summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* wall-2 session-80: ALL low-aperture window records found via the 'liat'-tag ↵Arthur Hanson Rasmusson6 hours
| | | | fix (the record tag is the u32 0x7461696c whose on-disk bytes are 'liat', not 'tail'); wall2_recscan.py scans them; the GR init semaphore windows identified and injected (0x4b17000->0x12a76f000 verified by content: +0xbb0=3/+0xe30=1 = the release payloads; 0x4b19000->0x122f9b000, release applied there) - releases now land on the semaphore pages; the NvOgl wait still spins (the A8 loop's per-entry counter tables are the remaining completion condition)
* wall-2 session-79: resolver7 tool + the corrected pair-specific injection ↵Arthur Hanson Rasmusson6 hours
| | | | recipe (0x4480000->0x125692000, 0x4ca0000->0x131649000, 0x4b16000->0x12a76a000) and the window-record layout {tag,VA,SIZE,0,tail} stride 0x40; documents the resolver7 cross-pair bug, the decoded low-VA releases and the remaining semaphore-VA translations (pending=417)
* vgsp-sema r686: accept the low aperture (>=0x4000000) for GR/GL release ↵Arthur Hanson Rasmusson6 hours
| | | | | | | | | | | | | | | decode in both release forms (0x5c-form and SET_REPORT_SEMAPHORE) The GR/GL ucode init pushes carry their releases on the RM's low aperture (the same 0x4000000-0x4ffffff VA family as the push/ring windows): the live GL init push decodes as rel=0x4b19b10 pay=1 (REPORT_SEM group 200426c0 00000000 04b19b10 00000001 10000000) and rel=0x4b17bb0 pay=3 / 0x4b17e30 pay=1 (0x5c-form 2005c017 04923060 ...), all rejected by the sysmem-only SEMA_VA_LO bound - the NvOgl engine-init wait then spun forever. With the bound relaxed (and the push windows injected via the window-record/memdesc recipe) the releases decode live (have_rel=1, applied rising) and the un-translated ones queue in svc_pending (417 at the observed steady state) awaiting the semaphore-VA translations.
* wall-2 session-78: post-device wait identified as the NvOgl (GL ucode) ↵Arthur Hanson Rasmusson6 hours
| | | | engine init (A8 retry loop work item named NvOgl_m0; D6 submit ORs 0x200000 into the pending word) and the push windows become READABLE via the resolver6 window-record/memdesc recipe (0x4480000 -> 0x120cfb000, 0x4ca0000 -> 0x12e51e000; the service decodes the GR init streams where sessions 73-74 saw unread) - remaining gate: have_rel=0 (CE-shaped matcher) and the GR forward not engaging (forwarded=0 gr_nocap=4 drain held=4)
* wall-2 session-77: vkCreateDevice PASSES - r682 0x7E event validated live ↵Arthur Hanson Rasmusson6 hours
| | | | (registered slot 13, EVPOST rc=0) and the completion word found/driven: the main-thread wait reads a u32 at +0x80 of a 16 KB rw-s /dev/nvidiactl notification mapping (should-wait = word != 1); a host write of 1 via the guest RAM file (PA from pagemap, file offset PA-0x80000000 above 4G) flips the wait and vkCreateDevice returns success (VKDEVICE ok family=0) - reproduced 3x (r683 manual, r684 nudger, r684d probe+single-word). Tools: t79.py (wait-chain resolver), guest_words.sh, nudge.sh; README-session77.md records the recipe, the residual guest event-dispatch gap (records consumed, notification word not written), and the -4/gdb-attach cautions.
* vgsp-rm r682: register NV01_EVENT_KERNEL_CALLBACK (0x78) and ↵Arthur Hanson Rasmusson7 hours
| | | | | | | | | | | | | | | | NV01_EVENT_KERNEL_CALLBACK_EX (0x7E) events alongside OS_EVENT (0x79) The driver's modern nvkms/Vulkan path allocates its per-channel completion events with class 0x7E (nvos.h NV01_EVENT_KERNEL_CALLBACK_EX; observed live as GSP_RM_ALLOC class=0x7e paramsSize=24 hParent=<subdevice> hObject=0xcaf00003 from the second RM client while its main thread sat in the vkCreateDevice wait loop, whose readiness word lives in a /dev/nvidiactl notification page that only an event completion can signal). The event registration scanned the params for hClass 0x79 only, so 0x7E allocations were never registered and their completion wake-ups (post_channel_event/post_all_events) could never reach them. Accept all three event classes; the NV0005_ALLOC_PARAMETERS layout is the same {hParentClient, hSrcResource, hClass, notifyIndex, data}.
