From d2524210912b934edab92e4412f6f7680ae048bb Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Sat, 7 Nov 2026 22:39:59 -0500 Subject: vgsp-disp: unconditional pushbuffer receipt log + NvBool valid fix Log every NV2080_CTRL_CMD_INTERNAL_DISPLAY_CHANNEL_PUSHBUFFER (0x20800a58) receipt with the decoded 56-byte params struct, and always log rejected channel registrations and SET_NOTIFIER_DMA - boot-only volume, settles whether the kernel RM ever programs the display push buffers through that control (r1621 follow-up). valid is an NvBool (1 byte); the previous u32 load could read the padding bytes and turn a PIO-channel valid=0 into a false positive. Raise the engine log budget to 4096. --- kernel/gsp_rm_emulation.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) (limited to 'kernel/gsp_rm_emulation.c') diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c index bb74767..3157a24 100644 --- a/kernel/gsp_rm_emulation.c +++ b/kernel/gsp_rm_emulation.c @@ -4401,11 +4401,28 @@ static void gsp_rm_handle_rm_control(struct gsp_emu_context *ctx, const u8 *pp = req_data + GSP_RM_CTRL_HDR_SIZE; u8 *rp = reply + GSP_RM_CTRL_HDR_SIZE; - if (req.paramsSize >= 52 && + /* + * The real struct (NV2080_CTRL_INTERNAL_DISPLAY_CHANNEL_ + * PUSHBUFFER_PARAMS) is 56 bytes: addressSpace@0, + * physicalAddr@8, limit@16, cacheSnoop@24, hclass@28, + * channelInstance@32, valid@36 (NvBool = 1 byte!), + * pbTargetAperture@40, channelPBSize@44, subDeviceId@48. + * Read valid as a byte: the 3 padding bytes after it are not + * guaranteed zero, so a u32 load can turn valid=0 (PIO + * cursor channel) into a false positive. + */ + pr_info("rm-ctl: display channel pushbuffer hObject=0x%x size=%u pa=0x%llx limit=0x%llx class=0x%x inst=%u valid=%u\n", + req.hObject, req.paramsSize, + req.paramsSize >= 24 ? *(const u64 *)(pp + 8) : 0, + req.paramsSize >= 24 ? *(const u64 *)(pp + 16) : 0, + req.paramsSize >= 32 ? *(const u32 *)(pp + 28) : 0, + req.paramsSize >= 36 ? *(const u32 *)(pp + 32) : 0, + req.paramsSize >= 37 ? pp[36] : 0); + if (req.paramsSize >= 40 && req.paramsSize + GSP_RM_CTRL_HDR_SIZE <= GSPRM_MAX_SINGLE_ELEM_DATA) { u32 address_space = 0, hclass = 0, instance = 0; - u32 valid = 0; + u8 valid = 0; u64 pa = 0, limit = 0; memcpy(&address_space, pp + 0, 4); @@ -4413,7 +4430,7 @@ static void gsp_rm_handle_rm_control(struct gsp_emu_context *ctx, memcpy(&limit, pp + 16, 8); memcpy(&hclass, pp + 28, 4); memcpy(&instance, pp + 32, 4); - memcpy(&valid, pp + 36, 4); + valid = pp[36]; memcpy(rp, pp, req.paramsSize); gsp_disp_engine_channel_add(ctx->vgpu, hclass, instance, pa, limit, address_space, -- cgit v1.2.3