summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* STATE-CURRENT: PD writes proven live; runtime client past registration; ↵Arthur Hanson Rasmusson13 days
| | | | | | | | canonical reply fix - page-directory entry writes captured and validated; 64/64 baseline stays - vectorAdd client now fails after registration in libcuda (rc=3), no kernel error - BAR-info canonical reply-size bug fixed; one cache mismatch remains
* guest-diag: PD-watch cycle (dst-keyed root-PD watch + park-time shadow dumps)Arthur Hanson Rasmusson13 days
| | | | | | | | Reproducible TASK 2 harness: fresh boot, sema_dbg=Y with sema_copy_dst=0x200000 / sema_copy_dst2=0x208000, cdt2 parked at CDT_CP_PAUSE so the root PD/PT pages can be dumped and walk_probe run while the client is live. Prints the offending write data (prov= names the translation layer) and the post-run walk state.
* GSPRM BUS_GET_PCI_BAR_INFO: reply the canonical 8-entry params structArthur Hanson Rasmusson13 days
| | | | | | | | | | The control is cacheable in the guest kernel (RMCTRL_FLAGS_CACHEABLE) and rmapiControlCacheSet validates paramsSize against the canonical sizeof(NV2080_CTRL_BUS_GET_PCI_BAR_INFO_PARAMS) = 200. We replied only 8 + 4*24 = 104 bytes, so every reply tripped NV_ERR_INVALID_PARAMETER in rmapiControlCacheSet (rpc.c:9998) and the BAR-info cache entry was never populated. Zero-fill and report all eight NV2080_CTRL_BUS_PCI_BAR_INFO entries (count still 4).
* STATE-CURRENT: quiet logging landed; baseline verified twice; PD-capture ↵Arthur Hanson Rasmusson13 days
| | | | | | | | task next - dmesg diagnostics gated behind default-off sema_dbg; 64/64 with a 520-line log - staging buffer kept resolvable via streamed pins; PD-entry capture remains - note the guest-side kernel fault observed in serial
* guest-diag: stream the client's high-VA UVM sysmem pages as pinsArthur Hanson Rasmusson13 days
| | | | | | | | | The DtoH staging buffer lives in the client's high-VA /dev/zero|nvidia mappings (e.g. devptr+0x3c00100), outside the scanner's fixed CE/GR windows; only the host's pagemap read can see it. The guest scanner now walks those VMAs and streams their present pages so the module pins them. run_cycle.sh learns the sema_dbg master switch (auto-on when any watch knob is set).
* sema-svc: gate per-push/per-doorbell/RPC tracing behind default-off sema_dbgArthur Hanson Rasmusson13 days
| | | | | | | | | | | | | | | | | | A healthy run left dmesg dominated by per-operation lines (sema-push, sema-lda, sema-chan rel-apply, sema-grce, DOORBELL/BAR writes, GSPRM per-RPC lines, the teardown garbage-element stream). Introduce the module parameter sema_dbg (default 0) and route every high-frequency diagnostic through it; the finer-grained watch knobs (sema_ops_log, sema_copy_watch, sema_copy_pat, sema_copy_dst, sema_copy_dst2) only take effect while it is on. Boot stats, channel registrations, pin events and state changes stay unconditional. Also carries the per-side translation provenance (op_tr_src, printed as prov= in the destination-window watch) and the 16 KB destination window used to observe the guest's page-table writes. Verified: fresh boot + full cdt2 smoke test (64/64, ALL OK) leaves a 520-line dmesg with zero per-push/per-doorbell/per-RPC lines.
