Open-IOV: initial public release

Open-IOV virtualizes NVIDIA GPUs so that unmodified guest drivers run with
real GPU functionality - CUDA first, 3D and video to follow - on unmodified
hosts, without a proprietary vGPU license and without patching any driver,
firmware or hypervisor.

Core principle: emulate the interface, pass through the work.

  kernel/     open-iov-vfio.ko - host VFIO mdev driver: virtual GPU device
              (PCI config space, BAR shadows, MSI-X), GSP boot emulation,
              GSP-RM message-queue/RPC emulation, memory model (GPU-VA to
              guest-PA discovery) and the semaphore-completion service that
              advances guest UVM progress.
  userspace/  libiov.so management API and examples.
  tools/      guest diagnostics, firmware analysis wrappers, RM probes.
  scripts/    stack manager, VM harness, build/load/test automation.
  config/     hardware/version profiles (the portability surface).
  docs/       documentation tree - start at docs/README.md.
  wiki/       long-form firmware and protocol deep dives.

Status: initialization works end to end for a stock 570.144 Linux guest on
Turing (TU104): driver probe, nvidia-smi, the full GSP-RM control battery,
object creation and the early CUDA/UVM start-up path. GPU work forwarding -
the step that makes CUDA kernels execute on real hardware - is the active
work item; see docs/04-implementation/01-known-knowns-and-unknowns.md.

License: BSD-3-Clause for the project; GPL-2.0 for kernel modules that link
GPL-only kernel interfaces. See LICENSE and docs/09-reference/legal-and-licensing.md.

7 files changed, 544 insertions, 0 deletions

diff --git a/tools/rmq/Makefile b/tools/rmq/Makefile
new file mode 100644
index 0000000..f58e4d9
--- /dev/null
+++ b/tools/rmq/Makefile
@@ -0,0 +1,19 @@
+# rmq - RM query tool (userspace RM API client)
+#
+# Queries the host NVIDIA Resource Manager via /dev/nvidia0 ioctls.
+# Used as an "oracle" to extract ground-truth static GPU data (device info
+# tables, static config) from the host's real GSP-RM for the GSP-RM emulation
+# layer (kernel/gsp_rm_emulation.c).
+
+CC      ?= gcc
+CFLAGS  ?= -O2 -Wall
+
+all: rmq
+
+rmq: rmq.c
+	$(CC) $(CFLAGS) -o $@ $<
+
+clean:
+	rm -f rmq
+
+.PHONY: all clean
diff --git a/tools/rmq/grctx_oracle.c b/tools/rmq/grctx_oracle.c
new file mode 100644
index 0000000..a2fc5fa
--- /dev/null
+++ b/tools/rmq/grctx_oracle.c
@@ -0,0 +1,189 @@
+/* grctx_oracle - query the host NVIDIA RM for the engine context buffer sizes.
+ *
+ * Goal: recover the table that GSP-RM serves for
+ * NV2080_CTRL_CMD_INTERNAL_STATIC_KGR_GET_CONTEXT_BUFFERS_INFO (0x20800a32),
+ * so the emulation layer does not have to guess the per-engine ctx buffer
+ * sizes (kernel/gsp_rm_tu104.h: TU104_CTX_SIZE_*).
+ *
+ * Outcome (2026-09-22): NOT REACHABLE from userspace on a bare-metal PF:
+ *   - 0x801707 NV0080_CTRL_CMD_FIFO_GET_ENGINE_CONTEXT_PROPERTIES
+ *       hObject=hDevice  -> 0x57 NV_ERR_OBJECT_NOT_FOUND (not exported)
+ *       hObject=hClient  -> 0x56 NV_ERR_NOT_SUPPORTED (bound to the
+ *                           _92bfc3 hal: the client RM does not manage ctx
+ *                           buffers on a PF, only a VF's VGPU_STATIC_INFO)
+ *   - 0x2080122d NV2080_CTRL_CMD_GR_GET_ENGINE_CONTEXT_PROPERTIES
+ *       (subdevice)      -> 0x57 / 0x56, never returns sizes
+ *   - The producing control (0x20800a32) is internal-only.
+ * The real values are probed from the ctxsw ucode by the physical RM
+ * (grSetupInitialCtxState -> grDiscoverCtxBufferSize) and are internal to
+ * GSP-RM, so the emulation currently serves synthesized page-aligned sizes
+ * (see tu104_ctx_buffer_info in kernel/gsp_rm_tu104.h).
