summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* STATE-CURRENT: refresh snapshot - arc since SESSION 143: CUDA ring-claim fix ↵Arthur Hanson Rasmusson12 hours
| | | | (41343c63), X/GL wall broken (fffae7b1) + RC-watchdog/VAS fixes, R18 CUDA-animation + two-VM GZDoom videos delivered, direct-GL-client channel gate root-caused (memfd slot bit0) and fixed by the kernel keeper (a64169db); walls = fresh-boot Xorg DMA-init, client PUT visibility, pixels (all captures black)
* vgsp: svc_shared_hold - kernel keeper clears bit0 of the GL shared-state ↵Arthur Hanson Rasmusson12 hours
| | | | slot word (sema_shared_hold_pa); validated live (held pa=0x279b01000 word -> 0x2); with hold: client allocs c46f (hObject=0xbeef0100/0101/0102), readback err 502->0, window md5 changes (mean 2.69,2.68,4.02, nz_frac=0.0172) - SESSION 153 r1012-r1013
* vgsp: BAR0-shadow aperture userd probe + full PCFG-window (0x88000-0x89000) ↵Arthur Hanson Rasmusson13 hours
| | | | doorbell dispatch - built/live r1011; measurement falsified BAR0-USERD premise for client GP_PUT (shadows static, only pos=0x88704 traps); X channel sub=60 via kick-family RAM watch - SESSION 153 r1011
* vgsp: RUSD INIT_USER_SHARED_DATA (0x20800afe) handler + gsp-phys-shared-bit0 ↵Arthur Hanson Rasmusson26 hours
| | | | knob - direct client channel alloc gate broken open (c46f hObject=0xbeef0101, err@ReadPixels=0x0 px=255,0,255,0) - SESSION 153 r999-r1002
* vgsp: full-frame strip assembly (origins+per-channel CE state, delta push ↵Arthur Hanson Rasmusson28 hours
| | | | fold), FERMI_TWOD executor (screen fills rc=0), RT-as-screen surface alias + win-drop auto, client replay retires (faulted=0, GR forward failed=0) - SESSION 153 r984-r997
* vgsp: BAR0 0x88000-0x89000 all-writes logging - decisive negative: GL client ↵Arthur Hanson Rasmusson34 hours
| | | | owns no channel, no command buffer; kicks on 0xbfef0002 are Xorg's (SESSION 153 r983)
* vgsp: canonical kick-push guard + anchor rescue chain + ring+0x20b0 notify ↵Arthur Hanson Rasmusson35 hours
| | | | targeting + per-handle notify cache - exec lane 48/48 continuous (SESSION 153 r977-r982)
* vgsp: kick USERD watch table 64 + adopt-on-PUT-step + churn monitor + ↵Arthur Hanson Rasmusson36 hours
| | | | FB->SYS notify retry - frozen alternation solved (SESSION 153 r974-r976)
* vgsp: kick-family USERD acceptance + ring revalidate + notify event post - ↵Arthur Hanson Rasmusson37 hours
| | | | notify lane executes (n=512), client c46f/c597 allocs appear (SESSION 153 r972/r973)
* vgsp: kick NOTIFY execution (sema_kick_notify; completion word authored + ↵Arthur Hanson Rasmusson37 hours
| | | | readback verified) + notify2d witness + kick probe (SESSION 153 r971)
* vgsp: binapi07_rep knob - BINAPI 0x20810107 feature flag authored (glcore ↵Arthur Hanson Rasmusson38 hours
| | | | method-emission gate); kick notify lane next (SESSION 153 r965)
* vgsp: chan alloc/refusal diagnostics (PROMOTE_CTX probe benign); ↵Arthur Hanson Rasmusson39 hours
| | | | attribution: r958 windows were Xorg init; harness DISPLAY regression fixed; init window retires 2 consecutive cycles (SESSION 153 r962)
* vgsp: sked fe0/fehost/fecsirq lanes + FECS post-mortem readback + ↵Arthur Hanson Rasmusson39 hours
| | | | sema_gl_win_patch knob (SESSION 153 r959-r961)
* vgsp: per-channel C597 attachment table, sema_gl_win_drop strip knob, ↵Arthur Hanson Rasmusson40 hours
| | | | WINPROBE; strip experiment: binds-only windows retire, full draws die in FECS switch-in (SESSION 153 r955-r958)
* vgsp: PB-FAULT-DUMP + pb block preservation (warm-sem probe off=0x800), ↵Arthur Hanson Rasmusson41 hours
| | | | attach-on-BEGIN; init replay retires ch_rel=0xc0ffee02; draw windows remain unreleased (SESSION 153 r951-r954)
* vgsp: staged program delivery (V3 SPH accepted by engine, 0 SPH faults/40 ↵Arthur Hanson Rasmusson42 hours
| | | | launches), inline bytes 256, per-VA typed slots (SESSION 153 r947-r950)
* vgsp: sticky C597 attachment + BEGIN recognizer + draw-scan window; draws ↵Arthur Hanson Rasmusson43 hours
