summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* sema: fix GR counter-slot mapping to fixed pool total (20)Arthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | The counter slot for GR rank r is 0x20400fec0 + (TOTAL-1-r)*0x10 with TOTAL the fixed pool total. The autoreg used a live high-water channel count instead; channels register progressively, so an early pass with a partial count (16) registered the ranks present at the wrong slots and every later rank's correct slot was then rejected as owned. Result: ranks 10..19 never got a counter, no counter was ever published, and the client's userspace tracker never advanced (cudaMalloc stall while the guest RM polled MC_SERVICE_INTERRUPTS). Validated on a live boot: 20/20 slots registered with 0 collisions (previously ranks 6..9 installed at the n_gr=16 mapping and ranks 10..19 rejected).
* vgsp+guest-diag: kcore-truth pin resolver (pool/pushbuffer/channel ↵Arthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | | | | | | | | | ring+userd) + GR ring userd-derived candidates guest_pin_stream.py now resolves translations entirely from guest truth via /proc/kcore + a manual page-table walk (no QMP races): the CE semaphore pool and pushbuffer memory from the UVM rm_mem structures, and each channel's GPFIFO ring + GPPUT from the tracking semaphore's embedding uvm_channel_t (channel_info located by its gpFifoGpuVa value). This removes the watcher pipeline's flakiness on the cudaMalloc stall class (missing pool/pushbuffer pins). gsp_sema_service.c: svc_gr_ring_autopin tries the guest-registered USERD memdesc base as a ring candidate (the fixed FB convention only matches when the guest's VRAM allocator happens to reproduce the old layout), plus an optional (gsp_sema_dbg) one-shot FB scan + raw-word diagnostics when every candidate fails. tools/cuda-ab/p2: self-checking arbitrary-kernel acceptance suite (10 programs: sequential launches, shapes, params, smem/GEMM, streams, malloc churn, printf+error, FMA benchmark, mixed, managed probe) with host oracle expectations and a guest runner.
* guest-diag: move the guest SSH port-forward to the NIC the guest usesArthur Hanson Rasmusson4 days
| | | | | | | | The hostfwd tcp::2222-:22 sat on the rtl8139 NIC (net0, guest enp0s7, DOWN); the guest networks over the legacy -net user NIC (enp0s2, 10.0.2.15), so SSH to the guest timed out during banner exchange. Move the forward to the legacy NIC (net0 loses it) - ssh -p 2222 now reaches the guest and key auth works.
* tools: stream UVM trace via trace_pipe in the guest pin scanner (kill the ↵Arthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | | | | second-client stall race) The guest scanner's TraceReader tailed the last 256 KB of the trace ring every 0.3 s. A one-shot uvmt sem= event could age out of that window before the next poll (the client's spin floods the ring), so a second client in the same VM was never discovered: semfix re-pinned the previous client's freed sem while the new client's push page stayed untranslated (host nomap, drain held, guest spins forever). - guest_pin_stream.py: consume /sys/kernel/tracing/trace_pipe instead (each event delivered exactly once; no ring-window race), with reconnect on read error. The old ring-tail read is kept only as semfix's fallback. - clear the trace ring on every client switch so the fallback cannot re-learn the previous client's stale events.
* tools: arm UVM kprobes deterministically (modprobe+wait+verify) and retry ↵Arthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | | | | | | | | pushbuffer pins Root cause of the cudaMalloc/UVM-init stall on our bring-up path: guest_kprobes.sh ran while nvidia_uvm was not yet loaded (it loads lazily with the first CUDA client), so every probe add failed silently (symbols not in kallsyms) and the host never got the #sem -> pushbuffer-pin pipeline. The CE push page (0x120021db8) then never translated and the guest spun forever at DEVICE. - guest_kprobes.sh: modprobe nvidia_uvm, wait (bounded 30 s) for the uvmt symbol, install, and print KP_ARMED/KP_FAIL for bring-up checks. - semfix_watch.pin_pushbuffer: retry transient/partial gva2gpa misses in-call (bounded passes with a short sleep) instead of aborting on the first all-miss block; report unresolved page counts. Validated: 2/2 cold boots (vmkeep6/7) arm the probes and run victory_mail green in 15-20 s (MAIL + VADD bad=0 checksum=12204516 + STATUS OK, oracle-matched); pre-fix boots with unarmed probes stalled 4/4.
