summaryrefslogtreecommitdiffstats
path: root/kernel/gsp_phys_booter.c
Commit message (Collapse)AuthorAge
* vgsp: CONT-91 - svc_gr_inline_retarget re-roots captured program-family ↵Arthur Hanson Rasmusson7 hours
| | | | inline records (page not in launch prog_va family nor prog_bind_va[]) onto launch family offset-preserved, page-crossing tails follow head, wired into svc_gr_req_fill; svc_gr_page_inline_covers widened; sema_ds_mask_clear=1 clears DS_HWW_REPORT_MASK/_2 (0x405844/c) ahead of every 3D window; gsp-phys-ds-spy debugfs; GR-STATE retire logs sph= (STAGE0..5 START/UPPER) + rr= (PROGRAM_REGION) + MME shadow readback; sema_gl_sph_region + sema_sph_region_base emit Volta+ program region (SET_MME_SHADOW_SCRATCH 0x78/0x79 = 0x35e0/0x35e4) - r1298 real V4 image at exact bind VA (INLINE-APPLY len=1536 first=020a0481 + INLINE-RB rb=020a0481); same launch DS flags sph=0,00620900,00620200,0,0,00620000 rr=0,0 ds=a4000e20 w/ correct bytes + region A/B 0/0 unchanged; DS rejects all bound stages -> unresolved variable = address space DS validates in (our shadow VAs 0x6xxxxx vs client guest VA region); next A/B: knob leaving program operands at ORIGINAL guest VAs when page identity-mappable (skip shadow rewrite for that pair only) - SESSION 153 r1298-r1306
* vgsp: CONT-90 - mapping EXONERATED (canary proof: sema_gl_sph_canary=1 maps ↵Arthur Hanson Rasmusson8 hours
| | | | program VAs to canary hpa=0x10bdc3000 w8=cc00cc40..., DS error set moves {5,9,10,11}->{1,2,5,9,10,11,18,26} = DS reads exactly what our PTE maps, content-driven; SPH-ALIAS pages/resolve/canary receipts w8 readback; shadow-win A/B no structural change); sema_gl_shader_exc=1 emits SET_SHADER_EXCEPTIONS(0x1528)<-0 (nv3dInitChannelTuring order) - 5/9/10/11 persists; real image rejected (INLINE-APPLY dst=0x4350900 len=1536 first=020a0481 -> 0.2s later 5/9/10/11 + Class Error Offset 0000022c Data 00000800); NEW delivery-lag bug r1297: stage-image/real-upload pinned old family while windows bind fam=0x42d0000/0x41c0000/0x4400000, fetch page all zeros, zero INLINE-APPLY that boot (r1294-96: 24-28) - next: make delivery follow req->prog_va family / fallback-author synthetic SPH at every bind target with zero page - SESSION 153 r1294-r1297
* vgsp: CONT-89 - INLINE-APPLY-ALIAS real bug fix (inline records landing on ↵Arthur Hanson Rasmusson9 hours
| | | | qmd_word=NONE page never applied - 1408B real program @0x4350f00 was head-only 256B at engine; live fix INLINE-APPLY-ALIAS dst=0x4351000 len=1152 pa=0x85e0f4000 first=0d0d7623); full init-push pipeline block into SPH-BIND prelude in client order (0x2040<-0x11 SET_PIPELINE_SHADER(1), 0x204c<-0x1a,0 REGISTER_COUNT/BINDING(1), 0x21c<-0x1001 INVALIDATE_SHADER_CACHES, 0x155c/0x1574 TEX pools, 0x310<-0x705, 0x22c<-0x800, 0x1128<-ffffffff x2; emission-count bug fixed - uncounted emission caused SPH-BIND skipped reloc=6/4) - 9/11 (and 5/10) PERSISTS on executing launch reading real image (r1293 SPH-BIND fam=0x4390000 j1-type=0x11 rc=0x1a initblk=17 win=306 + INLINE-RB rb=020a0481 -> S/5/9/10/11; r1292 full block visible in-window) -> wall is emulated GMMU/PTE view; next A/B gsp_phys_rmcall_gr_shadow_win0=0 vs 1, canary at SPH offset via second alias - SESSION 153 r1287-r1293
* vgsp: CONT-88 - real program payload delivery engine-visible: ↵Arthur Hanson Rasmusson10 hours
| | | | GSP_BRIDGE_INLINE_BYTES/SVC_GR_INLINE_BYTES/GSP_PHYS_GR_INLINE_BYTES 256->2048 (+static_asserts; svc_gl_flush prs[] static); svc_grce_dst_newest harvests window's REAL captured upload from svc_grce_dst_ring, svc_gl_flush attaches real 1536B@0x4350900 + 1408B@0x4350f00 (w0=0x020a0481) as inline records at own dst VAs (page-crossing split, tail page candidate); svc_grce_inline_write dual-writes engine-visible injected-pin page (svc_grce_land_write page-clamped); SPH-BIND also emits SET_PIPELINE_SHADER(2)<-0x21/(5)<-0x51 - delivery WORKS: real-upload record va=0x4350900 len=1536 first=020a0481 (engine-visible delivery), INLINE-APPLY guest=1, INLINE-RB rb=020a0481 pa=0x64cfd6000, page[7] va=0x4350000 hpa=0x64cfd6000 (r1283); wall survives real image (9/11 + ESR 0xa0000a00 +14ms; V4 window still 9/11); bind+type+real-image combo never seen on executing launch (lane wedges 1-3 launches); stores 0/900-901; next: healthy boot >=3 bind-carrying launches then harvest client init-push pipeline state (20010810 00000011 SET_PIPELINE_SHADER(1)<-0x11 + 0x204c pair) into SPH-BIND prelude - SESSION 153 r1282-r1286
* vgsp: CONT-87 - sema_gl_sph_bind (window's own binds + client's missing TESS ↵Arthur Hanson Rasmusson10 hours