| | | | captured and replayed on 3D lane (engine reaches program header validation); guest-page blob delivery; two mdevs coexist (SESSION 153 r944-r946)
* vgsp: CE_M_PITCH_IN batched fold (pitch_out/line_length from count-3 run) - ↵Arthur Hanson Rasmusson43 hours
| | | | 2D copies execute; client draw pushes with real C597 geometry now flow (SESSION 153 r943)
* vgsp: CE semaphore-release decode fix (count>=2 folds v1) - DDX sem-wait ↵Arthur Hanson Rasmusson43 hours
| | | | completion authored; xwd -root unblocked (SESSION 153 r942)
* vgsp: USERD allocation-locality gate (ring+/-64MB), sema-sw window, ↵Arthur Hanson Rasmusson44 hours
| | | | kick-family pubadv arm - true ring confirmed; no draw submissions exist (SESSION 153 r941)
* vgsp: GL section arrival ledger (sema-glass) + denied-copy serving ↵Arthur Hanson Rasmusson45 hours
| | | | (sema_serve_denied); no new GL content after init measured (SESSION 153 r939)
* vgsp: USERD rejection memory + re-arm (kick tracking continuous at 142-153 ↵Arthur Hanson Rasmusson45 hours
| | | | FPS; r938) (SESSION 153)
* vgsp: native publish-counter advance (sema_pub_adv; full-RAM content ↵Arthur Hanson Rasmusson46 hours
| | | | discovery of publish pages) - glxgears 120-148 FPS with no external pokes (SESSION 153 r936)
* vgsp: native >6GiB client page resolution (PA ceiling to scan_top), kick ↵Arthur Hanson Rasmusson47 hours
| | | | 2D-notifier release decode, zero_nop bound (SESSION 153 r933/r934)
* vgsp: 3D method-stream replay lane (verbatim C597 window + shadow relocation ↵Arthur Hanson Rasmusson47 hours
| | | | + release tail; engine retires real 3D methods, no QMD) (SESSION 153 r932)
* vgsp: mode-35 plan-F 3D class object accepted on V7; GL client C597 ↵Arthur Hanson Rasmusson2 days
| | | | section-open + draw-synth path; push dumps (SESSION 153 r923-r926)
* vgsp: USERD liveness latch (speculative+confirm/reject), push content-anchor ↵Arthur Hanson Rasmusson2 days
| | | | scan, PA ceiling to scan_top, release-group matching (SESSION 153: M-GL1.2 PASS r922)
* vgsp: sysmem GR USERD RAM scan (sliced, ring-entry validated) + ↵Arthur Hanson Rasmusson2 days
| | | | unreadable-push demand regex (SESSION 153 WIP: liveness latch pending)
* vgsp: GL ring scan fixed (ring-own-offset entries, either-side window, ↵Arthur Hanson Rasmusson2 days
| | | | va1==va0; scan top param) + ring VA demand regex (SESSION 153)
* vgsp GL path: widened pin prefixes, ring-scan PROMOTE_CTX ordering evidence, ↵Arthur Hanson Rasmusson2 days
| | | | graphics-execution plan (SESSION 153)
* tools/guest-diag: working guest-GL capture and input for virtio-gpu virgl ↵Arthur Hanson Rasmusson2 days
| | | | guests (SDL swap-hook capture; XSendEvent input - SDL ignores XTEST here; region capture, focus query, window resize)
* tools/guest-diag: guest frame capture + input driving for the two-VM GZDoom ↵Arthur Hanson Rasmusson2 days
| | | | video (Xvfb XGetImage capture, SDL present shim, window resize, XTEST input, QGA range fetch)
* tools: r18 GPU animation + QGA guest-file fetch - forwarded kernels must fit ↵Arthur Hanson Rasmusson3 days
| | | | ONE 4 KB code page (SESSION 150)
* vgsp: engine executes synthesized GL launches - inline upload applies + real ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | SASS path (SESSION 149 r891) - svc_gl_flush applies the section read upload list via svc_grce_inline_write; walker pairs subch0 0x180->0x1b0 runs on eng==0 channels and applies on sight (19/19 applied; once-only (push,hash,dst,bytes) dedupe). - sema_gl_prog_hex param + source priority trusted VA read > prog-hex > bounded LID fallback (12 B). - Evidence (r891): code64 = real sm_75 SASS (nvcc-assembled EXIT;NOP cubin); engine writes qmd_rel=0x600df00d ~500 ms after submit (executed + retired); 0 Illegal-Instruction lines (r890: 7). Completion still declared failed (rc=-110; ch_rel witness unwritten) -> SYNTH-FAULT + SW release; bounded. Feature gated by sema_gl_xlate (default off).
