linux-stable.git/drivers/gpu/nova-core, branch v7.0.10

gpu: nova-core: fix missing colon in SEC2 boot debug message

2026-05-23T11:08:53+00:00

[ Upstream commit a7a080bb4236ebe577b6776d940d1717912ff6dd ]

The SEC2 mailbox debug output formats MBOX1 without a colon separator,
producing "MBOX10xdead" instead of "MBOX1: 0xdead". The GSP debug
message a few lines above uses the correct format.

Fixes: 5949d419c193 ("gpu: nova-core: gsp: Boot GSP")
Signed-off-by: David Carlier 
Link: https://patch.msgid.link/20260331103744.605683-1-devnexen@gmail.com
Signed-off-by: Alexandre Courbot 
Signed-off-by: Sasha Levin

gpu: nova-core: remove redundant `.as_ref()` for `dev_*` print

2026-05-23T11:08:53+00:00

[ Upstream commit 8d1a65c2defdc4213a49008d0531bd35d26fdf35 ]

This is now handled by the macro itself.

Signed-off-by: Gary Guo 
Link: https://patch.msgid.link/20260123175854.176735-7-gary@kernel.org
Signed-off-by: Danilo Krummrich 
Stable-dep-of: a7a080bb4236 ("gpu: nova-core: fix missing colon in SEC2 boot debug message")
Signed-off-by: Sasha Levin

gpu: nova-core: bitfield: fix broken Default implementation

2026-05-23T11:08:53+00:00

[ Upstream commit de0aca13509bf47a2d49bc7a26d56079c758c95f ]

The current implementation does not actually set the default values for
the fields in the bitfield.

Fixes: 3fa145bef533 ("gpu: nova-core: register: generate correct `Default` implementation")
Signed-off-by: Eliot Courtney 
Link: https://patch.msgid.link/20260401-fix-bitfield-v2-1-2fa68c98114a@nvidia.com
Signed-off-by: Danilo Krummrich 
Signed-off-by: Sasha Levin

gpu: nova-core: firmware: fix and explain v2 header offsets computations

2026-05-23T11:08:44+00:00

[ Upstream commit 17d7c97f73c7a0bd90bd22cd7441269a6f8a1d72 ]

There are no offsets in `FalconUCodeDescV2` to give the non-secure and
secure IMEM sections start offsets relative to the beginning of the
firmware object.

The start offsets for both sections were set to `0`, but that is
obviously incorrect since two different sections cannot start at the
same offset. Since these offsets were not used by the bootloader, this
doesn't prevent proper function but is incorrect nonetheless.

Fix this by computing the start of the secure IMEM section relatively to
the start of the firmware object and setting it properly. Also add and
improve comments to explain how the values are obtained.

Fixes: dbfb5aa41f16 ("gpu: nova-core: add FalconUCodeDescV2 support")
Reviewed-by: Eliot Courtney 
Link: https://patch.msgid.link/20260306-turing_prep-v11-9-8f0042c5d026@nvidia.com
Signed-off-by: Alexandre Courbot 
Signed-off-by: Sasha Levin

gpu: nova-core: falcon: rename load parameters to reflect DMA dependency

2026-05-23T11:08:44+00:00

[ Upstream commit 8a623869b8269dbf52d52711cd7b9355044b6b53 ]

The current `FalconLoadParams` and `FalconLoadTarget` types are fit for
DMA loading, but not so much for PIO loading which will require its own
types. Start by renaming them to something that indicates that they are
indeed DMA-related.

Reviewed-by: Eliot Courtney 
Acked-by: Danilo Krummrich 
Link: https://patch.msgid.link/20260306-turing_prep-v11-3-8f0042c5d026@nvidia.com
[acourbot@nvidia.com: fixup order of import items.]
Signed-off-by: Alexandre Courbot 
Stable-dep-of: 17d7c97f73c7 ("gpu: nova-core: firmware: fix and explain v2 header offsets computations")
Signed-off-by: Sasha Levin

gpu: nova-core: create falcon firmware DMA objects lazily

2026-05-23T11:08:44+00:00

[ Upstream commit bc9de9e1af2f05461460e1b215a6d209ee62d65a ]

When DMA was the only loading option for falcon firmwares, we decided to
store them in DMA objects as soon as they were loaded from disk and
patch them in-place to avoid having to do an extra copy.

This decision complicates the PIO loading patch considerably, and
actually does not even stand on its own when put into perspective with
the fact that it requires 8 unsafe statements in the code that wouldn't
exist if we stored the firmware into a `KVVec` and copied it into a DMA
object at the last minute.

The cost of the copy is, as can be expected, imperceptible at runtime.
Thus, switch to a lazy DMA object creation model and simplify our code
a bit. This will also have the nice side-effect of being more fit for
PIO loading.