+ *
+ * Kept as a reference for the RM client bring-up sequence and for a future
+ * attempt via a kernel-side RM client.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <stdint.h>
+
+typedef uint32_t NvU32;
+typedef uint64_t NvU64;
+typedef uint32_t NvHandle;
+typedef uint32_t NvV32;
+typedef uint64_t NvP64;
+
+#define NV_IOCTL_MAGIC      'F'
+#define NV_ESC_RM_ALLOC     0x2B
+#define NV_ESC_RM_CONTROL   0x2A
+
+#define NV01_ROOT           0x0
+#define NV01_DEVICE_0       0x80
+#define NV20_SUBDEVICE_0    0x2080
+
+typedef struct {
+    NvHandle hRoot;
+    NvHandle hObjectParent;
+    NvHandle hObjectNew;
+    NvV32    hClass;
+    NvP64    pAllocParms __attribute__((aligned(8)));
+    NvU32    paramsSize;
+    NvV32    status;
+} NVOS21_PARAMETERS;
+
+typedef struct {
+    NvHandle hRoot;
+    NvHandle hObjectParent;
+    NvHandle hObjectNew;
+    NvV32    hClass;
+    NvP64    pAllocParms __attribute__((aligned(8)));
+    NvP64    pRightsRequested __attribute__((aligned(8)));
+    NvU32    paramsSize;
+    NvU32    flags;
+    NvV32    status;
+} NVOS64_PARAMETERS;
+
+typedef struct {
+    NvHandle hClient;
+    NvHandle hObject;
+    NvV32    cmd;
+    NvU32    flags;
+    NvP64    params __attribute__((aligned(8)));
+    NvU32    paramsSize;
+    NvV32    status;
+} NVOS54_PARAMETERS;
+
+#define NV_IOCTL_RM_ALLOC   _IOWR(NV_IOCTL_MAGIC, NV_ESC_RM_ALLOC, NVOS21_PARAMETERS)
+#define NV_IOCTL_RM_CONTROL _IOWR(NV_IOCTL_MAGIC, NV_ESC_RM_CONTROL, NVOS54_PARAMETERS)
+
+#define NV0080_CTRL_CMD_FIFO_GET_ENGINE_CONTEXT_PROPERTIES 0x801707U
+#define NV2080_CTRL_CMD_GR_GET_ENGINE_CONTEXT_PROPERTIES   0x2080122dU
+#define ENGINE_ID_COUNT 0x1a
+
+typedef struct {
+    NvU32 engineId;
+    NvU32 alignment;
+    NvU32 size;
+} FIFO_GET_ENGINE_CONTEXT_PROPERTIES_PARAMS;
+
+typedef struct {
+    NvU32 flags;
+    NvU32 pad;
+    NvU64 route;
+} GR_ROUTE_INFO;
+
+typedef struct {
+    GR_ROUTE_INFO grRouteInfo;
+    NvU32 engineId;
+    NvU32 alignment;
+    NvU32 size;
+    NvU32 bInfoPopulated;
+} GR_GET_ENGINE_CONTEXT_PROPERTIES_PARAMS;
+
+static int fd;
+
+static NvU32 rm_alloc(NvHandle parent, NvHandle client, NvU32 hClass, NvHandle *pOut)
+{
+    NVOS21_PARAMETERS p = {0};
+    p.hRoot = client;
+    p.hObjectParent = parent;
+    p.hClass = hClass;
+    if (ioctl(fd, NV_IOCTL_RM_ALLOC, &p) < 0) { perror("alloc ioctl"); return 1; }
+    if (p.status) { fprintf(stderr, "alloc class 0x%x failed: 0x%x\n", hClass, p.status); return p.status; }
+    *pOut = p.hObjectNew;
+    return 0;
+}
+
+static NvU32 rm_alloc64(NvHandle parent, NvHandle client, NvU32 hClass,
+                        NvHandle newHandle, void *parms, NvU32 parmsSize, NvHandle *pOut)
+{
+    NVOS64_PARAMETERS p = {0};
+    p.hRoot = client;
+    p.hObjectParent = parent;
+    p.hObjectNew = newHandle; /* 0 = let RM generate (device); subdevices take an explicit handle */
+    p.hClass = hClass;
+    p.pAllocParms = (NvP64)parms;
+    p.paramsSize = parmsSize;
+    p.flags = 0;
