1 files changed, 242 insertions, 7 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index eddfab5..90556f2 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -1169,6 +1169,7 @@ static const char *gsp_rm_rpc_name(u32 function)
 	case GSPRM_RPC_FUNC_GSP_RM_CONTROL:		return "GSP_RM_CONTROL";
 	case GSPRM_RPC_FUNC_UNLOADING_GUEST_DRIVER:	return "UNLOADING_GUEST_DRIVER";
 	case GSPRM_RPC_FUNC_UPDATE_BAR_PDE:		return "UPDATE_BAR_PDE";
+	case GSPRM_RPC_FUNC_DUP_OBJECT:			return "DUP_OBJECT";
 	default:					return "UNKNOWN";
 	}
 }
@@ -2955,6 +2956,115 @@ gsp_rm_handle_promote_fault_method_buffers(struct gsp_emu_context *ctx,
 }
 
 /*
+ * r519 experiment switch, independent of the P3 whitelist: forward ONLY the
+ * BINAPI reserved-interface query 0x20810107 to the live GSP session. The P3
+ * whitelist may be off (its mixed real/emulated device answers perturb the
+ * boot); this one command is what the GL surface init needs answered.
+ */
+static bool gsp_rm_binapi07_fwd_param;
+module_param_named(gsp_rm_binapi07_fwd, gsp_rm_binapi07_fwd_param, bool, 0644);
+MODULE_PARM_DESC(gsp_rm_binapi07_fwd,
+	"Forward only the guest GL core's BINAPI 0x20810107 query to the live GSP session (default 0; diagnostic/experiment)");
+
+/*
+ * The live session's oracle client/object for the 0x20810107 experiment,
+ * created on demand; 0 until the first query builds it. One device per module
+ * load, so file-statics are enough; reset by unload.
+ */
+static u32 gsp_rm_binapi07_be_client;
+static u32 gsp_rm_binapi07_be_object;
+
+/*
+ * One GSP_RM_ALLOC (fn 103) against the live backend, built exactly like the
+ * rm-call ladder's helper (rpc_gsp_rm_alloc_v03_00: hClient, hParent,
+ * hObject, hClass, status, paramsSize, flags, reserved[4] + params).
+ * object_is_out selects the reply read: a ROOT alloc returns the
+ * server-chosen client handle in params[0] (payload +32), anything else
+ * echoes the client-chosen hObject at +8; status is at +16 in both cases.
+ */
+static int gsp_rm_binapi07_backend_alloc(u32 h_client, u32 h_parent,
+					 u32 h_object, u32 h_class,
+					 const void *params, u32 params_len,
+					 bool object_is_out,
+					 u32 *out_object, u32 *out_status)
+{
+	u8 *areq;
+	void *arsp = NULL;
+	u32 arsp_len = 0, st = 0xffffffff, ho = 0;
+	int ret;
+
+	areq = kzalloc(32 + params_len, GFP_KERNEL);
+	if (!areq)
+		return -ENOMEM;
+	memcpy(areq + 0, &h_client, 4);
+	memcpy(areq + 4, &h_parent, 4);
+	memcpy(areq + 8, &h_object, 4);
+	memcpy(areq + 12, &h_class, 4);
+	memcpy(areq + 20, &params_len, 4);
+	if (params_len)
+		memcpy(areq + 32, params, params_len);
+
+	ret = gsp_phys_backend_rpc(GSPRM_RPC_FUNC_GSP_RM_ALLOC, areq,
+				   32 + params_len, &arsp, &arsp_len, 500);
+	kfree(areq);
+	if (!ret && arsp) {
+		if (arsp_len >= 20)
+			memcpy(&st, (u8 *)arsp + 16, 4);
+		if (object_is_out) {
+			if (arsp_len >= 36)
+				memcpy(&ho, (u8 *)arsp + 32, 4);
+		} else if (arsp_len >= 12) {
+			memcpy(&ho, (u8 *)arsp + 8, 4);
+		}
+	}
+	kfree(arsp);
+	if (out_object)
+		*out_object = ho;
+	if (out_status)
+		*out_status = st;
+	return ret;
+}
+
+/*
+ * Build the oracle object on the live session: a class-0x2081 child of the
+ * session's internal subdevice, since the server dispatches the method from
+ * the OBJECT's class (the subdevice attempt alone answered
+ * NV_ERR_NOT_SUPPORTED, 0x56, and a fresh root client at runtime answered
+ * NV_ERR_INVALID_CLIENT, 0x23 - the ladder "adopts" the server's own
+ * internal client instead of creating one). A small candidate list of
+ * likely-free handles in that client's namespace is tried; the first
+ * success wins. Returns 0 with *out_object set.
+ */
+static int gsp_rm_binapi07_backend_setup(struct gsp_emu_context *ctx,
+					 struct gsp_phys_backend_static_config *snap,
+					 u32 *out_object)
+{
+	static const u32 cand[] = { 0xabcd2081u, 0xabcd2001u, 0xabcd2a2au,
+				    0xabcd5f5fu, 0xabcd1234u };
+	u8 p4[4] = { 0, 0, 0, 0 };
+	u32 st = 0xffffffff, obj = 0;
+	int i, ret;
+
+	for (i = 0; i < (int)ARRAY_SIZE(cand); i++) {
+		u32 want = cand[i];
+
+		obj = want;
+		ret = gsp_rm_binapi07_backend_alloc(snap->h_internal_client,
+						    snap->h_internal_subdevice,
+						    want, 0x2081, p4, 4,
+						    false, &obj, &st);
+		nv_vgpu_info(ctx->vgpu,
+			     "vgsp-rm: BINAPI-EXPERIMENT oracle BINAPI alloc attempt %d: hObject=0x%x ret=%d status=0x%x",
+			     i, want, ret, st);
+		if (!ret && st == 0 && obj) {
+			*out_object = obj;
+			return 0;
+		}
+	}
+	return -EIO;
+}
+
+/*
  * Bounded logging for the P3 forward counters: the first four fallbacks (so a
  * session that cannot forward is visible) and every 64th event. Never called
  * when the parameter is off.
@@ -3003,12 +3113,37 @@ static bool gsp_rm_ctrl_forward(struct gsp_emu_context *ctx,
 	u32 out_params_size;
 	int ret;
 
