_ent_addr,
+					     gsp_rm_9096_ent_size,
+					     gsp_rm_9096_ent_type,
+					     gsp_rm_9096_ent_flag);
+		}
+		out_status = 0;
+		out_params_size = req.paramsSize;
+		break;
+	}
+
 	default:
 		/* Unknown control command - return success with zeroed params.
 		 * Do NOT echo the request: pure queries pass uninitialized