+    if (ioctl(fd, NV_IOCTL_RM_ALLOC, &p) < 0) { perror("alloc64 ioctl"); return 1; }
+    if (p.status) {
+        fprintf(stderr, "alloc64 class 0x%x failed: 0x%x\n", hClass, p.status);
+        return p.status;
+    }
+    *pOut = p.hObjectNew;
+    return 0;
+}
+
+static NvU32 rm_control(NvHandle hClient, NvHandle hObject, NvU32 cmd, void *params, NvU32 size)
+{
+    NVOS54_PARAMETERS p = {0};
+    p.hClient = hClient; p.hObject = hObject; p.cmd = cmd;
+    p.params = (NvP64)params; p.paramsSize = size;
+    if (ioctl(fd, NV_IOCTL_RM_CONTROL, &p) < 0) { perror("control ioctl"); return 1; }
+    return p.status;
+}
+
+int main(void)
+{
+    NvHandle hClient = 0, hDevice = 0, hSubdevice = 0;
+    NvU32 deviceParams = 0;    /* deviceId 0 */
+    NvU32 subdeviceParams = 0; /* subDeviceId 0 */
+    NvU32 st, i;
+
+    fd = open("/dev/nvidiactl", O_RDWR);
+    if (fd < 0) { perror("open /dev/nvidiactl"); return 1; }
+
+    if ((st = rm_alloc(0, 0, NV01_ROOT, &hClient))) return 1;
+    if ((st = rm_alloc64(hClient, hClient, NV01_DEVICE_0, 0,
+                         &deviceParams, sizeof(deviceParams), &hDevice))) return 1;
+    if ((st = rm_alloc64(hDevice, hClient, NV20_SUBDEVICE_0, 0xcaf00001,
+                         &subdeviceParams, sizeof(subdeviceParams), &hSubdevice))) return 1;
+    printf("hClient=0x%x hDevice=0x%x hSubdevice=0x%x\n", hClient, hDevice, hSubdevice);
+
+    printf("=== device-level FIFO_GET_ENGINE_CONTEXT_PROPERTIES (0x801707) ===\n");
+    for (i = 0; i < ENGINE_ID_COUNT; i++) {
+        FIFO_GET_ENGINE_CONTEXT_PROPERTIES_PARAMS p;
+        memset(&p, 0, sizeof(p));
+        p.engineId = i;
+        st = rm_control(hClient, hDevice, NV0080_CTRL_CMD_FIFO_GET_ENGINE_CONTEXT_PROPERTIES,
+                        &p, sizeof(p));
+        printf("engine[%2u] status=0x%x size=0x%08x alignment=0x%08x\n",
+               i, st, p.size, p.alignment);
+    }
+
+    printf("=== subdevice-level GR_GET_ENGINE_CONTEXT_PROPERTIES (0x2080122d) ===\n");
+    for (i = 0; i < ENGINE_ID_COUNT; i++) {
+        GR_GET_ENGINE_CONTEXT_PROPERTIES_PARAMS p;
+        memset(&p, 0, sizeof(p));
+        p.engineId = i;
+        st = rm_control(hClient, hSubdevice, NV2080_CTRL_CMD_GR_GET_ENGINE_CONTEXT_PROPERTIES,
+                        &p, sizeof(p));
+        printf("engine[%2u] status=0x%x size=0x%08x alignment=0x%08x\n",
+               i, st, p.size, p.alignment);
+    }
+
+    return 0;
+}
diff --git a/tools/rmq/kmod/Makefile b/tools/rmq/kmod/Makefile
new file mode 100644
index 0000000..2fde4ef
--- /dev/null
+++ b/tools/rmq/kmod/Makefile
@@ -0,0 +1,7 @@
+obj-m += wpr2_reset_kmod.o
+
+all:
+	make -C /lib/modules/$(shell uname -r)/build M=$(CURDIR) modules
+
+clean:
+	make -C /lib/modules/$(shell uname -r)/build M=$(CURDIR) clean
diff --git a/tools/rmq/kmod/wpr2_reset_kmod.c b/tools/rmq/kmod/wpr2_reset_kmod.c
new file mode 100644
index 0000000..523fac7
--- /dev/null
+++ b/tools/rmq/kmod/wpr2_reset_kmod.c
@@ -0,0 +1,90 @@
+/* wpr2_reset_kmod - kernel module that clears GPU WPR2 registers via BAR0 ioremap.
