summaryrefslogtreecommitdiffstats
path: root/tools/guest-diag
Commit message (Collapse)AuthorAge
* vgsp: all-ones scrub release for registered waits; walk-page registration; ↵Arthur Hanson Rasmusson11 hours
| | | | | | | | | | | | | | | | | | | | | GL frame publisher (CONT.416-417) - gsp_sema_service: merge a scanner registration arriving after the stash record instead of dropping it (a dropped registration let the next authoring pass write the blocking pair into the page the guest was polling, so the wait never ended); author the finish word all-ones for every registered record while the sema word stays put-based once real submissions were observed (CONT.416/417). - scrub_pin_qmp (host scanner): accept an unstable-but-live wait page instead of skipping it, and register the walk-resolved scrubber channel page - first the walk summary, then the per-VAS kernel row (h=0xc) when the summary path fails - so the release is armed before the guest polls (r1762/r1764 evidence). - guest-diag: add gl_frames, the direct-GL (GLX pbuffer) frame publisher; with it the stack produced the first non-black GPU-rendered frames (40/40, 640x480, animated) through pbuffer -> sysmem -> ivshmem -> host frame_reader. - gsp_rm_emulation: log the display-shim request words for triage.
* vgsp: USERD index/alias resolution, DDX kick-idle fix, completion-slot ↵Arthur Hanson Rasmusson21 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | authorship (CONT.403-412) Ten debugging rounds against the direct-GL channel, each fixing the wall that blocked the previous one: - USERD index: honour USERD_INDEX_VALUE/PAGE_VALUE from NVOS04 flags (X idx=3, GL idx=4) instead of always reading the block at base+0. This fixed the X "Failed to initialize DMA" wall. - USERD alias: learn the BAR1-alias bias from the first ring-validated FB latch (wire 0x80600 -> live 0x910000) and prefer alias/wire-page candidates before falling back to the RAM scan, which previously adopted another channel's control page. - USERD latch: keep a ring-validated kick-family block across a transient put=0 instead of dropping it (bounded, per-channel log). - VAS alias: DUP_OBJECT copies pdb/entries/ap/verified so hVASpace 0xbfef0001 resolves to 0x10005 and its gpfifo VA stops re-resolving to a bogus FB PA. - Short-kick NOTIFY: complete a kick that has no armed class-2D target (release + event, no write) so the client proceeds past setup. - DDX kick-idle: slot 0 of the 0x01xxxxxx family is the pb_kickIfIdle gate and 0xFFFF is its IDLE value; the keepalive no longer zeroes it. Removes the GR-STALL-stale-wedge on the X channel. - Completion slots: register a per-channel completion on every successful kick and reuse it when a NOTIFY has no per-push SET_NOTIFY; prefer the channel's notifier page over the VA walk. - Empty/no-op submit: author the completion even when there is no push to replay, so a synchronous GL submit does not wait forever. - Scrub records: multi-record per guest, stash-first lookup, registered PA is authoritative against the GPU-VAS walk, scanner-only records author the proven 0xffffffff/0xffffffff pair. - GL attachment: accept a draw run whose own subchannel is the engine subchannel the channel uses (bind is subch 0, draws on subch 3), not only the bind subchannel. Measured: glxgears 427 -> 526 FPS sustained with no GR stall; X binds and renders its 2D path; 3D draw capture on the GL channel still does not occur (see CONT.412: the GL thread blocks on the NVRM RM write lock before it reaches any ioctl). Adds tools/guest-diag/scrub_pin_qmp.py to register guest channel-buffer vmap pages as scrub records from the host.
