555.52.04

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## Release 555 Entries
 
+### [555.52.04] 2024-06-05
+
 ### [555.42.02] 2024-05-21
 
 ## Release 550 Entries

README.md

@@ -1,7 +1,7 @@
 # NVIDIA Linux Open GPU Kernel Module Source
 
 This is the source release of the NVIDIA Linux open GPU kernel modules,
-version 555.42.02.
+version 555.52.04.
 
 
 ## How to Build
@@ -17,7 +17,7 @@ as root:
 
 Note that the kernel modules built here must be used with GSP
 firmware and user-space NVIDIA GPU driver components from a corresponding
-555.42.02 driver release.  This can be achieved by installing
+555.52.04 driver release.  This can be achieved by installing
 the NVIDIA GPU driver from the .run file using the `--no-kernel-modules`
 option.  E.g.,
 
@@ -188,7 +188,7 @@ encountered specific to them.
 For details on feature support and limitations, see the NVIDIA GPU driver
 end user README here:
 
-https://us.download.nvidia.com/XFree86/Linux-x86_64/555.42.02/README/kernel_open.html
+https://us.download.nvidia.com/XFree86/Linux-x86_64/555.52.04/README/kernel_open.html
 
 For vGPU support, please refer to the README.vgpu packaged in the vGPU Host
 Package for more details.
@@ -757,6 +757,8 @@ Subsystem Device ID.
 | NVIDIA H100 80GB HBM3                           | 2330 10DE 16C0 |
 | NVIDIA H100 80GB HBM3                           | 2330 10DE 16C1 |
 | NVIDIA H100 PCIe                                | 2331 10DE 1626 |
+| NVIDIA H200                                     | 2335 10DE 18BE |
+| NVIDIA H200                                     | 2335 10DE 18BF |
 | NVIDIA H100                                     | 2339 10DE 17FC |
 | NVIDIA H800 NVL                                 | 233A 10DE 183A |
 | NVIDIA GH200 120GB                              | 2342 10DE 16EB |
@@ -874,6 +876,7 @@ Subsystem Device ID.
 | NVIDIA L40S                                     | 26B9 10DE 1851 |
 | NVIDIA L40S                                     | 26B9 10DE 18CF |
 | NVIDIA L20                                      | 26BA 10DE 1957 |
+| NVIDIA L20                                      | 26BA 10DE 1990 |
 | NVIDIA GeForce RTX 4080 SUPER                   | 2702           |
 | NVIDIA GeForce RTX 4080                         | 2704           |
 | NVIDIA GeForce RTX 4070 Ti SUPER                | 2705           |

kernel-open/Kbuild

@@ -72,7 +72,7 @@ EXTRA_CFLAGS += -I$(src)/common/inc
 EXTRA_CFLAGS += -I$(src)
 EXTRA_CFLAGS += -Wall $(DEFINES) $(INCLUDES) -Wno-cast-qual -Wno-format-extra-args
 EXTRA_CFLAGS += -D__KERNEL__ -DMODULE -DNVRM
-EXTRA_CFLAGS += -DNV_VERSION_STRING=\"555.42.02\"
+EXTRA_CFLAGS += -DNV_VERSION_STRING=\"555.52.04\"
 
 ifneq ($(SYSSRCHOST1X),)
  EXTRA_CFLAGS += -I$(SYSSRCHOST1X)

kernel-open/conftest.sh

@@ -5252,25 +5252,23 @@ compile_test() {
             compile_check_conftest "$CODE" "NV_PCI_CLASS_MULTIMEDIA_HD_AUDIO_PRESENT" "" "generic"
         ;;
 
-        unsafe_follow_pfn)
+        follow_pfn)
             #
-            # Determine if unsafe_follow_pfn() is present.
+            # Determine if follow_pfn() is present.
             #
-            # unsafe_follow_pfn() was added by commit 69bacee7f9ad
+            # follow_pfn() was added by commit 3b6748e2dd69
-            # ("mm: Add unsafe_follow_pfn") in v5.13-rc1.
+            # ("mm: introduce follow_pfn()") in v2.6.31-rc1, and removed
-            #
+            # by commit 233eb0bf3b94 ("mm: remove follow_pfn")
-            # Note: this commit never made it to the linux kernel, so
+            # from linux-next 233eb0bf3b94.
-            # unsafe_follow_pfn() never existed.
             #
             CODE="
             #include <linux/mm.h>
-            void conftest_unsafe_follow_pfn(void) {
+            void conftest_follow_pfn(void) {
-                unsafe_follow_pfn();
+                follow_pfn();
             }"
 
-            compile_check_conftest "$CODE" "NV_UNSAFE_FOLLOW_PFN_PRESENT" "" "functions"
+            compile_check_conftest "$CODE" "NV_FOLLOW_PFN_PRESENT" "" "functions"
         ;;
-
         drm_plane_atomic_check_has_atomic_state_arg)
             #
             # Determine if drm_plane_helper_funcs::atomic_check takes 'state'

kernel-open/nvidia/nvidia.Kbuild

@@ -161,7 +161,7 @@ NV_CONFTEST_FUNCTION_COMPILE_TESTS += pci_enable_atomic_ops_to_root
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += vga_tryget
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += cc_platform_has
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += seq_read_iter
-NV_CONFTEST_FUNCTION_COMPILE_TESTS += unsafe_follow_pfn
+NV_CONFTEST_FUNCTION_COMPILE_TESTS += follow_pfn
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += drm_gem_object_get
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += drm_gem_object_put_unlocked
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += add_memory_driver_managed
@@ -231,6 +231,7 @@ NV_CONFTEST_SYMBOL_COMPILE_TESTS += is_export_symbol_present_memory_block_size_b
 NV_CONFTEST_SYMBOL_COMPILE_TESTS += is_export_symbol_present_tegra_platform_is_fpga
 NV_CONFTEST_SYMBOL_COMPILE_TESTS += is_export_symbol_present_tegra_platform_is_sim
 NV_CONFTEST_SYMBOL_COMPILE_TESTS += crypto
+NV_CONFTEST_SYMBOL_COMPILE_TESTS += is_export_symbol_present_follow_pte
 
 NV_CONFTEST_TYPE_COMPILE_TESTS += dma_ops
 NV_CONFTEST_TYPE_COMPILE_TESTS += swiotlb_dma_ops

kernel-open/nvidia/os-mlock.c

@@ -36,10 +36,28 @@ static inline int nv_follow_pfn(struct vm_area_struct *vma,
                                 unsigned long address,
                                 unsigned long *pfn)
 {
-#if defined(NV_UNSAFE_FOLLOW_PFN_PRESENT)
+#if defined(NV_FOLLOW_PFN_PRESENT)
-    return unsafe_follow_pfn(vma, address, pfn);
-#else
     return follow_pfn(vma, address, pfn);
+#else
+#if NV_IS_EXPORT_SYMBOL_PRESENT_follow_pte
+    int status = 0;
+    spinlock_t *ptl;
+    pte_t *ptep;
+
+    if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)))
+        return status;
+
+    status = follow_pte(vma, address, &ptep, &ptl);
+    if (status)
+        return status;
+    *pfn = pte_pfn(ptep_get(ptep));
+
+    // The lock is acquired inside follow_pte()
+    pte_unmap_unlock(ptep, ptl);
+    return 0;
+#else // NV_IS_EXPORT_SYMBOL_PRESENT_follow_pte
+    return -1;
+#endif // NV_IS_EXPORT_SYMBOL_PRESENT_follow_pte
 #endif
 }
 

src/common/displayport/inc/dp_configcaps.h

@@ -246,7 +246,7 @@ namespace DisplayPort
         virtual bool             getOuiSupported() = 0;
         virtual AuxRetry::status setOuiSource(unsigned ouiId, const char * model, size_t modelNameLength, NvU8 chipRevision) = 0;
         virtual bool             getOuiSource(unsigned &ouiId, char * modelName, size_t modelNameBufferSize, NvU8 & chipRevision) = 0;
-        virtual bool             getOuiSink(unsigned &ouiId, char * modelName, size_t modelNameBufferSize, NvU8 & chipRevision) = 0;
+        virtual bool             getOuiSink(unsigned &ouiId, unsigned char * modelName, size_t modelNameBufferSize, NvU8 & chipRevision) = 0;
     };
 
     class HDCP
@@ -898,7 +898,7 @@ namespace DisplayPort
                                               size_t modelNameLength, NvU8 chipRevision);
         virtual bool getOuiSource(unsigned &ouiId, char * modelName,
                                   size_t modelNameBufferSize, NvU8 & chipRevision);
-        virtual bool getOuiSink(unsigned &ouiId, char * modelName,
+        virtual bool getOuiSink(unsigned &ouiId, unsigned char * modelName,
                                 size_t modelNameBufferSize, NvU8 & chipRevision);
 
         // DPCD offset 21h

src/common/displayport/inc/dp_connector.h

@@ -701,7 +701,7 @@ namespace DisplayPort
 
         virtual bool getHDCPAbortCodesDP12(NvU32 &hdcpAbortCodesDP12) = 0;
 
-        virtual bool getOuiSink(unsigned &ouiId, char * modelName,
+        virtual bool getOuiSink(unsigned &ouiId, unsigned char * modelName,
                                 size_t modelNameBufferSize, NvU8 & chipRevision) = 0;
 
         virtual bool getIgnoreSourceOuiHandshake() = 0;

src/common/displayport/inc/dp_connectorimpl.h

@@ -106,7 +106,7 @@ namespace DisplayPort
         bool     bOuiCached;
 
         unsigned ouiId;                                              // Sink ouiId
-        char modelName[NV_DPCD_SOURCE_DEV_ID_STRING__SIZE + 1];     // Device Model-name
+        unsigned char modelName[NV_DPCD_SOURCE_DEV_ID_STRING__SIZE + 1];  // Device Model-name
         bool    bIgnoreSrcOuiHandshake;                              // Skip writing source OUI
 
         LinkPolicy    linkPolicy;
@@ -316,6 +316,7 @@ namespace DisplayPort
         bool        bDisableSSC;
         bool        bEnableFastLT;
         NvU32       maxLinkRateFromRegkey;
+        bool        bFlushTimeslotWhenDirty;
 
         //
         // Latency(ms) to apply between link-train and FEC enable for bug
@@ -644,7 +645,7 @@ namespace DisplayPort
         void freeTimeslice(GroupImpl * targetGroup);
         void flushTimeslotsToHardware();
         bool getHDCPAbortCodesDP12(NvU32 &hdcpAbortCodesDP12);
-        bool getOuiSink(unsigned &ouiId, char * modelName, size_t modelNameBufferSize, NvU8 & chipRevision);
+        bool getOuiSink(unsigned &ouiId, unsigned char * modelName, size_t modelNameBufferSize, NvU8 & chipRevision);
         bool hdcpValidateKsv(const NvU8 *ksv, NvU32 Size);
         void cancelHdcpCallbacks();
         bool handleCPIRQ();

src/common/displayport/inc/dp_regkeydatabase.h

@@ -73,14 +73,14 @@
 //
 #define NV_DP_DSC_MST_CAP_BUG_3143315                  "DP_DSC_MST_CAP_BUG_3143315"
 
-//
+
 // Bug 4388987 : This regkey will disable reading PCON caps for MST.
-//
 #define NV_DP_REGKEY_MST_PCON_CAPS_READ_DISABLED       "DP_BUG_4388987_WAR"
 