+ *
+ * When nvidia.ko is unloaded without a clean GSP teardown, GSP firmware stays
+ * resident in WPR2 (a write-protected FB region described by
+ * PFB_PRI_MMU_WPR2_ADDR_LO/HI). Every subsequent RmInitAdapter then fails with
+ * "unexpected WPR2 already up" and FLR does not help (GSP survives warm resets).
+ *
+ * This module ioremaps GPU BAR0 and pokes WPR2_ADDR_LO/HI to zero so the next
+ * driver load takes the normal (clean) GSP boot path. Equivalent to the effect
+ * of FWSEC-SB + Booter Unload teardown, minus running the ucodes.
+ *
+ * Usage: sudo insmod wpr2_reset_kmod.ko [pci_bdf=0000:01:00.0]
+ *        result printed via pr_info (check dmesg)
+ */
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/io.h>
+
+#define NV_PFB_PRI_MMU_WPR2_ADDR_LO 0x1fa824
+#define NV_PFB_PRI_MMU_WPR2_ADDR_HI 0x1fa828
+
+static char *pci_bdf = "0000:01:00.0";
+module_param(pci_bdf, charp, 0444);
+MODULE_PARM_DESC(pci_bdf, "PCI BDF of the GPU (default 0000:01:00.0)");
+
+static int __init wpr2_reset_init(void)
+{
+    struct pci_dev *pdev = NULL;
+    unsigned int bus, dev, fn;
+    void __iomem *bar0;
+    u32 lo_before, hi_before, lo_after, hi_after;
+
+    if (sscanf(pci_bdf, "0000:%x:%x.%u", &bus, &dev, &fn) != 3) {
+        pr_err("wpr2_reset: bad pci_bdf %s\n", pci_bdf);
+        return -EINVAL;
+    }
+    pdev = pci_get_domain_bus_and_slot(0, bus, PCI_DEVFN(dev, fn));
+    if (!pdev) {
+        pr_err("wpr2_reset: device %s not found\n", pci_bdf);
+        return -ENODEV;
+    }
+    if (!pci_resource_start(pdev, 0)) {
+        pr_err("wpr2_reset: BAR0 not assigned\n");
+        pci_dev_put(pdev);
+        return -ENODEV;
+    }
+
+    if (pci_enable_device(pdev)) {
+        pr_err("wpr2_reset: pci_enable_device failed\n");
+        pci_dev_put(pdev);
+        return -EIO;
+    }
+    pci_set_master(pdev);
+    bar0 = ioremap_wc(pci_resource_start(pdev, 0), pci_resource_len(pdev, 0));
+    if (!bar0) {
+        pr_err("wpr2_reset: ioremap failed\n");
+        pci_dev_put(pdev);
+        return -ENOMEM;
+    }
+
+    lo_before = readl(bar0 + NV_PFB_PRI_MMU_WPR2_ADDR_LO);
+    hi_before = readl(bar0 + NV_PFB_PRI_MMU_WPR2_ADDR_HI);
+    pr_info("wpr2_reset: before LO=0x%08x HI=0x%08x\n", lo_before, hi_before);
+
+    writel(0, bar0 + NV_PFB_PRI_MMU_WPR2_ADDR_LO);
+    writel(0, bar0 + NV_PFB_PRI_MMU_WPR2_ADDR_HI);
+
+    lo_after = readl(bar0 + NV_PFB_PRI_MMU_WPR2_ADDR_LO);
+    hi_after = readl(bar0 + NV_PFB_PRI_MMU_WPR2_ADDR_HI);
+    pr_info("wpr2_reset: after  LO=0x%08x HI=0x%08x\n", lo_after, hi_after);
+
+    if (hi_after == 0)
+        pr_info("wpr2_reset: WPR2 cleared, clean GSP boot now possible\n");
+    else
+        pr_info("wpr2_reset: write dropped (PLM?) - WPR2 still up\n");
+
+    iounmap(bar0);
+    pci_dev_put(pdev);
+    return hi_after ? -EINVAL : 0;
+}
+
+static void __exit wpr2_reset_exit(void)
+{
+    pr_info("wpr2_reset: unloaded\n");
+}
+
+module_init(wpr2_reset_init);
+module_exit(wpr2_reset_exit);
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Clear GPU WPR2 registers to unstick GSP boot");