| | | | j=2 / PIXEL j=5 binds relocated by window pass; SPH version derives from loaded blob; INLINE-RB readback witness); stage-typed images at family VAs (TESS=vs image SHADER_TYPE->2), real-upload-wins record skip, gsp_sema_gl_sph_blob_version, prog_binds plumbing, pin-first arm - all three stages now fetch from authored VAs (sph=0,00620900,00620200,0,0,00620000); error 18 CLEARED (9/11/18->9/11); authored bytes engine-visible (INLINE-RB rb=000a0461); 9/11 survives every content A/B (V4 retag, SASS5, real w0 0x020a0481, REGISTER_COUNT, own-binds prelude, empty-blob) -> pipeline-state wall not content; real driver images in window inline writes dst=0x4350900 bytes=1536 + dst=0x4350f00 bytes=1408 (w0=0x020a0481 SPH V4) land in vGPU VRAM shadow NOT engine-read page; next: raise GSP_PHYS_GR_INLINE_BYTES 256->2048 + carry payloads in per-VA inline record or land svc_grce_inline_write via pin/fill - SESSION 153 r1276-r1281
* vgsp: CONT-86 - sema_gl_sph_version (emits Turing channel-init pair 200205a9 ↵Arthur Hanson Rasmusson11 hours
| | | | 00040004 00040004 after SET_OBJECT on replayed 3D windows); gsp_phys_fault_regs_log (MME_HWW_ESR/INFO/IR + DS_HWW_ESR/ESR_2 + SPH stage starts beside every GR-class 0x1006); SDM-DROP forensic log; block-cap hardening <=4096-128; attr-prelude capture range 0x2000..0x2200 (8 pipeline records) - fault witness: failing SPH stage1 fetched from relocated shadow VA 0x620900; minimal V3 blobs rejected STRUCTURALLY (V4 retag no help); SDM drops all 0001fff0 SET_SUB_DEV_MASK legit; missing binds: j=2 va=0x4300200 TESS + j=5 va=0x4300000 PIXEL never in windows/preludes; next: author client's REAL SPH+SASS bytes at relocated program VAs (VA 0x4300900-family from unreplayed init push) as sema_gl_vs_hex/ps_hex + replay stage-2/5 binds - SESSION 153 r1273-r1275
* vgsp: sema_gl_mme_sa_rearm (bool default 1) gating SA re-arm block for ↵Arthur Hanson Rasmusson12 hours
| | | | same-boot A/B - CONT-85: newest emissions EXONERATED (version=0 track=-1 flips did not stop poison; 0xbadf1201 = NV_PPRIV_SYS_PRI_ERROR_CODE_FECS_PRI_RESET ringstation latch not MME exception); r1270 first call-launch poisoned with calls HELD + no prelude -> macro execution not required for poison; r1272 rearm=0 EXECUTED launches but Shader Program Header 9/11/18 Error + ESR 0xa2040a00 x5 + ILLEGAL_OPCODE 0x80000004 + Class Error Offset 0000238c Data 00020020, 0 GR-STATE retires; SA-REARM A/B neutral; next: wire missing SPH state for draw (DS SPH 9/11/18) - leading candidate SDM-family entries that sema_gl_sdm_drop=1 drops, replay ahead of window + capture MME_HWW_ESR_INFO 0x404494 at ILLEGAL_OPCODE for PC witness - SESSION 153 r1271-r1272
* vgsp: CONT-84 - SA-REARM moved before window copy (was appended after, calls ↵Arthur Hanson Rasmusson13 hours
| | | | ran against prelude SA clobber); WIN-PATCH reaches beef path at last (sweep runs=383 matched=4, 0x124 off65 0x2->0x1 x4); prelude-capture pages bitmask + ring-drop log 8->64 - capture completeness FIXED (pages=0x7fff -> words=3083 covered=55 sa_mask=0x63fffefffffffff code_words=2854); sema_map_add_max=4096 guard (stale host writer re-injecting stale mapping every ~2s racing per-page pins - REFUSED, first-read capture complete); sema_gl_mme_version=1 (SET_MME_VERSION 0x234, absent from capture) + sema_gl_mme_track (0x124<-0) - no change observed; GATE1 black: call-bearing launches park+poison every boot (r1245/1250/1265/1270) even w/ complete prelude+rearm+TRACK+VERSION, gen0=0 MME never starts, shadow2[c597] 0x3810=0x11 0x3910=0; trap=80001614 + transient ds a2040a00 noted; next: A/B version=0/track=-1 (lane destabilized vs MME never starts), shadow port read at first call launch, track=2 PASSTHROUGH - SESSION 153 r1237-r1270
* vgsp: store-side emission forensics (DS_HWW_ESR, SPH_INFO_STAGE_START ↵Arthur Hanson Rasmusson14 hours
| | | | x6+UPPER+REGION, MME_HWW_ESR_INFO, FE_DECODE_STATE, MME shadow-RAM port reads w/ CALL trigger probes) + MME-SA-REARM (re-emit [0x11c]=j,[0x120]=sa_ent[j] for every macro slot the emitted window calls) - root-caused replayed-prelude ordering bug: stream ended SA[34]=0 so every draw call resolved to macro 0; rearm now fires 4/5/9/11/12 slots live; healthy boots DS clean sph unbound=0 (0xa2040a00 lead does NOT reproduce); MME executes macros (pc_valid=1 pc=513 mac=0xf1); calls reach MME (shadow2[c597] 0x3810=00000011) but draw methods NEVER emitted (0xd74=0 0xd78=0 0x1618=0); stores still 0/900-902; win_patch=124:1 knob never reached beef path; next: repair win_patch application point + sweep 124:1 TRACK, strip leading CALL-run header variants, compare CALL-run encoding vs nvk P_1INC shape - SESSION 153 r1229-r1236
* vgsp: sema_gl_mme_hold_calls (default 1) - elide window's remaining ↵Arthur Hanson Rasmusson15 hours
