summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* guest-diag: add --nocat for the next diagnostic bootArthur Hanson Rasmusson11 days
|
* gsp-phys: capture GSP-RM NOCAT journal records from the status queueArthur Hanson Rasmusson11 days
|
* STATE-CURRENT: cycles 2-3 results - clean release without reboot; RM init ↵Arthur Hanson Rasmusson11 days
| | | | failure 0x59 under diagnosis
* guest-diag: allow selecting the staged GSP firmware with --fwArthur Hanson Rasmusson11 days
|
* gsp-phys: use the reference default for a zero sequencer poll timeoutArthur Hanson Rasmusson11 days
| | | | | | | | | | | | A zero REG_POLL timeout dword is the reference's GPU_TIMEOUT_DEFAULT sentinel: the reference substitutes the platform default (microseconds; 4 s in graphics mode, the default platform) before waiting. The executor clamped zero to the 1 us floor, i.e. one jiffy, so a poll that was not already satisfied failed the boot in 1 ms. The live 0x1002 sequencer element contains exactly one REG_POLL with timeout=0 (addr 0x110040); substitute the 4 s graphics-mode default and then keep the existing 1 us .. 10 s clamp.
* STATE-CURRENT: stage 3e parser fix after the live GSP-RM sequencer request; ↵Arthur Hanson Rasmusson11 days
| | | | next cycle prepared
* gsp-phys: accept the real GSP-RM sequencer buffer size in stage 3eArthur Hanson Rasmusson11 days
| | | | | | | | | The live 0x1002 element carries bufferSizeDWord=0x3FE2 (16354) - the size of GSP-RM's own command buffer, not the message. The executor's 0x1000 sanity cap refused it, so the sequencer was never run and GSP_INIT_DONE was never observed. The reference imposes no upper bound (only nonzero and greater than cmdIndex); raise the cap to a sanity ceiling and document that the real execution bound is cmdIndex against the element payload.
* docs: record next-cycle readiness for the physical GSP bootArthur Hanson Rasmusson11 days
| | | | STATE-CURRENT and the integration page reflect the implemented sequencer, clean-shutdown RPC and static-info probe awaiting the next supervised live cycle.
* gsp-phys: harden the RM transport and add the static-info probeArthur Hanson Rasmusson11 days
| | | | | | Applies the adversarial review fixes for the command-queue TX and unload RPC: the unload RPC is gated on GSP-RM init-done, debugfs fops pin the module, REG_POLL timeouts use microseconds, the host status readPtr is published, TX free space is checked, swap flags and barriers are corrected, and the legacy payload fallback is opt-in. Generalizes the transport to multi-element records and a reply-matching status-queue reader, and adds a debugfs probe that round-trips GET_GSP_STATIC_INFO (with a SET_GUEST_SYSTEM_INFO fallback), decodes the server configuration, and a read-only state snapshot file. All gated by gsp_phys_boot; the normal load path is unchanged.
* gsp-phys: command-queue TX and the GSP-RM unload RPC for clean teardownArthur Hanson Rasmusson11 days
| | | | Adds a minimal msgq producer on the command queue (element layout, checksum, sequence, dma_wmb before writePtr, doorbell) and submits the UNLOADING_GUEST_DRIVER RPC so GSP-RM shuts down and sets the scratch14 handoff bit the Booter Unload gate needs. Release attempts the RPC once before quiescing when a boot ran; on-demand testing is available through the debugfs file gsp-phys-unload-rpc while the module owns the GPU. GSP-RM processor suspend is polled on the GSP mailbox.
* STATE-CURRENT: 10:08 check-back snapshot (first real GSP boot recorded; ↵Arthur Hanson Rasmusson11 days
| | | | sequencer executor next)
* docs: record the first real GSP boot and the live GSP-RM sessionArthur Hanson Rasmusson11 days
| | | | STATE-CURRENT and the architecture docs now describe the observed order (FWSEC -> Booter Load -> RISC-V active -> event 0x1002 run-sequencer -> 0x1001 init-done), the four-handoff-bit clean-release constraint, and the --boot/--keep harness contract.
* guest-diag: add --boot/--boot-dryrun/--keep to the claim harnessArthur Hanson Rasmusson11 days
| | | | --boot is the only device-writing mode (full boot lifecycle: FWSEC, Booter Load, RISC-V start, FALCON_OS, RM-init poll). --boot-dryrun rehearses the host staging read-only. --keep leaves a green claimed session running. --fwsec is retired and refused at parse time: a FWSEC-only carve is not host-recoverable on this part.