-//
+// Bug 4426624: Flush timeslot change to HW when dirty bit is set.
+#define NV_DP_REGKEY_FLUSH_TIMESLOT_INFO_WHEN_DIRTY    "DP_BUG_4426624_WAR"
+
 // Bug 4459839 : This regkey will enable DSC irrespective of LT status.
-//
 #define NV_DP_REGKEY_FORCE_DSC_ON_SINK                 "DP_FORCE_DSC_ON_SINK"
 #define NV_DP_REGKEY_ENABLE_SKIP_DPCD_READS_WAR        "DP_BUG_4478047_WAR"
 #define NV_DP_REGKEY_DISABLE_TUNNEL_BW_ALLOCATION      "DP_DISABLE_TUNNEL_BW_ALLOCATION"
@@ -120,6 +120,7 @@ struct DP_REGKEY_DATABASE
     bool  bMSTPCONCapsReadDisabled;
     bool  bForceDscOnSink;
     bool  bSkipFakeDeviceDpcdAccess;
+    bool  bFlushTimeslotWhenDirty;
     bool  bForceDisableTunnelBwAllocation;
 };
 

src/common/displayport/src/dp_configcaps.cpp

@@ -671,7 +671,7 @@ bool DPCDHALImpl::getOuiSource(unsigned &ouiId, char * modelName,
 bool DPCDHALImpl::getOuiSink
 (
     unsigned &ouiId,
-    char * modelName,
+    unsigned char * modelName,
     size_t modelNameBufferSize,
     NvU8 & chipRevision
 )
@@ -712,7 +712,7 @@ bool DPCDHALImpl::getOuiSink
     // Next 6 bytes are Device Identification String, copy as much as we can (limited buffer case).
     unsigned int i;
     for (i = 0; i < modelNameBufferSize; i++)
-        modelName[i] = ouiBuffer[3+i];
+        modelName[i] = (unsigned char)ouiBuffer[3+i];
 
     chipRevision = ouiBuffer[9];
 

src/common/displayport/src/dp_connectorimpl.cpp

@@ -179,6 +179,7 @@ void ConnectorImpl::applyRegkeyOverrides(const DP_REGKEY_DATABASE& dpRegkeyDatab
     this->bReassessMaxLink                 = dpRegkeyDatabase.bReassessMaxLink;
     this->bForceDisableTunnelBwAllocation  = dpRegkeyDatabase.bForceDisableTunnelBwAllocation;
     this->bSkipFakeDeviceDpcdAccess        = dpRegkeyDatabase.bSkipFakeDeviceDpcdAccess;
+    this->bFlushTimeslotWhenDirty          = dpRegkeyDatabase.bFlushTimeslotWhenDirty;
 }
 
 void ConnectorImpl::setPolicyModesetOrderMitigation(bool enabled)
@@ -3689,7 +3690,7 @@ bool ConnectorImpl::assessPCONLinkCapability(PCONLinkControl *pConControl)
     return true;
 }
 
-bool ConnectorImpl::getOuiSink(unsigned &ouiId, char * modelName, size_t modelNameBufferSize, NvU8 & chipRevision)
+bool ConnectorImpl::getOuiSink(unsigned &ouiId, unsigned char * modelName, size_t modelNameBufferSize, NvU8 & chipRevision)
 {
     if (!previousPlugged || !hal->getOuiSupported())
         return false;
@@ -5838,7 +5839,8 @@ void ConnectorImpl::beforeDeleteStream(GroupImpl * group, bool forFlushMode)
         }
     }
 
-    if (linkUseMultistream() && group && group->isHeadAttached() && group->timeslot.count)
+    if (linkUseMultistream() && group && group->isHeadAttached() &&
+        (group->timeslot.count || (this->bFlushTimeslotWhenDirty && group->timeslot.hardwareDirty)))
     {
         // Detach all the panels from payload
         for (Device * d = group->enumDevices(0); d; d = group->enumDevices(d))

src/common/displayport/src/dp_evoadapter.cpp

@@ -97,6 +97,7 @@ const struct
     {NV_DP_REGKEY_MST_PCON_CAPS_READ_DISABLED,      &dpRegkeyDatabase.bMSTPCONCapsReadDisabled,        DP_REG_VAL_BOOL},
     {NV_DP_REGKEY_FORCE_DSC_ON_SINK,                &dpRegkeyDatabase.bForceDscOnSink,                 DP_REG_VAL_BOOL},
     {NV_DP_REGKEY_ENABLE_SKIP_DPCD_READS_WAR,       &dpRegkeyDatabase.bSkipFakeDeviceDpcdAccess,       DP_REG_VAL_BOOL},
+    {NV_DP_REGKEY_FLUSH_TIMESLOT_INFO_WHEN_DIRTY,   &dpRegkeyDatabase.bFlushTimeslotWhenDirty,         DP_REG_VAL_BOOL},
     {NV_DP_REGKEY_DISABLE_TUNNEL_BW_ALLOCATION,     &dpRegkeyDatabase.bForceDisableTunnelBwAllocation, DP_REG_VAL_BOOL}
 };
 

src/common/displayport/src/dp_groupimpl.cpp

@@ -167,6 +167,16 @@ void GroupImpl::remove(Device * dev)
 
     if (isHeadAttached())
     {
+        /*
+         * The device may become lost and free after removal from the active
+         * group. Therefore, also remove the device from the
+         * 'dscEnabledDevices' list and ensure that its dangling pointer is not
+         * left behind.
+         */
+        if (parent->dscEnabledDevices.contains(dev)) {
+            parent->dscEnabledDevices.remove(dev);
+        }
+
         di->activeGroup = 0;
     }
     members.remove(di);

src/common/displayport/src/dp_wardatabase.cpp

@@ -67,15 +67,16 @@ void ConnectorImpl::applyOuiWARs()
         // Synaptics
         case 0x24CC90:
             if ((modelName[0] == 'S') && (modelName[1] == 'Y') && (modelName[2] == 'N') &&
-                (modelName[3] == 'A') && (modelName[4] == 'S') &&
+                (modelName[3] == 'A') && (((modelName[4] == 'S') &&
                 ((modelName[5] == '1') || (modelName[5] == '2') ||
                  (modelName[5] == '3') || (modelName[5] == '#') ||
-                 (modelName[5] == '\"')))
+                 (modelName[5] == '\"')))||((modelName[4] == 0x84) &&
+                 (modelName[5] == '0'))))
             {
                 //
                 // Extended latency from link-train end to FEC enable pattern
                 // to avoid link lost or blank screen with Synaptics branch.
-                // (Bug 2561206)
+                // (Bug 2561206, 4613021)
                 //
                 // Dock SKU ID:
                 // Dell    Salomon-WD19TB SYNAS1

src/common/inc/nvBldVer.h

@@ -36,25 +36,25 @@
 // and then checked back in. You cannot make changes to these sections without
 // corresponding changes to the buildmeister script
 #ifndef NV_BUILD_BRANCH
-    #define NV_BUILD_BRANCH             r555_79
+    #define NV_BUILD_BRANCH             r555_97
 #endif
 #ifndef NV_PUBLIC_BRANCH
-    #define NV_PUBLIC_BRANCH             r555_79
+    #define NV_PUBLIC_BRANCH             r555_97
 #endif
 
 #if defined(NV_LINUX) || defined(NV_BSD) || defined(NV_SUNOS)
-#define NV_BUILD_BRANCH_VERSION         "rel/gpu_drv/r555/r555_79-111"
+#define NV_BUILD_BRANCH_VERSION         "rel/gpu_drv/r555/r555_97-144"
-#define NV_BUILD_CHANGELIST_NUM         (34260717)
+#define NV_BUILD_CHANGELIST_NUM         (34376233)
 #define NV_BUILD_TYPE                   "Official"
-#define NV_BUILD_NAME                   "rel/gpu_drv/r555/r555_79-111"
+#define NV_BUILD_NAME                   "rel/gpu_drv/r555/r555_97-144"
-#define NV_LAST_OFFICIAL_CHANGELIST_NUM (34260717)
+#define NV_LAST_OFFICIAL_CHANGELIST_NUM (34376233)
 
 #else     /* Windows builds */
-#define NV_BUILD_BRANCH_VERSION         "r555_79-1"
+#define NV_BUILD_BRANCH_VERSION         "r555_97-2"
-#define NV_BUILD_CHANGELIST_NUM         (34253977)
+#define NV_BUILD_CHANGELIST_NUM         (34367477)
 #define NV_BUILD_TYPE                   "Official"
-#define NV_BUILD_NAME                   "555.81"
+#define NV_BUILD_NAME                   "555.99"
-#define NV_LAST_OFFICIAL_CHANGELIST_NUM (34253977)
+#define NV_LAST_OFFICIAL_CHANGELIST_NUM (34367477)
 #define NV_BUILD_BRANCH_BASE_VERSION    R555
 #endif
 // End buildmeister python edited section

src/common/inc/nvPNPVendorIds.h

@@ -471,6 +471,7 @@ static const PNPVendorId PNPVendorIds[] =
     { "SMC",    _VENDOR_NAME_ENTRY("Standard Microsystems")             },
     { "SMI",    _VENDOR_NAME_ENTRY("Smile")                             },
     { "SML",    _VENDOR_NAME_ENTRY("Smile")                             },
+    { "SMN",    _VENDOR_NAME_ENTRY("Somnium Space Ltd")                 },
     { "SMS",    _VENDOR_NAME_ENTRY("Silicon Multimedia Systems")        },
     { "SNI",    _VENDOR_NAME_ENTRY("Siemens Nixdorf")                   },
     { "SNY",    _VENDOR_NAME_ENTRY("Sony")                              },

src/common/inc/nvUnixVersion.h

@@ -4,7 +4,7 @@
 #if defined(NV_LINUX) || defined(NV_BSD) || defined(NV_SUNOS) || defined(NV_VMWARE) || defined(NV_QNX) || defined(NV_INTEGRITY) || \
     (defined(RMCFG_FEATURE_PLATFORM_GSP) && RMCFG_FEATURE_PLATFORM_GSP == 1)
 
-#define NV_VERSION_STRING               "555.42.02"
+#define NV_VERSION_STRING               "555.52.04"
 
 #else
 

src/nvidia-modeset/src/nvkms.c

@@ -3894,7 +3894,7 @@ static NvBool JoinSwapGroup(
     struct NvKmsJoinSwapGroupParams *pParams = pParamsVoid;
     const struct NvKmsJoinSwapGroupRequestOneMember *pMember =
         pParams->request.member;
-    NvU32 i;
+    NvU32 i, j;
     NvBool anySwapGroupsPending = FALSE;
     NVHsJoinSwapGroupWorkArea *pJoinSwapGroupWorkArea;
 