| | | | CALL_MME_MACRO/DATA runs while prelude generation not latched OR while this launch itself uploads generation code; real calls resume next launch; 0=legacy wedge - complete-generation hold PASS: r1228 real {0,2,34,39,40}+attr_prelude retire_delta=6 fail_delta=0 over 32s no wedge; r1225 MME-CALL-HOLD 36 word(s) window=222->186 then prelude gen=3 words=3083 - stores still 0/900-901 (gen0=0, no MME-emitted method witnessed); new localization: +slot48 Class Error Offset 0000238c Data 00020020, +slot51 Offset 00001614 Data 00000000 + WEDGE-RECOVER; next: store-side emission forensics SPH_INFO_STAGE_START 0x405c00+si*4 + DS_HWW_ESR - SESSION 153 r1221-r1228
* vgsp: sema_gl_mme_nop_drop (slots in mask have CALL runs dropped entirely - ↵Arthur Hanson Rasmusson18 hours
| | | | r1144-r1177 proven-safe retire) + force-stub semantics (nop_drop slot stubbed in drop filter + SA end-noop stub kept - r1186 lesson: keep|57 removes SA[57] stub, mis-detected kept run executes faulting macro) - validation: (a) keep=5 retires PROVEN (7/14/15 retires, poll break ch=0xc0ffee02 after 94us); (b) keep=5|1<<57 PARKS confirmed; (c) nop-retarget VALIDATED NEGATIVE (DATA-port run without open macro context parks); (d) all-real unresolved (bad boots baseline ILLEGAL_OPCODE too); boot lottery 7 healthy of ~28; stores 0/900-901 all session; next: apply nop_drop=1<<57+sa_stub_all=N within ~10s of first retire on a healthy boot, bisect slots via nop_drop (34=146650112133693440) - SESSION 153 r1180-r1208
* vgsp: sema_gl_mme_block_cap=2048 (blocks >~2050 words never start on engine ↵Arthur Hanson Rasmusson21 hours
| | | | - CONT-78 wall root cause), run-aligned prelude drain with generation-keyed cursor (3089-word program over 2 launches, latch on final part, WEDGE-RECOVER rewinds), attr prelude same cap, sema_gl_mme_nop_param_mask (parameter-conserving NOP: call-run header rewritten to CALL_MME_DATA port) - r1177: full program ships (words=3089 covered=55) + blocks 1327-2048 all retire; bisect: slot 57 PARKS (keep=5|1<<57 -> 0 retires/6 fails, grfifo frozen events=0, no poison; r1142 CALL_MME_MACRO(57) class); NOP transform fires (26 runs retargeted) but unvalidated on wedged boots; next: healthy boot validation sequence (a)keep=5 (b)+1<<57 parks (c)+nop_param=1<<57 (d)sa_stub_all=0 -> N/N stores - SESSION 153 r1173-r1179
* vgsp: SVC_MME_PRELUDE_WORDS 1024->3584 + SIGS 2048, 4-page module pushbuffer ↵Arthur Hanson Rasmusson23 hours
| | | | (VA_PB3/4 at PT slots 0x103/0x104, VA_DST->0x10b, VA_SEM->0x10c, METHOD_WORDS 4096, pb2 chunk 1->3 pages) - SA table extended past slot 12 (55 slots 0..35,37..53,57,58; mission slots [34,39,40,48,51,57] all IN table), prelude doubled (words=2048 ir_end=0x265 covered=34 code_words=1873); still stubbed by one PC (collect_mask [34..57]; slot 34 entry=0x265==ir_end); temporal pattern: window pages valid only inside channel context, new PA per context, zero at resolve time; next: session re-streaming full-SA push (0x402094c ~2min after GL context) then confirm dropped_mask->0 - SESSION 153 r1162-r1165
* vgsp: GUEST-WIT direct-write witness (every relocated operand destination ↵Arthur Hanson Rasmusson26 hours
| | | | guest page fingerprinted pre-doorbell + retire rescans with +150ms settle control) - r1156: 0/905 relocated-operand guest pages changed NONE (no direct guest writes); draw stream complete-looking (colour target 1280x720 fmt=0xe6 relocated to bounce 0x0a000000 + DRAW_CONTROL + index/program/vertex floats); draw rasterizes nothing in ANY watched channel; missing state = MME macro programs for called slots 34/39/40/48/51/57 (replayed IR tiny ir_end=0xe9 covered=13) while big push HELD unresolved (GR setup hold entry=131 va=0x3e4ccccc len=123916); next: resolve/capture that push, extend SA beyond slot 12, pushbuffer past 2 pages - SESSION 153 r1154-r1156
* vgsp: WEDGE-RECOVER race fix (MME-FAST sample returns poison observation; ↵Arthur Hanson Rasmusson27 hours
| | | | gate = live badf || fast_poison - validated r1151 catches self-cleared poison, recovery #1, retires continue), GR-STATE retire one-shot readback (fed0..3/trap/mthd/mmegen/DS/grfifo, beef <=48), MME-FAST fed= transition lines, force-prelude while keep_mask!=0 - mask train: stores 0 under EVERY mask; kept-macro execution proven (slot-2 macro ran); r1153 cleanest (keep=5, nothing dropped, prelude every launch, fast retires, 0 poison/ILLEGAL, still 0/900) = store wall DOWNSTREAM of macro execution; degrade intrinsic ~66s; next: write witness over relocated operand VAs + MME shadow-scratch (not only 900 RT pages) - SESSION 153 r1151-r1153
* vgsp: sema_gl_mme_keep_mask (u64, slots never stubbed/dropped), MME-PRE-DUMP ↵Arthur Hanson Rasmusson29 hours