* gsp-phys: real GSP boot stages 3d/3e and the GSP-RM run-sequencer eventArthur Hanson Rasmusson11 days
| | | | | | | | Stage 3d stages the GSP-RM boot from host sysmem (FMC, radix3 over the GSP-RM ELF, signature, message queues, libos LOGINIT/LOGRM/RMARGS and GSP arguments) and runs Booter Load on SEC2: GSP RISC-V reset, libos mailbox, IMEM/DMEM direct load, BOOTVEC=0, M0==0, FALCON_OS, RISC-V active. Stage 3e links the status queue and polls for GSP-RM events; it now also executes the inline run-sequencer command buffer (event 0x1002) against BAR0 (REG_WRITE/MODIFY/POLL, DELAY, STORE, CORE_* including CORE_RESUME) and then waits for GSP_INIT_DONE 0x1001. Gated by gsp_phys_boot / gsp_phys_boot_dryrun (default off; the normal load path writes nothing). gsp_phys_fwsec=1 without gsp_phys_boot=1 is refused: a FWSEC-only carve cannot pass the booter-unload handoff gate. Release quiesces the GSP, runs the existing FWSEC-SB/booter-unload teardown and frees all staging. tools/gen_gsp_bindata.py decodes the public generated archives into the Booter Load image (prod signature patched at 0x8700) and the GSP-RM boot (FMC) image; both are self-checked at build time.
* STATE-CURRENT: recovery complete (approved reboot restored GPU); ↵Arthur Hanson Rasmusson11 days
| | | | secure-verification-only retired; full boot lifecycle next
* STATE-CURRENT: FWSEC carve milestone; fail-safe teardown limit; approved ↵Arthur Hanson Rasmusson11 days
| | | | reboot for restoration
* gsp-phys: fix the booter-unload handoff seed (correct scratch register/access)Arthur Hanson Rasmusson11 days
|
* STATE-CURRENT: live secure-verification succeeded (WPR2 up); fail-safe holds ↵Arthur Hanson Rasmusson11 days
| | | | device pending rescue
* gsp-phys: fix booter-unload teardown (WPR meta/args) so WPR2 is cleared on ↵Arthur Hanson Rasmusson11 days
| | | | release
* gsp-phys: set PCI bus-master for the claimed GPU (bootloader host DMA)Arthur Hanson Rasmusson11 days
|
* gsp-phys: FWSEC failure diagnostics (falcon scratch/mailbox, DMEM/IMEM readback)Arthur Hanson Rasmusson11 days
|
* guest-diag: add --fwsec to the supervised claim harness (stage-3c write run)Arthur Hanson Rasmusson11 days
|
* gsp-phys: correct the FWSEC interface-patch size and staging loggingArthur Hanson Rasmusson11 days
|
* gsp-phys: read-only FWSEC dry-run mode; match the 6-byte BIT token decodeArthur Hanson Rasmusson11 days
|
* STATE-CURRENT: supervised D0 claim mitigation verified (3/3); FB 8 GiB; ↵Arthur Hanson Rasmusson11 days
| | | | FWSEC dry-run stage
* STATE-CURRENT: 07:12 check-back snapshot (backend hardening/read-only ↵Arthur Hanson Rasmusson11 days
| | | | dry-run stage before live boot)
* gsp-phys: fix the WPR2-up release hand-back and tighten FWSEC/VBIOS checksArthur Hanson Rasmusson11 days
|
* STATE-CURRENT: PLAN B claim path proven safe 3/3; real FB size 8 GiB; ↵Arthur Hanson Rasmusson11 days
| | | | secure-verification stage coded (build-only)
* gsp-phys: stage 3c FWSEC via VBIOS BIT image plus failure recoveryArthur Hanson Rasmusson11 days
|
* gsp-phys: decode the real FB size for the boot layout (stage 3b-prime)Arthur Hanson Rasmusson11 days
|
* STATE-CURRENT: claim harness verified; rung-3 boot spec complete; FB-size ↵Arthur Hanson Rasmusson11 days
| | | | decode identified
* guest-diag: reusable supervised physical-claim cycle harness (D0 pre-lock + ↵Arthur Hanson Rasmusson11 days
| | | | abort checks)
* gsp-phys: hold a GPU runtime-PM reference across the claim window (udev ↵Arthur Hanson Rasmusson11 days
| | | | bind-event hardening)
* STATE-CURRENT: D0 lock verified 3/3 supervised claim/release cycles; real ↵Arthur Hanson Rasmusson11 days
| | | | GSP boot is next
* gsp-phys: harden the D0 lock (pre-lock readiness, no unlock without rebind, ↵Arthur Hanson Rasmusson11 days
| | | | strict board check)
* STATE-CURRENT: power-domain lock implemented behind the hazard gate; ↵Arthur Hanson Rasmusson11 days
| | | | snapshot refreshed
* docs: refresh status wording after the 64/64 baseline and the ↵Arthur Hanson Rasmusson11 days
| | | | physical-backend lock
* gsp-phys: keep the dGPU power domain in D0 across the claim/release handoffArthur Hanson Rasmusson11 days
|
* docs: record the board power-domain hazard and D0-lock mitigation for the ↵Arthur Hanson Rasmusson11 days
| | | | | | | | | | | | | | | | | | | | | | physical backend - New 4.2: describe behaviourally how the option-D claim path can power-gate the board on driver release (platform power resource behind the root port, off/on sequence via the embedded controller), the two observed host freezes (no crash record), and the D0 lock now applied across release -> claim -> rebind: runtime-PM forbid + D3cold disable on the GPU, its board companion functions and the root port, config-space verification while claimed and again before rebind, abort with the locks held on any power-loss signature, runtime-PM restore after the distribution driver's probe. - 4.1/4.3: the lock is a required ownership step; returning to the normal driver is conditional, not assumed; real GSP boot not started. - 2/3(A): fresh no-unbind evidence - no exported RM/vGPU symbols and no manager daemon in the stock distribution build. - 6: driver-API baseline re-verified 64/64; ownership + firmware staging verified; power-domain lock implemented pending supervised verification. - 7/8: residual out-of-band power-cut risk, supervised-test requirement, and the gsp_phys_gpu + gsp_phys_hazard_ack operating constraint.