Reviewed-by: Eliot Courtney 
Acked-by: Danilo Krummrich 
Link: https://patch.msgid.link/20260306-turing_prep-v11-1-8f0042c5d026@nvidia.com
[acourbot@nvidia.com: add TODO item to switch back to a coherent
allocation when it becomes convenient to do so.]
Signed-off-by: Alexandre Courbot 
Stable-dep-of: 17d7c97f73c7 ("gpu: nova-core: firmware: fix and explain v2 header offsets computations")
Signed-off-by: Sasha Levin

gpu: nova-core: use checked arithmetic in FWSEC firmware parsing

2026-05-23T11:08:44+00:00

[ Upstream commit 0568b376a0b13da6582bce1f2e2bbb2eae7fc266 ]

Use checked_add() and checked_mul() when computing offsets from

firmware-provided values in new_fwsec().
Without checked arithmetic, corrupt firmware could cause integer
overflow. The danger is not just wrapping to a huge value, but
potentially wrapping to a small plausible offset that passes validation
yet accesses entirely wrong data, causing silent corruption or security
issues.

Reviewed-by: Zhi Wang 
Signed-off-by: Joel Fernandes 
Reviewed-by: Gary Guo 
Link: https://patch.msgid.link/20260126202305.2526618-2-joelagnelf@nvidia.com
[acourbot@nvidia.com: rewrap commit message to make checkpatch happy.]
[acourbot@nvidia.com: add missing empty lines after new code blocks.]
[acourbot@nvidia.com: move SAFETY comments to the unsafe statement they
 describe.]
[acourbot@nvidia.com: remove obvious computation comments and use
`CALC:` for the remaining ones.]
Signed-off-by: Alexandre Courbot 
Stable-dep-of: 17d7c97f73c7 ("gpu: nova-core: firmware: fix and explain v2 header offsets computations")
Signed-off-by: Sasha Levin

gpu: nova-core: gsp: fix improper handling of empty slot in cmdq

2026-05-23T11:08:42+00:00

[ Upstream commit f64caf673cb5add9ac2065609a52049e2317c498 ]

The current code hands out buffers that go all the way up to and
including `rx - 1`, but we need to maintain an empty slot to prevent the
ring buffer from wrapping around into having 'tx == rx', which means
empty.

Also add more rigorous no-panic proofs.

Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling")
Signed-off-by: Eliot Courtney 
Reviewed-by: Gary Guo 
Link: https://patch.msgid.link/20260129-nova-core-cmdq1-v3-4-2ede85493a27@nvidia.com
Signed-off-by: Alexandre Courbot 
Signed-off-by: Sasha Levin

gpu: nova-core: gsp: use empty slices instead of [0..0] ranges

2026-05-23T11:08:42+00:00

[ Upstream commit f6f072d8ef06ff5d29a6bb1bade3da29a1aafeec ]

The current code unnecessarily uses, for example, &before_rx[0..0] to
return an empty slice. Instead, just use an empty slice.

Signed-off-by: Eliot Courtney 
Reviewed-by: Gary Guo 
Link: https://patch.msgid.link/20260129-nova-core-cmdq1-v3-3-2ede85493a27@nvidia.com
Signed-off-by: Alexandre Courbot 
Stable-dep-of: f64caf673cb5 ("gpu: nova-core: gsp: fix improper handling of empty slot in cmdq")
Signed-off-by: Sasha Levin

gpu: nova-core: gsp: fix UB in DmaGspMem pointer accessors

2026-03-11T15:24:15+00:00

The DmaGspMem pointer accessor methods (gsp_write_ptr, gsp_read_ptr,
cpu_read_ptr, cpu_write_ptr, advance_cpu_read_ptr,
advance_cpu_write_ptr) dereference a raw pointer to DMA memory, creating
an intermediate reference before calling volatile read/write methods.

This is undefined behavior since DMA memory can be concurrently modified
by the device.

Fix this by moving the implementations into a gsp_mem module in fw.rs
that uses the dma_read!() / dma_write!() macros, making the original
methods on DmaGspMem thin forwarding wrappers.

An alternative approach would have been to wrap the shared memory in
Opaque, but that would have required even more unsafe code.

Since the gsp_mem module lives in fw.rs (to access firmware-specific
binding field names), GspMem, Msgq and their relevant fields are
temporarily widened to pub(super). This will be reverted once IoView
projections are available.

Cc: Gary Guo 
Closes: https://lore.kernel.org/nouveau/DGUT14ILG35P.1UMNRKU93JUM1@kernel.org/
Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling")
Reviewed-by: Alexandre Courbot 
Link: https://patch.msgid.link/20260309225408.27714-1-dakr@kernel.org
[ Use pub(super) where possible; replace bitwise-and with modulo
  operator analogous to [1]. - Danilo ]
Link: https://lore.kernel.org/all/20260129-nova-core-cmdq1-v3-1-2ede85493a27@nvidia.com/ [1]
Signed-off-by: Danilo Krummrich