diff --git a/tools/rmq/rmq.c b/tools/rmq/rmq.c
new file mode 100644
index 0000000..189d647
--- /dev/null
+++ b/tools/rmq/rmq.c
@@ -0,0 +1,189 @@
+/* rmq - query host NVIDIA RM via /dev/nvidia0 ioctls (oracle for TU104 static data) */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <stdint.h>
+
+typedef uint32_t NvU32;
+typedef uint16_t NvU16;
+typedef uint8_t  NvU8;
+typedef uint64_t NvU64;
+typedef uint32_t NvHandle;
+typedef uint32_t NvV32;
+typedef uint64_t NvP64;
+
+/* NVIDIA ioctl encoding: _IOWR('F', nr, type) */
+#define NV_IOCTL_MAGIC      'F'
+#define NV_IOCTL_BASE       200
+#define NV_ESC_RM_ALLOC     0x2B
+#define NV_ESC_RM_CONTROL   0x2A
+
+#define NV01_ROOT           0x0
+#define NV01_DEVICE_0       0x80
+#define NV20_SUBDEVICE_0    0x2080
+
+typedef struct {
+    NvHandle hRoot;
+    NvHandle hObjectParent;
+    NvHandle hObjectNew;
+    NvV32    hClass;
+    NvP64    pAllocParms __attribute__((aligned(8)));
+    NvU32    paramsSize;
+    NvV32    status;
+} NVOS21_PARAMETERS;
+
+typedef struct {
+    NvHandle hClient;
+    NvHandle hObject;
+    NvV32    cmd;
+    NvU32    flags;
+    NvP64    params __attribute__((aligned(8)));
+    NvU32    paramsSize;
+    NvV32    status;
+} NVOS54_PARAMETERS;
+
+#define NV_IOCTL_RM_ALLOC   _IOWR(NV_IOCTL_MAGIC, NV_ESC_RM_ALLOC, NVOS21_PARAMETERS)
+#define NV_IOCTL_RM_CONTROL _IOWR(NV_IOCTL_MAGIC, NV_ESC_RM_CONTROL, NVOS54_PARAMETERS)
+
+static int fd;
+
+/* NVOS64: 48 bytes (0x30), used for device/subdevice allocs (with rights) */
+typedef struct {
+    NvHandle hRoot;
+    NvHandle hObjectParent;
+    NvHandle hObjectNew;
+    NvV32    hClass;
+    NvP64    pAllocParms __attribute__((aligned(8)));
+    NvP64    pRightsRequested __attribute__((aligned(8)));
+    NvU32    paramsSize;
+    NvU32    flags;
+    NvV32    status;
+} NVOS64_PARAMETERS;
+
+#define NV_IOCTL_RM_ALLOC64 _IOWR(NV_IOCTL_MAGIC, NV_ESC_RM_ALLOC, NVOS64_PARAMETERS)
+
+static NvU32 rm_alloc(NvHandle hRoot, NvHandle hParent, NvU32 hClass, NvHandle *pOut)
+{
+    NVOS21_PARAMETERS p = {0};
+    p.hRoot = hRoot; p.hObjectParent = hParent; p.hClass = hClass;
+    if (ioctl(fd, NV_IOCTL_RM_ALLOC, &p) < 0) { perror("alloc ioctl"); return 1; }
+    if (p.status) { fprintf(stderr, "alloc class 0x%x failed: 0x%x\n", hClass, p.status); return p.status; }
+    *pOut = p.hObjectNew;
+    return 0;
+}
+
+/* Device/subdevice allocs use NVOS64 (48 bytes) with rights */
+static NvU32 rm_alloc64(NvHandle hRoot, NvHandle hParent, NvU32 hClass, NvHandle *pOut)
+{
+    NVOS64_PARAMETERS p = {0};
+    p.hRoot = hRoot; p.hObjectParent = hParent; p.hClass = hClass;
+    p.flags = 1; /* FINN_SERIALIZED */
+    if (ioctl(fd, NV_IOCTL_RM_ALLOC64, &p) < 0) { perror("alloc64 ioctl"); return 1; }
+    if (p.status) { fprintf(stderr, "alloc64 class 0x%x failed: 0x%x\n", hClass, p.status); return p.status; }
+    *pOut = p.hObjectNew;
+    return 0;
+}
+
+static NvU32 rm_control(NvHandle hClient, NvHandle hObject, NvU32 cmd, void *params, NvU32 size)
+{