* STATE-CURRENT: cdt2 baseline re-verified; second freeze class mechanism and ↵Arthur Hanson Rasmusson11 days
| | | | power-domain mitigation recorded
* STATE-CURRENT: execution backend hazard-gated after freeze root-cause; ↵Arthur Hanson Rasmusson11 days
| | | | bring-up snapshot refreshed
* STATE-CURRENT: root-cause the second freeze class (claim unbind) and its ↵Arthur Hanson Rasmusson11 days
| | | | hazard gate
* gsp-phys: stage-3b boot layout plus a hazard gate for the claim pathArthur Hanson Rasmusson11 days
| | | | | | | | | | | | | | Stage 3b allocates the three coherent boot-argument pages and fills the 256-byte WPR metadata from the computed Turing FB layout; no device registers are written (uncommitted work from the previous session, committed as-is behind the new gate). The physical claim unbinds the distribution NVIDIA driver; on this host that power-gates the dGPU board and the re-bind can leave the GPU unresponsive and hard-freeze the system (observed twice, 2026-09-30, no crash record). The claim now refuses unless the new gsp_phys_hazard_ack module parameter is also set, so a stale command line cannot re-trigger it. See the hazard note at the top of gsp_phys_gpu.c.
* gsp-phys: boot-layout stage 3b - boot-argument pages, WPR meta and FB layout ↵Arthur Hanson Rasmusson11 days
| | | | (no device writes)
* STATE-CURRENT: execution-backend bring-up started (claim + GSP firmware ↵Arthur Hanson Rasmusson11 days
| | | | verified); freeze-class watch note
* gsp-phys: read-only falcon state probe for the boot rungArthur Hanson Rasmusson11 days
| | | | | | | Logs both falcons' run/halt bits, the RISC-V active bit, WPR2 up/down and the security-falcon mailboxes when the physical GPU is claimed. Verified live: GSP and SEC2 halted, RISC-V inactive, WPR2 down (HI=0). This is the read-only half of the real boot rung; no device state is written.
* docs: execution-backend bring-up staged - ownership and firmware staging ↵Arthur Hanson Rasmusson11 days
| | | | verified, real boot next
* STATE-CURRENT: cdt2 64/64 rerun verified; execution backend bring-up ladder ↵Arthur Hanson Rasmusson11 days
| | | | drafted
* gsp-phys: claim the physical GPU and stage real GSP firmware (backend rungs 1-2)Arthur Hanson Rasmusson11 days
| | | | | | | | | | | | | | | | Rung 1 (ownership): a default-off gsp_phys_gpu module param; on claim the distribution driver is released from 10de:1ed3, our pci_driver binds it, BAR0/1/3 are mapped and the falcon state is sampled; release unbinds ours and rebinds the distribution driver. Verified live: claim reads BOOT0=0x164000a1 with the falcon halted and mailboxes clear; rmmod rebinds nvidia and nvidia-smi stays healthy. Rung 2 (firmware): while the device is owned, gsp_phys_fw (default nvidia/570.211.01/gsp_tu10x.bin) is fetched with request_firmware, checked as ELF64 RISC-V, and its sections are logged (.fwimage, .fwversion, .fwsignature_tu10x). The image is held for the boot rung. The claim is default-off; the emulation path is unchanged.
* sema-svc: rewind replays may only be skipped when their release was deliveredArthur Hanson Rasmusson11 days
| | | | | | | | | | | | | | | | | | | | The per-put-epoch consumed-slot skip must not suppress a slot whose entry was consumed *without* delivering its release (the CE grace expiry in real mode): the driver-API smoke test's CE pushes are consumed unreadable before their ring pin lands and depend on the pin-batch rewind replaying them once the translation appears. The skip now applies only to slots whose consumption delivered a release: - tail consumption records a slot when the iteration decoded a release (svc_rel_count delta); the sweep-delivered entry_want consume and the fake-release consume always record - the grace-expiry consume records only when a recovery (fake or sema_rel_recover) delivered the release - svc_fake_release counts as a delivered release So real-mode replays still re-process undelivered entries, while the runtime-client case (readable pushes delivered immediately) keeps the fast path that removed the 8 s stalls.
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-12 11:38:50 +0000