| Commit message (Collapse) | Author | Age |
|---|
| | |
|
| |
|
|
| |
the mapped VA
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
After a doorbell the GSP-RM status ring accumulated unconsumed records
that nothing drained: the host readPtr stayed behind the writePtr and
the engine's error text was never decoded. Add a bounded drain (max 64
records) using the existing validated ring walk: each record is logged
with its function/status/seqNum, function 0x1006 (OS_ERROR_LOG) is
decoded into exceptType/runlistId/chid/prevXid/errString, and function
0x1020 (GSP_POST_NOCAT_RECORD) into recType/errorCode/subsystem/
bugcheck/faultingEngine plus a bounded printable view of the diagnostic
buffer. The host read pointer advances per consumed record (the normal
consumer side), so the ring keeps free space. Stage 4's poll-timeout
path drains before returning -ETIMEDOUT, and a new read-only debugfs
file gsp-phys-status-drain triggers one bounded drain per read. No
locks are taken and no device register is written.
|
| |
|
|
|
|
|
|
|
|
| |
SET_SEMAPHORE_A/B always take a GPU VA and the channel is USER, so the
release cannot target a raw DMA address and physical-mode src/dst is not
permitted. Map the src/dst/semem pages at VA 0x102000/0x103000/0x104000
(small-PT slots 258/259/260) in the existing channel PDB, push the semaphore
VA, drop the SET_SRC/DST_PHYS_MODE pairs and clear LAUNCH_DMA bits 12/13
(0x18d: Pipelined|Flush|Release-one-word|Pitch). The block is now 13 method
pairs / 26 dwords; GPFIFO/PUT/doorbell/poll/memcmp are unchanged.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Revert the USERD selection to the client sysmem chunk unconditionally:
the ladder advances GP_PUT by writing that chunk directly, and there is
no BAR1/PRAMIN aperture here to reach an FBMEM page, so an FBMEM USERD
would leave the host write invisible to the hardware USERD the engine
polls. Remove the now-dead FBMEM USERD allocator, handle and state; the
FBMEM error-notifier allocation path is unchanged. The PDB hierarchy,
VA-based gpFifoOffset and ring-entry GET, TSG schedule insurance, logs
and asserts from the PDB change are kept. Logs now say userd=sysmem
(host-writable) so the path in use is unambiguous.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
GPU VAs
Fill the external VAS root's GP10X v2 hierarchy (root/PD2/PD1/PD0-small/PT)
around a 2 MB VA window so the PDBMA/CE can fetch the GPFIFO and pushbuffer
by GPU VA; gpFifoOffset and the GPFIFO ring entry GET now carry those VAs.
Allocate the USERD page in FBMEM (class 0x40, matching the reference default)
with the sysmem chunk as fallback, and add the advisory TSG-level
GPFIFO_SCHEDULE 0xa06c0101 after the channel BIND/schedule. Log the window,
table DMAs and entries, and expose them in the debugfs state snapshot.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
the notif index advisory
The class-0x40 NV_MEMORY_ALLOCATION_PARAMS reached the server with owner=0,
which the class constructor rejects with NV_ERR_INVALID_OWNER (0x39). Set
owner=HEAP_OWNER_RM_CLIENT_GENERIC (0xDEAF000C) and internalflags=
NVOS32_ALLOC_INTERNAL_FLAGS_SKIP_SCRUB (0x4), matching the reference notifier
allocation. Add static_asserts pinning owner/attr/size/offset/hVASpace/
internalflags to the reference 128-byte ABI so a layout drift breaks the build.
SET_WORK_SUBMIT_TOKEN_NOTIF_INDEX (0xc36f010a, index 3) now logs an advisory
warning on failure (no error-context object exists, so the server returns
NV_ERR_OBJECT_NOT_FOUND 0x57) and the stage continues to GET_WORK_SUBMIT_TOKEN:
the server writes the work-submit token before the notifier update, so the
token is independent of the notifier object.
|
| |
|
|
| |
submission
|
| |
|
|
|
|
|
|
|
| |
The TU104 GMMU root level has 2 index bits (4 PDEs of 2^47 bytes each), so
the server's vaLimitNew = (numEntries << 47) - 1 must stay within its
vaLimitMax = 2^49-1; numEntries=256 computed 2^55-1 and drew
NV_ERR_INVALID_ARGUMENT (0x1f). Send 4 entries (32 bytes of the 4 KB
page-aligned VASPDB chunk) and log the value on failure. The aperture/flags
word is unchanged (0x0a, SYSMEM_NONCOH + ALL_CHANNELS).
|
| |
|
|
| |
channel ladder (V5)
|
| | |
|
| |
|
|
| |
gsp-owned, server-allocated memdescs)
|
| |
|
|
| |
and decode rm-call statuses
|
| |
|
|
| |
static-config-handle ladder path
|
| |
|
|
| |
allocation and a first real copy
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
identity, and request the full static-config payload
The RM log-ring init argument carried a malformed libos id (LOGM), so the
server never mapped the ring and its early failure path was invisible.