@@ -4013,6 +4013,28 @@ static NvBool JoinSwapGroup(
             }
         }
 
+        /*
+         * We checked above that pDeferredRequestFifo is not currently a member
+         * of a SwapGroup, and that pEventOpenFd is currently valid to be used
+         * for a unicast event.  However, if either of those were also
+         * specified for an earlier member for this request, then that won't
+         * hold: by the time *this* member is processed, the
+         * pDeferredRequestFifo would already be a member of a swapgroup, or
+         * the pEventOpenFd would already be in use.
+         *
+         * Validate that that doesn't happen.
+         */
+        for (j = 0; j < i; j++) {
+            if (pJoinSwapGroupWorkArea[j].pDeferredRequestFifo ==
+                                          pDeferredRequestFifo) {
+                goto fail;
+            }
+            if (pJoinSwapGroupWorkArea[j].pEventOpenFd ==
+                                          pEventOpenFd) {
+                goto fail;
+            }
+        }
+
         pJoinSwapGroupWorkArea[i].pDevEvo = pOpenDev->pDevEvo;
         pJoinSwapGroupWorkArea[i].pSwapGroup = pSwapGroup;
         pJoinSwapGroupWorkArea[i].pDeferredRequestFifo = pDeferredRequestFifo;

src/nvidia/arch/nvalloc/common/inc/dev_ctrl_defines.h

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: Copyright (c) 2021-2022 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-FileCopyrightText: Copyright (c) 2021-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
  * SPDX-License-Identifier: MIT
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
@@ -77,6 +77,9 @@
 #define NV_CTRL_INTR_GPU_VECTOR_TO_SUBTREE(i) \
     ((NV_CTRL_INTR_GPU_VECTOR_TO_LEAF_REG(i)) / 2)
 
+// First index of doorbell which is controlled by VF
+#define NV_CTRL_INTR_GPU_DOORBELL_INDEX_VF_START 2048
+
 // The max number of leaf registers we expect
 #define NV_MAX_INTR_LEAVES 16
 

src/nvidia/generated/g_kernel_graphics_nvoc.c

@@ -251,6 +251,24 @@ void __nvoc_init_dataField_KernelGraphics(KernelGraphics *pThis, RmHalspecOwner
             pThis->bFecsRecordUcodeSeqnoSupported = ((NvBool)(0 != 0));
         }
     }
+
+    // Hal field -- bBug4208224WAREnabled
+    if (( ((rmVariantHal_HalVarIdx >> 5) == 0UL) && ((1UL << (rmVariantHal_HalVarIdx & 0x1f)) & 0x00000001UL) )) /* RmVariantHal: VF */ 
+    {
+        pThis->bBug4208224WAREnabled = ((NvBool)(0 != 0));
+    }
+    else if (( ((rmVariantHal_HalVarIdx >> 5) == 0UL) && ((1UL << (rmVariantHal_HalVarIdx & 0x1f)) & 0x00000002UL) )) /* RmVariantHal: PF_KERNEL_ONLY */ 
+    {
+        if (( ((chipHal_HalVarIdx >> 5) == 1UL) && ((1UL << (chipHal_HalVarIdx & 0x1f)) & 0x000000e0UL) )) /* ChipHal: TU102 | TU104 | TU106 */ 
+        {
+            pThis->bBug4208224WAREnabled = ((NvBool)(0 == 0));
+        }
+        // default
+        else
+        {
+            pThis->bBug4208224WAREnabled = ((NvBool)(0 != 0));
+        }
+    }
 }
 
 NV_STATUS __nvoc_ctor_OBJENGSTATE(OBJENGSTATE* );
@@ -325,6 +343,53 @@ static void __nvoc_init_funcTable_KernelGraphics_1(KernelGraphics *pThis, RmHals
     pThis->__kgraphicsServiceNotificationInterrupt__ = &kgraphicsServiceNotificationInterrupt_IMPL;
     pThis->__nvoc_base_IntrService.__intrservServiceNotificationInterrupt__ = &__nvoc_down_thunk_KernelGraphics_intrservServiceNotificationInterrupt;
 
+    // kgraphicsCreateBug4208224Channel -- halified (2 hals)
+    if (( ((chipHal_HalVarIdx >> 5) == 1UL) && ((1UL << (chipHal_HalVarIdx & 0x1f)) & 0x000000e0UL) )) /* ChipHal: TU102 | TU104 | TU106 */ 
+    {
+        pThis->__kgraphicsCreateBug4208224Channel__ = &kgraphicsCreateBug4208224Channel_TU102;
+    }
+    // default
+    else
+    {
+        pThis->__kgraphicsCreateBug4208224Channel__ = &kgraphicsCreateBug4208224Channel_56cd7a;
+    }
+
+    // kgraphicsInitializeBug4208224WAR -- halified (3 hals)
+    if (( ((rmVariantHal_HalVarIdx >> 5) == 0UL) && ((1UL << (rmVariantHal_HalVarIdx & 0x1f)) & 0x00000001UL) )) /* RmVariantHal: VF */ 
+    {
+        pThis->__kgraphicsInitializeBug4208224WAR__ = &kgraphicsInitializeBug4208224WAR_56cd7a;
+    }
+    else
+    {
+        if (( ((chipHal_HalVarIdx >> 5) == 1UL) && ((1UL << (chipHal_HalVarIdx & 0x1f)) & 0x000000e0UL) )) /* ChipHal: TU102 | TU104 | TU106 */ 
+        {
+            pThis->__kgraphicsInitializeBug4208224WAR__ = &kgraphicsInitializeBug4208224WAR_TU102;
+        }
+        // default
+        else
+        {
+            pThis->__kgraphicsInitializeBug4208224WAR__ = &kgraphicsInitializeBug4208224WAR_56cd7a;
+        }
+    }
+
+    // kgraphicsIsBug4208224WARNeeded -- halified (3 hals)
+    if (( ((rmVariantHal_HalVarIdx >> 5) == 0UL) && ((1UL << (rmVariantHal_HalVarIdx & 0x1f)) & 0x00000001UL) )) /* RmVariantHal: VF */ 
+    {
+        pThis->__kgraphicsIsBug4208224WARNeeded__ = &kgraphicsIsBug4208224WARNeeded_491d52;
+    }
+    else
+    {
+        if (( ((chipHal_HalVarIdx >> 5) == 1UL) && ((1UL << (chipHal_HalVarIdx & 0x1f)) & 0x000000e0UL) )) /* ChipHal: TU102 | TU104 | TU106 */ 
+        {
+            pThis->__kgraphicsIsBug4208224WARNeeded__ = &kgraphicsIsBug4208224WARNeeded_TU102;
+        }
+        // default
+        else
+        {
+            pThis->__kgraphicsIsBug4208224WARNeeded__ = &kgraphicsIsBug4208224WARNeeded_491d52;
+        }
+    }
+
     // kgraphicsLoadStaticInfo -- halified (2 hals)
     if (( ((rmVariantHal_HalVarIdx >> 5) == 0UL) && ((1UL << (rmVariantHal_HalVarIdx & 0x1f)) & 0x00000001UL) )) /* RmVariantHal: VF */ 
     {
@@ -411,13 +476,13 @@ static void __nvoc_init_funcTable_KernelGraphics_1(KernelGraphics *pThis, RmHals
 
     // kgraphicsStatePostUnload -- virtual inherited (engstate) base (engstate)
     pThis->__kgraphicsStatePostUnload__ = &__nvoc_up_thunk_OBJENGSTATE_kgraphicsStatePostUnload;
-} // End __nvoc_init_funcTable_KernelGraphics_1 with approximately 42 basic block(s).
+} // End __nvoc_init_funcTable_KernelGraphics_1 with approximately 50 basic block(s).
 
 
-// Initialize vtable(s) for 24 virtual method(s).
+// Initialize vtable(s) for 27 virtual method(s).
 void __nvoc_init_funcTable_KernelGraphics(KernelGraphics *pThis, RmHalspecOwner *pRmhalspecowner) {
 
-    // Initialize vtable(s) with 24 per-object function pointer(s).
+    // Initialize vtable(s) with 27 per-object function pointer(s).
     __nvoc_init_funcTable_KernelGraphics_1(pThis, pRmhalspecowner);
 }
 

src/nvidia/generated/g_kernel_graphics_nvoc.h

@@ -61,6 +61,7 @@ struct KGRAPHICS_STATIC_INFO;
 typedef struct KGRAPHICS_STATIC_INFO KGRAPHICS_STATIC_INFO;
 typedef struct KGRAPHICS_FECS_TRACE_INFO KGRAPHICS_FECS_TRACE_INFO;
 typedef struct KGRAPHICS_GLOBAL_CTX_BUFFERS_INFO KGRAPHICS_GLOBAL_CTX_BUFFERS_INFO;
+typedef struct KGRAPHICS_BUG4208224_CONTEXT_INFO KGRAPHICS_BUG4208224_CONTEXT_INFO;
 
 /*!
  * Static info retrieved from Physical RM detailing the configuration of the
@@ -143,6 +144,25 @@ struct KGRAPHICS_GLOBAL_CTX_BUFFERS_INFO
     GR_BUFFER_ATTR        vfGlobalCtxAttr[GR_GLOBALCTX_BUFFER_COUNT];
 };
 
+#define KGRAPHICS_SCRUBBER_HANDLE_VAS        0xdada0042       
+#define KGRAPHICS_SCRUBBER_HANDLE_PBVIRT     (KGRAPHICS_SCRUBBER_HANDLE_VAS + 1)      
+#define KGRAPHICS_SCRUBBER_HANDLE_PBPHYS     (KGRAPHICS_SCRUBBER_HANDLE_VAS + 2)      
+#define KGRAPHICS_SCRUBBER_HANDLE_CHANNEL    (KGRAPHICS_SCRUBBER_HANDLE_VAS + 3)      
+#define KGRAPHICS_SCRUBBER_HANDLE_3DOBJ      (KGRAPHICS_SCRUBBER_HANDLE_VAS + 4)      
+#define KGRAPHICS_SCRUBBER_HANDLE_USERD      (KGRAPHICS_SCRUBBER_HANDLE_VAS + 5)      
+
+        
+struct KGRAPHICS_BUG4208224_CONTEXT_INFO
+{
+    /* Dynamically allocated client handles */
+    NvHandle hClient;
+    NvHandle hDeviceId;
+    NvHandle hSubdeviceId;
+
+    // Have resources been setup
+    NvBool bConstructed;
+};
+
 // Opaque forward declarations
 typedef struct KGRAPHICS_PRIVATE_DATA KGRAPHICS_PRIVATE_DATA;
 typedef struct KGRAPHICS_FECS_TRACE_INFO KGRAPHICS_FECS_TRACE_INFO;
@@ -179,7 +199,7 @@ struct KernelGraphics {
     struct IntrService *__nvoc_pbase_IntrService;    // intrserv super
     struct KernelGraphics *__nvoc_pbase_KernelGraphics;    // kgraphics
 