| | | | one-shot (raw words+sa_mask+IR coverage), SA data-port capture (0x120 runs), gsp_sema_mme_code_words_get - offline MME64 sim proves macro(0) loads CB offsets (0x238c<-0x320 etc) and macro(2) binds vertex streams with observed args, no poison; live A/B keep_mask works (dropped 115 vs 181 words); r1146 boot beef did NOT retire (timeout 2500ms, elapsed 8842ms, 0/902 pages) vs r1144 94us retire - re-establish r1144 state (prelude 901 vs 773 words, pages 7 shadow 6 vs 8/5, warm-sem wedged) then rerun keep 0x4/0x1 - SESSION 153 r1145-r1146
* vgsp: Mesa mme_tu104_builder_finish terminator stub body (old body emitted ↵Arthur Hanson Rasmusson30 hours
| | | | SET_OBJECT(0)<-0 twice = Class 0xc597 Offset 0 Data 0 poison), ONEINC cnt 7, sa_block 8+3n; sema_mme_fast_ms pre-reset MME sample (spin ESR/INFO/INFO2/DS/grfifo/trap right after doorbell; poison floods PRI in <6ms, raw latch never visible); sema_gl_mme_stub_pc override; sema_gl_mme_call_drop=1 (drop stubbed-slot CALL runs) - DRAW-CLASS WINDOW RETIRES: MME-CALL-DROP 164 words dropped (window=220), poll break ch=0xc0ffee02 after 94us, 11 poll breaks 0 ILLEGAL_OPCODE 0 WEDGE-RECOVER, ok=11; stores still 0 (0/900 no writes); next: re-enable real macro execution one slot at a time (sim covered macro offline first) - SESSION 153 r1142-r1144
* vgsp: stub IR write real encoding SEC_OP_ONE_INC=5 (op=1 walked ↵Arthur Hanson Rasmusson31 hours
| | | | 0x114->0x118/0x11c/0x120 clobbering SA[0]=1 = r1131 MISSING_MACRO_DATA), stub PC at IR-end, byte-exact END body, coverage-aware stubbing, ONE_INC ghost CALL fix (18->6 real), MME-WINRUN dump, prelude latch keyed (generation,h_object); mme_ir_end/ir_cov bitmap + USERD adopt latch clear - ATTRIBUTION ANSWERED: non-retire is NONE of the attachments (window-only also ILLEGAL_OPCODE 0/901; all-macro-noop sa_stub_all=1 still ILLEGAL_OPCODE 0/902); r1111 retire was a different frame class (5016B no-CALL) vs draw-class (7148B CALL_MME_MACRO(0)); next: MME reg sample BEFORE WEDGE-RECOVER reset + stub landing verify (stub_pc 0xf0 test) - SESSION 153 r1132-r1141
* vgsp: replay/block capacity 1024->2048 words (r1126 drop was arithmetic: ↵Arthur Hanson Rasmusson32 hours
| | | | window 390+prelude 901+sa 47 > 1024), two-page module pushbuffer (VA_PB2 0x102000 small-PT 0x102, CE SRC->0x109000, warm-sem probe page 0x10a000), gsp_phys_gr_pb_copy page-wise, static_asserts - planted verified (r1127 pb page2+probe planted before first fetch); >4KB path never exercised (5 boots beef never forwarded; walk PA 0x23921d000=8.89GB outside 8GB image); guest setup push NOT in guest RAM (ram_content_pin accepted 0/74); next: drop+re-walk src=4 all-zero reads, reject PA>guest-RAM top - SESSION 153 r1127
* vgsp+diag: SA-RAM table captured unbounded (entry[64], sema-mme-sa log), ↵Arthur Hanson Rasmusson36 hours
| | | | surf geometry accessor + completeness recs, fill seeds RT candidate 0 full span (<=1024 pages, completeness only on fully-resolved run); MME slot stub (called-but-uncaptured slots end-noop IR 0xC0, sema_gl_mme_sa_stub=1), reloc prefers tracked rec bounce VA; pin family += 0x4200000 - 0x238c wall root-caused (capture truncated buffer full=28 words=512, SA[0x22]=0 jump IR 0; sim proves slot-0 emits EMIT 0x238c=0x20020); fixes never executed (setup-push read lost, unreadable=1 first8=00040000 00001000); next: trustworthy pagemap resolve or accept ipin first-chunk - SESSION 153 r1117-r1120
* vgsp: SURF-PRELUDE (replays captured C597 colour-target bind ↵Arthur Hanson Rasmusson37 hours
| | | | alias-scanned+pair-relocated ahead of targetless stream3d windows - the NO-STORE cause: windows carry no render target; emitted words=7 window=391), ATTR sanitize (drops active attr words with width=0; r1113 torn 0x81a4 fixed), MME-miss census into MISS-ABORT+demand, MME-IMMATURE-SKIP; r1116: draw reaches engine, trap moved to 0x238c LOAD_CONSTANT_BUFFER_OFFSET Data=0x20020 then PBENTRY; GATE 1 static nz=2551 mean=0.083 DIFF 0 - SESSION 153 r1112-r1116
* vgsp: re-arm on MISS-ABORT (candidate re-offered unwon, releases re-parked, ↵Arthur Hanson Rasmusson37 hours
| | | | 1500ms tick, 55s/64-try episode bound; GSP_PHYS_GR_RC_MISSABORT -ENOMSG), junk-operand filter (0x10000000..0x100000000 reloc misses not demanded - float constants), MME prelude latch cleared on WEDGE-RECOVER - **FIRST-EVER nonzero beef submit+retire** (GR LAUNCH submitted push=0xcf3d724 len=5016 pages=9 words=389, poll break ch=0xc0ffee02 after 64us, 12 poll breaks, 0 poisons; client 0.077->287-436 FPS); still NO-STORES (bounce 0 pages changed by engine); next: SKED CTA counters for prove dispatch-vs-degenerate + fix vertex/index operand state - SESSION 153 r1109-r1111
* vgsp: demand set 64->512 + ring-overwrite (no silent drop; ↵Arthur Hanson Rasmusson38 hours
