From 9cd0da4672ed9338a8466a2dda3aa88105984fdb Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Thu, 1 Oct 2026 11:22:34 -0400 Subject: gsp-phys: accept the real GSP-RM sequencer buffer size in stage 3e The live 0x1002 element carries bufferSizeDWord=0x3FE2 (16354) - the size of GSP-RM's own command buffer, not the message. The executor's 0x1000 sanity cap refused it, so the sequencer was never run and GSP_INIT_DONE was never observed. The reference imposes no upper bound (only nonzero and greater than cmdIndex); raise the cap to a sanity ceiling and document that the real execution bound is cmdIndex against the element payload. --- kernel/gsp_phys_booter.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'kernel') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index 6eb83cb..7966bc8 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -212,8 +212,14 @@ bool gsp_phys_boot_requested(void) * by the command buffer (opcode dword + opcode-specific payload dwords). All * bounds and delays are hard-capped so a malformed element can never drive an * unbounded access. + * + * bufferSizeDWord is the size of GSP-RM's own sequencer buffer, not the + * message: the reference only requires it to be nonzero and greater than + * cmdIndex, and live GSP-RM reports 0x3FE2 (16354) on this TU104. The cap is + * therefore a sanity ceiling, not a protocol limit; the real execution bound + * is cmdIndex against the element payload length. */ -#define GSP_PHYS_SEQ_MAX_BUFFER_DWORDS 0x1000 +#define GSP_PHYS_SEQ_MAX_BUFFER_DWORDS 0x40000 #define GSP_PHYS_SEQ_REG_SAVE_SIZE 8 #define GSP_PHYS_SEQ_HALT_TIMEOUT_MS 5000 #define GSP_PHYS_SEQ_RESUME_TIMEOUT_MS 10000 -- cgit v1.2.3