From 1e5be920add0dfd2d5c388b9cf8a4a09f3e72e37 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 23 Oct 2026 20:21:24 -0400 Subject: vgsp-rm r579: post the event notifyIndex INDEX field, not the overloaded registration word THE 2nd-client event-wait root cause (live guest Oops): the NV01_EVENT registration word we echoed (e.g. 0x3c00000c) is an OVERLOADED field - cl0005.h: INDEX=bits[15:0], SUBDEVICE=bits[23:16], FLAGS=bits[31:24] - but the guest's _kgspRpcPostEvent passes the payload's notifyIndex straight to gpuNotifySubDeviceEvent_IMPL, which indexes its notifier array with it. Posting 0x3c00000c produced a wild pointer (base + 0x3c00000c*4 + 0x1508) and a kernel Oops on every dispatched event: BUG: unable to handle page fault for address: ffffd04d4235f808 RIP: gpuNotifySubDeviceEvent_IMPL+0x21f [nvidia] RAX: 000000003c00000c note: victory_matmul[12151] exited with irqs disabled Fixing recursive fault but reboot is needed! The Oops killed the dispatch before osNotifyEvent/nv_post_event (hence the r576/r577 experiments: records consumed, nv_post_event=0, independent of sequence/bNotifyList/hClient), dropped every event, and tainted the guest kernel - clients that needed an event wake (the 2nd-client device-state spins) wedged. Mask the posted notifyIndex to bits[15:0] (the INDEX field). Also loadable probe r578: gsp_rm_ev_func (event records carry a caller-chosen RPC function for reachability tests). --- kernel/gsp_rm_emulation.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c index 357997c..fb0f31d 100644 --- a/kernel/gsp_rm_emulation.c +++ b/kernel/gsp_rm_emulation.c @@ -788,13 +788,27 @@ static void gsp_rm_fill_ev_payload(const struct gsp_rm_emu *rm, u32 i, u8 *payload) { u32 h_client = rm->events[i].h_client; + /* + * r579 THE EVENT-DROP ROOT CAUSE: NV0005_ALLOC_PARAMETERS.notifyIndex + * is OVERLOADED (cl0005.h): INDEX=bits[15:0], SUBDEVICE=bits[23:16], + * FLAGS=bits[31:24]. The registration word (e.g. 0x3c00000c) must not + * be posted verbatim: the guest's _kgspRpcPostEvent hands the payload + * notifyIndex straight to gpuNotifySubDeviceEvent_IMPL, which indexes + * its notifier array by it - posting 0x3c00000c produced a wild + * pointer (base + 0x3c00000c*4 + 0x1508) and a kernel Oops + * ("BUG: unable to handle page fault ... gpuNotifySubDeviceEvent_IMPL + * +0x21f", RAX=0x3c00000c) on every dispatched event, which is why + * nv_post_event never fired and clients waiting on event wakes + * wedged. Post the INDEX field only. + */ + u32 notify_index = rm->events[i].notify_index & 0xffffu; memset(payload, 0, 32); if (gsp_rm_ev_cl) h_client = gsp_rm_ev_cl; memcpy(payload + 0, &h_client, 4); memcpy(payload + 4, &rm->events[i].h_event, 4); - memcpy(payload + 8, &rm->events[i].notify_index, 4); + memcpy(payload + 8, ¬ify_index, 4); memcpy(payload + 12, &rm->events[i].data, 4); /* info16@16, status@20, eventDataSize@24 = 0 */ if (gsp_rm_ev_nlist) -- cgit v1.2.3