| | | | head/total/evicted in debugfs sema_setup_demand), EBADMSG return authors software release (suppresses synth), ZEROWIN-SKIP (all-zero 3D window software-released, no engine submit) - verified: demand 197 VAs past cap, MISS-ABORT convergence (submit only at miss=0), ZEROWIN-SKIP no-poison; store-bearing window still not achieved (r1106 retire root-caused zero window); r1108 slow-death (Wait for channel idle timed out + red screen on SKIP edge); next: re-arm candidate on MISS-ABORT (not consume) - SESSION 153 r1107-r1108
* vgsp: PBENTRY first-sighting watch (all 12 PBDMA intr0 bit18, ↵Arthur Hanson Rasmusson39 hours
| | | | PB_HEADER/COUNT/DATA0/HDR_SHADOW dump pre-rearm, 8/boot) + PB-FAULT-DUMP voff/tail/past-end; sema_gl_sdm_drop (op-0/2/6 single-word SDM entries from preludes+window); reloc level-2 fallback; sema_gl_miss_abort (pre-doorbell abort on residual MISS, feeds pin demand); gsp_sema_demand_note + attr-prelude ptr pages demand-recorded + sema_attr_settle_ms=8000 - **FIRST BEEF WINDOW RETIRES ON REAL HW** (poll break ch=0xc0ffee02 after 68us, 737-word block) but no-store retire (0/4 pages changed, NO-STORES); residual MISS flood (miss=11..17) blocked by FULL demand set (64/64 MAX) - SESSION 153 r1103-r1106
* vgsp: sema_gl_attr_zero_fix (default 1) - torn-read zero guard drops ↵Arthur Hanson Rasmusson39 hours
| | | | exactly-zero data words in SET_VERTEX_ATTRIBUTE_A/B INC runs (span=(wr-wout)+1), FE-decode trap regs (0x40a630..c MME_PC/MACRO/GENERATED) in sked sampler - 0x1168 fault root-caused to client's own 20030458 38400000 38200040 00000000 run (A(2)=0 ErrorCode 0x5); r1102: ZERO Class Errors (fault class cleared); next wall: PBENTRY fault intr0 bit18 (exceptType=0x20, pbfetch=0x101ebc block end, gp_put=5) - SESSION 153 r1101-r1102
* vgsp+diag: attr/pipeline prelude (families 0x1100-0x1200/0x2000-0x2060, ↵Arthur Hanson Rasmusson40 hours
| | | | dedup, 512w, program-pair VA record; emitted via patch_window relocation, run-aligned after MME prelude), mature-prelude gate (>=64 0x114 code words, sema_gr_prelude_gate_ms=60000 busy-defer), pin_gr_stream 0.75s pass, trap regs in sked sampler - first clean DS+MME (ds_esr=80000000 mme_esr=80000000, a2040a00 gone); 0x1168 CLASS ERROR persists as MME-MACRO-GENERATED WRITE (no 0x1168 header in emitted stream; macro(2) args [0,0,600000,0,610800]); next: disassemble macro (2) at pc 0xa + trapped-addr read pre-latch - SESSION 153 r1095-r1100
* vgsp+diag: debugfs sema_setup_demand (armed setup-hold VA set, 0444 ↵Arthur Hanson Rasmusson41 hours
| | | | seq_file) + pin_gr_stream demand loop reads it (kills dmesg-ring race; 20s resend/300s expiry), bounded 3D raw dump of pre-drop window - MME-PRELUDE emitted gen=2 words=512 (context alive submissions=760); NEW WALL: first beef window loads context + clean MME (mme_esr=80000000) then Class Error ChId 0001 Class 0xc597 Offset 0x1168 (SET_VERTEX_ATTRIBUTE_A(2)) ErrorCode 0x5 + poison; emitted attr runs byte-faithful; next: attr/pipeline prelude (0x1100-0x1200/0x2000-0x2060) + gate first launch on mature prelude - SESSION 153 r1091-r1094
* vgsp: MME setup prelude - capture client MME context-setup runs ↵Arthur Hanson Rasmusson42 hours
| | | | (0x114..0x124/0x234/0x550..0x568/0x3400..0x34fc) verbatim, exact-run dedup, 512-word buf + gen counter (sema_mme_prelude_cap); one-time-per-generation preplay in GR launch build (sema_gl_mme_prelude); capture verified - full macro program 11 SA/IR pairs ~206 code words, MME-PRELUDE emitted gen=5 words=444; no further mme_esr=80000004 after prelude (r1079); remaining: setup push unreadable=1 skip before pin demand; r1082-class content-independent dispatch stall - SESSION 153 r1078-r1082
* vgsp: in-flight MME/fault capture (ds_esr/mme_esr/mme_pc/mac/ir/mth regs at ↵Arthur Hanson Rasmusson43 hours
| | | | 5ms sked sampler), PB-FAULT-DUMP+WINPROBE+window-dump budgets raised, BLOCKVAL stream validator, subdrop (multi-word runs subchannel!=0 dropped), sema_mme_census - ROOT CAUSE: real MME ILLEGAL_OPCODE on CALL_MME_MACRO(2)=0x3810 with no macro program loaded (mme_esr=80000004 mme_pc=0 mme_ir=1); client's MME setup (0x120 LOAD_MME_START_ADDRESS_RAM, 0x124, 0x3400 scratch) never forwarded; 0x1c00+j*16=SET_VERTEX_STREAM_A_FORMAT(j); next: MME setup prelude injection - SESSION 153 r1073-r1077
* vgsp: svc_push_page_heal (beef push all-zero read re-resolves via ↵Arthur Hanson Rasmusson44 hours
| | | | launch-page chain, pin/cache, src=10; sema-pushzero len cap 1024), mme-reloc-rsv (MME-family payload miss resolves via RELOC-FIXED ledger/pin/walk shadow-map), pin_gr_stream pushzero 4K-page bulk demand (48/batch); HW retire only with A+0x34a8+C dropped - draw payloads live in exactly the refused families (0x1c00-0x1c20 MME macro-code uploads / 0x3810 CALL_MME_MACRO); Graphics Exception ChID 0001 Class 0x0000c597 Offset 0 - SESSION 153 r1070-r1072
* vgsp: sema_gl_mme_reloc (CALL_MME_MACRO/DATA payload relocation via launch ↵Arthur Hanson Rasmusson45 hours
