kernel: serve GMMU static info + per-VF fault/access-counter sizes for UVM

Three fixes that clear all driver-visible errors in UVM's device create
(cuInit still fails later in UVM_REGISTER_GPU):

1. GSP_RM_CONTROL 0x20800a59 INTERNAL_GMMU_GET_STATIC_INFO (new handler):
   kgmmu.pStaticInfo->replayableFaultBufferSize feeds
   kgmmuFaultBufferReplayableAllocate (called by faultbufConstruct when UVM
   opens the device). The generic zero reply made it a 0-page allocation:
   "faultbufConstruct_IMPL: Failed to setup Replayable Fault buffer
   (status=0x51)". Report 64KB replayable / 4KB legacy, mirroring
   kgmmuSetAndGetDefaultFaultBufferSize_TU102 defaults.

2. VF-window NV_VIRTUAL_FUNCTION_PRIV_MMU_FAULT_BUFFER_SIZE(0/1)
   (BAR0+0xB83010/0xB83030, plus plain aliases) pre-filled with _VAL in
   NVC369_BUF_SIZE units (0x800=64KB, 0x80=4KB) so the local (non-RPC)
   path reads the same values the control handler reports.

3. VF-window NV_VIRTUAL_FUNCTION_PRIV_ACCESS_COUNTER_NOTIFY_BUFFER_SIZE
   (BAR0+0xB83110, plus plain alias) = 0x1000 (the value the host's
   physical TU104 reports; x32B = 128KB). uvmGetAccessCounterBufferSize_
   TU102 multiplied our zero and uvmInitializeAccessCntrBuffer failed with
   NV_ERR_NO_MEMORY at mem_desc.c:1353.

Also note (companion finding, no code change): the guest must be placed
behind a pcie-root-port; on the Q35 root bus QEMU rewrites the PCIe cap to
Root Complex Integrated Endpoint and zeroes LNKCAP/LNKCTL/DeviceCaps
(vfio_setup_pcie_cap: "On a Root Complex bus Endpoints become Root Complex
Integrated Endpoints, which changes the type and clears the LNK & LNK2
fields"), which is what made getPCIELinkRateMBps read speed 0.

3 files changed, 79 insertions, 0 deletions

diff --git a/kernel/bar_emulation.c b/kernel/bar_emulation.c
index 2d82303..685831a 100644
--- a/kernel/bar_emulation.c
+++ b/kernel/bar_emulation.c
@@ -309,6 +309,35 @@ int nv_vgpu_bar_emul_init(struct nv_vgpu_device *vgpu)
 	*(u32 *)((u8 *)ctx->bar0_shadow + 0xC08084) = 0x00000103;
 	*(u32 *)((u8 *)ctx->bar0_shadow + 0xC08088) = 0x01030000;
 
+	/*
+	 * Per-VF static sizes the driver reads through the VF register window
+	 * (GPU_VREG_RD32 = BAR0 + sriovState.virtualRegPhysOffset, 0xB80000
+	 * for a non-SRIOV virtual GPU). Both are read-only SIZE registers on
+	 * real hardware; we pre-fill them so the local (non-RPC) paths agree
+	 * with the GSP_RM_CONTROL replies in gsp_rm_emulation.c.
+	 *
+	 *  0x3010/0x3030 NV_VIRTUAL_FUNCTION_PRIV_MMU_FAULT_BUFFER_SIZE(0/1):
+	 *      _VAL is in NVC369_BUF_SIZE (32B) units. 0x800 -> 64KB
+	 *      replayable, 0x80 -> 4KB legacy; matches TU104_GMMU_*_SIZE.
+	 *      kgmmuSetAndGetDefaultFaultBufferSize_TU102 writes SET_DEFAULT
+	 *      (bit30) and reads _VAL back, so a pre-filled _VAL is all it
+	 *      needs.
+	 *  0x3110 NV_VIRTUAL_FUNCTION_PRIV_ACCESS_COUNTER_NOTIFY_BUFFER_SIZE:
+	 *      UVM's uvmGetAccessCounterBufferSize_TU102 multiplies it by
+	 *      NV_ACCESS_COUNTER_NOTIFY_BUF_SIZE (32B). 0x1000 -> 128KB, the
+	 *      value the host's physical TU104 reports. Zero makes the
+	 *      access-counter buffer a 0-byte allocation and cuInit fails in
+	 *      uvmInitializeAccessCntrBuffer.
+	 */
+	*(u32 *)((u8 *)ctx->bar0_shadow + 0xB83010) = 0x00000800;
+	*(u32 *)((u8 *)ctx->bar0_shadow + 0xB83030) = 0x00000080;
+	*(u32 *)((u8 *)ctx->bar0_shadow + 0x003010) = 0x00000800;
+	*(u32 *)((u8 *)ctx->bar0_shadow + 0x003030) = 0x00000080;
+	*(u32 *)((u8 *)ctx->bar0_shadow + 0xB83110) = 0x00001000;
+	*(u32 *)((u8 *)ctx->bar0_shadow + 0x003110) = 0x00001000;
+	*(u32 *)((u8 *)ctx->bar0_shadow + 0xB8311C) = 0x00000000;
+	*(u32 *)((u8 *)ctx->bar0_shadow + 0xB83118) = 0x00000000;
+
 
