From 6aadb593750736f239fd54a0ccef4b3834c08fc4 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 21 Sep 2026 18:01:55 -0400 Subject: kernel: GSP-RM msgq emulation + TU104 hardware tables (GET_GSP_STATIC_INFO, GSP_RM_CONTROL) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Implements the GSP-RM reply content layer for the msgq RPC channel: - kernel/gsp_rm_emulation.c/h: GSP-RM msgq emulation engine - Queue chain discovery (libos args → RMARGS → GSP_ARGUMENTS_CACHED) - Status queue link + GSP_INIT_DONE emission - Command queue polling + RPC dispatch - SET_GUEST_SYSTEM_INFO version negotiation (VGX 41.12) - GET_GSP_STATIC_INFO(65) with 1656-byte GspStaticConfigInfo - GSP_RM_CONTROL(76) sub-command dispatch: - FIFO_GET_DEVICE_INFO_TABLE (0x20801112) - INTERNAL_INTR_GET_KERNEL_TABLE (0x20800a5c) - GPU_GET_CONSTRUCTED_FALCON_INFO (0x208001b0) - INTERNAL_GET_DEVICE_INFO_TABLE (0x20800a40) - kernel/gsp_rm_tu104.h: TU104 hardware tables - 12-entry FIFO engine table (GR0, CE0-4, NVDEC0-1, NVENC0, SEC2, NVJPG, SW) - 8-entry interrupt table (from intr_phys_tu102.c) - 1-entry constructed falcon table (FBFLCN) - 11-entry internal device info table - GspStaticConfigInfo layout (1656 bytes, ABI-verified offsets) - Data from NVIDIA driver material (ext-tree) + hwref/turing/tu104 - tools/rmq/: Userspace RM API client (oracle for ground-truth tables) KNOWN ISSUE: gsp_rm_send crashes (fortify_panic) on multi-element messages when reply data exceeds one 4096-byte queue element. Affects cmd 0x20800a41 (paramsSize=8204). Multi-element splitting is the next fix. --- kernel/gsp_emulation.h | 37 ++++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) (limited to 'kernel/gsp_emulation.h') diff --git a/kernel/gsp_emulation.h b/kernel/gsp_emulation.h index 53560e9..668d567 100644 --- a/kernel/gsp_emulation.h +++ b/kernel/gsp_emulation.h @@ -38,7 +38,27 @@ * physical GSP boot sequence is visible on the host (guest BAR0 access is * mmap-based and otherwise invisible). Offsets are BAR0-relative, GSP falcon * block at 0x110000. */ -#define GSP_EMU_FALCON_WATCH_COUNT 17 +#define GSP_EMU_FALCON_WATCH_COUNT 20 + +/* BAR0 shadow offsets used by the guest's physical GSP boot */ +#define GSP_EMU_REG_GSP_CPUCTL 0x110100 /* bit1 STARTCPU, bit4 HALTED */ +#define GSP_EMU_REG_GSP_ENGINE 0x1103c0 /* bit0 RESET */ +#define GSP_EMU_REG_GSP_MAILBOX0 0x110040 +#define GSP_EMU_REG_VBIOS_SCRATCH_0E 0x001438 /* FRTS err code (0=NONE) */ +#define GSP_EMU_REG_WPR2_ADDR_LO 0x1fa824 +#define GSP_EMU_REG_WPR2_ADDR_HI 0x1fa828 +#define GSP_EMU_REG_RISCV_STATUS 0x111240 /* bit0 ACTIVE (NV_PRISCV_RISCV + CORE_SWITCH_RISCV_STATUS=0x240 at + GSP riscvRegisterBase = + NV_FALCON2_GSP_BASE=0x111000) */ + +/* SEC2 falcon (Booter Load/Unload runs here, not on the GSP falcon) */ +#define GSP_EMU_REG_SEC2_CPUCTL 0x840100 +#define GSP_EMU_REG_SEC2_MAILBOX0 0x840040 +#define GSP_EMU_REG_SEC2_ENGINE 0x8403c0 + +#define GSP_EMU_CPUCTL_STARTCPU 0x2 +#define GSP_EMU_CPUCTL_HALTED 0x10 /* ============================================================ * GSP Emulation Context @@ -78,8 +98,23 @@ struct gsp_emu_context { u32 boot_stage; /* enum gsp_emu_boot_stage */ u32 flcn_kick_count; /* STARTCPU kicks seen since last ENGINE reset */ u32 wpr2_addr_lo; /* WPR2_ADDR_LO value to report after FWSEC */ + + /* GSP-RM msgq emulation (physical path, guest-sysmem queues) */ + struct gsp_rm_emu *rm_emu; }; +/* Shadow accessors shared with gsp_rm_emulation.c */ +static inline void gsp_emu_shadow_write32(struct gsp_emu_context *ctx, + u32 offset, u32 val) +{ + writel(val, ctx->bar0_vaddr + offset); +} + +static inline u32 gsp_emu_shadow_read32(struct gsp_emu_context *ctx, u32 offset) +{ + return readl(ctx->bar0_vaddr + offset); +} + /* ============================================================ * Public API * ============================================================ */ -- cgit v1.2.3