* wall-2 session-76 addendum (r681): decode the main-thread vkCreateDevice ↵Arthur Hanson Rasmusson7 hours
| | | | wait - should-wait = (readiness word != 1), readiness = u32 at nvidiactl-mapped holder+0x80 (VM_IO page, 39/39 reads zero, all fd polls time out), give-up predicate dcee20 fires -4 only on RM error flags (b29d60 / +0x70cc); the word's writer is the guest kernel driver/RM, not host RAM
* vgsp-rm r680 + wall-2 session-76 forensics: 0x2080a097 reply record-area ↵Arthur Hanson Rasmusson7 hours
| | | | | | | | | | | | | | | | | | | | tunables (wall2_a097_count/rec0..rec7, default 0xffffffff = echo) and the evidence set that re-questions the a097 gate The real host RM 0x2080a097 handler (GSP-RM 570.144 control table entry, params 0x490) overwrites params+4..+0x23 with up to four {u32,u32} mode pairs (engine value + a x1000 clock/percent) and the client copies back the first 16 bytes; the tick at eglcore 0xd5e3e0 consumes the second word of the first pair as the per-engine progress (session +0xe104, compared against per-boot config threshold 95 at lib+0x2019320+0xffc with 10/20 bit-history cutoffs). New module params let one boot sweep the record matrix; the r680 sweep (flag/v488/v48c + count/rec matrix incl. progress 100..1000000) changed nothing observable, and hw watchpoints show E+0x150 stays 0x00200000 with no writer over 5+ minutes while the a097 poller is a worker thread and the main thread sits in a 10 s poll() loop on /dev/nvidia0 inside vkCreateDevice. Tools: t75g.py (in-guest gdb state/watch probes), diag76.py (thread bt + address resolution), slots_probe.sh, run75g.sh; README-session76.md records the firmware handler decode and the sweep.
* r679: 0x2080a097 handler with runtime-tunable reply words (wall-2 session 75)Arthur Hanson Rasmusson8 hours
| | | | | | | | | | | | | | | | The guest Vulkan client (libnvidia-eglcore) issues RM control 0x2080a097 in a ~1.8 s retry loop while its engine-readiness check stays negative; the bare-metal oracle (same client on the host with the real driver) never issues it, so it is a vGPU-only path (engine type 0xe00101). The handler echoes the 1168-byte in/out record block and applies three module parameters - wall2_a097_flag/v488/v48c - so one boot can sweep reply variants without rebuilding (the client reads params +0x204, +0x488, +0x48c back; file offsets 0xecd45f..0xecd475 in libnvidia-eglcore.so.570.144). Sweep result so far: flag=1 with v488=0 or 1 does not stop the retry; the readiness wait lives in the client's engine loop (0xd6ef40..0xd6f0ab polling byte +0x1b038 of the engine object, recomputed by a91ea0 from engine-state fields), so the missing state is deeper than the reply words.
* wall-2 session 74: the client's 11s stalls are userspace completion-slot ↵Arthur Hanson Rasmusson8 hours
| | | | | | | | | | | | | | | | | | | | | | spins; the next wall is the polled RM control 0x2080a097 Root-caused the vk_frame client's exact 11.00s gaps: a pure sched_yield + clock_gettime userspace spin inside libnvidia-eglcore's EGL/GL init, waiting for completion slots (u16 at slot+0xe == 0xffff) in /dev/nvidiactl mappings. Guest-side filling of the slot flags lets the client proceed immediately, but vkCreateDevice still fails -4: with the slots filled the client settles into an NVOS54 poll of RM control 0x2080a097 (paramsSize=1168) which our emulation answers with the generic all-zero reply, so the poll never completes. Also captured: sema_push_raw dumps proving the GR channel-init push contains NO release (entry0 decodes 2 methods then zeros; entry2 SET_OBJECT 0xc597 then zeros), and the negative result that neither channelFillGpFifo nor nvWriteGpEntry runs for this channel's kick. New probes: gdbpoll6/gdbu16/gdbfill/gdbwatch/gdbparam/gdbgap3/gdbspin (slot check, flag fill, NVOS54 param dump, backtraces), slotfill{,2}.sh (guest slot watcher), stracevk/fastrun{,2}.sh (strace+perf recipes), find_ring_va.py and vmap_watch2.py (vmap/kcore watchers), README-session74.md.
* wall-2 forensics tools: GR channel-init push localization (session 73)Arthur Hanson Rasmusson9 hours
| | | | | | | | | | | | | | | | | Tools and findings from the live wall-2 campaign (r674/r675): the vk_frame client's GR channel-init push (va=0x4480000 len=1432) cannot be translated by the sema service, so no release is applied and vkCreateDevice fails -4. Captured: the RM window-record/memdesc layout (ring memdesc PA == the service's validated ring pa; push memdesc PA injected live and read by the service without a false-translation line), the CE-only shape of the service rescue matcher, the notrace status of nvidia/modeset kprobes (QEMU gdb hbreak works), and the ring-entry encoding from channelFillGpFifo/nvWriteGpEntry (neither runs for this channel's kick). New tools: wall2_resolver{2..5}.py, wall2_livecap{1..3}.py, RAM structure scanners (scan_r673*.py, trace_push674.py), gdb675*.gdb probes, plus a README with the ranked next steps.
