Open-IOV vGPU-IO: host-side GSP emulation for unmodified NVIDIA guest drivers https://git.vgpu.io/open-iov.git/atom?h=refactor%2Fhost-gsp-emulation 2026-09-21T17:06:51+00:00 2026-09-21T17:06:51+00:00 Arthur Hanson Rasmusson arthur@vgpu.io 2026-09-21T17:06:51+00:00 urn:sha1:c3a295efd1b1132bbaa5d422cd05b3fa8e89a8bf CRITICAL FIXES (guest driver bring-up): - gsp_emulation.c: emulation engine bound to the WRONG BAR0 - it polled the host physical BAR0 (bars[0].vaddr ioremap) for the doorbell and read RPCs from a local dma_alloc_wc buffer, while the guest writes land in the vzalloc'd bar0_shadow. The RPC path could never work; PBA writes even corrupted the host GPU's physical BAR0+0x3000. gsp_emu_init now binds exclusively to bar0_shadow (doorbell/mailbox/PBA aliases; shared_mem_dma==0 marks the alias so cleanup never dma_free's it). - main.c SET_IRQS: DATA_EVENTFD eventfds were DISCARDED ('TODO' + kfree) - the guest never received MSI-X completions. Full wiring now: eventfd_ctx_fdget per vector, fd -1 clears, dev_close releases refs. gsp_emu_inject_completion_interrupt looks up vgpu->irqs[0].trigger LIVE (init-time copy was permanently NULL since QEMU wires after gsp_emu_init). - gsp_rpc_client.c: BAR_TRAP/MIGRATE in emulation mode called gsp_rpc_submit_raw which rings the SAME doorbell the thread polls - self-triggered RPC livelock + multi-second stalls. Now fail fast with -ENOTSUPP + pr_warn_ratelimited (guest BAR access is direct MMIO). MORE FIXES: - main.c: nv_vgpu_config_write returned SIZE_MAX (while(count--) wrap) and was dead code while the VFIO write handler did unfiltered byte copies (guest could rewrite vendor ID/BARs). Return fixed; VFIO write handler now routes through the per-register filter. - kernel/Makefile: M=$(PWD) used the env var which is stale when invoked via the top-level make (pointed at repo root -> kbuild silently built NOTHING; explains every 'stale .ko' incident). Now M=$(CURDIR). - Warnings sweep: header prototypes for mdev/type functions, format casts in gsp_comm.c DRY-RUN logs, unused variable. ROBUSTNESS (harness/tooling): - vgpu_vm.py: run had no timeout (start could block forever); guest_shell recv could block forever on a wedged guest. Both now bounded; guest_shell pre-flights guest-ping and reports wedge diagnostics. - stack_manager.sh: qemu/qemu-debug now launch via the vgpu_vm.py harness (workflow rule: never raw QEMU). REPO REORGANIZATION: - driver/ (legacy guest-side gsp-vgpu.ko) moved to legacy-driver-guest/ (reference only, not built; README explains). 3 legacy un-buildable test files moved to legacy-driver-guest/kernel-tests/. Top-level Makefile cleaned of the dead DRIVER_DIR reference. DOCUMENTATION SUITE (new): - docs/GSP_EMULATION_ARCHITECTURE.md - emulator deep-dive: shadow BAR0 model, doorbell protocol, dispatch table, MSI-X path, lifecycle, memory- model caveats - docs/DEBUGGING.md - QEMU GDB stub workflow, serial console, QMP NMI, failure taxonomy, full bring-up validation checklist, EPT-livelock case study, version-matrix discipline - docs/ONBOARDING.md - repo tour, coding standards (incl. virt_to_phys / dma_addr_t / get-put rules), first build & test - docs/VERSION_UPGRADE.md - end-to-end new-driver-version procedure (firmware fetch, Ghidra analysis, configs, signatures, validation) - docs/PERFORMANCE.md - bare-metal A/B methodology + targets - README.md doc index; STATE.md refreshed; DEVELOPMENT_WORKFLOW.md corrected (load order: open-iov-vfio BEFORE nvidia; stock-driver blacklist note) 2026-09-21T16:37:46+00:00 Arthur Hanson Rasmusson arthur@vgpu.io 2026-09-21T16:37:46+00:00 urn:sha1:5d4d26f8e773f2871c1b5c9266b82495d390970e VFIO mmap (main.c): virt_to_phys() was used on vmalloc-family addresses (vzalloc'd BAR0 shadow, ioremap'd BAR2/3), producing garbage PFNs. Guest BAR0 access then hit a KVM make_spte reserved-bits WARN and an EPT-violation livelock, hard-wedging the guest on every nvidia driver probe (confirmed via QEMU GDB stub). BAR0 now maps per-page via vmalloc_to_pfn(); BAR2/3/4/5 