From 6b686f70d8ff3e6340e8307c95847cd1eed4f2ae Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 21 Sep 2026 19:04:05 -0400 Subject: kernel: Fix FIFO table fortify_panic + GSP boot-state reset on queue death + ISO fbRegion - gsp_rm_handle_fifo_device_table: read baseIndex from the queue element buffer (req_data + hdr), not past the local 24-byte header struct - FORTIFY proved the old memcpy always overflows -> fortify_panic killed gsp_emu_0 mid RmInitNvDevice (guest timed out on fn 76). - gsp_emu_clear_boot_state: clear WPR2/RISCV/mailboxes/stage tracker and reset GSP-RM queue state. Turing guests produce no observable BAR0 writes on unload, so the next probe's _kgspBootGspRm failed with 'unexpected WPR2 already up'. Trigger on ENGINE reset and on detected queue death (insane writePtr jump / garbage element signature). - GspStaticConfigInfo fbRegion[0].supportISO=1: memmgrCalcReservedFbSpace asserts some region supports ISO 'even with no display'; without it kdispStateInitLocked couldn't allocate clientChannelTable. - .gitignore: scripts/git-push-vgpu.sh (local per-machine helper) --- kernel/gsp_emulation.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) (limited to 'kernel/gsp_emulation.c') diff --git a/kernel/gsp_emulation.c b/kernel/gsp_emulation.c index 3b6f6e5..5522bf3 100644 --- a/kernel/gsp_emulation.c +++ b/kernel/gsp_emulation.c @@ -137,6 +137,32 @@ enum gsp_emu_boot_stage { GSP_BOOT_STAGE_BOOTER_DONE, /* Booter Load completed */ }; +/* + * gsp_emu_clear_boot_state - return the emulated GSP to a cold state. + * + * On real hardware, driver unload tears down WPR2 (Booter Unload) so the + * next probe's _kgspBootGspRm WPR2-up check passes. Turing guests produce + * no observable BAR0 writes on unload, so callers must trigger this on + * indirect death signals (ENGINE reset, GSP-RM queue going stale). + * Clears WPR2, RISCV active status and the falcon stage tracker, and + * drops the parsed GSP-RM queue state. + */ +void gsp_emu_clear_boot_state(struct gsp_emu_context *ctx, const char *reason) +{ + nv_vgpu_info(ctx->vgpu, "GSP-BOOT: clearing boot state (%s)", reason); + + gsp_emu_shadow_write32(ctx, GSP_EMU_REG_WPR2_ADDR_LO, 0); + gsp_emu_shadow_write32(ctx, GSP_EMU_REG_WPR2_ADDR_HI, 0); + gsp_emu_shadow_write32(ctx, GSP_EMU_REG_RISCV_STATUS, 0); + gsp_emu_shadow_write32(ctx, GSP_EMU_REG_GSP_MAILBOX0, 0); + gsp_emu_shadow_write32(ctx, GSP_EMU_REG_GSP_MAILBOX1, 0); + + ctx->boot_stage = GSP_BOOT_STAGE_IDLE; + ctx->flcn_kick_count = 0; + + gsp_rm_emu_reset(ctx); +} + /* * gsp_emu_poll_boot - drive the guest's physical GSP boot to completion. * @@ -155,12 +181,10 @@ static void gsp_emu_poll_boot(struct gsp_emu_context *ctx) /* GSP ENGINE reset asserted -> falcon rebooted, restart stage tracking */ if ((engine & 0x1) && ctx->boot_stage != GSP_BOOT_STAGE_IDLE) { - ctx->boot_stage = GSP_BOOT_STAGE_IDLE; - ctx->flcn_kick_count = 0; nv_vgpu_info(ctx->vgpu, "GSP-BOOT: falcon reset, back to IDLE"); /* The guest is rebooting the GSP (new probe or unload): the * GSP-RM queue state is stale, reset it too. */ - gsp_rm_emu_reset(ctx); + gsp_emu_clear_boot_state(ctx, "ENGINE reset"); return; } -- cgit v1.2.3