* r655 diagnostics: dump unknown-RPC payloads and UPDATE_BAR_PDE payloads ↵Arthur Hanson Rasmusson10 hours
| | | | (wall-2 forensics aid - the r670 capture proved zero unknown RPCs and no mapping RPC during the client's vkCreateDevice attempts, so these dumps are bounded evidence tools for the next wall)
* r654 FIFO_GET_ENGINE_CONTEXT_PROPERTIES (0x801707): return the real ↵Arthur Hanson Rasmusson11 hours
| | | | per-engine context geometry captured from the GSP on the physical backend - the client queries ZCULL geometry (engineId=8) at the end of every vkCreateDevice attempt and the generic all-zero reply failed its ZCULL-context buffer allocation (VKFAIL -3); with the handler the client proceeds through GR_CTXSW_ZCULL_BIND, GR_SET_CTXSW_PREEMPTION_MODE, VRAM allocs and MAP_MEMORY_DMA to the GR channel kick
* r651-r653 display path: DISPLAY_GET_STATIC_INFO reports the ↵Arthur Hanson Rasmusson12 hours
| | | | one-head/8-window model (feHwSysCap head-0, windowPresentMask 0xff, numDispChannels 81 for the cursor channel numbers) - live gdb pinned the 0x56 to kdispGetChannelNum_v03_00 requiring windowPresentMask&NVBIT32(instance) for dispChnClass_Win and HEAD_EXISTS for Curs; + INTERNAL_DISPLAY_GET_ACTIVE_DISPLAY_DEVICES (displayMask=1 numHeads=1; dispswConstruct rejected every head against numHeads=0); + NVC370_CTRL_CMD_GET_CHANNEL_INFO reports IDLE immediately (nvRMSyncEvoChannel polls 2s for IDLE after every kickoff)
* docs: SESSION 66 - the 0x56 pinned to the guest RS alloc path ↵Arthur Hanson Rasmusson14 hours
| | | | (rmapiAllocWithSecInfo enters with class 0xc57e, serverAllocResourceUnderLock returns 0x56 before the GSP-RM RPC at under-lock+0x447; _rpcAllocObjectPrologue exonerated); the guest's not-stripped nvidia.ko is a new live-debug instrument; gdb-stub hazards recorded (kill wedges the VM - detach-only recovery; stepi loops wedge the guest - prefer conditional breakpoints)
* docs + nvkmstrace: the GL/Vulkan wall fully bisected (SESSION 65) - ↵Arthur Hanson Rasmusson14 hours
| | | | ALLOC_DEVICE reply status 5 (CORE_CHANNEL_ALLOC_FAILED) decoded by the LD_PRELOAD nvKms logger with a widened reply scan; the empty display capability notifier is the first missing piece (a live-gdb fill of SYS_CAP/SYS_CAPB flips the driver to the window path, proving numWindows>0 unblocks it); the residual wall is the vGPU-guest display-class rejection: nvRmApiAlloc(0xc57e) returns NV_ERR_NOT_SUPPORTED inside the guest kernel and never reaches the emulated GSP - the guest runs in vGPU mode where display/modeset classes are host-service-provided by design
* docs: record the real-render walls measured this session (Vulkan ICD ↵Arthur Hanson Rasmusson15 hours
| | | | enumerates on the emulated vGPU; vkCreateDevice fails in nvidia-modeset's ALLOC_DEVICE past the new NV0073 head/connector shim, residual wall = the display core/modeset channel objects; Xorg ScreenInit fails in nvidia-push's 10 s channel test with submissions=0 and unresolved X-channel VAs - the guest scanner serves CUDA clients only - plus a rank-0 counter-slot collision with a live CUDA client; EGL/glsi unchanged) and link the page from the README
* tools/vk + nvkmstrace: real-Vulkan probe stack for the emulated vGPU - ↵Arthur Hanson Rasmusson16 hours
| | | | vk_probe/vk_probe2 (ctypes loader probes: enumerate + create device/queue), vk_frame (headless Vulkan compute renderer: loads the NVIDIA ICD, paints a plasma into an RGBA8 storage image, reads it back to PPM and publishes frames into the kvmfr ivshmem BAR), vk_plasma.comp -> SPIR-V; nvkmstrace.c (LD_PRELOAD NVKMS ioctl logger that decoded the vkCreateDevice failure to ALLOC_DEVICE cmd=0). Measured: the NVIDIA device enumerates and its Vulkan ICD loads (2 ICDs: NVIDIA + llvmpipe); vkCreateDevice fails VK_ERROR_INITIALIZATION_FAILED because nvKmsAllocDevice returns non-success after the display shim
* vgsp-rm r643/r644: NV0073 display-common shim for nvidia-modeset - report ↵Arthur Hanson Rasmusson16 hours
| | | | one head (GET_NUM_HEADS 0x730102, GET_ALL_HEAD_MASK 0x730287, flexible window assignment 0x7302ad) and one static TMDS/HDMI connector on display id 0 (GET_SUPPORTED 0x730107, OR_GET_INFO 0x73028b SOR+SOR_SINGLE_TMDS_A, GET_CONNECTOR_DATA 0x730250 HDMI_A, DFP_GET_INFO 0x731140); the generic all-zero replies made nvkms log 'No heads found on board!' and fail (killing Xorg ScreenInit and Vulkan vkCreateDevice), then fail NoValidDisplays() after the heads were added
* vgsp-sema r640: raise the wait-gate episode extension cap 25 s -> 45 s - the ↵Arthur Hanson Rasmusson17 hours
| | | | r639 streams2 transcript has the readback's acquire giving up at waited_ms=28378 while the launch whose release it waits for only forwarded ~9 s later (watermark defer + arg-partial defer + backend poll chained past the 25 s bound), so the readback ran out of order and the client read zeros (bad=65534); 45 s keeps >15 s of headroom under the clients' >= 60 s timeouts and only engages while a GR forward is unoffered (green boots never reach it)