+	bool guest_handles = false;
+
 	/* Wave 1 whitelist: compile-time side-effect-free queries only. */
 	switch (req->cmd) {
 	case TU104_CTRL_BUS_GET_PCI_BAR_INFO:
 	case TU104_CTRL_BUS_GET_INFO_V2:
 	case TU104_CTRL_FB_GET_INFO_V2:
 	case TU104_CTRL_INTERNAL_GMMU_GET_STATIC_INFO:
+		if (!gsp_phys_ctrl_forward_enabled())
+			return false;
+		break;
+	case 0x20810107:	/* NV2081_BINAPI reserved-interface method 7 */
+		/*
+		 * EXPERIMENT (r519): the guest GL core allocates a BINAPI
+		 * object (class 0x2081) and sends this 2-byte query during
+		 * 3D-surface init; our {0,0} generic reply leaves the
+		 * driver's feature flag clear and the EGL surface init tears
+		 * down (EGL_BAD_ALLOC at eglMakeCurrent). The guest-side
+		 * handles (hClient 0xc1d..., a 0xbeef object) have no backend
+		 * counterpart: allocate a real BINAPI object (class 0x2081) on
+		 * the live session once, then send the query to it. The first
+		 * attempt (subdevice translation) came back NV_ERR_NOT_SUPPORTED
+		 * (0x56) - the server dispatches the method by the OBJECT's
+		 * class, so a subdevice cannot answer a BINAPI method. The
+		 * reply is logged either way; an error falls back to the
+		 * emulated generic success until the semantics are known.
+		 * Gated by its own parameter so the P3 whitelist can stay off.
+		 */
+		if (!gsp_rm_binapi07_fwd_param)
+			return false;
+		guest_handles = true;
 		break;
 	default:
 		return false;
@@ -3020,24 +3155,44 @@ static bool gsp_rm_ctrl_forward(struct gsp_emu_context *ctx,
 	if (req->paramsSize > GSPRM_MAX_SINGLE_ELEM_DATA - GSP_RM_CTRL_HDR_SIZE)
 		goto fallback;
 
+	/* The experiment is scoped to the observed shape: 2-byte in/out. */
+	if (guest_handles && req->paramsSize != 2)
+		goto fallback;
+
 	/* A valid snapshot implies a READY session and the adopted handles. */
 	if (gsp_phys_backend_static_get(&snap))
 		goto fallback;
 