-    // Vtable with 24 per-object function pointers
+    // Vtable with 27 per-object function pointers
     NV_STATUS (*__kgraphicsConstructEngine__)(OBJGPU *, struct KernelGraphics * /*this*/, ENGDESCRIPTOR);  // virtual override (engstate) base (engstate)
     NV_STATUS (*__kgraphicsStateInitLocked__)(OBJGPU *, struct KernelGraphics * /*this*/);  // virtual override (engstate) base (engstate)
     NV_STATUS (*__kgraphicsStateLoad__)(OBJGPU *, struct KernelGraphics * /*this*/, NvU32);  // virtual override (engstate) base (engstate)
@@ -190,6 +210,9 @@ struct KernelGraphics {
     NV_STATUS (*__kgraphicsStatePostLoad__)(OBJGPU *, struct KernelGraphics * /*this*/, NvU32);  // virtual override (engstate) base (engstate)
     void (*__kgraphicsRegisterIntrService__)(OBJGPU *, struct KernelGraphics * /*this*/, IntrServiceRecord *);  // virtual override (intrserv) base (intrserv)
     NV_STATUS (*__kgraphicsServiceNotificationInterrupt__)(OBJGPU *, struct KernelGraphics * /*this*/, IntrServiceServiceNotificationInterruptArguments *);  // virtual override (intrserv) base (intrserv)
+    NV_STATUS (*__kgraphicsCreateBug4208224Channel__)(OBJGPU *, struct KernelGraphics * /*this*/);  // halified (2 hals)
+    NV_STATUS (*__kgraphicsInitializeBug4208224WAR__)(OBJGPU *, struct KernelGraphics * /*this*/);  // halified (3 hals)
+    NvBool (*__kgraphicsIsBug4208224WARNeeded__)(OBJGPU *, struct KernelGraphics * /*this*/);  // halified (3 hals)
     NV_STATUS (*__kgraphicsLoadStaticInfo__)(OBJGPU *, struct KernelGraphics * /*this*/, NvU32);  // halified (2 hals)
     NvBool (*__kgraphicsClearInterrupt__)(OBJGPU *, struct KernelGraphics * /*this*/, IntrServiceClearInterruptArguments *);  // virtual halified (singleton optimized) override (intrserv) base (intrserv)
     NvU32 (*__kgraphicsServiceInterrupt__)(OBJGPU *, struct KernelGraphics * /*this*/, IntrServiceServiceInterruptArguments *);  // virtual halified (singleton optimized) override (intrserv) base (intrserv)
@@ -216,6 +239,7 @@ struct KernelGraphics {
     NvBool PRIVATE_FIELD(bUcodeSupportsPrivAccessMap);
     NvBool PRIVATE_FIELD(bRtvCbSupported);
     NvBool PRIVATE_FIELD(bFecsRecordUcodeSeqnoSupported);
+    NvBool PRIVATE_FIELD(bBug4208224WAREnabled);
     NvU32 PRIVATE_FIELD(instance);
     KGRAPHICS_PRIVATE_DATA *PRIVATE_FIELD(pPrivate);
     NvBool PRIVATE_FIELD(bCollectingDeferredStaticData);
@@ -224,6 +248,7 @@ struct KernelGraphics {
     struct CTX_BUF_POOL_INFO *PRIVATE_FIELD(pCtxBufPool);
     CTX_BUF_INFO PRIVATE_FIELD(maxCtxBufSize)[10];
     GR_BUFFER_ATTR PRIVATE_FIELD(ctxAttr)[10];
+    struct KGRAPHICS_BUG4208224_CONTEXT_INFO PRIVATE_FIELD(bug4208224Info);
 };
 
 
@@ -242,7 +267,7 @@ struct KernelGraphics_PRIVATE {
     struct IntrService *__nvoc_pbase_IntrService;    // intrserv super
     struct KernelGraphics *__nvoc_pbase_KernelGraphics;    // kgraphics
 
-    // Vtable with 24 per-object function pointers
+    // Vtable with 27 per-object function pointers
     NV_STATUS (*__kgraphicsConstructEngine__)(OBJGPU *, struct KernelGraphics * /*this*/, ENGDESCRIPTOR);  // virtual override (engstate) base (engstate)
     NV_STATUS (*__kgraphicsStateInitLocked__)(OBJGPU *, struct KernelGraphics * /*this*/);  // virtual override (engstate) base (engstate)
     NV_STATUS (*__kgraphicsStateLoad__)(OBJGPU *, struct KernelGraphics * /*this*/, NvU32);  // virtual override (engstate) base (engstate)
@@ -253,6 +278,9 @@ struct KernelGraphics_PRIVATE {
     NV_STATUS (*__kgraphicsStatePostLoad__)(OBJGPU *, struct KernelGraphics * /*this*/, NvU32);  // virtual override (engstate) base (engstate)
     void (*__kgraphicsRegisterIntrService__)(OBJGPU *, struct KernelGraphics * /*this*/, IntrServiceRecord *);  // virtual override (intrserv) base (intrserv)
     NV_STATUS (*__kgraphicsServiceNotificationInterrupt__)(OBJGPU *, struct KernelGraphics * /*this*/, IntrServiceServiceNotificationInterruptArguments *);  // virtual override (intrserv) base (intrserv)
+    NV_STATUS (*__kgraphicsCreateBug4208224Channel__)(OBJGPU *, struct KernelGraphics * /*this*/);  // halified (2 hals)
+    NV_STATUS (*__kgraphicsInitializeBug4208224WAR__)(OBJGPU *, struct KernelGraphics * /*this*/);  // halified (3 hals)
+    NvBool (*__kgraphicsIsBug4208224WARNeeded__)(OBJGPU *, struct KernelGraphics * /*this*/);  // halified (3 hals)
     NV_STATUS (*__kgraphicsLoadStaticInfo__)(OBJGPU *, struct KernelGraphics * /*this*/, NvU32);  // halified (2 hals)
     NvBool (*__kgraphicsClearInterrupt__)(OBJGPU *, struct KernelGraphics * /*this*/, IntrServiceClearInterruptArguments *);  // virtual halified (singleton optimized) override (intrserv) base (intrserv)
     NvU32 (*__kgraphicsServiceInterrupt__)(OBJGPU *, struct KernelGraphics * /*this*/, IntrServiceServiceInterruptArguments *);  // virtual halified (singleton optimized) override (intrserv) base (intrserv)
@@ -279,6 +307,7 @@ struct KernelGraphics_PRIVATE {
     NvBool bUcodeSupportsPrivAccessMap;
     NvBool bRtvCbSupported;
     NvBool bFecsRecordUcodeSeqnoSupported;
+    NvBool bBug4208224WAREnabled;
     NvU32 instance;
     KGRAPHICS_PRIVATE_DATA *pPrivate;
     NvBool bCollectingDeferredStaticData;
@@ -287,6 +316,7 @@ struct KernelGraphics_PRIVATE {
     struct CTX_BUF_POOL_INFO *pCtxBufPool;
     CTX_BUF_INFO maxCtxBufSize[10];
     GR_BUFFER_ATTR ctxAttr[10];
+    struct KGRAPHICS_BUG4208224_CONTEXT_INFO bug4208224Info;
 };
 
 #ifndef __NVOC_CLASS_KernelGraphics_TYPEDEF__
@@ -343,6 +373,15 @@ NV_STATUS __nvoc_objCreate_KernelGraphics(KernelGraphics**, Dynamic*, NvU32);
 #define kgraphicsRegisterIntrService(arg1, arg_this, arg3) kgraphicsRegisterIntrService_DISPATCH(arg1, arg_this, arg3)
 #define kgraphicsServiceNotificationInterrupt_FNPTR(arg_this) arg_this->__kgraphicsServiceNotificationInterrupt__
 #define kgraphicsServiceNotificationInterrupt(arg1, arg_this, arg3) kgraphicsServiceNotificationInterrupt_DISPATCH(arg1, arg_this, arg3)
+#define kgraphicsCreateBug4208224Channel_FNPTR(arg_this) arg_this->__kgraphicsCreateBug4208224Channel__
+#define kgraphicsCreateBug4208224Channel(arg1, arg_this) kgraphicsCreateBug4208224Channel_DISPATCH(arg1, arg_this)
+#define kgraphicsCreateBug4208224Channel_HAL(arg1, arg_this) kgraphicsCreateBug4208224Channel_DISPATCH(arg1, arg_this)
+#define kgraphicsInitializeBug4208224WAR_FNPTR(arg_this) arg_this->__kgraphicsInitializeBug4208224WAR__
+#define kgraphicsInitializeBug4208224WAR(arg1, arg_this) kgraphicsInitializeBug4208224WAR_DISPATCH(arg1, arg_this)
+#define kgraphicsInitializeBug4208224WAR_HAL(arg1, arg_this) kgraphicsInitializeBug4208224WAR_DISPATCH(arg1, arg_this)
+#define kgraphicsIsBug4208224WARNeeded_FNPTR(arg_this) arg_this->__kgraphicsIsBug4208224WARNeeded__
+#define kgraphicsIsBug4208224WARNeeded(arg1, arg_this) kgraphicsIsBug4208224WARNeeded_DISPATCH(arg1, arg_this)
+#define kgraphicsIsBug4208224WARNeeded_HAL(arg1, arg_this) kgraphicsIsBug4208224WARNeeded_DISPATCH(arg1, arg_this)
 #define kgraphicsLoadStaticInfo_FNPTR(arg_this) arg_this->__kgraphicsLoadStaticInfo__
 #define kgraphicsLoadStaticInfo(arg1, arg_this, swizzId) kgraphicsLoadStaticInfo_DISPATCH(arg1, arg_this, swizzId)
 #define kgraphicsLoadStaticInfo_HAL(arg1, arg_this, swizzId) kgraphicsLoadStaticInfo_DISPATCH(arg1, arg_this, swizzId)
@@ -421,6 +460,18 @@ static inline NV_STATUS kgraphicsServiceNotificationInterrupt_DISPATCH(OBJGPU *a
     return arg_this->__kgraphicsServiceNotificationInterrupt__(arg1, arg_this, arg3);
 }
 
+static inline NV_STATUS kgraphicsCreateBug4208224Channel_DISPATCH(OBJGPU *arg1, struct KernelGraphics *arg_this) {
+    return arg_this->__kgraphicsCreateBug4208224Channel__(arg1, arg_this);
+}
+
+static inline NV_STATUS kgraphicsInitializeBug4208224WAR_DISPATCH(OBJGPU *arg1, struct KernelGraphics *arg_this) {
+    return arg_this->__kgraphicsInitializeBug4208224WAR__(arg1, arg_this);
+}
+
+static inline NvBool kgraphicsIsBug4208224WARNeeded_DISPATCH(OBJGPU *arg1, struct KernelGraphics *arg_this) {
+    return arg_this->__kgraphicsIsBug4208224WARNeeded__(arg1, arg_this);
+}
+
 static inline NV_STATUS kgraphicsLoadStaticInfo_DISPATCH(OBJGPU *arg1, struct KernelGraphics *arg_this, NvU32 swizzId) {
     return arg_this->__kgraphicsLoadStaticInfo__(arg1, arg_this, swizzId);
 }
@@ -583,6 +634,24 @@ void kgraphicsRegisterIntrService_IMPL(OBJGPU *arg1, struct KernelGraphics *arg2
 
 NV_STATUS kgraphicsServiceNotificationInterrupt_IMPL(OBJGPU *arg1, struct KernelGraphics *arg2, IntrServiceServiceNotificationInterruptArguments *arg3);
 
+NV_STATUS kgraphicsCreateBug4208224Channel_TU102(OBJGPU *arg1, struct KernelGraphics *arg2);
+
+static inline NV_STATUS kgraphicsCreateBug4208224Channel_56cd7a(OBJGPU *arg1, struct KernelGraphics *arg2) {
+    return NV_OK;
+}
+
+static inline NV_STATUS kgraphicsInitializeBug4208224WAR_56cd7a(OBJGPU *arg1, struct KernelGraphics *arg2) {
+    return NV_OK;
+}
+
+NV_STATUS kgraphicsInitializeBug4208224WAR_TU102(OBJGPU *arg1, struct KernelGraphics *arg2);
+
+static inline NvBool kgraphicsIsBug4208224WARNeeded_491d52(OBJGPU *arg1, struct KernelGraphics *arg2) {
+    return ((NvBool)(0 != 0));
+}
+
+NvBool kgraphicsIsBug4208224WARNeeded_TU102(OBJGPU *arg1, struct KernelGraphics *arg2);
+
 NV_STATUS kgraphicsLoadStaticInfo_VF(OBJGPU *arg1, struct KernelGraphics *arg2, NvU32 swizzId);
 