* tools/guest-diag: GL/Vulkan probe + X capture publisher for the real-render ↵Arthur Hanson Rasmusson17 hours
| | | | path - egl_retry (explicit EGL make-current retry probe: the glsi engine-init returns busy once and eglcore never retries; prints the per-try EGL error), xshm_pub (X11/XShm screen capture into the kvmfr ivshmem BAR in the frame_producer layout so a GL/Vulkan-rendered guest frame reaches the host), xorg-vgpu.conf (headless nvidia Xorg server layout for the emulated vGPU)
* vgsp-sema r638: break the CE-watermark/wait-gate mutual citation - a channel ↵Arthur Hanson Rasmusson17 hours
| | | | whose unconsumed head entry is wait-gate held is a consumer-side wait, not a producer backlog; the watermark skips it while the candidate's operands are fully resolved and no decoded device write is pending, so the deferred launch forwards and its release installs (the r612/r636 streams chain: readback acquire op=3 pay=N sits behind the very launch whose release it wants, the two defer each other for the full 15 s cap and the copy runs ~20 s late); module param sema_mutual_skip (default 1, 0 = r636 behaviour)
* STATE-CURRENT: refresh snapshot - r635 closes the host-side ↵Arthur Hanson Rasmusson18 hours
| | | | operand-resolution gap (content-tracked shadow anchors + launch-level content anchor + bounded cross synth + table guard; the draft's self-feeding mint caught and gated, green-boot table 6144/8192 -> 0 minted), r636 fresh-boot battery best-equal 9 OK / 2 clean FAIL / 1 HANG with streams_events hang->clean CUDA_ERROR and the streams2 red chain measured (H2D dsts replay-denied -> GR forward deferred on the CE stream-order watermark -> degenerate refusal -> SYNTH-FAULT); remaining: streams2 CE-order chain, first-wait crawls, used-boot allocation exhaustion, then 15/15 + soak
* vgsp-sema r635: host-side operand resolution when the scanner misses - ↵Arthur Hanson Rasmusson18 hours
| | | | per-shadow-page REAL-content tracking (r->content set on every landed write) anchors a client's own H2D-shadowed pages and arms a launch-level content anchor, so an answerless output candidate (contiguous tail of a shadowed input, or a non-contiguous allocation) is served from a bounded synthetic page set (1024/candidate, 4096/launch, 3/4-table guard) instead of failing the launch closed; synthetic pages can never re-anchor (the first draft self-fed on its own minted pages and filled the shared table to the guard - 6144/8192 measured on a green boot - content gating restored 0 minted pages there and the historical green shape); trusted pin/walk/ledger answers keep the r633 anchored budgets and no longer arm the cross mint; fresh r636 boot: best-equal battery 9 OK / 2 clean FAIL / 1 HANG (streams2 bad=65534 - its H2D dsts are replay-denied, the GR forward defers on the CE stream-order watermark, degenerate refusal faults cleanly; streams_events hang->clean CUDA_ERROR via the auto-fault; smiley first-wait crawl)
* STATE-CURRENT: refresh snapshot - r632 mail hang root-caused+fixed (r633: ↵Arthur Hanson Rasmusson20 hours
| | | | held GR launches park their push-level release records and the eventual forward delivers them; mail green on two fresh boots), release-target question answered (rel_mod=1 default redirect, resolver works), synthetic shadow caps gated (anchor + per-episode; peak 2048/8192), best-ever battery r633b pass=9 fail=0 hang=1, r631 math red draw green; remaining top blocker = operand-resolution shortfall behind the wrongness class
* vgsp-sema r633b diag: log the hold-engage record set (nrel/va0/pay0/gr) and ↵Arthur Hanson Rasmusson20 hours
| | | | raise the non-pool device-VA release-write log budget 512 -> 4096/boot - the r633b battery's streams2 spin (userspace, launches completed, QMD releases applied) needs the held records and the release target PA visible; the 512-line budget was exhausted by mid-battery and hid every later application
* vgsp-sema r633: park a held GR launch's push-level release records and ↵Arthur Hanson Rasmusson20 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | deliver them on the eventual forward (the r632 mail hang), gate synthetic shadow pages on an anchored span with per-episode budgets (the r632 junk-candidate flood), and name the release0 redirect cause The r632 first boot's mail client spun forever in cudaDeviceSynchronize after its vadd launch: the push-level tracking release (0x20480fff0 pay=112) never landed while the client's word stayed at 111, even though the launch itself completed (GUEST GR LAUNCH OK) and its QMD release was software-applied. Root cause: the release records (svc_fwd_rel[]) are per-decode state (reset at the top of svc_decode_stream), and the two GR hold paths (busy-defer hold, m150 data-stalled hold) break out of the pump entry loop BEFORE the release block (hold-engage / inline apply) runs - so a held