From 7c7d4c15a09556ff79c19c8d4890f25af43e531d Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Sun, 8 Nov 2026 05:57:26 -0500 Subject: vgsp-disp: resolve the notifier via the announced display instance memory The guest announces the display instance-memory block (8 KB context-DMA hash table + entries, vidmem PA 0x1fff0000 on r1627) via NV2080_CTRL_CMD_INTERNAL_DISPLAY_WRITE_INST_MEM (0x20800a49), but the engine ignored it and scanned its FB shadow blindly, never finding the hash entry - so SET_NOTIFIER_DMA handle 0x10013 resolved to pa=0 and UPDATE never wrote FINISHED (r1627: UPDATE armed=1 notifier=0x0/0). Handle 0xa49, record pa/size/address space per guest, read the block through the FB shadow (or guest RAM for sysmem), and parse the hash table from the announced location with bounded diagnostics. --- kernel/gsp_rm_emulation.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) (limited to 'kernel/gsp_rm_emulation.c') diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c index b05ee3d..c1b98f3 100644 --- a/kernel/gsp_rm_emulation.c +++ b/kernel/gsp_rm_emulation.c @@ -4453,6 +4453,43 @@ static void gsp_rm_handle_rm_control(struct gsp_emu_context *ctx, break; } + case TU104_CTRL_INTERNAL_DISPLAY_WRITE_INST_MEM: { + /* + * The kernel RM announces the display instance-memory block + * (8 KB context-DMA hash table + context-DMA entries) and + * its location. The host engine resolves the notifier + * context-DMA handle carried by SET_NOTIFIER_DMA through + * this block; without it the notifier PA stays unknown and + * the UPDATE FINISHED word is never written (r1627: UPDATE + * armed=1 handle=0x10013 -> pa=0x0). + * + * Params: instMemPhysAddr@0 (u64), instMemSize@8 (u64), + * instMemAddrSpace@16 (u32), instMemCpuCacheAttr@20 (u32). + */ + const u8 *pp = req_data + GSP_RM_CTRL_HDR_SIZE; + u8 *rp = reply + GSP_RM_CTRL_HDR_SIZE; + + pr_info("rm-ctl: display write inst mem size=%u pa=0x%llx space=%u\n", + req.paramsSize, + req.paramsSize >= 16 ? *(const u64 *)(pp + 0) : 0, + req.paramsSize >= 24 ? *(const u32 *)(pp + 16) : 0); + if (req.paramsSize >= 24 && + req.paramsSize + GSP_RM_CTRL_HDR_SIZE <= + GSPRM_MAX_SINGLE_ELEM_DATA) { + u64 pa = 0, size = 0; + u32 space = 0; + + memcpy(&pa, pp + 0, 8); + memcpy(&size, pp + 8, 8); + memcpy(&space, pp + 16, 4); + memcpy(rp, pp, req.paramsSize); + gsp_disp_engine_inst_mem(ctx->vgpu, pa, size, space); + } + out_status = 0; + out_params_size = req.paramsSize; + break; + } + case 0x801707: /* NV0080_CTRL_CMD_FIFO_GET_ENGINE_CONTEXT_PROPERTIES */ gsp_rm_handle_fifo_engine_ctx_props(ctx, req_data + GSP_RM_CTRL_HDR_SIZE, req.paramsSize, -- cgit v1.2.3