* STATE-CURRENT: payload roundtrip 64/64 restored by the page-table ↵Arthur Hanson Rasmusson13 days
| | | | | | | | publication capture - the device-to-host destination now resolves; baseline green again in live runs - frontier/active-work notes updated: land the capture fix, then the runtime vectorAdd client
* STATE-CURRENT: baseline regression (DtoH destination translation) and the ↵Arthur Hanson Rasmusson13 days
| | | | targeted-fallback/retry work
* sema-svc: hold and retry a readable push whose operand is under a targeted ↵Arthur Hanson Rasmusson13 days
| | | | RAM scan (the DtoH dst staging VA needs multiple scan slices)
* sema-svc: operand resolver gains the targeted rm_mem fallback; per-side ↵Arthur Hanson Rasmusson13 days
| | | | translation-miss tracing (the DtoH copy operand is the failing side)
* sema-svc: targeted 256-byte op + compute-channel release-block tracing (the ↵Arthur Hanson Rasmusson13 days
| | | | DtoH op is still invisible)
* sema-svc: log the LAUNCH_DMA push VA and injected/allow flags; widen the ↵Arthur Hanson Rasmusson13 days
| | | | op-failure log budget (the DtoH work path is invisible at the old caps)
* docs: retire the 2026-09-21 STATE.md snapshotArthur Hanson Rasmusson13 days
| | | | | | | - remove the superseded flat state page; current state lives in STATE-CURRENT.md and the docs tree - update the historical-material note in docs/README and the STATE-CURRENT header/see-also references
* guest-diag: retry the guest pin-scanner startup (a transient agent exec ↵Arthur Hanson Rasmusson13 days
| | | | failure left a boot without pins and the client hung)
* STATE-CURRENT: runtime bring-up started; runtime buffer translations are the ↵Arthur Hanson Rasmusson13 days
| | | | | | | | | wall - harness runs nvidia-smi and a static-runtime vectorAdd-style client - page-table walk succeeds at scale; larger runtime buffers still fail translation (host copies report missing entries) - frontier/active-work notes updated
* guest-diag: mount tracefs before installing kprobesArthur Hanson Rasmusson13 days
| | | | | | A fresh boot can leave /sys/kernel/tracing as an unmounted mount point; the probe adds then fail silently (probe count 0) and the whole sem/kptr pipeline goes blind.
* guest-diag: reset per-client pin state when a new client pid appearsArthur Hanson Rasmusson13 days
| | | | | | | A new CUDA client allocates fresh channel pools at the same GPU VAs; the watcher kept the previous client's sem kptrs and seen-pin marks, so it pinned the previous (freed) pool pages and the new client's release writes went to dead memory. Clear the learned sems/marks on each pid change.
* guest-diag: pin scanner matches va* clients too (static-cudart vectorAdd)Arthur Hanson Rasmusson13 days
|
* sema-svc: apply UVM increment releases once per GPFIFO slotArthur Hanson Rasmusson13 days
| | | | | | | | | | | UVM CE tracking semaphores start at a base value and each completed push adds the release payload (observed base 1 + payload 1 -> the client waits for 2). The absolute comparison (payload > cur) could not see the second push and the release was silently dropped, leaving cuInit/UVM stuck. Track applied GPFIFO slots in a per-channel bitmap (preserved across re-registration and the pump's snapshot write-back) so a pin-batch rewind replays entries without double-incrementing; rescued pages stay release-only and never mark a slot.
* guest-diag: cycle monitor CPUs on kernel-VA translation failureArthur Hanson Rasmusson13 days
| | | | | | | | | HMP x/gva2gpa translate with the selected vCPU's CR3; while that CPU runs user code under PTI the kernel half is hidden, so kernel-VA reads (the tracking-sem chain and the CE pushbuffer CPU alias) fail and the pin pass aborts. Try the other vCPUs before giving up: during an active CUDA client at least one CPU is in kernel mode, so the chain/pin work no longer require the client to be parked in sleep().
* STATE-CURRENT: full driver-API smoke test passes with payload 64/64Arthur Hanson Rasmusson13 days
| | | | | | | - milestone: cuCtxCreate through cuCtxDestroy with correct data roundtrip - GMMU walk decode fixed (real entry encoding); DtoH copy-engine-on-compute allowed for trusted injected pushes - ladder/diagrams/rails updated; next rung is real CUDA workloads
* sema-svc: execute CE-class work on host-injected compute pushes (the DtoH copy)Arthur Hanson Rasmusson13 days
| | | | | | | | cuMemcpyDtoH submits the copy as C5B5 methods bound on subchannel 0 of a compute channel (eng=0). allow_ops was false for every eng=0 channel, so the LAUNCH_DMA copy was decoded (and its release applied) but never executed, and the client read zeros. A host-injected translation is verified truth: allow CE work on those pushes too.