launch's records are dropped at the pass boundary. The eventual forward (queued from the capture ring at the defer cap, without a re-decode of the entry) then engaged the release hold with whatever records that pass happened to carry (often none, or another entry's). Live evidence: read_proc_va on the spinning client - 0x20480fff0 = 111 (payload 112 never applied), 0x204827f74 = 6 (QMD release delivered); host log - no sema-sw line for 0x20480fff0 val=0x70 anywhere. Fix (parked releases, keyed by vgpu/channel/push VA): both hold paths park the pass's records (svc_grpark_put) before their break; svc_gr_request restores the queued push's parked set into svc_fwd_rel[] at the consume point so the pump's hold-engage holds exactly those records; the two fail-closed REFUSED paths deliver the parked set inline; the session flush clears the table. Bounded log line "GR parked releases restored" (32/boot). Proven live: r633 first boot restored push=0x20043c1c8 n=1 va0=0x20480fff0 pay0=100; r633 mail now completes (VADD bad=0 checksum=12204516.000000, STATUS OK) on two consecutive fresh boots. Also r633: the r632 synthetic shadow caps were per-FILL-CALL and the fill re-runs on every retry pass, so one probe=none junk argument candidate could mint another 1024 synthetic pages per pass - the 8192-page shadow table filled within seconds of the r632 first launch (va-shadow 8192/8192, all synthetic, from the two 16 MB guessed spans of candidates no resolver ever answered), which then killed the lane for every later real page ("shadow table full ... write dropped"). Two changes: - ANCHOR GATE: a synthetic page is created only when the candidate's span already has >= 1 page answered by ipin/resolve/ledger. Existing H2D shadow content still serves unconditionally (the red-draw chain), and a real buffer's unresolved tail stays anchored by its resolved head. A candidate whose every page is answerless takes the historical drop path - its guessed span is not a buffer; - PER-EPISODE BUDGETS: the per-candidate (1024) and per-launch (4096) caps now persist per (push VA, span base) across the episode's passes, not per call. Measured r633: shadow table peak 2048/8192 (vs 8192/8192 full), 32 synthetic pages for the mail launch (vs 4041 junk-inflated n_data), the lane stays available for content serves. Diagnostics (bounded, one boot of evidence): "vgsp-work: gr-rel0 ..." names the release0 resolution chain (rel_pa/ap/hpa/word/pay/unobs) and "vgsp-gr: qmd-rel redirect: ..." names the backend redirect cause. The first live reading answers the release-target question: rel_hpa resolves (0x2fc495000), map_ret=0, unobs=0 - the redirect is the deliberate gsp_phys_rmcall_gr_rel_mod=1 default (m64 forced module-semaphore release), not a resolver failure. The r632 hang was the push-level release loss, fixed above. Build clean (kernel + r65535 warnings only).
* STATE-CURRENT: refresh snapshot - corruption panic class root-caused+fixed ↵Arthur Hanson Rasmusson21 hours
| | | | (r627), best battery 11/15 zero hangs, r632 shadow-lane operand serving, remaining: release-target resolver + wrongness class
* vgsp-sema r632: the GR data fill serves unresolved operand pages from the VA ↵Arthur Hanson Rasmusson21 hours
| | | | shadow lane (existing H2D content, or a synthetic page for an argument candidate under per-candidate/per-launch caps) instead of dropping them - the submit build hands the shadow page's host address to the bounce machinery, so copy-in stages the client's own bytes and copy-out writes the engine's results into the same page the D2H copies read (red-draw chain: walk=none -> H2D shadow -> fill fail-closes -> degenerate refusal -> SYNTH-FAULT); write guard keeps a shadowed VA's writeback; sema_no_shadow=1 keeps the historical drop path
* vgsp-sema r627: the copy-landing parity pass no longer clobbers per-page ↵Arthur Hanson Rasmusson24 hours
| | | | | | | | | | | | | | | | | | | | | | landings - the r623c wrong-write site The post-loop parity store (r254-era) recorded a large virtual-destination copy's whole range contiguously (dst + po) AFTER the per-page loop had already stored each page's true resolved PA (m180/r391). For a scattered UVM host buffer the contiguity guess overwrote the true entries; the next copy of the same VA then followed the poisoned ledger (the non-pin DIVERGE branch keeps the ledger) and wrote client c-data into guest pages the kernel had since re-used. r623c evidence chain (saxpy D2H readback of 0x70e64e700000): sema-ledger: rewrite va=0x70e64e77f000 old=0x12e700000 new=0x115800000 504x sema-ledger: DIVERGE write ... prev=0x1158xxxxx cur=0x12e7xxxxx guest panic: kchannelGetGfid_IMPL+0x12, garbage 0x44560800445590f0 (IEEE754 floats 854.25/856.125 = client c-data in nvidia channel structs) Fix: the parity pass skips pages the per-page loop already stored (lookup guard); it only seeds pages the loop did not reach. True per-page landings are never overwritten.