* scripts: create_mdev.sh honors VGPU_MDEV_TYPE (VGPU_MDEV_TYPE=<type> ↵Arthur Hanson Rasmusson4 days
| | | | ./create_mdev.sh [bdf])
* vgsp: m143 (1.0 P1) - 2GiB turing type, BAR1 size = fb_emul_size, script ↵Arthur Hanson Rasmusson4 days
| | | | accepts -1g/-2g
* vgsp: m140 - resolve 33 pages/pointer (128KB buffers with 0x400 in-page ↵Arthur Hanson Rasmusson4 days
| | | | offset span 33 pages; tails read the next reloc record)
* vgsp: m137 - CE-hold liveness watchdog (bound deferred CE waits across ↵Arthur Hanson Rasmusson4 days
| | | | passes; targets the guest cudaMalloc stall class)
* vgsp: m135 - never relocate param offsets < 0x100 (header server-VA ↵Arthur Hanson Rasmusson5 days
| | | | corrupted vadd blockDim -> one-CTA result); pre-rewrite/final header dumps
* vgsp: m134 - re-apply the data-pointer relocation after the inline-data ↵Arthur Hanson Rasmusson5 days
| | | | replay (inline records restored the original guest pointers into the engine-mapped page; root cause of the param-read wall)
* vgsp: m133 - move the win0 shadow pool to a fresh PTE line (slots ↵Arthur Hanson Rasmusson5 days
| | | | 0x190..0x197) + win0 content and PT-slot diagnostics (the slot-0x108 line reads stale to the SM data path)
* vgsp: m132 - unique marker in spare bounce page 101 (prove SM data-path ↵Arthur Hanson Rasmusson5 days
| | | | reach for probes)
* vgsp: m130 - mirror write readback diagnostic (does the guest-page pointer ↵Arthur Hanson Rasmusson5 days
| | | | patch land?)
* vgsp: m129 - mirror relocated data pointers into the guest param page (SM ↵Arthur Hanson Rasmusson5 days
| | | | c[0x0] reads the guest page, not the shadow)
* vgsp: m128 - post-success qmdwin w48..51 dump (read probe dumps from the ↵Arthur Hanson Rasmusson5 days
| | | | success path)
* vgsp: m124 - reset the window-0 shadow slot cursor per launch (second launch ↵Arthur Hanson Rasmusson5 days
| | | | collided with the bounce window)
* vgsp: m121 - resolve param-page kernel-argument pointers (offsets >= 0x150) ↵Arthur Hanson Rasmusson5 days
| | | | before the bounce cap
* vgsp: m120 - data-fill 32 pages/ptr under the 100 cap + rewrite hit/coverage ↵Arthur Hanson Rasmusson5 days
| | | | logging + param 0x150 dump + main-PT slot dump
* cuda-ab: rebuild run/victory_mail for the native path (n=1<<15, param-based ↵Arthur Hanson Rasmusson5 days
| | | | | | | | mail) The run/ binary was the Oct 4 build (4 MB buffers, __device__ kMail); ab.sh push_bin only builds when the binary is absent, so the guest shipped the stale build. This is the rebuilt binary matching today's .cu.
* vgsp: m118 - data fill candidates at page granularity (runs start at the ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | pointer page) m110 collected candidate windows at 2 MB granularity, so the 64-page runs started at the window base and never covered the pointer pages themselves - the bank/param pointers matched no record and were never rewritten (m117: only 2 relocations, trap unchanged). Collect candidate pages instead.
* vgsp: m117 - 8-byte stride + 256-alignment guard for the pointer rewriteArthur Hanson Rasmusson5 days
| | | | | | | m116's param dump exposed the m103 4-byte-stride scan corrupting small adjacent fields (0x40/1 rewritten into relocated-looking values). Use 8-byte stride, require 256-byte-aligned values (all device pointers), and skip records without a reloc VA.
* cuda-ab: victory_mail native-path sizing + param-based mail messageArthur Hanson Rasmusson5 days
| | | | | | | | | Two changes for the native GR path: vadd buffers shrink to 1<<15 elements (128 KB each) so all data fits the engine-visible 2 MB window, and mail_kernel receives the message as a kernel-parameter buffer instead of a __device__ constant (the c[0x4] module-data base is driver-populated and is zero in the forwarded launch). The guest binary must be rebuilt in tools/cuda-ab/run (ab.sh push_bin only builds when the binary is absent).