 NV_STATUS kgraphicsLoadStaticInfo_KERNEL(OBJGPU *arg1, struct KernelGraphics *arg2, NvU32 swizzId);
@@ -706,6 +775,16 @@ static inline NvBool kgraphicsIsFecsRecordUcodeSeqnoSupported(OBJGPU *pGpu, stru
     return pKernelGraphics_PRIVATE->bFecsRecordUcodeSeqnoSupported;
 }
 
+static inline NvBool kgraphicsGetBug4208224WAREnabled(OBJGPU *pGpu, struct KernelGraphics *pKernelGraphics) {
+    struct KernelGraphics_PRIVATE *pKernelGraphics_PRIVATE = (struct KernelGraphics_PRIVATE *)pKernelGraphics;
+    return pKernelGraphics_PRIVATE->bBug4208224WAREnabled;
+}
+
+static inline void kgraphicsSetBug4208224WAREnabled(OBJGPU *pGpu, struct KernelGraphics *pKernelGraphics, NvBool bProp) {
+    struct KernelGraphics_PRIVATE *pKernelGraphics_PRIVATE = (struct KernelGraphics_PRIVATE *)pKernelGraphics;
+    pKernelGraphics_PRIVATE->bBug4208224WAREnabled = bProp;
+}
+
 void kgraphicsDestruct_IMPL(struct KernelGraphics *arg1);
 
 #define __nvoc_kgraphicsDestruct(arg1) kgraphicsDestruct_IMPL(arg1)

src/nvidia/generated/g_mem_desc_nvoc.h

@@ -383,11 +383,11 @@ typedef enum
     NV_FB_ALLOC_RM_INTERNAL_OWNER_UNNAMED_TAG_143       = 176U,
     NV_FB_ALLOC_RM_INTERNAL_OWNER_GSP_NOTIFY_OP_SURFACE = 177U,
     NV_FB_ALLOC_RM_INTERNAL_OWNER_FAKE_WPR_RSVD         = 178U,
+    NV_FB_ALLOC_RM_INTERNAL_OWNER_GR_SCRUB_CHANNEL      = 179U,
     //
     // Unused tags from here, for any new use-case it's required 
     // to replace the below tags with known verbose strings
     //
-    NV_FB_ALLOC_RM_INTERNAL_OWNER_UNNAMED_TAG_146       = 179U,
     NV_FB_ALLOC_RM_INTERNAL_OWNER_UNNAMED_TAG_147       = 180U,
     NV_FB_ALLOC_RM_INTERNAL_OWNER_UNNAMED_TAG_148       = 181U,
     NV_FB_ALLOC_RM_INTERNAL_OWNER_UNNAMED_TAG_149       = 182U,

src/nvidia/generated/g_nv_name_released.h

@@ -904,6 +904,8 @@ static const CHIPS_RELEASED sChipsReleased[] = {
     { 0x2330, 0x16c0, 0x10de, "NVIDIA H100 80GB HBM3" },
     { 0x2330, 0x16c1, 0x10de, "NVIDIA H100 80GB HBM3" },
     { 0x2331, 0x1626, 0x10de, "NVIDIA H100 PCIe" },
+    { 0x2335, 0x18be, 0x10de, "NVIDIA H200" },
+    { 0x2335, 0x18bf, 0x10de, "NVIDIA H200" },
     { 0x2339, 0x17fc, 0x10de, "NVIDIA H100" },
     { 0x233A, 0x183a, 0x10de, "NVIDIA H800 NVL" },
     { 0x2342, 0x16eb, 0x10de, "NVIDIA GH200 120GB" },
@@ -1021,6 +1023,7 @@ static const CHIPS_RELEASED sChipsReleased[] = {
     { 0x26B9, 0x1851, 0x10de, "NVIDIA L40S" },
     { 0x26B9, 0x18cf, 0x10de, "NVIDIA L40S" },
     { 0x26BA, 0x1957, 0x10de, "NVIDIA L20" },
+    { 0x26BA, 0x1990, 0x10de, "NVIDIA L20" },
     { 0x2702, 0x0000, 0x0000, "NVIDIA GeForce RTX 4080 SUPER" },
     { 0x2704, 0x0000, 0x0000, "NVIDIA GeForce RTX 4080" },
     { 0x2705, 0x0000, 0x0000, "NVIDIA GeForce RTX 4070 Ti SUPER" },

src/nvidia/generated/g_subdevice_nvoc.h

@@ -143,7 +143,7 @@ struct Subdevice {
     struct Notifier *__nvoc_pbase_Notifier;    // notify super
     struct Subdevice *__nvoc_pbase_Subdevice;    // subdevice
 
-    // Vtable with 567 per-object function pointers
+    // Vtable with 568 per-object function pointers
     void (*__subdevicePreDestruct__)(struct Subdevice * /*this*/);  // virtual override (res) base (gpures)
     NV_STATUS (*__subdeviceInternalControlForward__)(struct Subdevice * /*this*/, NvU32, void *, NvU32);  // virtual override (gpures) base (gpures)
     NV_STATUS (*__subdeviceControlFilter__)(struct Subdevice * /*this*/, struct CALL_CONTEXT *, struct RS_RES_CONTROL_PARAMS_INTERNAL *);  // virtual override (res) base (gpures)
@@ -392,6 +392,7 @@ struct Subdevice {
     NV_STATUS (*__subdeviceCtrlCmdGrInternalGetFecsTraceRdOffset__)(struct Subdevice * /*this*/, NV2080_CTRL_INTERNAL_GR_GET_FECS_TRACE_RD_OFFSET_PARAMS *);  // exported (id=0x20800a3b)
     NV_STATUS (*__subdeviceCtrlCmdGrInternalSetFecsTraceWrOffset__)(struct Subdevice * /*this*/, NV2080_CTRL_INTERNAL_GR_SET_FECS_TRACE_WR_OFFSET_PARAMS *);  // exported (id=0x20800a3a)
     NV_STATUS (*__subdeviceCtrlCmdGrStaticGetFecsTraceDefines__)(struct Subdevice * /*this*/, NV2080_CTRL_INTERNAL_STATIC_GR_GET_FECS_TRACE_DEFINES_PARAMS *);  // exported (id=0x20800a3e)
+    NV_STATUS (*__subdeviceCtrlCmdKGrInternalInitBug4208224War__)(struct Subdevice * /*this*/, NV2080_CTRL_INTERNAL_KGR_INIT_BUG4208224_WAR_PARAMS *);  // exported (id=0x20800a46)
     NV_STATUS (*__subdeviceCtrlCmdGpuGetCachedInfo__)(struct Subdevice * /*this*/, NV2080_CTRL_GPU_GET_INFO_V2_PARAMS *);  // exported (id=0x20800182)
     NV_STATUS (*__subdeviceCtrlCmdGpuGetInfoV2__)(struct Subdevice * /*this*/, NV2080_CTRL_GPU_GET_INFO_V2_PARAMS *);  // exported (id=0x20800102)
     NV_STATUS (*__subdeviceCtrlCmdGpuGetIpVersion__)(struct Subdevice * /*this*/, NV2080_CTRL_GPU_GET_IP_VERSION_PARAMS *);  // exported (id=0x2080014d)
@@ -1297,6 +1298,8 @@ NV_STATUS __nvoc_objCreate_Subdevice(Subdevice**, Dynamic*, NvU32, struct CALL_C
 #define subdeviceCtrlCmdGrInternalSetFecsTraceWrOffset(pSubdevice, pParams) subdeviceCtrlCmdGrInternalSetFecsTraceWrOffset_DISPATCH(pSubdevice, pParams)
 #define subdeviceCtrlCmdGrStaticGetFecsTraceDefines_FNPTR(pSubdevice) pSubdevice->__subdeviceCtrlCmdGrStaticGetFecsTraceDefines__
 #define subdeviceCtrlCmdGrStaticGetFecsTraceDefines(pSubdevice, pParams) subdeviceCtrlCmdGrStaticGetFecsTraceDefines_DISPATCH(pSubdevice, pParams)
+#define subdeviceCtrlCmdKGrInternalInitBug4208224War_FNPTR(pSubdevice) pSubdevice->__subdeviceCtrlCmdKGrInternalInitBug4208224War__
+#define subdeviceCtrlCmdKGrInternalInitBug4208224War(pSubdevice, pParams) subdeviceCtrlCmdKGrInternalInitBug4208224War_DISPATCH(pSubdevice, pParams)
 #define subdeviceCtrlCmdGpuGetCachedInfo_FNPTR(pSubdevice) pSubdevice->__subdeviceCtrlCmdGpuGetCachedInfo__
 #define subdeviceCtrlCmdGpuGetCachedInfo(pSubdevice, pGpuInfoParams) subdeviceCtrlCmdGpuGetCachedInfo_DISPATCH(pSubdevice, pGpuInfoParams)
 #define subdeviceCtrlCmdGpuGetInfoV2_FNPTR(pSubdevice) pSubdevice->__subdeviceCtrlCmdGpuGetInfoV2__
@@ -2940,6 +2943,10 @@ static inline NV_STATUS subdeviceCtrlCmdGrStaticGetFecsTraceDefines_DISPATCH(str
     return pSubdevice->__subdeviceCtrlCmdGrStaticGetFecsTraceDefines__(pSubdevice, pParams);
 }
 
+static inline NV_STATUS subdeviceCtrlCmdKGrInternalInitBug4208224War_DISPATCH(struct Subdevice *pSubdevice, NV2080_CTRL_INTERNAL_KGR_INIT_BUG4208224_WAR_PARAMS *pParams) {
+    return pSubdevice->__subdeviceCtrlCmdKGrInternalInitBug4208224War__(pSubdevice, pParams);
+}
+
 static inline NV_STATUS subdeviceCtrlCmdGpuGetCachedInfo_DISPATCH(struct Subdevice *pSubdevice, NV2080_CTRL_GPU_GET_INFO_V2_PARAMS *pGpuInfoParams) {
     return pSubdevice->__subdeviceCtrlCmdGpuGetCachedInfo__(pSubdevice, pGpuInfoParams);
 }
@@ -4824,6 +4831,8 @@ NV_STATUS subdeviceCtrlCmdGrInternalSetFecsTraceWrOffset_IMPL(struct Subdevice *
 
 NV_STATUS subdeviceCtrlCmdGrStaticGetFecsTraceDefines_IMPL(struct Subdevice *pSubdevice, NV2080_CTRL_INTERNAL_STATIC_GR_GET_FECS_TRACE_DEFINES_PARAMS *pParams);
 
+NV_STATUS subdeviceCtrlCmdKGrInternalInitBug4208224War_IMPL(struct Subdevice *pSubdevice, NV2080_CTRL_INTERNAL_KGR_INIT_BUG4208224_WAR_PARAMS *pParams);
+
 NV_STATUS subdeviceCtrlCmdGpuGetCachedInfo_IMPL(struct Subdevice *pSubdevice, NV2080_CTRL_GPU_GET_INFO_V2_PARAMS *pGpuInfoParams);
 