map bars[N].gpa directly (like BAR1); config space uses new nv_vgpu_mmap_virt_to_pfn() helper. mdev remove path (main.c): old path never list_del'd the device (available_instances leaked), never ran cleanup (leaked gsp_emu kthread), never unregistered VFIO (leaked /dev/vfio/N + iommu group), never put pdev, never freed the struct. New kvmgt-style path: cancel init_work -> wait fds -> vfio_unregister_group_dev -> cleanup work -> list_del -> pci_dev_put -> vfio_put_device. gsp_rpc_client.c: fix dma_map_page dma_addr_t->int truncation in gsp_rpc_alloc_emul (corrupts >=4GB IOVAs); export gsp_client_init_emulation. gsp_emulation.c: export gsp_emu_process_rpc and gsp_emu_get_stats. main.c: remove wrong MODULE_SOFTDEP("pre: nvidia") - module has zero nvidia imports, loads standalone, and must load BEFORE nvidia.ko (it exports nvidia_vgpu_vfio_* for nvidia.ko to import). nvidia-vgpu-vfio.h: NULL-safe nv_vgpu_{dbg,info,warn,err} macros. tests/gsp_emulation_test.c: rewritten against current API - drives gsp_emu_process_rpc() with crafted shared-memory messages (protocol validation, SCHEDULE/YIELD/NOTIFY/DEBUG dispatch, stress). Builds with KBUILD_EXTRA_SYMBOLS; depends: open-iov-vfio. stack_manager.sh: vfio_mdev doesn't exist on >=6.4 (probe per-module); load-nvidia detects foreign nvidia via /sys/module/nvidia/version and errors with guidance instead of silently skipping. 2026-09-21T15:30:46+00:00 Arthur Hanson Rasmusson arthur@vgpu.io 2026-09-21T15:30:46+00:00 urn:sha1:79d86fe350eaa520cda91b3832d30b085d9bcd6f The mdev core's shared parent->available_instances counter leaks whenever an mdev remove path fails to complete (as happened during the now-fixed remove crash): creates then fail with -EUSERS while sysfs reports 0 available instances with zero mdevs present. Implement mdev_driver.get_available to compute availability from the driver's own authoritative device list instead of the core counter. Handles the 'nvidia-' prefixed sysfs type names when looking up per-type max_instances (falls back to 1). 2026-09-21T15:09:36+00:00 Arthur Hanson Rasmusson arthur@vgpu.io 2026-09-21T15:09:36+00:00 urn:sha1:ad1f7a6a3cd262cc084673ec5cf0c561328ec7c7 - install.sh: one-command fresh-Ubuntu reproduction (deps, NVIDIA clone + patch, GSP firmware fetch from linux-firmware.git with objcopy .fwimage extraction + MD5 verify, ordered build, host config, load, mdev creation). Wrapper-neutral: works with libvirt/raw QEMU. - patches/nvidia: regenerated path-independent patch (KBUILD_EXTRA_SYMBOLS resolved via $(src)/$(CURDIR) relative to the NVIDIA tree). - scripts/stack_manager.sh and helper scripts auto-detect repo root (OPEN_IOV_ROOT override); no hardcoded developer paths anywhere. - firmware analysis scripts use script-relative paths (also fixes stale firmware/570-GSP references); docs/wiki updated to $OPEN_IOV_ROOT. - .github/workflows/ci.yml updated for standalone repo layout; firmware fetched from linux-firmware in CI. - Untrack remaining kbuild artifacts (Module.symvers, modules.order, *.o.d); gitignore them. - STATE.md: live project state, limitations, fixed/open bugs. - README.md: rewritten for clone-and-run reproducibility. 2026-09-21T14:40:30+00:00 Arthur Hanson Rasmusson arthur@vgpu.io 2026-09-21T14:40:30+00:00 urn:sha1:7400361f8e5c47c2c36c6598c7006017ba62d945 - Fix vendor/device/subsys ID byte order from vGPU type info - BAR0: 16MB 32-bit non-prefetchable (matches physical TU104) - BAR1: 256MB 64-bit prefetchable VRAM (consumes BAR2 upper half) - BAR3: 32MB 64-bit prefetchable (consumes BAR4 upper half) - Subsystem vendor/device IDs at correct offsets 0x2C/0x2E - MSI-X: 32 vectors (table size 31), chain to PCIe cap at 0x80 - Capabilities pointer at 0x34 -> PM at 0x40 - Interrupt pin INTA at 0x3D 2026-09-14T10:43:11+00:00 Arthur Hanson Rasmusson arthur@vgpu.io 2026-09-14T10:43:11+00:00 urn:sha1:5dd8165f1754e156a0f9fb16c7a6bfa90e99ed60 - Removed IOMMU group addition before vfio_register_emulated_iommu_dev() in nv_vgpu_mdev_create() - Added IOMMUFD