+	if (guest_handles && !gsp_rm_binapi07_be_object) {
+		u32 obj = 0;
+
+		if (gsp_rm_binapi07_backend_setup(ctx, &snap, &obj))
+			goto fallback;
+		/*
+		 * The object lives in the internal client's namespace; the
+		 * control is sent as that client (snap.h_internal_client).
+		 */
+		gsp_rm_binapi07_be_client = snap.h_internal_client;
+		gsp_rm_binapi07_be_object = obj;
+	}
+
 	/* Translate the guest's emulated internal handles; any other handle
 	 * domain stays emulated. */
-	if (req->hClient != TU104_H_INTERNAL_CLIENT ||
-	    (req->hObject != TU104_H_INTERNAL_DEVICE &&
-	     req->hObject != TU104_H_INTERNAL_SUBDEVICE))
+	if (!guest_handles &&
+	    (req->hClient != TU104_H_INTERNAL_CLIENT ||
+	     (req->hObject != TU104_H_INTERNAL_DEVICE &&
+	      req->hObject != TU104_H_INTERNAL_SUBDEVICE)))
 		goto fallback;
 
 	fwd_req = kmalloc(GSP_RM_CTRL_HDR_SIZE + req->paramsSize, GFP_KERNEL);
 	if (!fwd_req)
 		goto fallback;
 	memset(&fwd_hdr, 0, sizeof(fwd_hdr));
-	fwd_hdr.hClient = snap.h_internal_client;
-	fwd_hdr.hObject = req->hObject == TU104_H_INTERNAL_DEVICE ?
-			  snap.h_internal_device : snap.h_internal_subdevice;
+	fwd_hdr.hClient = guest_handles ? gsp_rm_binapi07_be_client :
+			  snap.h_internal_client;
+	fwd_hdr.hObject = guest_handles ? gsp_rm_binapi07_be_object :
+			  (req->hObject == TU104_H_INTERNAL_DEVICE ?
+			   snap.h_internal_device : snap.h_internal_subdevice);
 	fwd_hdr.cmd = req->cmd;
 	fwd_hdr.paramsSize = req->paramsSize;
 	fwd_hdr.flags = req->flags;
@@ -3057,6 +3212,27 @@ static bool gsp_rm_ctrl_forward(struct gsp_emu_context *ctx,
 	}
 
 	/*
+	 * r519 experiment evidence: log the live GSP's own answer to the
+	 * BINAPI query (status + first params bytes) before deciding.
+	 */
+	if (req->cmd == 0x20810107) {
+		u32 st = 0xffffffff, ps = 0xffffffff;
+		u8 b[8] = { 0 };
+
+		if (rsp && rsp_len >= GSP_RM_CTRL_HDR_SIZE) {
+			memcpy(&st, (u8 *)rsp + 12, 4);
+			memcpy(&ps, (u8 *)rsp + 16, 4);
+			if (ps <= 8 && ps <= rsp_len - GSP_RM_CTRL_HDR_SIZE)
+				memcpy(b, (u8 *)rsp + GSP_RM_CTRL_HDR_SIZE,
+				       ps);
+		}
+		nv_vgpu_info(ctx->vgpu,
+			     "vgsp-rm: BINAPI-EXPERIMENT 0x20810107 forwarded to live GSP: rsp_len=%u status=0x%x outSize=%u bytes=%02x %02x %02x %02x %02x %02x %02x %02x",
+			     rsp_len, st, ps, b[0], b[1], b[2], b[3], b[4],
+			     b[5], b[6], b[7]);
+	}
+
+	/*
 	 * The reply is rpc_gsp_rm_control_v03_00: status at +12, paramsSize
 	 * at +16, echoed params at +24 - the same 24-byte prefix the emulated
 	 * handler builds below. The RPC-level rpc_result was already checked
@@ -3231,7 +3407,7 @@ static void gsp_rm_handle_rm_control(struct gsp_emu_context *ctx,
 	 * return means nothing was sent and the emulated switch below runs
 	 * byte-identically to the parameter-off path.
 	 */
-	if (gsp_phys_ctrl_forward_enabled() &&
+	if ((gsp_phys_ctrl_forward_enabled() || gsp_rm_binapi07_fwd_param) &&
 	    gsp_rm_ctrl_forward(ctx, &req, req_data + GSP_RM_CTRL_HDR_SIZE,
 				reply, reply_data_len, sequence)) {
 		kfree(reply);
@@ -3623,6 +3799,61 @@ rm_control_reply:
 }
 