* vgsp: m114 - pre-commit bounce window for the kernel's data (native run w/ ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | copy-in/out) Decisive evidence: the SM walker resolves only the commit-time tree (every late write/install fails: m94, m99-m113; UNSET refused 0x1f). Plant a 112-page bounce window into the main small-PT at stage 3 (slots 0x110..0x17f - the proven win0 pattern), copy the launch's resolved data pages in, pointers are already rewritten to those VAs, and copy results back after the release. The mail message lives at bounce page 100 (c[0x4][0x0]=0x174000). Data cap 100 pages (440 KB), matching the shrunk victory_mail (3 x 128 KB).
* vgsp: m113 - re-register the VAS page directory after planting data ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | (re-commit probe) All late engine-tree writes are invisible to the SM walker (only the commit-time snapshot resolves); the mail injection at a main-window fresh slot also fails (m112). Probe whether UNSET+SET_PAGE_DIRECTORY on the ladder VAS after planting forces the server walker to re-snapshot the tree; gated by gr_recommit.
* vgsp: m112 - mail window VA is absolute 0x1f0000 (slot 0x1f0 of the main window)Arthur Hanson Rasmusson5 days
| | | | | m111's mret=-34: mva was BASE+0x1f0000 = 0x200000, outside the 2 MB main window. Use the absolute VA 0x1f0000.
* vgsp: m111 - prepare the mail page unconditionally in stage 3Arthur Hanson Rasmusson5 days
| | | | | | m110 ran without gr_data_prewin, and the mail prep was nested inside that block - mail.pages stayed 0 and the injection failed with EINVAL. Move the mail page preparation out; it is 4 KB and harmless.
* vgsp: m110 - relocate data into the engine-walkable main-PT window; shrink ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | the demo All UPDATE_PDE_2 installs (post- or pre-commit) are invisible to the SM walker; the only window it honours is the commit-time main small-PT page (VA 0x100000+, the proven win0/const window). Relocate each candidate data pointer's first 64 pages into slots 0x110..0x1f0 of that window (fresh PTE lines, direct leaf writes), rewrite bank pointers per page record, and put the mail page at the reserved slot 0x1f0 (c[0x4][0x0]=0x1f0000). Shrink victory_mail's buffers (n=1<<15, 128 KB each) to fit the 2 MB window.
* vgsp: m109 - fix the mail window VA precedence: (BASE + ((WINS-1) << 21))Arthur Hanson Rasmusson5 days
| | | | | | m108's mret=-34 (ERANGE): the shift bound tighter than expected in the written expression, making mva = (0x100000000 + 31) << 21, outside the pool. Parenthesize.
* vgsp: m108 - prepare the mail page in stage 3 (launch-time alloc failed)Arthur Hanson Rasmusson5 days
| | | | | | | | m107's inject entry showed mail.pages=0 after the launch-time dma_alloc_coherent attempt: the allocation fails silently there. Allocate and fill the message page in stage 3 alongside the data PT pool (proven to allocate fine), and at launch only map it into pool window 31 and patch c[0x4][0x0]; log the map result either way.
* vgsp: m107 - debug the bank-4 injection path: launch-opts print + ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | unconditional inject m106's bank-4 injection silently did not fire although the insmod args carried mail_patch=1 and the stage-3 data pool installed. Print the getter values at launch and log the injection entry (w0/w1/mail.pages/pt31.pages), then inject unconditionally when bank-4 is processed so the pool-backed mail page (window 31) is exercised either way.
* vgsp: m106 - pre-install the data PT window pool in stage 3 (pre-commit)Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | Post-commit UPDATE_PDE_2 installs are accepted (status 0x0) but ineffective (m94's scratch windows, m101-m105's reloc windows: the SM never resolves them), while the stage-3 ctx-window installs are honoured. Add a fixed 32-window pool at GSP_PHYS_RMCALL_VA_GR_DATA_BASE (0x100000000 + k<<21, inside the server-managed region), each backed by a module PT page installed through UPDATE_PDE_2 during stage 3; the engine data map then only writes leaf PTEs into those fresh PT pages at launch (the P6b-proven 'direct leaf write into a walker-installed fresh table' pattern). The mail injection uses the reserved last window (k=31); service data windows cap at 31 and use the same fixed layout.