callbacks (bind_iommufd, unbind_iommufd, attach_ioas, detach_ioas) using kernel's vfio_iommufd_emulated_* functions - Implemented VFIO ioctl handlers: GET_INFO, GET_REGION_INFO, GET_IRQ_INFO, SET_IRQS, MMAP - Added config space read/write handlers at offset 0x70000000000 - Mmap handler for config space, BAR0 (emulation shadow), BAR1-5 (physical VRAM/registers) - Interrupt handler for VFIO_DEVICE_SET_IRQS (DATA_EVENTFD, DATA_NONE, DATA_BOOL) - Added udev rules for vfio group permissions - Created stack_manager.sh unified tool - Fixed mdev remove crash with deferred cleanup in vfio_device_release callback - Kernel 6.8+ IOMMUFD compatibility - QEMU launches successfully with vGPU passthrough 2026-09-14T02:17:09+00:00 Arthur Hanson Rasmusson arthur@vgpu.io 2026-09-14T02:17:09+00:00 urn:sha1:9a7263fce4e3156349a526631805fce66b87fb1b - Implemented nv_vgpu_mdev_register_parent() using mdev_register_parent() API with nv_vgpu_mdev_types array for proper mdev parent registration - Added ioctl NV_VGPU_IOCTL_REGISTER_VGPU_TYPE for userspace vGPU type registration - Created separate header nv-vgpu-vfio-interface-nvidia.h for nvidia.ko with only extern declarations to avoid duplicate symbol exports - Used KBUILD_EXTRA_SYMBOLS to provide only needed symbols (nvidia_vgpu_vfio_*) - Updated create_mdev.sh to use correct mdev type names (pci-nvidia-vgpu-*) - Updated load_vgpu_stack.sh to load open-iov-vfio.ko before nvidia.ko Result: 4 mdev types now show available_instances=8, mdev creation successful 2026-09-13T23:28:03+00:00 Arthur Hanson Rasmusson arthur@vgpu.io 2026-09-13T23:28:03+00:00 urn:sha1:bfd269ee74d166be4f386640f8b5daad31d5d6ed - Firmware Analyzer: Runtime firmware signature computation (CRC32, SHA256) and pattern-based RPC handler address discovery - Dynamic RPC Dispatcher: Version-aware dispatch with native firmware handlers (550/560/570/580) and emulation fallback - Hardware Architecture Layer: Turing, Ampere, Blackwell configs with BAR layouts, doorbell offsets, MSI-X vectors - Driver Version Adaptation Layer: Feature detection per driver version - Declarative YAML configs for hardware (turing/ampere/blackwell) and versions (550/560/570/580) - Kernel unit tests for GSP emulation (gsp_emulation_test.c) - Test infrastructure scripts (test_gsp_emu.sh, test_guest_driver.sh, test_cuda_workloads.sh, test_graphics_workloads.sh, test_windows_guest.sh, test_vgpu_stack.sh) - Updated kernel Makefile with new source files 2026-09-13T23:18:21+00:00 Arthur Hanson Rasmusson arthur@vgpu.io 2026-09-13T23:18:21+00:00 urn:sha1:7adef330df18691acabda9f5c988742f23a2917d - Enhanced gsp_rpc_client.c with proper emulation implementations: - ALLOC/FREE: VRAM allocation tracking with host page allocation and DMA mapping - MAP/UNMAP: GPU VA mapping management - PIN/UNPIN: DMA address retrieval for pinned pages - SCHEDULE/YIELD: Local workqueue-based scheduling - NOTIFY: Callback registration for async events - Added emulation function declarations to gsp_rpc_client.h - Exported nv_vgpu_simple_mapping struct in memory.h for cross-file use - Updated RPC handlers to use gsp_rpc_emulation_is_enabled() accessor - All 12 RPC types now have functional emulation fallbacks 2026-09-13T23:11:39+00:00 Arthur Hanson Rasmusson arthur@vgpu.io 2026-09-13T23:11:39+00:00 urn:sha1:8e64754d9980d2423f1907ae184ec46e63e5ff7e - Enhanced PCI config space write handlers in main.c: - Added MSI-X Message Control (0x72-0x73) write support - Added MSI-X Table Offset/BIR (0x74-0x77) write support - Added MSI-X PBA Offset/BIR (0x78-0x7B) write support - Enhanced BAR emulation in bar_emulation.c: - Added MSI-X Table emulation (32 entries at BAR0+0x2000) - Added MSI-X PBA emulation (64-bit at BAR0+0x3000) - Added nv_vgpu_msix_set_pending/clear_pending for interrupt injection - Integrated with GSP emulation constants from gsp_emulation.h - Updated bar_emulation.h with MSI-X struct definitions and function declarations - Added GSP emulation constants to gsp_emulation.h (MSIX offsets, polling params)