From 6b686f70d8ff3e6340e8307c95847cd1eed4f2ae Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 21 Sep 2026 19:04:05 -0400 Subject: kernel: Fix FIFO table fortify_panic + GSP boot-state reset on queue death + ISO fbRegion - gsp_rm_handle_fifo_device_table: read baseIndex from the queue element buffer (req_data + hdr), not past the local 24-byte header struct - FORTIFY proved the old memcpy always overflows -> fortify_panic killed gsp_emu_0 mid RmInitNvDevice (guest timed out on fn 76). - gsp_emu_clear_boot_state: clear WPR2/RISCV/mailboxes/stage tracker and reset GSP-RM queue state. Turing guests produce no observable BAR0 writes on unload, so the next probe's _kgspBootGspRm failed with 'unexpected WPR2 already up'. Trigger on ENGINE reset and on detected queue death (insane writePtr jump / garbage element signature). - GspStaticConfigInfo fbRegion[0].supportISO=1: memmgrCalcReservedFbSpace asserts some region supports ISO 'even with no display'; without it kdispStateInitLocked couldn't allocate clientChannelTable. - .gitignore: scripts/git-push-vgpu.sh (local per-machine helper) --- kernel/gsp_emulation.h | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'kernel/gsp_emulation.h') diff --git a/kernel/gsp_emulation.h b/kernel/gsp_emulation.h index 668d567..fe4186e 100644 --- a/kernel/gsp_emulation.h +++ b/kernel/gsp_emulation.h @@ -44,6 +44,7 @@ #define GSP_EMU_REG_GSP_CPUCTL 0x110100 /* bit1 STARTCPU, bit4 HALTED */ #define GSP_EMU_REG_GSP_ENGINE 0x1103c0 /* bit0 RESET */ #define GSP_EMU_REG_GSP_MAILBOX0 0x110040 +#define GSP_EMU_REG_GSP_MAILBOX1 0x110044 #define GSP_EMU_REG_VBIOS_SCRATCH_0E 0x001438 /* FRTS err code (0=NONE) */ #define GSP_EMU_REG_WPR2_ADDR_LO 0x1fa824 #define GSP_EMU_REG_WPR2_ADDR_HI 0x1fa828 @@ -121,6 +122,10 @@ static inline u32 gsp_emu_shadow_read32(struct gsp_emu_context *ctx, u32 offset) int gsp_emu_init(struct nv_vgpu_device *vgpu); void gsp_emu_cleanup(struct nv_vgpu_device *vgpu); + +/* Clear emulated GSP boot state (WPR2/RISCV/stages/RM queues) on + * ENGINE reset or detected GSP death (stale msgq). */ +void gsp_emu_clear_boot_state(struct gsp_emu_context *ctx, const char *reason); int gsp_emu_process_rpc(struct gsp_emu_context *ctx); void gsp_emu_inject_completion_interrupt(struct gsp_emu_context *ctx, u32 seq_id); -- cgit v1.2.3