* guest-diag: cdt2 mapping scan is opt-in (CDT_SCAN=1); it can wedge the clientArthur Hanson Rasmusson13 days
|
* sema-svc: GRCE write log budget follows sema_ops_log when raised (catch late ↵Arthur Hanson Rasmusson13 days
| | | | HtoD writes)
* guest-diag: cdt2 payload scan limited to anon mappings (device-mapping reads ↵Arthur Hanson Rasmusson13 days
| | | | can block)
* guest-diag: cdt2 payload scan only touches anon/device mappings (avoid ↵Arthur Hanson Rasmusson13 days
| | | | SIGBUS on truncated file maps)
* guest-diag: cdt2 scans its own mappings for the payload after HtoD (DtoH ↵Arthur Hanson Rasmusson14 days
| | | | mechanism probe)
* sema-svc: CE op translation falls back to the GMMU walk for virtual operandsArthur Hanson Rasmusson14 days
|
* sema-svc: decode GMMU PDE/PTE addresses with the real encoding (addr>>12 in ↵Arthur Hanson Rasmusson14 days
| | | | | | | | | | bits 32:8/53:8) The mask-and-keep decode dropped the left shift by 12, so every page-table child pointer and leaf resolved 16x too low and no GMMU walk ever produced a translation (walks_ok=0 on every boot). Verified against live page tables: directory entry 0x2020a -> table 0x202000, leaf 0x0600000000760001 (aperture VID, KIND=6) -> PA 0x7600000.
* STATE-CURRENT: payload path found (compute-class inline DMA); page-table ↵Arthur Hanson Rasmusson14 days
| | | | | | | | | walk is the wall - smoke test ends ALL OK; data roundtrip pending the GPU-VA walk - HtoD identified as a GRCE inline-data DMA and decoded; destination translation is the remaining blocker - frontier/rail refreshed
* sema-svc: destination-keyed copy watch (dump page-table writes)Arthur Hanson Rasmusson14 days
| | | | | | sema_copy_dst=dumps the source bytes of every copy whose destination falls in the given page, so the 32-byte page-directory updates the guest writes into vidmem can be read directly and their entry encoding learned.
* guest-diag: pin scanner matches cdt* so the copy-path test binary is trackedArthur Hanson Rasmusson14 days
| | | | | | | The GR-window pin scanner matched comm=="cdt" exactly, so runs using the cuda_drv_test2 binary (comm "cdt2") never streamed their mappings: the GR push pages stayed unresolvable and the client stalled in context creation. Match the cdt prefix instead.
* sema-svc: decode GRCE inline-data DMA (small HtoD path)Arthur Hanson Rasmusson14 days
| | | | | | | | | | | | | | | | | | The 256-byte cuMemcpyHtoD payload never appears in any CE push: CUDA submits it on the compute channel as a compute-class DMA whose source is the push's own inline data (LINE_LENGTH_IN=256, OFFSET_OUT=<device VA>, LAUNCH_DMA=0x41, LOAD_INLINE_DATA 64 dwords, then the channel's SET_REPORT_SEMAPHORE release). The CE-shaped decoder skipped the data run (opcode 3) and no GR work ran at all. - Decode NVC5C0 GRCE methods on subchannel 1 (LINE_LENGTH_IN, LINE_COUNT, OFFSET_OUT/UPPER, LAUNCH_DMA) and the opcode-3 LOAD_INLINE_DATA run. - svc_grce_inline_write resolves the destination VA through trusted sources (pins, map, published page directories, targeted rm_mem resolve), pins the page and writes into vidmem or guest RAM; budgeted sema-grce logs name the target or report UNRESOLVED. - cdt2 test binary gains CDT_CP_PAUSE / CDT_HP_PAUSE for live inspection of the copy path; pushed by push_guest_tools.sh.