* vgsp: synthesized GL launch passes SKEDCHECK - bounded LID blob + QMD ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | scheduling fields (SESSION 149 r889) - svc_gl_field 0x1b0: skip LAUNCH_DMA cfg word; bound the inline blob by the run's own word count (blob 64 -> 12 B, no over-read of following methods). - svc_gl_flush QMD fields: CTA dims 1/1/1 (w12-14), w18=0x00010023, w19=0x00010001, w20=0x00001a00 (REGISTER_COUNT from the stream's own REGISTER_COUNT(1) method), barrier bit w29, SASS_VERSION 7.5 (w31), driver cache-control block (w5). - Evidence (r889): SKEDCHECK06/16 zero occurrences; 'GR LAUNCH submitted shadow=1 words=239'; SM decodes; FAULT-CAP code_src=win0 ok=1; bounded action=proceed + SW release (no stall). Next wall: Illegal Instruction Encoding (program content not yet materialized). Gated by sema_gl_xlate.
* vgsp: GL section capture + synthesized launch reaches the engine (SESSION ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | 149 r888) - M1.1a: preserve the bracketing release across the section-open reset; allow hash-verified replay capture (exactly-once guard). First trusted pass now captures the GL setup section (push=0x120010004, prog=0x121201b00, rel=0x120001000, replay=0). - M1.1b: per-channel ring scan 16->24 slices + put-triggered keep-alive. - M2-S1: booter skips w48 Tier-1 when shadow_win0 is set; flush attaches the observed LID payload as an inline record. - Evidence (r888): 'qmd_word 48 page copied to window-0 shadow'; 'GR LAUNCH submitted pages=5 shadow=1 qmdwin=0x108000'; FAULT-CAP code_src=win0, code64 non-zero, FAULT_PDE count=0 (engine fetched the shadowed code). - Remaining wall: SKEDCHECK06_REGISTER_COUNT + SKEDCHECK16_CTA_THREAD_DIM_ZERO (synthesized QMD scheduling fields) -> bounded fail + SW release. Feature gated by sema_gl_xlate (default off).
* tools/guest-diag: fbcopy_pub maps BAR1 at any offset (nonzero-offset mmaps ↵Arthur Hanson Rasmusson3 days
| | | | work on this mdev; offset-0 64 MB window fallback kept, pread beyond window) - SESSION 149
* vgsp: GL pushbuffer readability - eng==0 ring-window pairing + bounded ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | sysmem PDB probe (SESSION 149 r882) - svc_pb GR namespace + svc_pb_gr_done: pair eng==0 (GL/X) channel ring windows from the content-verified ring pair; entries consumed only by the untrusted read source (src=3, last resort). CE/CUDA paths untouched. - Bounded sysmem phase added to the X-VAS PDB discover probe (vidmem sweep unchanged); accepted but inert on r882 (map cap; no candidate root). - Evidence (r882): GL channel h=0x1000013 rc=-2 572 -> 0; ring window paired va=0x120090000 -> pa=0x104ad7000; drain pb=2/48 (was 0/48); decoded bytes byte-identical to the vidmem shadow; no CE/CUDA regressions; host clean.
* vgsp: xw-mirror page-reuse guards + submit-status clearer scaffold (SESSION ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | 148 r873) The unguarded 3 ms mirror loop kept writing the count law into its latched page after the guest had reused it (r872 evidence: guest 'Bad page map ... pmd:102656067' pointing at exactly the mirrored page's PA as another process's PTE table). The loop now latches the progress word's base bits and stops permanently when they change or are zeroed, and re-checks the counter object's signature every 64th tick. New sema_xw_comp parameter + vgsp-xwcomp kthread can clear a submit member's armed 0x8000 status (value 0 pattern only); r874 proved an unverified clear into a false member kills Xorg within seconds, so it stays uninjected until the member address is watched live.
