diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-18 15:10:58 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-18 15:12:26 -0400 |
| commit | b7c1cff5f290ae19ceca47f4d0bb9024eb45146c (patch) | |
| tree | bfcbcefc54833f140d270e9e176aa412f1862a10 | |
| parent | dec59afafa6ecae494404bd78a5c527c7603b03b (diff) | |
| download | open-iov-b7c1cff5f290ae19ceca47f4d0bb9024eb45146c.tar.gz open-iov-b7c1cff5f290ae19ceca47f4d0bb9024eb45146c.zip | |
vgsp: fail4 r229 - REC-DUMP per-rec VA->HPA->reloc census at submit
The r229 ctaid_probe came back as: PROBE1 (coordinate map) perfect, PROBE2
(flat A read) wrong at every element - band 0 read A's own values at
wildly wrong offsets (16382/16383 = A's last elements), bands >= 1 read
float-typed data. Writes are flawless; the engine's READ of a freshly
H2D'd 64 KB buffer returned foreign content, so before anything else the
next capture needs the exact (va, hpa, reloc_va) triples the engine will
read for that launch.
REC-DUMP logs the submit's rec table at launch build time: all recs for
small launches (n_data <= 64, the probe class), first/last 8 for larger
ones, gated by gsp_phys_gr_copyout_dump. Comparing the A buffer's recs
against the H2D landing (and against each other: distinct VAs collapsing
onto one HPA, or HPAs outside the uploaded range) names the wrong-read
source directly. Logging-only; greens safe.
(cherry picked from commit f83ef995c17fba896950cc7f1818c65ac8839ac4)
| -rw-r--r-- | kernel/gsp_phys_booter.c | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index d32d588..7b6a1bf 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -18727,6 +18727,28 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, qmd[15], qmd[17], qmd[18], qmd[19]); /* + * REC-DUMP (r229): the probe-class launches (small data sets) get + * their full rec table logged - every (va, hpa, reloc_va) the engine + * will read/write - so the next capture can compare the resolved + * HPAs against the buffer the client actually uploaded (distinct + * VAs collapsing onto one HPA, or HPAs in a foreign range, are + * visible directly). Big launches log the first/last 8 recs only. + */ + if (gsp_phys_gr_copywit_enabled() && req->n_data) { + u32 d; + + for (d = 0; d < req->n_data; d++) { + if (req->n_data > 64u && d >= 8u && + d < req->n_data - 8u) + continue; + pr_info_ratelimited("vgsp-gr: REC-DUMP[%u/%u] va=0x%llx hpa=0x%llx reloc=0x%llx\n", + d, req->n_data, req->data[d].va, + req->data[d].hpa, + req->data[d].reloc_va); + } + } + + /* * Pages: Tier 1 maps the resolved HPA at the guest VA; a page without * a usable Tier-1 mapping falls to Tier 2 when captured inline bytes * cover it and a QMD pointer pair names it (the pair is rewritten to |