* vgsp-gr: re-target the captured render surface per launch so a partial ↵Arthur Hanson Rasmusson6 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | VA-colliding allocation cannot receive the draw The SURF-PRELUDE target pair was patched once per capture generation and then reused; the re-patch test was dead because gsp_sema_gr_surf_recs() only fills in the VA when it returns true and the code negated the call, so 'want' could never be computed. A later draw whose ~10-page SYS allocation sits at the same 0x1204xxxxx VA as the X server's 1280x720 screen inherited the X server's 900-page target; the engine's RT pair then named the client's command/operand buffer, which is why the 'surface' held method words and copy-out saw no engine pixels. Add gsp_phys_gr_surf_launch_target(): only a complete contiguous rec run for the captured surface may use its data-rec bounce lane; a partial run falls back to the boot-time contiguous alias built from the captured bind's VAS pages (the real screen HPAs). Re-patch whenever the cached pair differs from that effective target (SURF-PRELUDE retarget); RT0 copies the same words, so the RT0==RT1 design is unchanged. r1490 (VP_MODE=6 RT0=1, r1476-args): 15 launches, poison=0, retarget have=0xa000000 want=0x15e0000 for the partial lane then 900-page targets, output retirement up to 3/900 with 2 copy-out pages changed by engine, and a non-empty 3.69 MB xwd. New wall: the draw still produces no raster fragments - the only changed pages are the forced MME constant-buffer pages inside the screen (offset pages 768/772/773, 0xff000000 fills). Also harden tools/guest-diag/qga_fetch.py (retry open, long timeout, atomic .part write, clear error exit) for evidence capture.
* vgsp-diag: thread STREAM_ANCHOR_RETRY_S into the guest scanner (r1410: ↵Arthur Hanson Rasmusson9 days
| | | | strict-anchor pins land at +23.5 s = one 20 s throttle while the GL setup generation lives ~6-12 s, so the 60216-byte init push is consumed unreadable before its pins land; allows STREAM_ANCHOR_RETRY_S=2 cycles)
* guest-diag: global two-pass client-mem candidate order (near offsets across ↵Arthur Hanson Rasmusson9 days
| | | | | | | | | | | | | | | | | | | | | | | ALL maps first) The r1398 client-mem sweep failed on a window that parses: with 74 qualifying rw mappings ahead of the nvidiactl mapping holding the MME 0x114 pack, their full per-map sweeps burned 37 808 of the global 8 192-candidate budget before the target map was ever reached, while a manual _window_accept of that map accepted at idx 1/2/0/3. Near-first PER MAP is not enough when the budget is global; near-first ACROSS maps is. Collect the candidate maps first and run two phases: phase 0 tries the 19 neighbourhood offsets for every map (cheap, not charged against the budget), phase 1 runs the remaining full sweep under the historical 8192 bound. Content gates unchanged (_window_accept on every candidate before any pin). k==None/0 (unknown family / family base) keeps its single bounded full-sweep phase exactly as before. SESSION 153 r1398; validation on the next cycle (r1399): the strict client-mem parse of 0x4001004's 60216 B window should now succeed and re-emit its 15 pins.
* vgsp-diag: re-assert GL setup-push pins end-to-end (strict window re-emit + ↵Arthur Hanson Rasmusson9 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | host GL-family exception) The r1397 cycle located and content-validated the 60 216 B GL setup push (the MME 0x114 carrier: 15-page window at a client rw-s mapping, 3728 code words / 74 SA pairs) and the strict client-mem parse emitted all 15 pins - yet the host entry stayed unreadable (src=255) on every re-read: pages 0x400a000..0x400e000 never reached the pin table (no injection line, no re-resolution), so the per-page read always failed on a missing tail page, and the loose family-learn could additionally overwrite a validated page with a wrong one (weak 0x200-byte prefix learn). Two one-line-class changes, mirroring the proven CE-window rationale ('a pin batch that raced in must be allowed to land again even when the pair is unchanged'): * guest_pin_stream: a strict-window success stashes its content-validated pairs (_strict_reemit) and re-emits them every ~4 s, so a page dropped in burst delivery heals without a new resolution and without defeating the done latch (r1397: the missing pages were never retried). * pin_gr_stream: re-asserts GL setup-push family pairs (0x4000000-0x4160000, 0x4200000-0x4300000, 0xcc80000-0xcc90000, 0x6f00000-0x6f10000) like the CE window, instead of dropping unchanged repeats via the seen dedup. SESSION 153 r1397b; follows the r1397 offline brief Change 1 (pagemap window fallback, kept).
