1 files changed, 60 insertions, 0 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index eddfab5..efd350b 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -1169,6 +1169,7 @@ static const char *gsp_rm_rpc_name(u32 function)
 	case GSPRM_RPC_FUNC_GSP_RM_CONTROL:		return "GSP_RM_CONTROL";
 	case GSPRM_RPC_FUNC_UNLOADING_GUEST_DRIVER:	return "UNLOADING_GUEST_DRIVER";
 	case GSPRM_RPC_FUNC_UPDATE_BAR_PDE:		return "UPDATE_BAR_PDE";
+	case GSPRM_RPC_FUNC_DUP_OBJECT:			return "DUP_OBJECT";
 	default:					return "UNKNOWN";
 	}
 }
@@ -3623,6 +3624,61 @@ rm_control_reply:
 }
 
 /*
+ * r510gl: DUP_OBJECT (function 21) - NVOS55_PARAMETERS echo with status=NV_OK.
+ *
+ * The guest driver dups an object into a second client at EGL/GLX
+ * MakeCurrent time (memory and VASpace objects: the GL context's client
+ * shares the device's allocations), and the historical generic-SUCCESS
+ * default replied with an EMPTY payload - the driver's reply must carry the
+ * params struct back (rpc_dup_object_v03_00 = NVOS55_PARAMETERS
+ * {hClient, hParent, hObject, hClientSrc, hObjectSrc, flags, status}), so
+ * an empty reply failed the call and the driver tore the whole EGL session
+ * down (guest witness: 'RPC UNKNOWN(21) seq=0 len=60 -> generic SUCCESS',
+ * immediately followed by the session's FREE cascade and
+ * eglMakeCurrent -> EGL_BAD_ALLOC (0x3003), 2026-10-23 r510).
+ *
+ * The emulation does not model per-object state for these classes (controls
+ * and allocs are answered from the request), so the echo with NV_OK is the
+ * complete answer; the dup'd handle is used by later calls exactly like the
+ * source handle.
+ */
+static void gsp_rm_handle_dup_object(struct gsp_emu_context *ctx,
+				     const u8 *elem, u32 sequence)
+{
+	struct gsp_rm_emu *rm = ctx->rm_emu;
+	const struct gsprm_rpc_header *hdr =
+		(const struct gsprm_rpc_header *)(elem + GSPRM_ELEM_HDR_SIZE);
+	const u8 *req = elem + GSPRM_ELEM_HDR_SIZE + sizeof(*hdr);
+	u8 params[28];	/* NVOS55_PARAMETERS_v03_00 */
+	u32 hDstClient = 0, hDstObject = 0, hSrcClient = 0, hSrcObject = 0;
+
+	if (hdr->length >= sizeof(*hdr) + sizeof(params))
+		memcpy(params, req, sizeof(params));
+	else
+		memset(params, 0, sizeof(params));
+
+	memcpy(&hDstClient, params + 0, 4);
+	memcpy(&hDstObject, params + 8, 4);
+	memcpy(&hSrcClient, params + 12, 4);
+	memcpy(&hSrcObject, params + 16, 4);
+	memset(params + 24, 0, 4);	/* status = NV_OK */
+
+	nv_vgpu_info(ctx->vgpu,
+		     "vgsp-rm: DUP_OBJECT hDstClient=0x%x hDstObject=0x%x hSrcClient=0x%x hSrcObject=0x%x seq=%u -> NV_OK echo",
+		     hDstClient, hDstObject, hSrcClient, hSrcObject, sequence);
+
+	/* Small delay before the reply: same reply-matching race mitigation as
+	 * FREE/UNLOADING. */
+	udelay(2000);
+
+	if (gsp_rm_send(ctx, GSPRM_RPC_FUNC_DUP_OBJECT, sequence, 0,
+			params, sizeof(params)))
+		nv_vgpu_err(ctx->vgpu, "vgsp-rm: DUP_OBJECT reply send failed");
+	else
+		rm->rpcs_replied++;
+}
+
+/*
  * GSP_RM_FREE (function 10) - NVOS00_PARAMETERS echo with status=NV_OK.
  *
  * rpc_gsp_free: { hRoot, hObjectParent, hObjectOld, status }. Echo the
@@ -3903,6 +3959,10 @@ static void gsp_rm_handle_element(struct gsp_emu_context *ctx, const u8 *elem)
 		gsp_rm_handle_free(ctx, elem, sequence);
 		return;
 
+	case GSPRM_RPC_FUNC_DUP_OBJECT:
+		gsp_rm_handle_dup_object(ctx, elem, sequence);
+		return;
+
 	case GSPRM_RPC_FUNC_SET_PAGE_DIRECTORY:
 		gsp_rm_handle_set_page_directory(ctx, elem, sequence, hdr->length);
 		return;