| | | | pages, raw-operand fault fix), MME-page collection + 4KB ptr dedup, 0x1b00 pair-relocation, sema_gr_wedge_recover (TSG-preempt re-arm on 0xbadf, revived channel: REAL GR SEM OK 0xc0ffee01), win_drop_auto += 0x1b00 - BEEF LAUNCHES RETIRE (h=0xbeef0100 ch_rel=0xc0ffee02 elapsed_ms=0 ok=6, 3 consecutive); full-perimeter windows still wedge in [0x1200,0x7ffc); client registration 5/5 with keeper - SESSION 153 r1058-r1063
* vgsp: sema_gl_idx_reloc knob (idx-buffer/vertex-stream shadow-VA relocation, ↵Arthur Hanson Rasmusson46 hours
| | | | default 0 = r1035-r1041 set), win_drop lo-hi ranges, engine-entry logging (e0/e1 in GR LAUNCH, ring[3] in poll break) - entry encoding IDENTICAL X vs beef (e0=0x00101000); discriminator = raw operand VA in window content faulting GR once and wedging ladder (cwd0=badf1201, fecsirq=0x10); next: relocate CALL_MME_DATA(j)=0x3804+j*8 operands + wedge recovery - SESSION 153 r1042-r1057
* vgsp: 3D flush gate fix (built-in chunk bound, not bisect knob), pushzero ↵Arthur Hanson Rasmusson2 days
| | | | zero-content rescue (probe PROMOTE_CTX, src=9), CHUNK1 dump, SET_INDEX_BUFFER+vertex-stream collection; publish GPFIFO entry at engine GP_GET (PUT-GET=1); win_drop 0x parser fix - beef chunks still PBDMA-stop at 0x1160 attr run (hdr=20030458 INC m=0x1160 cnt=3) while X retires ch_rel=0xc0ffee02 same boot - SESSION 153 r1034-r1041
* vgsp: 3D stream chunking for client pushes - GR push words 512->2048, ↵Arthur Hanson Rasmusson2 days
| | | | candidates 4->8, method-aligned <=384-word chunks in ring order with 8-pending backpressure (sema_gl_chunk_words knob), zero-head guard, PBDMA chunk-end fault fix, 3DSTREAM dump; first client src=stream capture (h=0xbeef0100 push=0x54eefd4 len=1580 nprog=2 recs=2), ch_rel=0xc0ffee02 submitted; beef windows still don't retire (scheduler stall vs X retiring same boot) - SESSION 153 r1028-r1033
* vgsp: RUSD INIT_USER_SHARED_DATA (0x20800afe) handler + gsp-phys-shared-bit0 ↵Arthur Hanson Rasmusson3 days
| | | | knob - direct client channel alloc gate broken open (c46f hObject=0xbeef0101, err@ReadPixels=0x0 px=255,0,255,0) - SESSION 153 r999-r1002
* vgsp: full-frame strip assembly (origins+per-channel CE state, delta push ↵Arthur Hanson Rasmusson3 days
| | | | fold), FERMI_TWOD executor (screen fills rc=0), RT-as-screen surface alias + win-drop auto, client replay retires (faulted=0, GR forward failed=0) - SESSION 153 r984-r997
* vgsp: sked fe0/fehost/fecsirq lanes + FECS post-mortem readback + ↵Arthur Hanson Rasmusson3 days
| | | | sema_gl_win_patch knob (SESSION 153 r959-r961)
* vgsp: per-channel C597 attachment table, sema_gl_win_drop strip knob, ↵Arthur Hanson Rasmusson3 days
| | | | WINPROBE; strip experiment: binds-only windows retire, full draws die in FECS switch-in (SESSION 153 r955-r958)
* vgsp: PB-FAULT-DUMP + pb block preservation (warm-sem probe off=0x800), ↵Arthur Hanson Rasmusson3 days
| | | | attach-on-BEGIN; init replay retires ch_rel=0xc0ffee02; draw windows remain unreleased (SESSION 153 r951-r954)
* vgsp: staged program delivery (V3 SPH accepted by engine, 0 SPH faults/40 ↵Arthur Hanson Rasmusson4 days
| | | | launches), inline bytes 256, per-VA typed slots (SESSION 153 r947-r950)
* vgsp: sticky C597 attachment + BEGIN recognizer + draw-scan window; draws ↵Arthur Hanson Rasmusson4 days
| | | | captured and replayed on 3D lane (engine reaches program header validation); guest-page blob delivery; two mdevs coexist (SESSION 153 r944-r946)
* vgsp: 3D method-stream replay lane (verbatim C597 window + shadow relocation ↵Arthur Hanson Rasmusson4 days
| | | | + release tail; engine retires real 3D methods, no QMD) (SESSION 153 r932)
* vgsp: mode-35 plan-F 3D class object accepted on V7; GL client C597 ↵Arthur Hanson Rasmusson4 days
| | | | section-open + draw-synth path; push dumps (SESSION 153 r923-r926)
* vgsp: GL section capture + synthesized launch reaches the engine (SESSION ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | 149 r888) - M1.1a: preserve the bracketing release across the section-open reset; allow hash-verified replay capture (exactly-once guard). First trusted pass now captures the GL setup section (push=0x120010004, prog=0x121201b00, rel=0x120001000, replay=0). - M1.1b: per-channel ring scan 16->24 slices + put-triggered keep-alive. - M2-S1: booter skips w48 Tier-1 when shadow_win0 is set; flush attaches the observed LID payload as an inline record. - Evidence (r888): 'qmd_word 48 page copied to window-0 shadow'; 'GR LAUNCH submitted pages=5 shadow=1 qmdwin=0x108000'; FAULT-CAP code_src=win0, code64 non-zero, FAULT_PDE count=0 (engine fetched the shadowed code). - Remaining wall: SKEDCHECK06_REGISTER_COUNT + SKEDCHECK16_CTA_THREAD_DIM_ZERO (synthesized QMD scheduling fields) -> bounded fail + SW release. Feature gated by sema_gl_xlate (default off).