 	/*
 	 * Serve a valid VBIOS at the PROM window (BAR0+0x300000).
diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index 1f029b1..c2b306a 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -1065,6 +1065,40 @@ static void gsp_rm_handle_ce_get_fault_method_buffer_size(
 }
 
 /*
+ * INTERNAL_GMMU_GET_STATIC_INFO (0x20800a59)
+ *
+ * The guest asks GSP-RM (us) for the GMMU static info; kgmmu. pStaticInfo->
+ * replayableFaultBufferSize feeds kgmmuFaultBufferReplayableAllocate (called
+ * from faultbufConstruct when UVM opens the device). Zero -> 0-page alloc ->
+ * NV_ERR_NO_MEMORY -> faultbufConstruct fails and cuInit aborts.
+ * params: replayableFaultBufferSize(4) + replayableShadowFaultBufferMetadata
+ * Size(4) + nonReplayableFaultBufferSize(4) + nonReplayableShadowFaultBuffer
+ * MetadataSize(4). Shadow metadata is only used with confidential computing,
+ * so it stays 0.
+ */
+static void gsp_rm_handle_gmmu_get_static_info(struct gsp_emu_context *ctx,
+					       u32 sequence,
+					       u32 *out_status,
+					       u8 *out_params,
+					       u32 *out_params_size)
+{
+	u32 replay = TU104_GMMU_REPLAYABLE_FAULT_BUFFER_SIZE;
+	u32 nonreplay = TU104_GMMU_NONREPLAYABLE_FAULT_BUFFER_SIZE;
+	u32 zero = 0;
+
+	memcpy(out_params + 0, &replay, 4);
+	memcpy(out_params + 4, &zero, 4);
+	memcpy(out_params + 8, &nonreplay, 4);
+	memcpy(out_params + 12, &zero, 4);
+
+	*out_params_size = 16;
+	*out_status = 0;
+
+	nv_vgpu_info(ctx->vgpu, "GSPRM: GMMU_GET_STATIC_INFO -> replayFaultBuf=0x%x nonReplayFaultBuf=0x%x",
+		     replay, nonreplay);
+}
+
+/*
  * STATIC_KGR_GET_GLOBAL_SM_ORDER (0x20800a22)
  *
  * kgrStaticInit copies globalSmOrder[grIdx] into the GR engine's static
@@ -1548,6 +1582,12 @@ static void gsp_rm_handle_rm_control(struct gsp_emu_context *ctx,
 			reply + GSP_RM_CTRL_HDR_SIZE, &out_params_size);
 		break;
 
+	case TU104_CTRL_INTERNAL_GMMU_GET_STATIC_INFO:
+		gsp_rm_handle_gmmu_get_static_info(ctx, sequence,
+			&out_status,
+			reply + GSP_RM_CTRL_HDR_SIZE, &out_params_size);
+		break;
+
 	case TU104_CTRL_STATIC_KGR_GET_GLOBAL_SM_ORDER:
 		gsp_rm_handle_kgr_get_global_sm_order(ctx, sequence,
 			&out_status,
diff --git a/kernel/gsp_rm_tu104.h b/kernel/gsp_rm_tu104.h
index 2edeeb4..ab97307 100644
--- a/kernel/gsp_rm_tu104.h
+++ b/kernel/gsp_rm_tu104.h
@@ -700,6 +700,7 @@ static const struct tu104_internal_device_info tu104_internal_device_table[] = {
 #define TU104_CTRL_INTERNAL_DISPLAY_GET_IP_VERSION	0x20800a4b
 #define TU104_CTRL_I2C_TRANSACTION			0x402c0105
 #define TU104_CTRL_CE_GET_FAULT_METHOD_BUFFER_SIZE	0x20802a08
+#define TU104_CTRL_INTERNAL_GMMU_GET_STATIC_INFO	0x20800a59
 #define TU104_CTRL_STATIC_KGR_GET_GLOBAL_SM_ORDER	0x20800a22
 #define TU104_CTRL_STATIC_KGR_GET_INFO		0x20800a2a
 #define TU104_CTRL_STATIC_KGR_GET_CONTEXT_BUFFERS_INFO	0x20800a32
@@ -956,6 +957,15 @@ struct tu104_gr_global_sm_order {
  * Turing inherits: 135 * (13*totalCes + 2), page-aligned; TU104 has 5 PCEs) */
 #define TU104_CE_FAULT_METHOD_BUFFER_SIZE		12288
 
+/* GMMU static info (kgmmuSetAndGetDefaultFaultBufferSize_TU102 semantics):
+ * the hardware default is reported in NV_VIRTUAL_FUNCTION_PRIV_MMU_FAULT_
+ * BUFFER_SIZE_VAL units of NVC369_BUF_SIZE (32B). UVM's faultbufConstruct
+ * allocates replayableFaultBufferSize and fails with NV_ERR_NO_MEMORY when
+ * it reads back 0. Turing defaults are 64KB replayable / 4KB legacy; both
+ * must stay within NV2080_CTRL_INTERNAL_GMMU_FAULT_BUFFER_MAX_PAGES (256). */
+#define TU104_GMMU_REPLAYABLE_FAULT_BUFFER_SIZE		0x10000
+#define TU104_GMMU_NONREPLAYABLE_FAULT_BUFFER_SIZE	0x1000
+
 /* Turing display IP version (DISP v04.00 per DispIpHal halspec) */
 #define TU104_DISPLAY_IP_VERSION				0x04000000