The pre-boot system-info payload carried unpacked 16-bit identity fields;
the server expects the raw config-space dwords (device<<16|vendor), so its
GPU device-id read back as zero and the static-config device-name lookup
returned NOT_SUPPORTED.
The static-config RPC must be sized to the full reply payload, and the
guest-system-info RPC is sent first, matching the reference order.
Live result: GSP-RM completes initialization (init-done rpc_result=0),
serves the 1656-byte static config (name, FB size, handles, PDE bases),
and shuts down cleanly through the unload RPC.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Fill the GspSystemInfo chipset fields the production client syncs before
the GSP boot instead of leaving them zero:
- clPdbProperties (bitmask in the client's clSyncWithGsp order): bit 0
(config space accessible, from the OS MCFG/ECAM availability), bit 7
and bit 21 (Intel Skylake-family upstream-port setup: ASPM POR list,
root-port nosnoop WAR), bit 13 (upstream port ASPM L1 capable), bit 27
(LTR supported+enabled up to the root port) and bit 32 (IO coherent).
PDB_PROP_CL_UNSUPPORTED_CHIPSET is never assigned by the client, so the
faithful unmatched-chipset value is 0.
- Chipset = 0 (CS_UNKNOWN) for a host bridge with no chipsetInfo[] entry,
the reference's no-match fallback.
- FHBBusInfo/chipsetIDInfo: 10-byte BUSINFO blobs of the first host
bridge of the GPU's domain (device, vendor, subdevice, subvendor,
revision), with the subsystem-capability fallback on chipsetIDInfo.
acpiMethodData is intentionally sent all-zero (bValid=0): no ACPI/AML
calls are made and every consumer tolerates the no-data encoding. All
device lookups use refcounted pci_get_device()/pci_dev_put().
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
experiment)
The working distribution driver runs with display enabled; the
RmDisableDisplay=1 deviation changes board/display state and may be
implicated in the devid/board validation failure blocking GSP-RM init.
Regenerate the profile without it: the 35 host default parameters plus
RMDevidCheckIgnore=1, 36 entries total, display brought up as a stock
boot would.
Same canonical packing: size 1344, numEntries 36, rpc.length 1376,
record 1392 (8-byte aligned), one 4 KB element. The module is unchanged
apart from comments and the prepared log line, which now reports
'host default profile + RMDevidCheckIgnore=1, display enabled'.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Append RMDevidCheckIgnore=1 (dword) to the pre-boot SET_REGISTRY
profile, after the 35 host default parameters and RmDisableDisplay=1.
The key is the registry escape for the static-config devid/board check
that currently fails GSP-RM init; every existing entry is unchanged.
Regenerated kernel/gsp_phys_registry_img.h with the same canonical
packing (values inline, names-only blob): size 1377, numEntries 37,
rpc.length 1409, one 4 KB element. The module code is unchanged apart
from comments: the submission and the prepared log line read the size
and entry count from the generated blob/macros.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
GSP-RM init
The pre-boot SET_REGISTRY (function 73) submitted an empty
PACKED_REGISTRY_TABLE. Replace it with the default registry profile the
host driver sends before boot: the 35 default dword parameters from its
parameter table plus RmDisableDisplay=1. The display key makes the GSP-RM
display-presence check treat display as absent, so the display engine is
removed during pre-init instead of being brought up on a headless boot.
The payload is generated into kernel/gsp_phys_registry_img.h as a
PACKED_REGISTRY_TABLE blob (8-byte header, 36 16-byte dword entries,
NUL-terminated names after the array; values inline; no value bytes in
the name blob, matching the reference packer): size 1342, numEntries 36,
rpc.length 1374, one 4 KB element. fn72 is unchanged.