+    NVOS54_PARAMETERS p = {0};
+    p.hClient = hClient; p.hObject = hObject; p.cmd = cmd;
+    p.params = (NvP64)params; p.paramsSize = size;
+    if (ioctl(fd, NV_IOCTL_RM_CONTROL, &p) < 0) { perror("control ioctl"); return 1; }
+    return p.status;
+}
+
+/* NV2080_CTRL_FIFO_DEVICE_ENTRY (16 u32 engineData + 2 pbdmaIds + 2 pbdmaFaultIds + numPbdmas + name[16]) */
+typedef struct {
+    NvU32 engineData[16];
+    NvU32 pbdmaIds[2];
+    NvU32 pbdmaFaultIds[2];
+    NvU32 numPbdmas;
+    char  engineName[16];
+} FIFO_DEVICE_ENTRY;
+
+typedef struct {
+    NvU32 baseIndex;
+    NvU32 numEntries;
+    NvU32 bMore;
+    FIFO_DEVICE_ENTRY entries[32];
+} FIFO_GET_DEVICE_INFO_TABLE_PARAMS;
+
+typedef struct {
+    NvU32 faultId, instanceId, typeEnum, resetId, devicePriBase, isEngine;
+    NvU32 rlEngId, runlistPriBase, groupId, ginTargetId, deviceBroadcastPriBase, groupLocalInstanceId;
+} INTERNAL_DEVICE_INFO;
+
+typedef struct {
+    NvU32 numEntries;
+    INTERNAL_DEVICE_INFO deviceInfoTable[512];
+} INTERNAL_GET_DEVICE_INFO_TABLE_PARAMS;
+
+int main(int argc, char **argv)
+{
+    NvHandle hClient = 0, hDevice = 0, hSubdevice = 0;
+    NvU32 st;
+
+    /* RM_ALLOC creates clients on /dev/nvidiactl, not /dev/nvidia0 */
+    fd = open("/dev/nvidiactl", O_RDWR);
+    if (fd < 0) { perror("open /dev/nvidiactl"); return 1; }
+
+    if ((st = rm_alloc(0, 0, NV01_ROOT, &hClient))) return 1;
+    if ((st = rm_alloc64(hClient, hClient, NV01_DEVICE_0, &hDevice))) return 1;
+    if ((st = rm_alloc64(hClient, hDevice, NV20_SUBDEVICE_0, &hSubdevice))) return 1;
+    printf("hClient=0x%x hDevice=0x%x hSubdevice=0x%x\n", hClient, hDevice, hSubdevice);
+
+    /* FIFO_GET_DEVICE_INFO_TABLE (0x20801112) */
+    {
+        FIFO_GET_DEVICE_INFO_TABLE_PARAMS *t = calloc(1, sizeof(*t));
+        NvU32 base = 0;
+        printf("\n=== FIFO_GET_DEVICE_INFO_TABLE (0x20801112) ===\n");
+        do {
+            memset(t, 0, sizeof(*t));
+            t->baseIndex = base;
+            st = rm_control(hClient, hSubdevice, 0x20801112, t, sizeof(*t));
+            if (st) { printf("control failed: 0x%x\n", st); break; }
+            NvU32 i;
+            for (i = 0; i < t->numEntries; i++) {
+                FIFO_DEVICE_ENTRY *e = &t->entries[i];
+                printf("[%3u] name=%-16s numPbdmas=%u pbdmaIds=[%u,%u] faultIds=[%u,%u] engineData=[",
+                       base + i, e->engineName, e->numPbdmas,
+                       e->pbdmaIds[0], e->pbdmaIds[1],
+                       e->pbdmaFaultIds[0], e->pbdmaFaultIds[1]);
+                int j;
+                for (j = 0; j < 16; j++) printf("%s%u", j ? "," : "", e->engineData[j]);
+                printf("]\n");
+            }
+            base += t->numEntries;
+            if (!t->bMore) break;
+        } while (1);
+        free(t);
+    }
+
+    /* INTERNAL_GET_DEVICE_INFO_TABLE (0x20800a40) */
+    {
+        INTERNAL_GET_DEVICE_INFO_TABLE_PARAMS *t = calloc(1, sizeof(*t));
+        printf("\n=== INTERNAL_GET_DEVICE_INFO_TABLE (0x20800a40) ===\n");