* vgsp: xw-mirror back to plain tracking law (r867 ahead-mode rejected)Arthur Hanson Rasmusson3 days
| | | | | | | | | r867 with member = counter + learned-delta: every check is a permanent +0x70 mismatch (the mirror re-advances right after each counter change), xorg.log shows '(2, ..., 0xa8c, 0xa1c)' timeouts and the GL client gets nothing. Plain member = counter is the correct law; the driver's re-probe cadence gives the mirror room to settle between the driver's counter increment and its next probe.
* vgsp: xw-mirror writes one learned frame-step ahead of the counterArthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | r866: the mirror tracked perfectly yet every wait still paid the driver's ~3 s re-check sleep (one '(0)' success print every 20-80 s; the GL client hung minutes on its X socket). Cause: the driver increments its counter and then enters the wait; a member that only tracks the counter always loses that entry-check race (mirror wakes <=3 ms after the change; the driver probes within microseconds), so the check fails and the driver sleeps out its retry interval. Writing member = counter + last-observed- delta (learned from each counter change, 0 until the first) makes the driver's own increment land exactly on the pre-written member value, so the first probe after submission succeeds and frames complete at the driver's pace.
* vgsp: notify keepalive on registered notifier slots + 8GB demo guestArthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | r864 ground truth while wedged: both the RC-watchdog channel (0x31415900) and the X/GL channel (0x1000013) sit with their class2d notification ARMED (u16 status 0xFFFF at notifier_pa + 0x3E = slot-3 struct status) and nothing ever clears them (X notified=0 after 459 submissions), so the guest krcWatchdog fires 'GPU is probably locked' every ~8.2 s and the whole X/GL stack wedges (glxgears poll() never returns; late XOOM death). Under the mirrored flow the watchdog ring reads go unreadable (rc=-2), so the decode-time ack and the notify2d_va path both miss. svc_notify2d_keepalive(): every pass, every GR channel with a registered notifier PA, read slots 0..3; for each slot armed exactly 0xFFFF write the zeroed 16-byte NvNotification and post the channel event - the same effects as svc_notify_complete without any ring read. Also bump the demo harness guest RAM to 8GB (launch_qemu_rootport.sh) to survive the observed emulation-path allocation growth during accelerated runs.
* vgsp: X/GL frame-pacer mirror (sema_xw_mirror) - unblocks the 10s/frame stallArthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | r861 evidence: the X server's present path spins in a 10s-timeout wait ((EE) NVIDIA(GPU-0): WAIT (2, 8, 0x8000, <stuck 0xd4..>, <driver counter +0x70/frame>)) comparing (progress_word & 0x3ffff) << 2 against its own submitted-byte counter; the progress word (lone u32 0x140235 in an otherwise-zero guest page) never advances because the emulation does not execute the 2D method streams -> glxgears 0.09 FPS. A gdb write of the word to 0x140000 | (counter >> 2) made the wait complete in 3 ms (WAIT (0, ... <equal>, <equal>) immediately after the timeout print) and silenced all further timeouts. This adds a 3 ms kthread that mirrors the driver's counter word into the progress word; both guest PAs are injected per boot via the sema_xw_mirror parameter (0,0 stops). Demo-path tuning aid; no product logic depends on it.
* vgsp: extend notifier-derived ring pin to all GR channelsArthur Hanson Rasmusson3 days
| | | | | | | | | r859: the X channel never resolved its ring all boot (garbage entries va=0x41c000/0x2017a20/0x10104, unreadable/skipped, ~11 s per frame). Rule verified on the RC watchdog across r848/r853/r858: ring = notifier page + 0x400. Widened to every GR channel with a registered notifier PA; the standard entry0+USERD candidate probe still content-gates each derivation, so a wrong guess costs a failed probe (the current state).
* vgsp: notifier-derived RC-watchdog ring pin (client-init determinism)Arthur Hanson Rasmusson3 days
| | | | | | | | | | The RC-watchdog channel's ring page sits at (notifier_pa page + 0x400) in every observed boot (r848/r853/r858 data points). The trusted walk resolved the same ring 14 s late on r858, inside the driver's DMA-test window on the failing boots, where the ring read zeros/garbage - 'Failed to initialize DMA' plus guest vmap-lock livelocks followed. Deriving the ring from the registered notifier PA (guest truth from the channel alloc) removes the race; the standard entry0+USERD candidate probe still content-gates it.