The payload length is not 8-byte aligned (record 1390 -> 1392); the TX
producer already zero-pads the kvzalloc'd staging record and folds the
XOR checksum over the padded length, exactly like the reference producer
zero-pads before _checkSum32, so no producer change is needed. The blob
is static const data: no heap, no new stack frame, and a submit failure
still aborts the boot. The prepared log line now prints the payload size
and entry count.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The real-GSP boot path staged the message queue but never queued the two
fire-and-forget init RPCs the production client places in it before the
booter starts. GSP-RM therefore created its GPU object without any system
information and aborted RM init (live GSP_INIT_DONE rpc_result=0x59), with
the resource-manager's object-database lookups asserting from the first
journal record.
Submit function 72 (GSP_SET_SYSTEM_INFO, 928-byte v17_00 payload carrying
the BAR physical bases, domain/bus/slot, PCI IDs, the BAR0 config-mirror
offset, link/FLR capabilities and upstream-port flags read from the
pci_dev) and function 73 (SET_REGISTRY, header-only empty table, which the
server explicitly accepts) through the existing submit-only queue producer
after all stage-3d preconditions and before the GSP falcon reset/Booter
Load kick. The wire layouts are re-declared in the module with per-field
static asserts against the reference ABI; payloads are heap-allocated, so
no new stack frames are introduced.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
| |
A zero REG_POLL timeout dword is the reference's GPU_TIMEOUT_DEFAULT
sentinel: the reference substitutes the platform default (microseconds;
4 s in graphics mode, the default platform) before waiting. The executor
clamped zero to the 1 us floor, i.e. one jiffy, so a poll that was not
already satisfied failed the boot in 1 ms.
The live 0x1002 sequencer element contains exactly one REG_POLL with
timeout=0 (addr 0x110040); substitute the 4 s graphics-mode default and
then keep the existing 1 us .. 10 s clamp.
|
| |
|
|
|
|
|
|
|
| |
The live 0x1002 element carries bufferSizeDWord=0x3FE2 (16354) - the size
of GSP-RM's own command buffer, not the message. The executor's 0x1000
sanity cap refused it, so the sequencer was never run and GSP_INIT_DONE
was never observed. The reference imposes no upper bound (only nonzero and
greater than cmdIndex); raise the cap to a sanity ceiling and document
that the real execution bound is cmdIndex against the element payload.
|
| |
|
|
|
|
| |
Applies the adversarial review fixes for the command-queue TX and unload RPC: the unload RPC is gated on GSP-RM init-done, debugfs fops pin the module, REG_POLL timeouts use microseconds, the host status readPtr is published, TX free space is checked, swap flags and barriers are corrected, and the legacy payload fallback is opt-in.
Generalizes the transport to multi-element records and a reply-matching status-queue reader, and adds a debugfs probe that round-trips GET_GSP_STATIC_INFO (with a SET_GUEST_SYSTEM_INFO fallback), decodes the server configuration, and a read-only state snapshot file. All gated by gsp_phys_boot; the normal load path is unchanged.
|
| |
|
|
| |
Adds a minimal msgq producer on the command queue (element layout, checksum, sequence, dma_wmb before writePtr, doorbell) and submits the UNLOADING_GUEST_DRIVER RPC so GSP-RM shuts down and sets the scratch14 handoff bit the Booter Unload gate needs. Release attempts the RPC once before quiescing when a boot ran; on-demand testing is available through the debugfs file gsp-phys-unload-rpc while the module owns the GPU. GSP-RM processor suspend is polled on the GSP mailbox.
|
|
|
Stage 3d stages the GSP-RM boot from host sysmem (FMC, radix3 over the GSP-RM ELF, signature, message queues, libos LOGINIT/LOGRM/RMARGS and GSP arguments) and runs Booter Load on SEC2: GSP RISC-V reset, libos mailbox, IMEM/DMEM direct load, BOOTVEC=0, M0==0, FALCON_OS, RISC-V active. Stage 3e links the status queue and polls for GSP-RM events; it now also executes the inline run-sequencer command buffer (event 0x1002) against BAR0 (REG_WRITE/MODIFY/POLL, DELAY, STORE, CORE_* including CORE_RESUME) and then waits for GSP_INIT_DONE 0x1001.
Gated by gsp_phys_boot / gsp_phys_boot_dryrun (default off; the normal load path writes nothing). gsp_phys_fwsec=1 without gsp_phys_boot=1 is refused: a FWSEC-only carve cannot pass the booter-unload handoff gate. Release quiesces the GSP, runs the existing FWSEC-SB/booter-unload teardown and frees all staging.
tools/gen_gsp_bindata.py decodes the public generated archives into the Booter Load image (prod signature patched at 0x8700) and the GSP-RM boot (FMC) image; both are self-checked at build time.
|