 NV_STATUS subdeviceCtrlCmdGpuGetInfoV2_IMPL(struct Subdevice *pSubdevice, NV2080_CTRL_GPU_GET_INFO_V2_PARAMS *pGpuInfoParams);

src/nvidia/generated/g_vgpuconfigapi_nvoc.c

@@ -118,12 +118,12 @@ const struct NVOC_CLASS_DEF __nvoc_class_def_VgpuConfigApi =
 static const struct NVOC_EXPORTED_METHOD_DEF __nvoc_exported_method_def_VgpuConfigApi[] = 
 {
     {               /*  [0] */
-#if NVOC_EXPORTED_METHOD_DISABLED_BY_FLAG(0x8u)
+#if NVOC_EXPORTED_METHOD_DISABLED_BY_FLAG(0x4u)
         /*pFunc=*/      (void (*)(void)) NULL,
 #else
         /*pFunc=*/      (void (*)(void)) vgpuconfigapiCtrlCmdVgpuConfigSetInfo_IMPL,
-#endif // NVOC_EXPORTED_METHOD_DISABLED_BY_FLAG(0x8u)
+#endif // NVOC_EXPORTED_METHOD_DISABLED_BY_FLAG(0x4u)
-        /*flags=*/      0x8u,
+        /*flags=*/      0x4u,
         /*accessRight=*/0x0u,
         /*methodId=*/   0xa0810101u,
         /*paramSize=*/  sizeof(NVA081_CTRL_VGPU_CONFIG_INFO_PARAMS),
@@ -681,7 +681,7 @@ static void __nvoc_init_funcTable_VgpuConfigApi_1(VgpuConfigApi *pThis) {
     PORT_UNREFERENCED_VARIABLE(pThis);
 
     // vgpuconfigapiCtrlCmdVgpuConfigSetInfo -- exported (id=0xa0810101)
-#if !NVOC_EXPORTED_METHOD_DISABLED_BY_FLAG(0x8u)
+#if !NVOC_EXPORTED_METHOD_DISABLED_BY_FLAG(0x4u)
     pThis->__vgpuconfigapiCtrlCmdVgpuConfigSetInfo__ = &vgpuconfigapiCtrlCmdVgpuConfigSetInfo_IMPL;
 #endif
 

src/nvidia/interface/nvrm_registry.h

@@ -1301,6 +1301,19 @@
 #define NV_REG_STR_RM_WATCHDOG_INTERVAL_HI                    0x0000000C
 #define NV_REG_STR_RM_WATCHDOG_INTERVAL_DEFAULT               NV_REG_STR_RM_WATCHDOG_INTERVAL_LOW
 
+// Enable/Disable watchcat in GSP-Plugin for Guest RPC
+// Default is Enabled
+#define NV_REG_STR_RM_GSP_VGPU_WATCHCAT                     "RmEnableGspPluginWatchcat"
+#define NV_REG_STR_RM_GSP_VGPU_WATCHCAT_ENABLE              0x00000001
+#define NV_REG_STR_RM_GSP_VGPU_WATCHCAT_DISABLE             0x00000000
+#define NV_REG_STR_RM_GSP_VGPU_WATCHCAT_DEFAULT             NV_REG_STR_RM_GSP_VGPU_WATCHCAT_ENABLE
+
+// Set watchcat timeout value in GSP-Plugin for Guest RPC
+// Default is 10 seconds
+#define NV_REG_STR_RM_GSP_VGPU_WATCHCAT_TIMEOUT             "RmGspPluginWatchcatTimeOut"
+#define NV_REG_STR_RM_GSP_VGPU_WATCHCAT_TIMEOUT_MIN         0x0000000A
+#define NV_REG_STR_RM_GSP_VGPU_WATCHCAT_TIMEOUT_DEFAULT     NV_REG_STR_RM_GSP_VGPU_WATCHCAT_TIMEOUT_MIN
+
 #define NV_REG_STR_RM_DO_LOG_RC_EVENTS                      "RmLogonRC"
 // Type Dword
 // Encoding : 0 --> Skip Logging

src/nvidia/src/kernel/gpu/gpu_suspend.c

@@ -31,6 +31,8 @@
 
 #include "platform/platform.h"
 #include "platform/chipset/chipset.h"
+#include "platform/sli/sli.h"
+#include "kernel/gpu/gr/kernel_graphics.h"
 #include "gpu/mem_mgr/mem_mgr.h"
 #include "gpu/mem_mgr/fbsr.h"
 #include "gpu/gsp/gsp_init_args.h"
@@ -348,6 +350,10 @@ gpuResumeFromStandby_IMPL(OBJGPU *pGpu)
                   IS_GPU_GC6_STATE_EXITING(pGpu) ? "GC6" : "APM Suspend");
     }
 
+    if (kgraphicsIsBug4208224WARNeeded_HAL(pGpu, GPU_GET_KERNEL_GRAPHICS(pGpu, 0)))
+    {
+        return kgraphicsInitializeBug4208224WAR_HAL(pGpu, GPU_GET_KERNEL_GRAPHICS(pGpu, 0));
+    }
     return resumeStatus;
 }
 
@@ -410,6 +416,9 @@ NV_STATUS gpuResumeFromHibernate_IMPL(OBJGPU *pGpu)
     {
         NV_PRINTF(LEVEL_NOTICE, "End resuming from APM Suspend\n");
     }
-
+    if (kgraphicsIsBug4208224WARNeeded_HAL(pGpu, GPU_GET_KERNEL_GRAPHICS(pGpu, 0)))
+    {
+        return kgraphicsInitializeBug4208224WAR_HAL(pGpu, GPU_GET_KERNEL_GRAPHICS(pGpu, 0));
+    }
     return resumeStatus;
 }