* vgsp: m105 - route every const-bank page through the proven window-0 poolArthur Hanson Rasmusson5 days
| | | | | | | | | Only QMD words 32 (param) and 48 (program) went to the engine-proven window-0 pool; banks 1/3/4/7 (words 34..46) fell to the window-1 scratch path, which the SM appears not to resolve (m94's pre-SM failure, and the bank-4 value never reaching the kernel: m104's injected base read back as zero through the ULDC). Route all bank pages to window-0 (5 of 8 slots used: 32/34/40/46/48).
* vgsp: m104 - inject the mail_kernel module-data base when bank-4 is emptyArthur Hanson Rasmusson5 days
| | | | | | | | | | | | The forwarded mail_kernel reads __device__ kMail through c[0x4][0x0] (the driver-provided module-data base), but the guest's bank-4 page content is zero in the launch (the driver's value never lands in the resolved page). With gr_mail_patch set, when bank 4's first 8 bytes are zero, allocate a module page holding the demo message, map it at server-managed VA 0x11ff00000 (UPDATE_PDE_2, inside [0x100000000,0x11fffffff)) and point c[0x4][0x0] there. The kernel then reads the message from device memory and writes out[i] through the already-relocated bank-0 pointer; vadd (params only) becomes the real relocated-data acceptance test.
* vgsp: m103 - scan bank pointers at 4-byte strides; dump every bank pageArthur Hanson Rasmusson5 days
| | | | | | | | | m102 relocated the server-installed data windows (UPDATE_PDE_2 pdeIndex 2060.. accepted, status 0x0) and rewrote bank 0 (10 pointers) and bank 1 (1) - but the LDG's base in c[0x4][0x0] (bank 4) produced no hit: its pointer sits at a 4-aligned offset that the 8-stride scan skipped. Scan every 4-byte boundary and dump the first 16 words of every bank page (2..7) for verification.
* vgsp: m102 - relocate guest data into the server-managed VA region and ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | rewrite bank pointers The server refuses UPDATE_PDE_2 (status 0x1f) for guest CUDA VAs: they are client-managed, while the golden VAS reserves the server-managed region [0x100000000, 0x11fffffff) (gsp_phys_booter.c:8455). Map each resolved data page there at an affine-relocated VA (identity HPA, no copies), rewrite every 8-byte pointer value inside the shadowed const-bank pages (banks 0..7) that falls inside a mapped guest window to the relocated VA, and raise the Tier-1 window pool to 32 windows x 512 PTEs so the relocated pages fit. The kernel now reaches its real data through the server-installed windows.
* vgsp: m101 - route guest data pages through the server walker (Tier-1 ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | map_va_locked) The scratch-window comment is decisive: on the shared-management VAS the client PD0 entries built by pdb_build are NOT preserved by the server's root migration, so every engine-visible mapping must be installed through DMA_UPDATE_PDE_2 - the m99/m100 direct plants were invisible (same NACK with 16381 pages 'mapped'). Route each data page through gsp_phys_rmcall_gr_map_va_locked (same call the request pages use) and log the per-window acceptance/refusal (server 0x1f) so the high-VA install behavior is measured. The window pool is currently 8 windows x 32 PTEs.
* vgsp: m100 - scan every const-bank page for data VAs; data PTEs kind 0 by ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | default The +0x880 trap instruction disassembles (nvdisasm on the m98b prologue bytes) to LDG.E.U8.CONSTANT.SYS R5, [R2.64+UR4] with UR4 = c[0x4][0x0] - the first global load's base comes from const bank 4, not the c[0x0] param page the m99 scan covered. svc_gr_data_fill now scans every bank page the launch carries (QMD words 32..47, even LO words: banks 0..7), deduping up to 16 windows. Data PTEs use the gr_pte_kind param (default 0 = the kind proven SM-visible via the const reads) instead of a hardcoded 6.
* vgsp: m99 - identity-map the forwarded kernel's guest data pages into the ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | | | | | | | | engine tree The m97/m98 decode proved the SM instruction fetch and const reads work; the wall is the kernel's first global data access (prologue instruction at +0x80) to a guest-VA device pointer (param page words 6..9 carry the demo's two 16MB buffers at 0x763dXXXXXXXX), which is not mapped in the engine's page tables. The walker walks OUR root->PD2->PD1->PD0->PT tree (SC PDB == our VASPDB chunk, proven by matching the same-run INST base to the PDB-root DMA log), and fresh direct-planted tables are visible at first fetch. Service side (gsp_sema_service.c): svc_gr_data_fill() scans the param (c[0x0]) page for plausible device VAs, resolves the containing 2MB windows (-1..+16 windows, early stop when a window resolves nothing) via svc_resolve_va on the service thread, and carries {va, pa} in svc_fwd_req.gr_data; svc_fwd_gr_work() converts PA->HPA and attaches the list to the submit. Backend (gsp_phys_booter.c): gsp_phys_rmcall_gr_data_map() plants VA->HPA leaf PTEs (GENERIC_MEMORY kind 0x06, like UVM/RM on Turing) into lazily allocated PD1/PD0/PT chunk branches under root[0] (VAs < 2^47), caching branches per index; the submit maps all req->data pages before publish and logs the count.