* vgsp: perf tracing + map-verified rescue + us RPC quanta (session 148)Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | - sema_trace_h + sema-perf logs: per-second channel state (put/last/armed/ counter) and publish-gate reasons, plus maprescue attempt outcomes. Instrument added after window tuning failed to move the 22.4 s/frame glxgears cadence; it located the real blocker in one run. - svc_rescue_push_page: content-verified full-chain map rescue (works for GR channels, whose rescue was previously refused outright). - gsp_phys_booter: RPC reply waits now usleep_range(150-350us) instead of msleep(5) (termbin review suggestion, in-tree constant verified; no FPS change measured, kept as correctness-neutral latency reduction). Evidence: r843-r847 dmesg_live logs; measured constant 22.4 s/frame for glxgears across all param windows (grace/poll/first-poll), showing the pacer is elsewhere - traced to client pushbuffer pages (va=0x3f06270-class) failing svc_lookup (-ENOENT) while the client is alive.
* vgsp r801: gsp_phys_gr_min_data=0 is an explicit bypass (the ↵Arthur Hanson Rasmusson6 days
| | | | | | | | | | | | | | | no-external-data launch class), not a clamp to 1 The Vulkan compute launch's single QMD pointer pair names its own QMD window and its params are scalars (0.2/640/480), so n_data=0 is correct for it; the bare n_data>=min threshold refused it as degenerate. The bypass is safe now that gsp_phys_chunk_page_va answers NULL for an unallocated chunk (r800) - before that guard the empty-set post-mortem print dereferenced a garbage pointer (Oops at gsp_phys_backend_guest_gr_submit+0x4394). Default stays 16; 0 is opt-in for the egg-break test that forwards the launch to the real engine so the copy-out can carry pixels back. Proper launch-internal predicate next.
* r800 SESSION 141 walk guard: gsp_phys_chunk_page_va returns NULL for an ↵Arthur Hanson Rasmusson6 days
| | | | unallocated chunk (no per-page array AND no base va) - it previously returned (u8*)NULL + page*PAGE_SIZE, a small non-NULL garbage pointer, so the caller's NULL guard passed and the empty-set post-mortem print dereferenced it (Oops #2 at gsp_phys_backend_guest_gr_submit+0x4394, CR2=0x1e93c); with the guard, min_data=0's no-external-data forward can proceed
* vgsp-sema: SESSION 127 C5C0 TRANSLATOR v1 - the Vulkan compute launch ↵Arthur Hanson Rasmusson7 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | captured, filled and forwarded (and its copy-out executed) through the CUDA QMD machinery The Vulkan client's compute dispatch is an inline-QMD launch that lives in the PRE-BUILT ring continuation beyond GP_PUT (the earlier analysis only inspected the put-bounded pushes' idx7/idx12 and concluded 'no inline QMD'): beec0100 idx23 carries SET_INLINE_QMD_ADDRESS_B (0x31c = 0x4b85f, the upper half absent) plus the 64-word LOAD_INLINE_QMD_DATA (0x320) run - grid 40x30, prog=0xdfd8feb900 (the SASS page), param=0x4b86000, release0=0x4b85e08/1 - and idx24 carries the TURING_DMA_COPY_A (0xC5B5, subch 4) image->buffer copy-out (src=0xdfd8d60000 dst=0x050b0000, 640x480 RGBA rows) plus the SEND_PCAS schedule (0x2b4 = qmd>>8, 0x2bc = SCHEDULE). Pieces landed (all service-thread, all bounded/logged): - svc_gr_ahead_push (the sema_gr_ahead sweep parser) is now a strict tail-aware translated decode of one continuation entry: it accepts a method stream whose final inline run is completed from the NEXT ring entry (the driver splits big LOAD_INLINE_DATA payloads into a dedicated data slot entry: beef0100 idx00->idx01 256 B, idx08->idx09 12288 B), feeds the C5C0 inline-QMD window to svc_qmd_accum (capture via the standard CUDA QMD candidate), materializes GRCE/KEPLER_INLINE_TO_MEMORY_B LOAD_INLINE_DATA writes into the VA shadow exactly like the main decode (once-only keyed; recorded in the dst ring for the fill's inline-served pages), parses the C5B5 copy operands (0x400/0x404/0x408/0x40c/0x410/0x414/0x418/0x41c, 0x300 LAUNCH_DMA, 0x700/0x708 remap) into a pending copy list, and queues the release groups minus a release a live launch candidate owns (that word belongs to the completion edge, so the client's fence can never clear on a pre-render image). - The parser reads the run data words correctly (w3 fix; the GRCE 0x18c operand was being read from the next run's header word, which sent the 1568 B parameter-bank write to a bogus destination). - svc_qmd_accum: accept the ADDRESS_B-only inline-QMD form (implicit zero upper half) so qmd_dev_va is real for the Vulkan launch. - svc_gr_page_note + svc_gr_req_fill: resolve a client-VAS page through the registered-VAS walk when the trusted sources do not carry it (the Vulkan QMD's program/parameter/descriptor pages are client-managed vidmem; the fill refused the whole launch with -ENOENT before this). - The QMD capture's inline recs are filtered to the pages the captured QMD names (a stale session-wide rec destination made the fill refuse with ENOENT va=0x80412000 qmd_word=NONE). - Pending GRCE copy-out list executed on the launch completion edge (svc_fwd_hold_gr_release and svc_fwd_outcome_check) before the guest release is authored, with a bounded no-forward fallback at the sweep; the copy itself runs through the standard svc_copy executor (observed: 'copy done h=0xbeec0100 dst=0x50b0000 bytes=0x12c000 rows=480 rc=0'). - The pump offers a sweep-captured launch every pass (svc_gr_request) - the continuation launch's only dispatch path - and retires pending copies when no forward is owed. - gsp_phys_gr_min_data (module param, default 16): the degenerate-data-set refusal threshold is now tunable; the Vulkan dispatch's operand set is a handful of records, not the CUDA-era 968. - Bounded witnesses for the request paths (first-N/periodic: no-candidate, backend-not-ready, hold-busy, inflight-busy, fill-ENOENT) and the capture tail dump is now sema_dbg-gated with a 4/boot budget (it flooded dmesg). Live status (r726, cycles r719..r726): the client runs green through the fence (VKFRAME seq/DONE/IDLE, 3 PPMs) with no in-flight client assist; the sweep captures the launch ('launch captured ... qmd=0x4b85f00 prog=0xdfd8feb900 param=0x4b86000'); the fill resolves the QMD pages (page-note src=walk) and now passes its ENOENT gate; the copy-out executes for every frame. The physical launch itself is still refused: the fill yields n_data=0 because the launch's operand CONTENT (the SASS at prog=0xdfd8feb900, the descriptor data) is delivered by the driver through the MME / inline-to-memory engine upload stream (beec0100 idx7/idx12, beef0100 idx08), which the emulation does not execute - the pages the QMD names stay zero in the emulated vidmem. That engine-side upload path is the next work item; sessions r719..r726, evidence in the handoff. No host reboots; 0 oopses; the fetch of the CUDA battery on a fresh boot follows separately.