src/nvidia/src/kernel/gpu/gr/arch/turing/kgraphics_tu102.c

@@ -183,3 +183,318 @@ kgraphicsAllocGrGlobalCtxBuffers_TU102
 
     return status;
 }
+/**
+ * @brief Initializes Bug 4208224 by performing the following actions
+ *        1.) Sets up static handles inside an info struct to be referenced later
+ *        2.) Creates a channel tied to VEID0 on GR0
+ *        3.) Sends an RPC to physical RM for the physical side initialization
+ */
+NV_STATUS
+kgraphicsInitializeBug4208224WAR_TU102
+(
+    OBJGPU *pGpu,
+    KernelGraphics *pKernelGraphics
+)
+{
+    NV_STATUS   status = NV_OK;
+    RM_API     *pRmApi = rmapiGetInterface(RMAPI_GPU_LOCK_INTERNAL);
+    NV2080_CTRL_INTERNAL_KGR_INIT_BUG4208224_WAR_PARAMS params = {0};
+
+    if (pKernelGraphics->bug4208224Info.bConstructed)
+    {
+        return NV_OK;
+    }
+
+    NV_CHECK_OK_OR_RETURN(LEVEL_ERROR,
+        kgraphicsCreateBug4208224Channel_HAL(pGpu, pKernelGraphics));
+
+    params.bTeardown = NV_FALSE;
+    status =  pRmApi->Control(pRmApi,
+                        pKernelGraphics->bug4208224Info.hClient,
+                        pKernelGraphics->bug4208224Info.hSubdeviceId,
+                        NV2080_CTRL_CMD_INTERNAL_KGR_INIT_BUG4208224_WAR,
+                        &params,
+                        sizeof(params));
+
+    if (status != NV_OK)
+    {
+        NV_ASSERT_OK(pRmApi->Free(pRmApi,
+            pKernelGraphics->bug4208224Info.hClient,
+            pKernelGraphics->bug4208224Info.hClient));
+    }
+
+    return status;
+}
+
+/*!
+ * @brief Creates a VEID0 channel for Bug 4208224 WAR
+ *
+ * @return NV_OK if channel created successfully
+ */
+NV_STATUS
+kgraphicsCreateBug4208224Channel_TU102
+(
+    OBJGPU *pGpu,
+    KernelGraphics *pKernelGraphics
+)
+{
+    NV_STATUS                              status = NV_OK;
+    NvHandle                               hClientId = NV01_NULL_OBJECT;
+    NvHandle                               hDeviceId;
+    NvHandle                               hSubdeviceId;
+    NvHandle                               hVASpace     = KGRAPHICS_SCRUBBER_HANDLE_VAS;
+    NvHandle                               hPBVirtMemId = KGRAPHICS_SCRUBBER_HANDLE_PBVIRT;
+    NvHandle                               hPBPhysMemId = KGRAPHICS_SCRUBBER_HANDLE_PBPHYS;
+    NvHandle                               hChannelId   = KGRAPHICS_SCRUBBER_HANDLE_CHANNEL;
+    NvHandle                               hObj3D       = KGRAPHICS_SCRUBBER_HANDLE_3DOBJ;
+    NvHandle                               hUserdId     = KGRAPHICS_SCRUBBER_HANDLE_USERD;
+    NvU32                                  gpFifoEntries = 32;       // power-of-2 random choice
+    NvU64                                  gpFifoSize = NVA06F_GP_ENTRY__SIZE * gpFifoEntries;
+    NvU64                                  chSize = gpFifoSize;
+    RM_API                                *pRmApi = rmapiGetInterface(RMAPI_GPU_LOCK_INTERNAL);
+    RsClient                              *pClientId;
+    NvBool                                 bBcStatus;
+    NvBool                                 bClientUserd = IsVOLTAorBetter(pGpu);
+    NvBool                                 bAcquireLock = NV_FALSE;
+    NvU32                                  sliLoopReentrancy;
+    NV_VASPACE_ALLOCATION_PARAMETERS       vaParams;
+    NV_MEMORY_ALLOCATION_PARAMS            memAllocParams;
+    NV_CHANNEL_ALLOC_PARAMS channelGPFIFOAllocParams;
+    NvU32                                  classNum;
+    NvU32                                  primarySliSubDeviceInstance;
+    // XXX This should be removed when broadcast SLI support is deprecated
+    if (!gpumgrIsParentGPU(pGpu))
+    {
+        return NV_OK;
+    }
+
+    bBcStatus = gpumgrGetBcEnabledStatus(pGpu);
+
+    // FIXME these allocations corrupt BC state
+    NV_ASSERT_OK_OR_RETURN(
+        rmapiutilAllocClientAndDeviceHandles(pRmApi, pGpu, &hClientId, &hDeviceId, &hSubdeviceId));
+
+    pKernelGraphics->bug4208224Info.hClient = hClientId;
+    pKernelGraphics->bug4208224Info.hDeviceId = hDeviceId;
+    pKernelGraphics->bug4208224Info.hSubdeviceId = hSubdeviceId;
+
+    // rmapiutilAllocClientAndDeviceHandles allocates a subdevice object for this subDeviceInstance
+    primarySliSubDeviceInstance = gpumgrGetSubDeviceInstanceFromGpu(pGpu);
+
+    NV_ASSERT_OK_OR_RETURN(serverGetClientUnderLock(&g_resServ, hClientId, &pClientId));
+
+    gpumgrSetBcEnabledStatus(pGpu, NV_TRUE);
+
+    // As we have forced here SLI broadcast mode, temporarily reset the reentrancy count
+    sliLoopReentrancy = gpumgrSLILoopReentrancyPop(pGpu);
+
+    // Allocate subdevices for secondary GPUs
+    SLI_LOOP_START(SLI_LOOP_FLAGS_BC_ONLY)
+    {
+        NvHandle hSecondary;
+        NV2080_ALLOC_PARAMETERS nv2080AllocParams;
+        NvU32 thisSubDeviceInstance = gpumgrGetSubDeviceInstanceFromGpu(pGpu);
+
+        // Skip if already allocated by rmapiutilAllocClientAndDeviceHandles()
+        if (thisSubDeviceInstance == primarySliSubDeviceInstance)
+            SLI_LOOP_CONTINUE;
+
+        // Allocate a subDevice
+        NV_CHECK_OK_OR_GOTO(status, LEVEL_ERROR,
+            clientGenResourceHandle(pClientId, &hSecondary),
+            cleanup);
+
+        portMemSet(&nv2080AllocParams, 0, sizeof(nv2080AllocParams));
+        nv2080AllocParams.subDeviceId = thisSubDeviceInstance;
+
+        NV_CHECK_OK(status, LEVEL_SILENT,
+            pRmApi->AllocWithHandle(pRmApi,
+                                    hClientId,
+                                    hDeviceId,
+                                    hSecondary,
+                                    NV20_SUBDEVICE_0,
+                                    &nv2080AllocParams,
+                                    sizeof(nv2080AllocParams)));
+    }
+    SLI_LOOP_END;
+
+    //
+    // VidHeapControl and vaspace creation calls should happen outside GPU locks
+    // UVM/CUDA may be holding the GPU locks here and the allocation may subsequently fail
+    // So explicitly release GPU locks before RmVidHeapControl
+    //
+    rmGpuLocksRelease(GPUS_LOCK_FLAGS_NONE, NULL);
+    bAcquireLock = NV_TRUE;
+    pRmApi = rmapiGetInterface(RMAPI_API_LOCK_INTERNAL);
+
+    // Create a new VAspace for channel
+    portMemSet(&vaParams, 0, sizeof(NV_VASPACE_ALLOCATION_PARAMETERS));
+
+    vaParams.flags = NV_VASPACE_ALLOCATION_FLAGS_PTETABLE_HEAP_MANAGED;
+
+    NV_ASSERT_OK_OR_GOTO(status,
+        pRmApi->AllocWithHandle(pRmApi, hClientId, hDeviceId, hVASpace, FERMI_VASPACE_A, &vaParams, sizeof(vaParams)),
+        cleanup);
+
+    // Allocate gpfifo entries
+    portMemSet(&memAllocParams, 0, sizeof(NV_MEMORY_ALLOCATION_PARAMS));
+    memAllocParams.owner     = HEAP_OWNER_RM_CLIENT_GENERIC;
+    memAllocParams.type      = NVOS32_TYPE_IMAGE;
+    memAllocParams.size      = chSize;
+    memAllocParams.attr      = DRF_DEF(OS32, _ATTR, _LOCATION, _PCI);
+    memAllocParams.hVASpace  = 0; // Physical allocations don't expect vaSpace handles
+
+    NV_ASSERT_OK_OR_GOTO(status,
+        pRmApi->AllocWithHandle(pRmApi, hClientId, hDeviceId, hPBPhysMemId, NV01_MEMORY_SYSTEM, &memAllocParams, sizeof(memAllocParams)),
+        cleanup);
+
+    portMemSet(&memAllocParams, 0, sizeof(NV_MEMORY_ALLOCATION_PARAMS));
+    memAllocParams.owner     = HEAP_OWNER_RM_CLIENT_GENERIC;
+    memAllocParams.type      = NVOS32_TYPE_IMAGE;
+    memAllocParams.size      = chSize;
+    memAllocParams.attr      = DRF_DEF(OS32, _ATTR, _LOCATION, _PCI);
+    memAllocParams.flags     = NVOS32_ALLOC_FLAGS_VIRTUAL;
+    memAllocParams.hVASpace  = hVASpace; // Virtual allocation expect vaSpace handles
+                                         // 0 handle = allocations on gpu default vaSpace
+
+    NV_ASSERT_OK_OR_GOTO(status,
+        pRmApi->AllocWithHandle(pRmApi, hClientId, hDeviceId, hPBVirtMemId, NV50_MEMORY_VIRTUAL, &memAllocParams, sizeof(memAllocParams)),
+        cleanup);
+
+    // Allocate Userd
+    if (bClientUserd)
+    {
+        NvU32 userdMemClass = NV01_MEMORY_LOCAL_USER;
+        NvU32 ctrlSize;
+
+        if (gpuIsClassSupported(pGpu, VOLTA_CHANNEL_GPFIFO_A))
+        {
+            ctrlSize = sizeof(Nvc36fControl);
+        }
+        else if (gpuIsClassSupported(pGpu, TURING_CHANNEL_GPFIFO_A))
+        {
+            ctrlSize = sizeof(Nvc46fControl);
+        }
+        else
+        {
+            status = NV_ERR_NOT_SUPPORTED;
+            goto cleanup;
+        }
+
+        portMemSet(&memAllocParams, 0, sizeof(NV_MEMORY_ALLOCATION_PARAMS));
+        memAllocParams.owner = HEAP_OWNER_RM_CLIENT_GENERIC;
+        memAllocParams.size  = ctrlSize;
+        memAllocParams.type  = NVOS32_TYPE_IMAGE;
+
+        // Apply registry overrides to USERD.
+        switch (DRF_VAL(_REG_STR_RM, _INST_LOC, _USERD, pGpu->instLocOverrides))
+        {
+            case NV_REG_STR_RM_INST_LOC_USERD_NCOH:
+            case NV_REG_STR_RM_INST_LOC_USERD_COH:
+                userdMemClass = NV01_MEMORY_SYSTEM;
+                memAllocParams.attr = DRF_DEF(OS32, _ATTR, _LOCATION, _PCI);
+                break;
+
+            case NV_REG_STR_RM_INST_LOC_USERD_VID:
+            case NV_REG_STR_RM_INST_LOC_USERD_DEFAULT:
+                memAllocParams.attr = DRF_DEF(OS32, _ATTR, _LOCATION, _VIDMEM) |
+                                      DRF_DEF(OS32, _ATTR, _ALLOCATE_FROM_RESERVED_HEAP, _YES);
+                break;
+        }
+
+        NV_ASSERT_OK_OR_GOTO(status,
+            pRmApi->AllocWithHandle(pRmApi, hClientId, hDeviceId, hUserdId,
+                                    userdMemClass, &memAllocParams, sizeof(memAllocParams)),
+            cleanup);
+    }
+
+    // Get fifo channel class Id
+    classNum = kfifoGetChannelClassId(pGpu, GPU_GET_KERNEL_FIFO(pGpu));
+    NV_ASSERT_OR_GOTO(classNum != 0, cleanup);
+
+    // Allocate a bare channel
+    portMemSet(&channelGPFIFOAllocParams, 0, sizeof(NV_CHANNEL_ALLOC_PARAMS));
+    channelGPFIFOAllocParams.hVASpace      = hVASpace;
+    channelGPFIFOAllocParams.hObjectBuffer = hPBVirtMemId;
+    channelGPFIFOAllocParams.gpFifoEntries = gpFifoEntries;
+
+    //
+    // Set the gpFifoOffset to zero intentionally since we only need this channel
+    // to be created, but will not submit any work to it. So it's fine not to
+    // provide a valid offset here.
+    //
+    channelGPFIFOAllocParams.gpFifoOffset  = 0;
+    if (bClientUserd)
+    {
+        channelGPFIFOAllocParams.hUserdMemory[0] = hUserdId;
+    }
+
+    channelGPFIFOAllocParams.engineType = gpuGetNv2080EngineType(RM_ENGINE_TYPE_GR0);
+
+    NV_ASSERT_OK_OR_GOTO(status,
+        pRmApi->AllocWithHandle(pRmApi, hClientId, hDeviceId, hChannelId,
+                                classNum, &channelGPFIFOAllocParams, sizeof(channelGPFIFOAllocParams)),
+        cleanup);
+
+    // Reaquire the GPU locks
+    NV_ASSERT_OK_OR_GOTO(status,
+        rmGpuLocksAcquire(GPUS_LOCK_FLAGS_NONE, RM_LOCK_MODULES_GR),
+        cleanup);
+    bAcquireLock = NV_FALSE;
+    pRmApi = rmapiGetInterface(RMAPI_GPU_LOCK_INTERNAL);
+
+    // Get KernelGraphicsObject class Id
+    NV_ASSERT_OK_OR_GOTO(status,
+        kgraphicsGetClassByType(pGpu, pKernelGraphics, GR_OBJECT_TYPE_3D, &classNum),
+        cleanup);
+    NV_ASSERT_OR_GOTO(classNum != 0, cleanup);
+
+    // Allocate a GR object on the channel
+    NV_ASSERT_OK_OR_GOTO(status,
+        pRmApi->AllocWithHandle(pRmApi, hClientId, hChannelId, hObj3D, classNum, NULL, 0),
+        cleanup);
+
+cleanup:
+
+    if (bAcquireLock)
+    {
+        NV_ASSERT_OK_OR_CAPTURE_FIRST_ERROR(status,
+            rmGpuLocksAcquire(GPUS_LOCK_FLAGS_NONE, RM_LOCK_MODULES_GR));
+        pRmApi = rmapiGetInterface(RMAPI_GPU_LOCK_INTERNAL);
+    }
+
+    if (status != NV_OK)
+    {
+        // Drop GPU lock while freeing memory and channel handles
+        // Free all handles
+        NV_ASSERT_OK_OR_CAPTURE_FIRST_ERROR(status,
+            pRmApi->Free(pRmApi, hClientId, hClientId));
+    }
+
+    pKernelGraphics->bug4208224Info.bConstructed = (status == NV_OK);
+
+    // Restore the reentrancy count
+    gpumgrSLILoopReentrancyPush(pGpu, sliLoopReentrancy);
+
+    gpumgrSetBcEnabledStatus(pGpu, bBcStatus);
+
+    return status;
+}
+
+/*!
+ * @brief Determines if a channel for Bug 4208224 is needed
+ */
+NvBool
+kgraphicsIsBug4208224WARNeeded_TU102
+(
+    OBJGPU *pGpu,
+    KernelGraphics *pKernelGraphics
+)
+{
+    if (pGpu->getProperty(pGpu, PDB_PROP_GPU_IS_ALL_INST_IN_SYSMEM))
+    {
+        return NV_FALSE;
+    }
+
+    return kgraphicsGetBug4208224WAREnabled(pGpu, pKernelGraphics);
+}

src/nvidia/src/kernel/gpu/gr/kernel_graphics.c

@@ -87,6 +87,21 @@ static NV_STATUS _kgraphicsPostSchedulingEnableHandler(OBJGPU *, void *);
 static void
 _kgraphicsInitRegistryOverrides(OBJGPU *pGpu, KernelGraphics *pKernelGraphics)
 {
+    {
+        NvU32 data;
+
+        if (osReadRegistryDword(pGpu, NV_REG_STR_RM_FORCE_GR_SCRUBBER_CHANNEL, &data) == NV_OK)
+        {
+            if (data == NV_REG_STR_RM_FORCE_GR_SCRUBBER_CHANNEL_DISABLE)
+            {
+                kgraphicsSetBug4208224WAREnabled(pGpu, pKernelGraphics, NV_FALSE);
+            }
+            else if (data == NV_REG_STR_RM_FORCE_GR_SCRUBBER_CHANNEL_ENABLE)
+            {
+                kgraphicsSetBug4208224WAREnabled(pGpu, pKernelGraphics, NV_TRUE);
+            }
+        }
+    }
     return;
 }
 
@@ -299,6 +314,10 @@ kgraphicsStateInitLocked_IMPL
                                       NULL, NULL));
     }
 
+    pKernelGraphics->bug4208224Info.hClient      = NV01_NULL_OBJECT;
+    pKernelGraphics->bug4208224Info.hDeviceId    = NV01_NULL_OBJECT;
+    pKernelGraphics->bug4208224Info.hSubdeviceId = NV01_NULL_OBJECT;
+    pKernelGraphics->bug4208224Info.bConstructed = NV_FALSE;
     return NV_OK;
 }
 
