Re: [PATCH v6 2/2] gpu: nova-core: add support for GPU timer block. (v6)

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] gpu: nova-core: wrapped timer offset programmed in
  set_sys_timer_offset()
--

commit 7d2284f17f67e098294d4252bcce87d29a2a59b1
Author: Dave Airlie <airlied@redhat.com>

gpu: nova-core: add support for GPU timer block. (v6)

This commit adds GPU timer block initialization for Turing through
Blackwell GPUs to compute the system timer offset for GSP initialization,
including a GH100 FSP ucode version check for bug 3957833.

> diff --git a/drivers/gpu/nova-core/timer/hal/gh100.rs b/drivers/gpu/nova-core/timer/hal/gh100.rs
> new file mode 100644
> index 0000000000000..154c7a301a0c1
> --- /dev/null
> +++ b/drivers/gpu/nova-core/timer/hal/gh100.rs

[ ... ]

> +fn set_sys_timer_offset(bar: Bar0<'_>, fsp: &Fsp<'_>, time_ns: u64) -> Result<u64> {
> +    let sec_timer_ns = sec_timer_read(bar);
> +
> +    let sys_timer_offset_ns = time_ns.wrapping_sub(sec_timer_ns);
> +
> +    // Don't set the timer offset registers on buggy firmware
> +    if !fsp.is_bug_3957833_affected(bar) {
> +        bar.write_reg(NV_PGC6_SCI_SYS_TIMER_OFFSET_1::from_nsec(
> +            sys_timer_offset_ns,
> +        ));
> +        bar.write_reg(
> +            NV_PGC6_SCI_SYS_TIMER_OFFSET_0::from_nsec(sys_timer_offset_ns).with_update(true),
> +        );
> +    }
> +    Ok(sys_timer_offset_ns)
> +}

[Severity: Medium]
As reported by Alexandre Courbot on v4 [1], can set_sys_timer_offset()
program a wrapped value into NV_PGC6_SCI_SYS_TIMER_OFFSET_1 and
NV_PGC6_SCI_SYS_TIMER_OFFSET_0 when sec_timer_ns exceeds time_ns?

If the host wall-clock time is behind the GPU secure timer, wrapping_sub()
produces a large wrapped u64 that nsec_hi() truncates to 61 bits when
writing the hardware offset registers while returning the unmasked 64-bit
value for GSP initialization.  In OpenRM, tmrSetCurrentTime_GH100 verifies
secTimerNs < osTimeNs and returns early without programming the offset
registers if the delta is not positive, with the caller logging and
ignoring the error.

[1] https://lore.kernel.org/r/DMO7FUYY05LK.123ZPLIW24C2S@nvidia.com

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109-nova-timer-v6-0-5544a3bd8b28@redhat.com?part=2