 /*
+ * r510gl: DUP_OBJECT (function 21) - NVOS55_PARAMETERS echo with status=NV_OK.
+ *
+ * The guest driver dups an object into a second client at EGL/GLX
+ * MakeCurrent time (memory and VASpace objects: the GL context's client
+ * shares the device's allocations), and the historical generic-SUCCESS
+ * default replied with an EMPTY payload - the driver's reply must carry the
+ * params struct back (rpc_dup_object_v03_00 = NVOS55_PARAMETERS
+ * {hClient, hParent, hObject, hClientSrc, hObjectSrc, flags, status}), so
+ * an empty reply failed the call and the driver tore the whole EGL session
+ * down (guest witness: 'RPC UNKNOWN(21) seq=0 len=60 -> generic SUCCESS',
+ * immediately followed by the session's FREE cascade and
+ * eglMakeCurrent -> EGL_BAD_ALLOC (0x3003), 2026-10-23 r510).
+ *
+ * The emulation does not model per-object state for these classes (controls
+ * and allocs are answered from the request), so the echo with NV_OK is the
+ * complete answer; the dup'd handle is used by later calls exactly like the
+ * source handle.
+ */
+static void gsp_rm_handle_dup_object(struct gsp_emu_context *ctx,
+				     const u8 *elem, u32 sequence)
+{
+	struct gsp_rm_emu *rm = ctx->rm_emu;
+	const struct gsprm_rpc_header *hdr =
+		(const struct gsprm_rpc_header *)(elem + GSPRM_ELEM_HDR_SIZE);
+	const u8 *req = elem + GSPRM_ELEM_HDR_SIZE + sizeof(*hdr);
+	u8 params[28];	/* NVOS55_PARAMETERS_v03_00 */
+	u32 hDstClient = 0, hDstObject = 0, hSrcClient = 0, hSrcObject = 0;
+
+	if (hdr->length >= sizeof(*hdr) + sizeof(params))
+		memcpy(params, req, sizeof(params));
+	else
+		memset(params, 0, sizeof(params));
+
+	memcpy(&hDstClient, params + 0, 4);
+	memcpy(&hDstObject, params + 8, 4);
+	memcpy(&hSrcClient, params + 12, 4);
+	memcpy(&hSrcObject, params + 16, 4);
+	memset(params + 24, 0, 4);	/* status = NV_OK */
+
+	nv_vgpu_info(ctx->vgpu,
+		     "vgsp-rm: DUP_OBJECT hDstClient=0x%x hDstObject=0x%x hSrcClient=0x%x hSrcObject=0x%x seq=%u -> NV_OK echo",
+		     hDstClient, hDstObject, hSrcClient, hSrcObject, sequence);
+
+	/* Small delay before the reply: same reply-matching race mitigation as
+	 * FREE/UNLOADING. */
+	udelay(2000);
+
+	if (gsp_rm_send(ctx, GSPRM_RPC_FUNC_DUP_OBJECT, sequence, 0,
+			params, sizeof(params)))
+		nv_vgpu_err(ctx->vgpu, "vgsp-rm: DUP_OBJECT reply send failed");
+	else
+		rm->rpcs_replied++;
+}
+
+/*
  * GSP_RM_FREE (function 10) - NVOS00_PARAMETERS echo with status=NV_OK.
  *
  * rpc_gsp_free: { hRoot, hObjectParent, hObjectOld, status }. Echo the
@@ -3903,6 +4134,10 @@ static void gsp_rm_handle_element(struct gsp_emu_context *ctx, const u8 *elem)
 		gsp_rm_handle_free(ctx, elem, sequence);
 		return;
 
+	case GSPRM_RPC_FUNC_DUP_OBJECT:
+		gsp_rm_handle_dup_object(ctx, elem, sequence);
+		return;
+
 	case GSPRM_RPC_FUNC_SET_PAGE_DIRECTORY:
 		gsp_rm_handle_set_page_directory(ctx, elem, sequence, hdr->length);
 		return;