* guest-diag: strict-anchor pagemap window fallback un-deadlocks the GL ↵Arthur Hanson Rasmusson9 days
| | | | | | | | | | | | | | | | | | | | | | | | setup-push family A strict demand anchor (the host's exact [entry_va,+len) read window, e.g. the 60 216 B setup push) whose full-window content parse fails on every candidate used to set strict_pending, and the pend_bases rule then skipped every loose demand VA of the same GL family for as long as the anchor was pending - the host demanded the push's pages individually, the guest suppressed them, and the entry stayed unreadable for the whole generation (r1396: entry 8 unreadable=1 on all generations while its sibling entries read fine; generations churn every ~12 s, the content sweeps take longer). Add _pagemap_window_pin(): on a failed strict resolve, pin the anchor window's pages directly from the client's /proc/pid/pagemap (the r586 mechanism already proven for the non-family draws). The anchor VA is the host's own GPFIFO entry VA, so a present client page is by definition its translation; no content gate and no family learn, so no k/(area,adj) risk. Partial presence heals on the ~2 s anchor resend. A 'strict-pagemap:' log line reports present/total pages either way (0 present => kernel-resident, the fallback cannot help). SESSION 153 r1397; scan: r1397 offline brief Change 1.
* guest-diag: widen PB_GL_FAMILIES GL setup-push window to 0x4300000 (the ↵Arthur Hanson Rasmusson9 days
| | | | setup push moved to 0x4250110)
* diag: guest_pin_stream unknown-family demand anchors run kernel-vmap sweep ↵Arthur Hanson Rasmusson11 days
| | | | first (union nv_vm_map_pages + os_alloc_mem vmalloc, phys/ioremap excluded, _window_accept full-parse gate, 8192 win/64 pages bound) - held push 0x3e4ccccc len=123916 proven NOT resolvable from any CPU-visible source (walk_probe PD1[1] rc=-2 on all 6 VASes; 8GB scan zero exact pairs; strict parse 0/8850+777 accepted); MME-CALL-DROP bits [34,39,40,48,51,57] exactly; next: discover beef channel's own hVASpace (log it, COPY_SERVER_PDES/VAS-candidate), then extend prelude>1024 + 3rd PB page cascade together - SESSION 153 r1156
* vgsp: replay/block capacity 1024->2048 words (r1126 drop was arithmetic: ↵Arthur Hanson Rasmusson11 days
| | | | window 390+prelude 901+sa 47 > 1024), two-page module pushbuffer (VA_PB2 0x102000 small-PT 0x102, CE SRC->0x109000, warm-sem probe page 0x10a000), gsp_phys_gr_pb_copy page-wise, static_asserts - planted verified (r1127 pb page2+probe planted before first fetch); >4KB path never exercised (5 boots beef never forwarded; walk PA 0x23921d000=8.89GB outside 8GB image); guest setup push NOT in guest RAM (ram_content_pin accepted 0/74); next: drop+re-walk src=4 all-zero reads, reject PA>guest-RAM top - SESSION 153 r1127
* vgsp+diag: strict replay/hold plumbing + pushfail/unread diagnostics + ↵Arthur Hanson Rasmusson11 days
| | | | demand-record ex; guest_pin_stream vmap full-sweep resolver (unknown-family anchors), zero-head first-page acceptance, strict retry throttles - MME-PRELUDE MATURED (gen=4 words=901) but replay DROPS it (window=390 prelude=901 sa=47 exceeds block; replaying window alone) -> every launch prelude=0 timeout; GR-DEC data produced (5657 lines); retirement 0/900 no writes; next: raise replay/block capacity or two-pass prelude - SESSION 153 r1126