* vgsp: m98 - dump the program prologue (entry offset) and the param/const-0 ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | page at launch m97 settled the fetch question: zeros planted at the QMD's program offset executed and trapped ILLEGAL_INSTR_ENCODING (0x9) at PC=0x109800 - the SM instruction fetch and const reads through our shadows work; the m90-m96 MMU_NACK at PC=0x109880 is a memory access by the prologue instruction at +0x80, almost certainly the first global load using a guest-VA device pointer from the param buffer (c[0x0]). Dump the program page from the entry offset (40 words) and the param page (16 words) so the access instruction and its pointer arguments are visible in the log.
* vgsp: m96 - gr_pte_kind: set the Turing v2 PTE KIND on the window-0 shadow poolArthur Hanson Rasmusson5 days
| | | | | | | | | | | UVM's Turing PTE maker sets KIND=GENERIC_MEMORY (0x06) in PTE bits 63:56 because PITCH no longer exists on Turing (uvm_turing_mmu.c:32-34,106; NV_MMU_PTE_KIND_GENERIC_MEMORY=0x06, NV_MMU_VER2_PTE_KIND=63:56). Our shadow PTEs encode kind=0. The SM I-fetch refuses the kind-0 PTE with MMU_NACK while the FE tolerates it, so gr_pte_kind (default 0) selects the KIND for the window-0 pool. Also log the VASPDB root DMA at SET_PAGE_DIRECTORY time (settles whether the SC PDB the server programs is our chunk).
* vgsp: m95 - program GPC MMU_CTRL from PFB MMU_CTRL (RM grInitGPCMmuPRIRegs copy)Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | The real RM initialises every GPC's NV_PGPC_PRI_MMU_CTRL (0x500880 + gpc*0x8000) from NV_PFB_PRI_MMU_CTRL (0x100C80) using the TU102 hub-to-GPC matching fields (VM_PG_SIZE, COMP_FAULT, MISS_GRAN, CACHE_MODE, USE_PDB_BIG_PAGE_SIZE, ATOMIC_CAPABILITY_MODE, ATOMIC_CAPABILITY_SYS_NCOH; ext-tree gr_gk104.c:3340-3380 + gr_tu102.c:229-238). Our ladder never programmed it (grep-verified). The m93 INST dump shows the server's SC(0) PDB carries USE_VER2_PT_FORMAT + BIG_PAGE_SIZE=1, so a GPC/hub MMU_CTRL mismatch is a candidate for the GPC-side walker refusing the SM I-fetch with MMU_NACK while hub-side reads resolve. Gated by gsp_phys_rmcall_gr_gpc_mmu_init (default 0); sampler now reads GPC0/GPC1_MMU_CTRL (0x500880/0x508880) and PFB_MMU_CTRL (0x100C80).
* vgsp: m93 - dump the launch-time instance SC/PDB words (w126..131, w166..173)Arthur Hanson Rasmusson5 days
| | | | | | | | | | The m90/m91 decode pinned the SM I-fetch failure to WARP_ESR MMU_NACK at the window-0 shadow VA, while everything FE-side resolves the same small-PT line. The SC array (RAMIN words 166+: VALID mask, then per-VEID SC_PAGE_DIR_BASE LO/HI/flags) is the page directory the SMs' walk is expected to use; log it raw at launch time so the next cycle shows which base/target/flags the server actually programmed (and whether it is the module VASPDB root).