* sema-svc: run CE work before its release, grace unreadable CE entries, ↵Arthur Hanson Rasmusson14 days
| | | | | | | | | | | | | | | | | | | payload-pattern audit - CE LAUNCH_DMA releases are now applied after the push's collected work runs: the client reads copied data as soon as it observes the release, so release-first let cuMemcpyDtoH observe a copy that had not executed. - Unreadable CE entries stay pending for a grace window (sema_ce_grace_ms, default 8s) before the release fallback consumes them, so a translation that lands within a service pass lets the push be decoded and its work executed instead of being dropped. - sema_copy_pat matches an 8-byte value against every copy's src/dst first word and scans decoded pushes for it, naming the submission that carries a known payload regardless of size/encoding. - sema-dma-skip logs transfer-shaped launches that collect no op; op log lines carry the channel handle; LAUNCH_DMA inventory follows OPS_LOG. - A real release application now records the release VA, so decoded pushes no longer trigger a spurious fake release.
* guest-diag: cdt CDT_WAIT park-at-end (live memory inspection); run_cycle ↵Arthur Hanson Rasmusson14 days
| | | | CDT_WAIT passthrough
* sema-svc: copy-watch also logs dst8_after (write-effect check)Arthur Hanson Rasmusson14 days
|
* sema-svc: sema_vidmem_find pattern search (CE data-path ground truth)Arthur Hanson Rasmusson14 days
|
* guest-diag: pushbuffer pin survives PTI holes (full-range scan + bounded ↵Arthur Hanson Rasmusson14 days
| | | | retries until complete)
* sema-svc: sema_copy_watch (size-keyed src/dst byte audit for the CE data path)Arthur Hanson Rasmusson14 days
|
* sema-svc: sema_vidmem_dump param to inspect emulated vidmem (CE data-path audit)Arthur Hanson Rasmusson14 days
|
* sema-svc: sema_ops_log param (default 8) to audit executed CE operands; ↵Arthur Hanson Rasmusson14 days
| | | | run_cycle OPS_LOG knob
* STATE-CURRENT: cuCtxCreate 999 root-caused and fixed; UVM runtime progressArthur Hanson Rasmusson14 days
| | | | | | | | - GR-info indices 7/9/0x17/0x22 were zero in the emulation (shader-pipe sub-count among them); filling real-device values clears the previously fatal context check - client now runs inside UVM for minutes instead of failing in seconds - next wall: push-data operand translation (fix in); frontier notes updated
* sema-svc: CE operand translation consults pinned translations before the ↵Arthur Hanson Rasmusson14 days
| | | | scanned map (push-data memcopies were rc=-ENOENT; UVM inline writes now execute)
* guest-diag: run_cycle enables semfix pushbuffer chain walk by default (CE ↵Arthur Hanson Rasmusson14 days
| | | | window has no CPU alias; the vsock stream cannot supply it)
* guest-diag: run_cycle SKIP_OPS knob + cdt output on serial; cdt richer ↵Arthur Hanson Rasmusson14 days
| | | | roundtrip diagnostics
* gsp-rm: fill GR info indices 7/9/0x17/0x22 (libcuda clock-table path; e94 ↵Arthur Hanson Rasmusson14 days
| | | | TPC count)
* guest-diag: bpz21 - dump the FUN_00337e60 info array from FUN_00550ff0Arthur Hanson Rasmusson14 days
|
* guest-diag: bpz20 - watchpoint on ds+0xe94 to catch the zeroing writeArthur Hanson Rasmusson14 days
|
* guest-diag: push bpz18Arthur Hanson Rasmusson14 days
|
* guest-diag: run_cycle gdb-launch mode + bpz18 early path traceArthur Hanson Rasmusson14 days
|
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-13 23:43:03 +0000