@@ -349,6 +368,21 @@ kgraphicsStatePreUnload_IMPL
     NvU32 flags
 )
 {
+    if (pKernelGraphics->bug4208224Info.bConstructed)
+    {
+        RM_API *pRmApi = rmapiGetInterface(RMAPI_GPU_LOCK_INTERNAL);
+        NV2080_CTRL_INTERNAL_KGR_INIT_BUG4208224_WAR_PARAMS params = {0};
+
+        params.bTeardown = NV_TRUE;
+        NV_ASSERT_OK(pRmApi->Control(pRmApi,
+                     pKernelGraphics->bug4208224Info.hClient,
+                     pKernelGraphics->bug4208224Info.hSubdeviceId,
+                     NV2080_CTRL_CMD_INTERNAL_KGR_INIT_BUG4208224_WAR,
+                     &params,
+                     sizeof(params)));
+        NV_ASSERT_OK(pRmApi->Free(pRmApi, pKernelGraphics->bug4208224Info.hClient, pKernelGraphics->bug4208224Info.hClient));
+        pKernelGraphics->bug4208224Info.bConstructed = NV_FALSE;
+    }
 
     fecsBufferUnmap(pGpu, pKernelGraphics);
 
@@ -432,7 +466,7 @@ _kgraphicsPostSchedulingEnableHandler
     KernelGraphics *pKernelGraphics = GPU_GET_KERNEL_GRAPHICS(pGpu, ((NvU32)(NvUPtr)pGrIndex));
     const KGRAPHICS_STATIC_INFO *pKernelGraphicsStaticInfo = kgraphicsGetStaticInfo(pGpu, pKernelGraphics);
 
-    if (!IS_GSP_CLIENT(pGpu))
+    if (!IS_GSP_CLIENT(pGpu) && !kgraphicsIsBug4208224WARNeeded_HAL(pGpu, pKernelGraphics))
         return NV_OK;
 
     // Defer golden context channel creation to GPU instance configuration
@@ -463,7 +497,13 @@ _kgraphicsPostSchedulingEnableHandler
         }
     }
 
-    return kgraphicsCreateGoldenImageChannel(pGpu, pKernelGraphics);
+    NV_CHECK_OK_OR_RETURN(LEVEL_ERROR, kgraphicsCreateGoldenImageChannel(pGpu, pKernelGraphics));
+    if (kgraphicsIsBug4208224WARNeeded_HAL(pGpu, pKernelGraphics) && !pGpu->getProperty(pGpu, PDB_PROP_GPU_IN_PM_RESUME_CODEPATH))
+    {
+        return kgraphicsInitializeBug4208224WAR_HAL(pGpu, pKernelGraphics);
+    }
+
+    return NV_OK;
 }
 
 void

src/nvidia/src/kernel/gpu/mem_sys/kern_mem_sys_ctrl.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: Copyright (c) 1993-2023 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+ * SPDX-FileCopyrightText: Copyright (c) 1993-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
  * SPDX-License-Identifier: MIT
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
@@ -475,8 +475,11 @@ _kmemsysGetFbInfos
                         // It will be zero unless VGA display memory is reserved
                         if (pKernelMemorySystem->fbOverrideStartKb != 0)
                         {
+                            status = NV_OK;
                             data = NvU64_LO32(pKernelMemorySystem->fbOverrideStartKb);
-                            NV_ASSERT(((NvU64) data << 10ULL) == pKernelMemorySystem->fbOverrideStartKb);
+                            NV_ASSERT_OR_ELSE((NvU64) data == pKernelMemorySystem->fbOverrideStartKb,
+                                              status = NV_ERR_INVALID_DATA);
+                            
                         }
                         else
                         {

src/nvidia/src/kernel/gpu/nvenc/nvencsession.c

@@ -241,6 +241,7 @@ _gpuNvEncSessionProcessBuffer(POBJGPU pGpu, NvencSession *pNvencSession)
     NvU64 latestFrameEndTS;
     NvU64 processedFrameCount;
     NvU64 timeTakenToEncodeNs;
+    NvS64 timeDiffFrameTS;
     NVENC_SESSION_INFO_V1 *pSessionInfoBuffer;
     NVENC_SESSION_INFO_V1 *pLocalSessionInfoBuffer;
     NVENC_SESSION_INFO_ENTRY_V1 *pSubmissionTSEntry;
@@ -321,9 +322,6 @@ _gpuNvEncSessionProcessBuffer(POBJGPU pGpu, NvencSession *pNvencSession)
             break;
         }
 
-        // Update latest processed frame index.
-        latestFrameIndex = currIndex;
-
         // Validation : Check if submission-start-end frame ids match.
         if ((pSubmissionTSEntry->frameId != pStartTSEntry->frameId) || (pStartTSEntry->frameId != pEndTSEntry->frameId))
         {
@@ -335,6 +333,9 @@ _gpuNvEncSessionProcessBuffer(POBJGPU pGpu, NvencSession *pNvencSession)
             continue;
         }
 
+        // Update latest processed frame index.
+        latestFrameIndex = currIndex;
+
         // Add the difference of end timestamp and submission timestamp to total time taken.
         timeTakenToEncodeNs += (pEndTSEntry->timestamp - pSubmissionTSEntry->timestamp);
         processedFrameCount++;
@@ -355,11 +356,11 @@ _gpuNvEncSessionProcessBuffer(POBJGPU pGpu, NvencSession *pNvencSession)
         // Find time difference between latest processed frame end TS and last processed frame end TS in last callback.
         // Same is done for findng processed frame count.
         // This would provide a better average FPS value.
-        timeTakenToEncodeNs = latestFrameEndTS - pNvencSession->lastProcessedFrameTS;
+        timeDiffFrameTS = latestFrameEndTS - pNvencSession->lastProcessedFrameTS;
-        if (timeTakenToEncodeNs > 0)
+        if (timeDiffFrameTS > 0)
         {
             processedFrameCount = latestFrameId - pNvencSession->lastProcessedFrameId;
-            pNvencSession->nvencSessionEntry.averageEncodeFps = ((processedFrameCount * 1000 * 1000 * 1000) / timeTakenToEncodeNs);
+            pNvencSession->nvencSessionEntry.averageEncodeFps = ((processedFrameCount * 1000 * 1000 * 1000) / timeDiffFrameTS);
         }
         else
         {

src/nvidia/src/kernel/mem_mgr/video_mem.c

@@ -127,7 +127,7 @@ _vidmemPmaAllocate
     MemoryManager               *pMemoryManager = GPU_GET_MEMORY_MANAGER(pGpu);
     PMA                         *pPma           = &pHeap->pmaObject;
     NvU64                        size           = 0;
-    NvU32                        pageCount;
+    NvU32                        pageCount      = 0;
     NvU32                        pmaInfoSize;
     NvU64                        pageSize;
     NV_STATUS                    status;
@@ -266,6 +266,9 @@ _vidmemPmaAllocate
     allocOptions.alignment = NV_MAX(sizeAlign, pageSize);
 
     // Get the number of pages to be allocated by PMA
+    NV_CHECK_OR_RETURN(LEVEL_ERROR,
+        (NV_DIV_AND_CEIL(size, pageSize) <= NV_U32_MAX),
+        NV_ERR_NO_MEMORY);
     pageCount = (NvU32) NV_DIV_AND_CEIL(size, pageSize);
 
 retry_alloc:
@@ -277,7 +280,12 @@ retry_alloc:
     }
     else
     {
-        pmaInfoSize = sizeof(PMA_ALLOC_INFO) + ((pageCount - 1) * sizeof(NvU64));
+        NV_CHECK_OR_RETURN(LEVEL_ERROR,
+            portSafeMulU32((pageCount - 1), (sizeof(NvU64)), &pmaInfoSize),
+            NV_ERR_NO_MEMORY);
+        NV_CHECK_OR_RETURN(LEVEL_ERROR,
+            portSafeAddU32(pmaInfoSize, (sizeof(PMA_ALLOC_INFO)), &pmaInfoSize),
+            NV_ERR_NO_MEMORY);
     }
 
     // Alloc the tracking structure and store the values in it.

src/nvidia/src/kernel/rmapi/embedded_param_copy.c

@@ -596,6 +596,21 @@ NV_STATUS embeddedParamCopyIn(RMAPI_PARAM_COPY *paramCopies, RmCtrlParams *pRmCt
                             ((NV0000_CTRL_SYSTEM_GET_P2P_CAPS_PARAMS*)pParams)->busPeerIds,
                             numEntries, sizeof(NvU32));
             paramCopies[0].flags |= RMAPI_PARAM_COPY_FLAGS_SKIP_COPYIN;
+            numEntries = 0;
+
+            if (NvP64_VALUE(((NV0000_CTRL_SYSTEM_GET_P2P_CAPS_PARAMS*)pParams)->busEgmPeerIds) != NULL)
+            {
+                // The handler will check gpuCount * gpuCount against overflow
+                numEntries = ((NV0000_CTRL_SYSTEM_GET_P2P_CAPS_PARAMS*)pParams)->gpuCount *
+                             ((NV0000_CTRL_SYSTEM_GET_P2P_CAPS_PARAMS*)pParams)->gpuCount;
+            }
+
+            RMAPI_PARAM_COPY_INIT(paramCopies[1],
+                                  ((NV0000_CTRL_SYSTEM_GET_P2P_CAPS_PARAMS*)pParams)->busEgmPeerIds,
+                                  ((NV0000_CTRL_SYSTEM_GET_P2P_CAPS_PARAMS*)pParams)->busEgmPeerIds,
+                                  numEntries, sizeof(NvU32));
+            paramCopies[1].flags |= RMAPI_PARAM_COPY_FLAGS_SKIP_COPYIN;
+            paramsCnt++;
             break;
         }
         case NV0080_CTRL_CMD_FB_GET_CAPS:
@@ -1009,9 +1024,18 @@ NV_STATUS embeddedParamCopyOut(RMAPI_PARAM_COPY *paramCopies, RmCtrlParams *pRmC
 #endif
         case NV0000_CTRL_CMD_SYSTEM_GET_P2P_CAPS:
         {
+            NV_STATUS peerIdsStatus;
             CHECK_PARAMS_OR_RETURN(pRmCtrlParams, NV0000_CTRL_SYSTEM_GET_P2P_CAPS_PARAMS);
-            status = rmapiParamsRelease(&paramCopies[0]);
+
+            peerIdsStatus = rmapiParamsRelease(&paramCopies[0]);
             ((NV0000_CTRL_SYSTEM_GET_P2P_CAPS_PARAMS*)pParams)->busPeerIds = paramCopies[0].pUserParams;
+
+            status = rmapiParamsRelease(&paramCopies[1]);
+            ((NV0000_CTRL_SYSTEM_GET_P2P_CAPS_PARAMS*)pParams)->busEgmPeerIds = paramCopies[1].pUserParams;
+
+            if (peerIdsStatus != NV_OK)
+                status = peerIdsStatus;
+
             break;
         }
         case NV0080_CTRL_CMD_FB_GET_CAPS:

version.mk

@@ -1,4 +1,4 @@
-NVIDIA_VERSION = 555.42.02
+NVIDIA_VERSION = 555.52.04
 
 # This file.
 VERSION_MK_FILE := $(lastword $(MAKEFILE_LIST))