* vgsp-sema r626: sema_no_shadow - A/B knob to disable the VA shadow lane ↵Arthur Hanson Rasmusson25 hours
| | | | (copy-dst + fill fallbacks hold instead); isolates the lane as a variable for the fatal corruption class (nvidia channel structs overwritten with PTE-like patterns -> panic in kchannelGetGfid_IMPL via nvGpuOpsStopChannel; r613c/r616/r623c)
* tools r625: stuck_client_capture.sh - one-shot capture for a stuck client ↵Arthur Hanson Rasmusson25 hours
| | | | (pause the trace-consuming scanner, read the retained uvtw/uvsv/uvmt tail, walk the tracker + pool page, resume); wraps the manual sequence that unlocked the first-wait evidence
* tools r624: tracker_walk.py + pool_page.py - guest-side (kcore) walks for ↵Arthur Hanson Rasmusson25 hours
| | | | the first-wait class: read a UVM tracker's semaphore object and expected payload, and dump the semaphore-pool page's applied values; together with the host pool-wr/sema-sw logs they compare what the driver waits for against what the host wrote
* vgsp-rm r623: oserrlog - deliver a synthetic OS_ERROR_LOG (0x1006) ↵Arthur Hanson Rasmusson25 hours
| | | | engine-fault report to the guest's RM queue (debug param; payload mirrors the GSP ABI decode: exceptType/runlistId/chid/errString/prevXid) - the suspected missing recovery half after a synth-fault (post-fault clients stick pre-submission)
* tools r621: read_proc_va.py - read a running client's mapped words via ↵Arthur Hanson Rasmusson25 hours
| | | | /proc/<pid>/mem (the guest-side half of the sem-write divergence comparison; pairs with the r619/r620 sema-sw witness)
* vgsp-sema r620: r619's device-VA sem-write witness range used the 1 TiB ↵Arthur Hanson Rasmusson26 hours
| | | | SVC_VAS_FLOOR and silently excluded the 0x200000000-0x20fffffff VAS window (the release words it exists for) - use the window base so the r618-style write-target divergence is actually logged
* vgsp-sema r619 diag: log the resolved target (pa/ap/src/rc/rb) of NON-pool ↵Arthur Hanson Rasmusson26 hours
| | | | device-VA semaphore writes - the r618 hung math client read 0 at 0x20480fef0 while the host's deferred releases advanced cur 97..105 on its own target; this makes the write-target divergence measurable (bounded 512/boot)
* vgsp-sema r618: a failed/refused GR forward now delivers a synthetic channel ↵Arthur Hanson Rasmusson27 hours
| | | | error edge (notifier status=0xffff + channel event, sema_refusal_fault=1 default) - proven live by the r616 grfaultpoke test: the r616b matmul wedge ended with CUDA_ERROR unspecified launch failure instead of spinning forever; rollback = sema_refusal_fault=0
* tools r617: battery_resume.sh - zombie-tolerant battery resume ↵Arthur Hanson Rasmusson27 hours
| | | | (verdict-in-log completion check; the plain pgrep -x poll falsely hangs on a client that exited after printing its verdict but left an unreaped zombie comm)
* vgsp-sema r616 diag: grfaultpoke - manually write a channel's error notifier ↵Arthur Hanson Rasmusson28 hours
| | | | (relayed-fault shape: info32=except, info16=engine, status=0xffff, notifier_err latch) and post its channel event, to test whether a synthetic engine-error edge ends a refused launch's cudaDeviceSynchronize spin (the authored sw release lands - measured 0x6 - but the kernel never completes for a never-executed launch)
* STATE-CURRENT: refresh snapshot - 10 consecutive green physical-engine CUDA ↵Arthur Hanson Rasmusson28 hours
| | | | clients, launch p50 ~650ms, held-chain fix, variance root-caused, GL running, LG frame path proven
* tools r615: redboot-triage.sh - one-pass evidence extraction for the ↵Arthur Hanson Rasmusson28 hours
| | | | unresolved-arg wedge class (sema-shadow-dst entry point, GRFILL-DROP/held/refused chain, untruncated arg-miss walk lists, cand probes, EVPOST drops)
* vgsp-sema r614 diag: name the first shadow-lane device-dst copies and ↵Arthur Hanson Rasmusson29 hours
| | | | untruncate the arg-miss walk list - the r613b matmul wedge began with an H2D taking the shadow silently (no ledger/pin/walk) and the post-mortem could not see which registered pdb answered what (240B buffer, 3 of 8 entries)
* vgsp-sema r613: a wait-gate give-up is deferred while a GR forward is owed - ↵Arthur Hanson Rasmusson30 hours
| | | | | | | | | | | | | | | | | | | | the release sits behind our own launch deferral The r34x acquire wait gate gives up (fail-open, ops run) after gsp_sema_wait_hold_ms with no satisfiable value, on the premise that the value cannot be installed by firmware alone. That premise is false while we are holding the launch that authors the release: the r612 streams2 capture gave up the D2H readback's acquire (ch=0x5c00005f va=0x20480ffe0 op=3 pay=4 cur=2 waited_ms=10333) while the vadd launches that release that semaphore sat deferred by the CE watermark for the full 15 s cap; the readback then ran BEFORE the kernels and the client read zeros (STREAMS bad=65534 even with the launches forwarded and GUEST GR LAUNCH OK). While any captured candidate is still unoffered (svc_gr_forward_pending), extend the episode up to wait-hold + SVC_GR_DEFER_CAP_MS + 5 s margin and log 'extend' instead of giving up. Every client-side timeout is >= 60 s, so a <= 24 s episode cannot strand the client; when no forward is pending the give-up is unchanged.
