From 51d080a176533e240bcd251a20729c3f02d5fd21 Mon Sep 17 00:00:00 2001
From: Arthur Hanson Rasmusson <arthur@vgpu.io>
Date: Thu, 29 Oct 2026 10:18:50 -0400
Subject: vgsp: binapi07_rep knob - BINAPI 0x20810107 feature flag authored
 (glcore method-emission gate); kick notify lane next (SESSION 153 r965)

---
 kernel/gsp_rm_emulation.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index fc94b7d..653ff1d 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -3522,6 +3522,19 @@ module_param_named(gsp_rm_binapi07_fwd, gsp_rm_binapi07_fwd_param, bool, 0644);
 MODULE_PARM_DESC(gsp_rm_binapi07_fwd,
 	"Forward only the guest GL core's BINAPI 0x20810107 query to the live GSP session (default 0; diagnostic/experiment)");
 
+/*
+ * SESSION 153-CONTINUED-17: reply word (little-endian u16) for BINAPI
+ * 0x20810107. The guest GL client reads reply byte[1] as a feature flag
+ * (glcore+0xFC74E1: setne <ctx>+0x203 after cmpb $0x0,reply[1]) and the
+ * flag gates method emission at glcore+0xB5B48B (see the control handler).
+ * 0x0101 sets both bytes; 0x0100 sets byte[1] only. Default 0 = the
+ * historical {0,0} reply.
+ */
+static uint gsp_rm_binapi07_rep;
+module_param_named(binapi07_rep, gsp_rm_binapi07_rep, uint, 0644);
+MODULE_PARM_DESC(binapi07_rep,
+	"reply word (LE u16) for BINAPI cmd 0x20810107; the GL client reads byte[1] as a feature flag (default 0)");
+
 /*
  * session 75: reply words for the client-pending control 0x2080a097 (the
  * libnvidia-eglcore engine-readiness poll). Runtime-tunable so one boot can
@@ -4528,6 +4541,52 @@ static void gsp_rm_handle_rm_control(struct gsp_emu_context *ctx,
 		out_params_size = req.paramsSize;
 		break;
 
+	case 0x20810107: { /* NV2081_BINAPI reserved-interface method 7 */
+		/*
+		 * SESSION 153-CONTINUED-17: the guest GL client
+		 * (libnvidia-glcore 570.144, file offset 0xFC74A6) sends this
+		 * 2-byte query right after allocating its BINAPI object and
+		 * CONSUMES REPLY BYTE [1] AS A FEATURE FLAG:
+		 *
+		 *   glcore+0xFC74D9: cmpb $0x0, 0x131(%rsp)
+		 *   glcore+0xFC74E1: setne 0x203(%r14)   ; flag = replies[1]
+		 *
+		 * and the flag gates 3D method emission into the command
+		 * buffer:
+		 *
+		 *   glcore+0xB5B48B: mov 0x1248(%r14),%rax
+		 *                    cmpb $0x0,0x203(%rax)
+		 *                    je <skip>
+		 *   glcore+0xB5B49B: movabs $0xf020010e66,%rdi
+		 *                    mov %rdi,(0x80(%r14))  ; emit + advance
+		 *
+		 * With the historical {0,0} generic reply the flag stays 0 and
+		 * the client's submission pipeline never activates (no GL
+		 * channel, no pushes, black window). binapi07_rep selects the
+		 * reply word (LE u16) at runtime so one boot can test the
+		 * feature without a rebuild: 0x0101 = both bytes set,
+		 * 0x0100 = byte[1] only. Default 0 reproduces {0,0}.
+		 */
+		u8 *rp = reply + GSP_RM_CTRL_HDR_SIZE;
+		const u8 *pp = req_data + GSP_RM_CTRL_HDR_SIZE;
+
+		if (req.paramsSize >= 2 && req.paramsSize <= 16) {
+			memcpy(rp, pp, req.paramsSize);
+			rp[0] = gsp_rm_binapi07_rep & 0xff;
+			rp[1] = (gsp_rm_binapi07_rep >> 8) & 0xff;
+			out_params_size = req.paramsSize;
+		} else {
+			out_params_size = 0;
+		}
+		if (gsp_sema_dbg)
+			nv_vgpu_info(ctx->vgpu,
+				     "vgsp-rm: BINAPI 0x20810107 reply in=%u rep=0x%04x bytes=%02x %02x",
+				     req.paramsSize, gsp_rm_binapi07_rep,
+				     rp[0], rp[1]);
+		out_status = 0;
+		break;
+	}
+
 	case TU104_CTRL_I2C_TRANSACTION:
 		/* I2C transactions have variable-length FINN-serialized
 		 * params: an all-zero reply fails the driver's DeserializeUp
-- 
cgit v1.2.3