From a7bda851fc7938555eaaf69b062f49efb9d90ece Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Tue, 22 Sep 2026 10:59:59 -0400 Subject: PRAMIN window translation + queue state preservation on Booter-unload Fixes the BAR2 verify test failure (kbusVerifyBar2_GM107): - GSP emulation thread now watches NV_PBUS_BAR0_WINDOW (BAR0+0x1700) for base/target changes and syncs the PRAMIN window (BAR0+0x700000) from the emulated BAR1 (vidmem) at (base << 16). This makes PRAMIN reads return correct vidmem content for the BAR2 verify test. Fixes the fn-10 FREE timeout during driver cleanup: - gsp_emu_clear_boot_state no longer resets the GSP-RM queue state on Booter-unload kick. The driver sends cleanup FREEs AFTER the Booter-unload kick; resetting the queue here caused those frees to time out. - Queue state is now only reset on: ENGINE reset (full GPU reset) or genuine queue death (insane writePtr). Both call gsp_rm_emu_reset explicitly. Also fixes rmq tool ioctl encoding: - Use _IOWR('F', nr, type) encoding for NVIDIA ioctls (was raw numbers) - Open /dev/nvidiactl (not /dev/nvidia0) for RM_ALLOC - Add NVOS64_PARAMETERS (48 bytes) for device/subdevice allocs Verified: BAR2 verify test passes, INSTLOC regkey read, driver probes past RmInitNvDevice bus init, reaches fn-10 FREE timeout during cleanup (same as handoff's characterized blocker). --- tools/rmq/rmq.c | 57 ++++++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 46 insertions(+), 11 deletions(-) (limited to 'tools') diff --git a/tools/rmq/rmq.c b/tools/rmq/rmq.c index 97d1bed..189d647 100644 --- a/tools/rmq/rmq.c +++ b/tools/rmq/rmq.c @@ -15,11 +15,15 @@ typedef uint32_t NvHandle; typedef uint32_t NvV32; typedef uint64_t NvP64; -#define NV_ESC_RM_ALLOC 0x2B -#define NV_ESC_RM_CONTROL 0x2A -#define NV01_ROOT 0x0 -#define NV01_DEVICE_0 0x80 -#define NV20_SUBDEVICE_0 0x2080 +/* NVIDIA ioctl encoding: _IOWR('F', nr, type) */ +#define NV_IOCTL_MAGIC 'F' +#define NV_IOCTL_BASE 200 +#define NV_ESC_RM_ALLOC 0x2B +#define NV_ESC_RM_CONTROL 0x2A + +#define NV01_ROOT 0x0 +#define NV01_DEVICE_0 0x80 +#define NV20_SUBDEVICE_0 0x2080 typedef struct { NvHandle hRoot; @@ -41,24 +45,54 @@ typedef struct { NvV32 status; } NVOS54_PARAMETERS; +#define NV_IOCTL_RM_ALLOC _IOWR(NV_IOCTL_MAGIC, NV_ESC_RM_ALLOC, NVOS21_PARAMETERS) +#define NV_IOCTL_RM_CONTROL _IOWR(NV_IOCTL_MAGIC, NV_ESC_RM_CONTROL, NVOS54_PARAMETERS) + static int fd; +/* NVOS64: 48 bytes (0x30), used for device/subdevice allocs (with rights) */ +typedef struct { + NvHandle hRoot; + NvHandle hObjectParent; + NvHandle hObjectNew; + NvV32 hClass; + NvP64 pAllocParms __attribute__((aligned(8))); + NvP64 pRightsRequested __attribute__((aligned(8))); + NvU32 paramsSize; + NvU32 flags; + NvV32 status; +} NVOS64_PARAMETERS; + +#define NV_IOCTL_RM_ALLOC64 _IOWR(NV_IOCTL_MAGIC, NV_ESC_RM_ALLOC, NVOS64_PARAMETERS) + static NvU32 rm_alloc(NvHandle hRoot, NvHandle hParent, NvU32 hClass, NvHandle *pOut) { NVOS21_PARAMETERS p = {0}; p.hRoot = hRoot; p.hObjectParent = hParent; p.hClass = hClass; - if (ioctl(fd, NV_ESC_RM_ALLOC, &p) < 0) { perror("alloc ioctl"); return 1; } + if (ioctl(fd, NV_IOCTL_RM_ALLOC, &p) < 0) { perror("alloc ioctl"); return 1; } if (p.status) { fprintf(stderr, "alloc class 0x%x failed: 0x%x\n", hClass, p.status); return p.status; } *pOut = p.hObjectNew; return 0; } +/* Device/subdevice allocs use NVOS64 (48 bytes) with rights */ +static NvU32 rm_alloc64(NvHandle hRoot, NvHandle hParent, NvU32 hClass, NvHandle *pOut) +{ + NVOS64_PARAMETERS p = {0}; + p.hRoot = hRoot; p.hObjectParent = hParent; p.hClass = hClass; + p.flags = 1; /* FINN_SERIALIZED */ + if (ioctl(fd, NV_IOCTL_RM_ALLOC64, &p) < 0) { perror("alloc64 ioctl"); return 1; } + if (p.status) { fprintf(stderr, "alloc64 class 0x%x failed: 0x%x\n", hClass, p.status); return p.status; } + *pOut = p.hObjectNew; + return 0; +} + static NvU32 rm_control(NvHandle hClient, NvHandle hObject, NvU32 cmd, void *params, NvU32 size) { NVOS54_PARAMETERS p = {0}; p.hClient = hClient; p.hObject = hObject; p.cmd = cmd; p.params = (NvP64)params; p.paramsSize = size; - if (ioctl(fd, NV_ESC_RM_CONTROL, &p) < 0) { perror("control ioctl"); return 1; } + if (ioctl(fd, NV_IOCTL_RM_CONTROL, &p) < 0) { perror("control ioctl"); return 1; } return p.status; } @@ -93,12 +127,13 @@ int main(int argc, char **argv) NvHandle hClient = 0, hDevice = 0, hSubdevice = 0; NvU32 st; - fd = open("/dev/nvidia0", O_RDWR); - if (fd < 0) { perror("open /dev/nvidia0"); return 1; } + /* RM_ALLOC creates clients on /dev/nvidiactl, not /dev/nvidia0 */ + fd = open("/dev/nvidiactl", O_RDWR); + if (fd < 0) { perror("open /dev/nvidiactl"); return 1; } if ((st = rm_alloc(0, 0, NV01_ROOT, &hClient))) return 1; - if ((st = rm_alloc(hClient, hClient, NV01_DEVICE_0, &hDevice))) return 1; - if ((st = rm_alloc(hClient, hDevice, NV20_SUBDEVICE_0, &hSubdevice))) return 1; + if ((st = rm_alloc64(hClient, hClient, NV01_DEVICE_0, &hDevice))) return 1; + if ((st = rm_alloc64(hClient, hDevice, NV20_SUBDEVICE_0, &hSubdevice))) return 1; printf("hClient=0x%x hDevice=0x%x hSubdevice=0x%x\n", hClient, hDevice, hSubdevice); /* FIFO_GET_DEVICE_INFO_TABLE (0x20801112) */ -- cgit v1.2.3