* vgsp: perf tracing + map-verified rescue + us RPC quanta (session 148)Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | - sema_trace_h + sema-perf logs: per-second channel state (put/last/armed/ counter) and publish-gate reasons, plus maprescue attempt outcomes. Instrument added after window tuning failed to move the 22.4 s/frame glxgears cadence; it located the real blocker in one run. - svc_rescue_push_page: content-verified full-chain map rescue (works for GR channels, whose rescue was previously refused outright). - gsp_phys_booter: RPC reply waits now usleep_range(150-350us) instead of msleep(5) (termbin review suggestion, in-tree constant verified; no FPS change measured, kept as correctness-neutral latency reduction). Evidence: r843-r847 dmesg_live logs; measured constant 22.4 s/frame for glxgears across all param windows (grace/poll/first-poll), showing the pacer is elsewhere - traced to client pushbuffer pages (va=0x3f06270-class) failing svc_lookup (-ENOENT) while the client is alive.
* vgsp: client-session boundary fixes - WD ring scan gate + forced session flushArthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | | | | | | | | | Two changes from the r839/r840 multi-client forensics (session 147): 1. The guest-RAM content scan for a GR ring must not run for the kernel RC-watchdog channel (h=0x31415900). Its ring is a plain kernel allocation always resolvable through the driver-published VAS walk; on r840 the walk lost a registration race, the scan latched a foreign garbage page, and the bad latch poisoned the driver's DMA test ('Failed to initialize DMA', Xorg died). Gated, the walk retries per pass; r841 Xorg#1 passes DMA (DMAFAIL=0) where r840 failed. 2. sema_force_flush module parameter + gsp_sema_service_sess_flush_force(): execute the ISSUE-0002 client-session flush even with live channels. The channel-close trigger never fires on real boots (driver-global channels stay valid), so later client sessions inherited stale discovery state. Verified on r841: flush executes mid-boot, Xorg survives it and re-registers its channels. Remaining wall (addendum 9): GR client channels' pushbuffer reads return all-zero through the trusted translation (va=0x4000000-class, src=4), so first entries never complete and GL clients never render.
* tools/lg: seed frame_reader last_seq from shm headerArthur Hanson Rasmusson4 days
| | | | | | | A stale frame left in the kvmfr shm by a previous publisher run (xshm_pub restarts its own seq at 1) was saved and then blocked the new run's frames via the seq-collision rule. Seeding last_seq from the header's current seq skips the stale frame and lets a fresh run's frames save normally.
* vgsp: channel-scoped VA resolution via the channel's own VAS (r835)Arthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | | | | | | | | | | | | Every RM client maps different objects at the same numeric VAs (all clients' windows sit at 0x1200xxxxx), so the global VA-keyed pin/lat/map layers conflate them across clients. Live walk_probe evidence (r834): the X server's ring VA 0x120090000 resolved through the GL client's page tables (vas h=0xcaf00005 -> a zero page) while the X client's own VAS (vas h=0x10005) holds the real page (pa=0x1294fa000). That conflation is what wedged the X server's readback wait and starved the RC watchdog's ring (its pushes decoded as empty). * Parse NV_CHANNEL_ALLOC_PARAMS.hVASpace (@28; layout confirmed by the struct's own known offsets) at channel registration and carry it on svc_channel. * svc_chanvas_lookup: resolve a VA through the serviced channel's own VAS page tables first (svc_cur_vas, refreshed per channel turn and in the decode path). The hook sits at the head of svc_lookup_trusted, so ring, push, release and notifier resolution all inherit it; a failed walk falls through to the old chain unchanged. Live r835: X's XShmGetImage readback, previously never completing, returned after its long wait and a frame reached the kvmfr BAR (first frame content still black and readback latency still ~87 s; the guest-side fbcopy_pub framebuffer reader tool is added for the direct-VRAM capture path, find/pub/test modes).
* vgsp: pin the RC watchdog's push and notifier pages at first real decodeArthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | r834: the watchdog push's translation can go stale under heavy GL load (the content-scanned map answering a zero page where an injected pin previously delivered the real method stream), starving the notifier ack. Pin the page that delivered the first real decode (svc_read_last_pa at the SET_NOTIFY_A capture) and the page that accepted the first ack (svc_notify2d_write), so the every-pass ack keeps resolving. Still observed: under 150 s of sustained GZDOOM the guest's krcWatchdog can still report 13-17 timeouts and xshm_pub's XShmGetImage never completes (the X readback op stalls), so the capture path is not yet usable; the X server itself stays up (4 WAIT lines / 150 s).
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-31 04:24:54 +0000