* vgsp-gr r612: refuse the defer cap only for a DEGENERATE argument fill - ↵Arthur Hanson Rasmusson30 hours
| | | | | | | | | | | | | | | | | | | | stalled decoy candidates must not kill a launch whose real operands resolved r586's fail-closed refused any launch still carrying unresolved argument pages at the 15 s cap. streams2 as the first client of a fresh boot (r611) shows the cost: its two launches carry candidates 0x783299000000 and 0x783297000000 that stall in EVERY source from the first fill (no pin, no walk, no ledger; 'stalled VA' listed, never resolving in the run) while 969 real pages resolve, the r543 arg-defer is pre-empted by the CE watermark defers, and at the cap both kernels are refused - STREAMS bad=65534 with the engine never running. Refuse only a degenerate fill (resolved < dropped - the r584 matmul shape, 2 resolved / 18 dropped, where the engine has no usable window). A non-degenerate fill at the cap forwards historically and loudly (fwd_gr_argfw witness): waiting longer cannot resolve a candidate stalled in every source, and by this point every copy-related guard (dstpend, CE watermark) has already had its chance and returned above when it fired.
* vgsp-gr r611: the stream-order watermark considers only op-carrying channels ↵Arthur Hanson Rasmusson30 hours
| | | | | | | | | | | | | | | | | | | - sibling launch rings caused mutual deferral r607 made the CE submission watermark watch every other ring. That caught the copy channel the r568 class needs, but it also caught sibling GR LAUNCH channels, whose rings legitimately hold the client own future launches: streams2s two stream channels (h=0x5c00001f/23) each saw the others published entry as backlog, deferred for the full 15 s cap, and the r586 fail-closed then refused BOTH kernels (r610c streams2 as the first client of a fresh boot: every launch REFUSED, STREAMS n=32768 bad=65534). A channel that carries the client stream-ordered memory work is exactly a channel that has decoded a transfer op; measured across r606/r609/r610c, ops appear only on the 0x5c000059 copy family and the CE ranks, and the GR launch channels decode none. Mark it in the op-append block (ever_ops) and scope the watermark to those channels: the r606 red-draw copy channel stays in scope, the sibling launch rings no longer defer.
* vgsp-sema r610: a replay pass must not re-mark a copy entry as ↵Arthur Hanson Rasmusson31 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | operand-pending - the held-chain livelock The fail4 r302 block marks a denied device-destination copy op_tr_pending so the m163/opdef hold retries it. It fires on EVERY decode pass with allow=false - including a REPLAY pass, which is the pump re-walking an entry whose ops were already recorded complete for this identity (entry_replay = same && slot_ops_complete). The re-mark therefore un-completes a slot whose copy HAS run: the next pass is fresh, re-executes the op, the next pin-batch rewind re-marks it again - a replay/fresh/replay cycle that re-arms a 3 s opdef hold every round and stalls the whole copy channel behind it. Measured: 100% of the op_tr_pending marks in the r604-r609 boots came from replay passes (27/27 in r609; 71/71 in r606, whose captured held chain idx=90/92 is this shape; 72/72 in r608). In the r609 boot the d_b H2D entry (idx=94) was re-marked and re-run every ~0.3 s from 368841 while the vadd launch waited on it; the launch then hit the r586 fail-closed cap at 15 s and the engine never wrote (VADD bad=32767 csum=0). r308's rationale for the replay re-mark (pre-r595 the eng==0 copy channel's fresh passes never admitted ops, so the re-mark was the only retry hatch) no longer holds: r595's cap_trust admission runs a plausible copy on its fresh pass, and a genuinely failed copy keeps its slot incomplete via op_owed / the svc_run_ops rc!=0 pending rule. The whole denied accounting block (dstpend note, staging re-snapshot, pending mark, hold) is now skipped on replay; a fresh (non-replay) denied pass marks exactly as before.