+        st = rm_control(hClient, hSubdevice, 0x20800a40, t, sizeof(*t));
+        if (st) {
+            printf("control failed: 0x%x (expected from userspace if internal-only)\n", st);
+        } else {
+            NvU32 i;
+            printf("numEntries=%u\n", t->numEntries);
+            for (i = 0; i < t->numEntries; i++) {
+                INTERNAL_DEVICE_INFO *e = &t->deviceInfoTable[i];
+                printf("[%3u] faultId=%u instanceId=%u typeEnum=%u resetId=%u devicePriBase=0x%x isEngine=%u rlEngId=%u runlistPriBase=0x%x groupId=%u ginTargetId=%u deviceBroadcastPriBase=0x%x groupLocalInstanceId=%u\n",
+                       i, e->faultId, e->instanceId, e->typeEnum, e->resetId,
+                       e->devicePriBase, e->isEngine, e->rlEngId, e->runlistPriBase,
+                       e->groupId, e->ginTargetId, e->deviceBroadcastPriBase,
+                       e->groupLocalInstanceId);
+            }
+        }
+        free(t);
+    }
+
+    return 0;
+}
diff --git a/tools/rmq/wpr2_reset b/tools/rmq/wpr2_reset
new file mode 100755
index 0000000..08d4f55
--- /dev/null
+++ b/tools/rmq/wpr2_reset
diff --git a/tools/rmq/wpr2_reset.c b/tools/rmq/wpr2_reset.c
new file mode 100644
index 0000000..4435843
--- /dev/null
+++ b/tools/rmq/wpr2_reset.c
@@ -0,0 +1,50 @@
+/* wpr2_reset - clear GPU WPR2 registers via BAR0 MMIO to unstick GSP boot.
+ *
+ * When nvidia.ko is unloaded, GSP firmware can remain resident in WPR2
+ * (write-protected region 2 in FB). The next RmInitAdapter then fails with
+ * "unexpected WPR2 already up". FLR does not clear WPR2; only a cold (power)
+ * reset does. This tool pokes WPR2_ADDR_LO/HI to zero directly through
+ * /sys/bus/pci/devices/<dev>/resource0 while no driver is bound.
+ *
+ * Usage: sudo ./wpr2_reset [pci.bdf]   (default 0000:01:00.0)
+ */
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/mman.h>
+
+#define NV_PFB_PRI_MMU_WPR2_ADDR_LO 0x1fa824
+#define NV_PFB_PRI_MMU_WPR2_ADDR_HI 0x1fa828
+
+int main(int argc, char **argv)
+{
+    const char *bdf = argc > 1 ? argv[1] : "0000:01:00.0";
+    char path[256];
+    snprintf(path, sizeof(path), "/sys/bus/pci/devices/%s/resource0", bdf);
+
+    int fd = open(path, O_RDWR | O_SYNC);
+    if (fd < 0) { perror(path); return 1; }
+    void *bar = mmap(NULL, 0x200000, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
+    if (bar == MAP_FAILED) { perror("mmap"); return 1; }
+
+    volatile uint32_t *lo = (volatile uint32_t *)((char *)bar + NV_PFB_PRI_MMU_WPR2_ADDR_LO);
+    volatile uint32_t *hi = (volatile uint32_t *)((char *)bar + NV_PFB_PRI_MMU_WPR2_ADDR_HI);
+
+    printf("before: WPR2_ADDR_LO=0x%08x WPR2_ADDR_HI=0x%08x\n", *lo, *hi);
+    *lo = 0;
+    *hi = 0;
+    /* read back */
+    printf("after : WPR2_ADDR_LO=0x%08x WPR2_ADDR_HI=0x%08x\n", *lo, *hi);
+
+    if (*hi == 0)
+        printf("WPR2 cleared - driver load should now boot GSP cleanly\n");
+    else
+        printf("write dropped (PLM?) - WPR2 still up\n");
+
+    munmap(bar, 0x200000);
+    close(fd);
+    return *hi ? 1 : 0;
+}