* vgsp-sema r633: park a held GR launch's push-level release records and ↵Arthur Hanson Rasmusson8 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | deliver them on the eventual forward (the r632 mail hang), gate synthetic shadow pages on an anchored span with per-episode budgets (the r632 junk-candidate flood), and name the release0 redirect cause The r632 first boot's mail client spun forever in cudaDeviceSynchronize after its vadd launch: the push-level tracking release (0x20480fff0 pay=112) never landed while the client's word stayed at 111, even though the launch itself completed (GUEST GR LAUNCH OK) and its QMD release was software-applied. Root cause: the release records (svc_fwd_rel[]) are per-decode state (reset at the top of svc_decode_stream), and the two GR hold paths (busy-defer hold, m150 data-stalled hold) break out of the pump entry loop BEFORE the release block (hold-engage / inline apply) runs - so a held launch's records are dropped at the pass boundary. The eventual forward (queued from the capture ring at the defer cap, without a re-decode of the entry) then engaged the release hold with whatever records that pass happened to carry (often none, or another entry's). Live evidence: read_proc_va on the spinning client - 0x20480fff0 = 111 (payload 112 never applied), 0x204827f74 = 6 (QMD release delivered); host log - no sema-sw line for 0x20480fff0 val=0x70 anywhere. Fix (parked releases, keyed by vgpu/channel/push VA): both hold paths park the pass's records (svc_grpark_put) before their break; svc_gr_request restores the queued push's parked set into svc_fwd_rel[] at the consume point so the pump's hold-engage holds exactly those records; the two fail-closed REFUSED paths deliver the parked set inline; the session flush clears the table. Bounded log line "GR parked releases restored" (32/boot). Proven live: r633 first boot restored push=0x20043c1c8 n=1 va0=0x20480fff0 pay0=100; r633 mail now completes (VADD bad=0 checksum=12204516.000000, STATUS OK) on two consecutive fresh boots. Also r633: the r632 synthetic shadow caps were per-FILL-CALL and the fill re-runs on every retry pass, so one probe=none junk argument candidate could mint another 1024 synthetic pages per pass - the 8192-page shadow table filled within seconds of the r632 first launch (va-shadow 8192/8192, all synthetic, from the two 16 MB guessed spans of candidates no resolver ever answered), which then killed the lane for every later real page ("shadow table full ... write dropped"). Two changes: - ANCHOR GATE: a synthetic page is created only when the candidate's span already has >= 1 page answered by ipin/resolve/ledger. Existing H2D shadow content still serves unconditionally (the red-draw chain), and a real buffer's unresolved tail stays anchored by its resolved head. A candidate whose every page is answerless takes the historical drop path - its guessed span is not a buffer; - PER-EPISODE BUDGETS: the per-candidate (1024) and per-launch (4096) caps now persist per (push VA, span base) across the episode's passes, not per call. Measured r633: shadow table peak 2048/8192 (vs 8192/8192 full), 32 synthetic pages for the mail launch (vs 4041 junk-inflated n_data), the lane stays available for content serves. Diagnostics (bounded, one boot of evidence): "vgsp-work: gr-rel0 ..." names the release0 resolution chain (rel_pa/ap/hpa/word/pay/unobs) and "vgsp-gr: qmd-rel redirect: ..." names the backend redirect cause. The first live reading answers the release-target question: rel_hpa resolves (0x2fc495000), map_ret=0, unobs=0 - the redirect is the deliberate gsp_phys_rmcall_gr_rel_mod=1 default (m64 forced module-semaphore release), not a resolver failure. The r632 hang was the push-level release loss, fixed above. Build clean (kernel + r65535 warnings only).
* vgsp-gr r597: emit the captured prelude's SEM_EXECUTE ACQUIRE groups ahead ↵Arthur Hanson Rasmusson9 days
| | | | | | | | | | | | | | | | | of the rebuilt window (default off) The verbatim prelude replay breaks the launch (r599: qmd_rel=0 after an 8.9 s stall), so the acquire cannot be taken by replaying the prelude. This takes only the wait method groups - C46F addr 0x5c count>=5 with EXECUTE&7 != 1, and C5C0 SET_REPORT_SEMAPHORE A..D with a non-release op - and copies them verbatim before the proven init+window+PCAS+release block, leaving the window untouched. Gate: gsp_phys_rmcall_gr_acq (default 0). Live A/B on r601: the mail launch's prelude carries ZERO acquire groups (the C5C0 prelude is inline parameter data + release only), so emitted=0 and the VADD race is unchanged - the driver assumes its relocation copies precede the launch without an engine-visible wait.
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-01 23:07:02 +0000