* vgsp-sema r609: age the device-dst guard per channel burst - the r606 ↵Arthur Hanson Rasmusson31 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | held-chain serialization The m169 device-dst first-touch window is per PAGE, but the risk it covers is per client table build. The driver's H2D relocation burst on the eng==0 copy channel writes N distinct first-write pages back to back; because the pump holds the first held entry and the rest of the chain decodes only after it drains, each page paid its own 3 s window, serialized (r606 red draw: hold idx=90 362167.7->362170.8, idx=92 362177.7->362182.9, the b H2D entry ran 362182.882, 326 ms AFTER the launch forward -> VADD bad=32735 csum=8139264, c = a + 0). Every observed release logs 'without a pin': the pin the window waits for never arrives for this class. After ONE un-pinned release on a channel, age it (gsp_sema_copy_dst_age_ms, default 3000): further first-write device-dst pages of that channel inside the window run immediately with the walk translation - the exact translation the expired guard would have used anyway. The first page of every burst still pays the full window; only the N x window serialization is removed (~20 s of chain -> one window). Keyed by h_object like every channel table and cleared by the session flush (svc_dst_guard_reset; also clears the per-page slots, which are keyed by VA alone and must not pre-age the next client's first touch - the r604 lifetime lesson). 0 restores per-page windows (pre-r609).
* vgsp-gr r607: the stream-order watermark must watch EVERY ring, not ↵Arthur Hanson Rasmusson33 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | engine_type!=0 (final form of r590b, on the r606 red-draw capture) The r606 fresh-boot first mail client drew the classic red VADD (bad=32735 csum=8139264, c = a + 0) with the peek armed, and the capture names the blindness exactly: 362177.927 GR-DEC push=0x20043c394 dropped=9 partial=1 dstpend=0 copypend=0 ceback=0 defer_exp=0 362178.001 peek-backlog h=0x5c000059 eng=0 put=95 last=92 362182.145 peek-backlog h=0x5c000059 eng=0 put=95 last=92 362182.556 GR LAUNCH submitted (one-shot arg-defer retry) 362182.882 ce-soft-copy va=d_b executed - 326 ms AFTER the forward -> VADD bad=32735 csum=8139264 The driver's H2D relocation copy sat three entries behind on the COMPUTE-class channel h=0x5c000059 (eng=0) for 4.7 s, held by 'sema-pend: hold h=0x5c000059 idx=90 ... (operand pending)' - the wait group (0x20480fff0 pay=84) passed every pass, so the only guard blindness was the engine_type filter: ceback=0 while the copy channel was provably behind. The r590 watermark now considers every other channel of the device (the launching channel itself is excluded: its ring legitimately runs ahead with future entries). Same pass snapshot, same bounded busy-defer; this guard never refuses - the r586 fail-closed branch is separate and fires only when argument pages never resolve. r595's GR-class ops admission has since cut hold resolution to 0.5-4.7 s (the captured 4.7 s), well inside the 15 s cap, so the deferral ends by forwarding with the copy executed. Companion to r605 (newest-registered-first walk within the class): r605 drains consumable published entries before the launch decision in the same pass; r607 defers the decision while any other ring still holds unconsumed entries (held chains included).
* vgsp-gr r605: walk the eng==0 class newest-registered first - the ↵Arthur Hanson Rasmusson34 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | stream-order fix completed (the write-pointer drain, by ordering) The r507o stream-order fix (walk CE channels before GR ones) assumed the client's H2D copies ride CE channels. r595 established they also ride the compute-class channel h=0x5c000059 (eng=0), and r604 gave the decision-time capture: at the vadd's second decision on a fresh boot, 'peek-backlog h=0x5c000059 eng=0 put=95 last=94' - the b-copy entry was already written and PUBLISHED (GP_PUT ahead of the pump) while the launch decision ran, invisible to every guard (the r590 watermark skips engine_type==0; the r541/r568 gates only see DECODED copies). The pump's stable partition walked the launch channel (registered early, 0x5c000019) before the copy channel (registered later, 0x5c000059), so the copy was consumed 8 ms AFTER the decision and ~320 ms before the launch's copy-in; the run was green only because the partial-argument defer had stretched the window. Pins landing one pass earlier would have forwarded against the pre-copy page (c = a + 0, the r568 red draw). Fix the order within the class: newest-registered first (descending h_object) walks the driver's later-registered copy / push-library channels before its compute channels, so every launch decision sees the copy ring consumed to its live write pointer (GP_PUT) - the write-pointer drain, by ordering. No deferral, no cap interaction, no speculative execution: the pump still consumes each entry exactly once through its normal per-slot identity bookkeeping (slot_ops_ident/done/complete/hash), so no identity mirroring is needed. A client whose compute channel registers last keeps the historical order (no worse).
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-25 18:24:47 +0000