* vgsp: m91 - gsp_phys_rmcall_gr_ptr_guest: keep QMD pointer pairs at the ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | | guest VAs The m90/m91 trap decoded the SM I-fetch failure precisely: GPC0/GPC1 TPC0 SM0 WARP_ESR ERROR=0x20 ADDR_ERROR_TYPE=0xb = MMU_NACK, PC=0x109880 (the rewritten window-0 shadow program VA). The FE reads the same small-PT line fine (the forwarded inline QMD in the qmdwin page is processed to CWD ACTIVE), so the SM walk is not using the channel/ladder VAS the shadow lives in - it appears to use the guest subctx page directory (instance SC_PAGE_DIRECTORY_BASE 0x10956b000), which maps the guest VAs the real client's captured QMD points at, and not our window. Add gr_ptr_guest: when set, the forwarded launch leaves the QMD pointer pairs (param w32/33, program w48/49, prefetch w8/w31) exactly as the guest driver wrote them (as the real driver's captured QMD carries), and only relocates the QMD page itself (qmdwin, a proven FE read). Shadows are still copied for logging but unused.
* gr-regs: capture the faulting SM's WARP_ESR_PC/PC_HI and GPCMMU ESRArthur Hanson Rasmusson5 days
| | | | | | | | m90 decoded the TPC0 SM0 warp error as ESR.ERROR=0x20 ADDR_ERROR_TYPE=0xb = MMU_NACK (the ESR.ERROR field is an enum, not a bitmask). Add the 4R companion words (ESR_MASK 0x734, PC 0x738, PC_HI 0x73c) for GPC0/TPC0/SM0 and GPC1/TPC0/SM0 plus the per-GPC GPCMMU ESR at +0x324 so the next cycle captures the faulting PC and the MMU-side latch.
* gr-regs: sample the faulting TPCs' SM HWW_WARP_ESR/ESR_INFO registersArthur Hanson Rasmusson5 days
| | | | | | | | GPC0/TPC0 and GPC1/TPC0 raised the exception (GPC_EXCEPTION bit16 = TPC0 bitmap). SM warp ESR registers (TPC aperture = GPC base + 0x4000 + tpc*0x800; SM stride 0x80; ESR 0x730, INFO 0x76c) at 0x504730.. and 0x50c730.. carry the exact error code (ILLEGAL_INSTR_ENCODING 0x9, INVALID_CONST_ADDR_LDC 0x12, MMU_FAULT 0x17, MISALIGNED_PC 0x5, ...) plus the VEID/warp info.
* vgsp/gr-regs: per-GPC exception + activity + GPCMMU ESR readbackArthur Hanson Rasmusson5 days
| | | | | | | | | | PGRAPH_EXCEPTION bit24 (GPC) with EXCEPTION1 GPC1:0=0b11 fires at every forwarded QMD activation and the engine then saves/unloads. The per-GPC PRI window (BAR0 0x500000 + gpc*0x8000) carries NV_PGPC_PRI_GPCCS_GPC_EXCEPTION (0x2c90: PROP/ZCULL/GCC/SETUP/PES/TPC/GPCMMU0/GPCCS bits), GPC_ACTIVITY1.GPCMMU0 (0x2c84: FAULTED=6) and the GPCMMU GLOBAL_ESR (0x324): the post-mortem and the external sampler now record them to name the failing GPC sub-unit (or the GPC MMU).
* vgsp: m86 - sticky gsp_phys_rmcall_gr_override_hex module parameterArthur Hanson Rasmusson5 days
| | | | | | | | | The override blob can now be supplied at load (hex string, <= 1 page) and is parsed at the first forwarded launch, so the minimal-kernel experiment no longer depends on a debugfs write racing the guest's launch. Also observed in the m86 attempt: after many failed launches the forwarded ring desynced (USERD GP_PUT rewound to 1 while the engine's GP_GET was 513; IQ2M sentinel intact, no FE fetch) - a fresh boot is required per experiment.
* vgsp: m85 ext - fill-map image probe over 12 offsets across the whole ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | context image The probe now copies the header, VEID0 subctx header and ten pages spread from 0x1000 to 0xf0000, printing a nonzero-word count and first words per page, so one ladder run shows whether the golden image is actually populated across its 0xf2d00 span (the GPC slices load from it).
* vgsp: m86 - gsp-phys-gr-override SASS injection into the forwarded launch's ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | program page debugfs gsp-phys-gr-override (write-only, <= 1 page) stores bytes that the forwarded launch places at the QMD's program offset inside the shadowed program page, before any relocation. Intended use: a hand-assembled minimal SM75 kernel (MOV R1, c[0x0][0x28]; EXIT) to prove native GR execution and the release path independent of the guest kernel's SASS; the guest kernel's own entry words observed in the shadow (00017a02 00000a00) are the same standard prologue MOV encoding, so this isolates execution-path faults from code content.
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-12 12:11:22 +0000