* vgsp+diag: anchored demand record (sema_setup_demand prints VA/off/len), ↵Arthur Hanson Rasmusson11 days
| | | | ipin-table eviction (32768 slots silently dropped demand pins; nodrop + alt stash), MME prelude 512->1024 words + SIGS 512; guest_pin_stream resolve_va_strict (host svc_stream_parse port + client-mem /proc/pid/mem+pagemap), pin_gr_stream chunked script push (MAX_ARG_STRLEN) - setup-push read NOW SUCCEEDS (plausible=1 ipin=1 unreadable=0, pa=0x2387b9000), SA table captured, MME-PRELUDE gen=3 words=443, GR LAUNCH words=934, retire 0/903 pages (no writes); new wall: NO 0x114 instruction-RAM upload in any parseable window (code=0) - prelude immature; next: bind setup-hold to the entry carrying the 0x114 uploads - SESSION 153 r1121-r1124
* vgsp+diag: SA-RAM table captured unbounded (entry[64], sema-mme-sa log), ↵Arthur Hanson Rasmusson11 days
| | | | surf geometry accessor + completeness recs, fill seeds RT candidate 0 full span (<=1024 pages, completeness only on fully-resolved run); MME slot stub (called-but-uncaptured slots end-noop IR 0xC0, sema_gl_mme_sa_stub=1), reloc prefers tracked rec bounce VA; pin family += 0x4200000 - 0x238c wall root-caused (capture truncated buffer full=28 words=512, SA[0x22]=0 jump IR 0; sim proves slot-0 emits EMIT 0x238c=0x20020); fixes never executed (setup-push read lost, unreadable=1 first8=00040000 00001000); next: trustworthy pagemap resolve or accept ipin first-chunk - SESSION 153 r1117-r1120
* vgsp+diag: attr/pipeline prelude (families 0x1100-0x1200/0x2000-0x2060, ↵Arthur Hanson Rasmusson11 days
| | | | dedup, 512w, program-pair VA record; emitted via patch_window relocation, run-aligned after MME prelude), mature-prelude gate (>=64 0x114 code words, sema_gr_prelude_gate_ms=60000 busy-defer), pin_gr_stream 0.75s pass, trap regs in sked sampler - first clean DS+MME (ds_esr=80000000 mme_esr=80000000, a2040a00 gone); 0x1168 CLASS ERROR persists as MME-MACRO-GENERATED WRITE (no 0x1168 header in emitted stream; macro(2) args [0,0,600000,0,610800]); next: disassemble macro (2) at pc 0xa + trapped-addr read pre-latch - SESSION 153 r1095-r1100
* vgsp+diag: debugfs sema_setup_demand (armed setup-hold VA set, 0444 ↵Arthur Hanson Rasmusson11 days
| | | | seq_file) + pin_gr_stream demand loop reads it (kills dmesg-ring race; 20s resend/300s expiry), bounded 3D raw dump of pre-drop window - MME-PRELUDE emitted gen=2 words=512 (context alive submissions=760); NEW WALL: first beef window loads context + clean MME (mme_esr=80000000) then Class Error ChId 0001 Class 0xc597 Offset 0x1168 (SET_VERTEX_ATTRIBUTE_A(2)) ErrorCode 0x5 + poison; emitted attr runs byte-faithful; next: attr/pipeline prelude (0x1100-0x1200/0x2000-0x2060) + gate first launch on mature prelude - SESSION 153 r1091-r1094
* vgsp+diag: resolver GL pushbuffer families (0x4000000/0x42000000 learn-once ↵Arthur Hanson Rasmusson11 days
| | | | byte-exact, raw-tail newest-first scan), setup-hold demand cap 0x8000->0x10000 (60216B push=16 pages), pin_gr_stream harvest 2MB - r1089 target reached: setup push readable (unreadable=0), MME prelude captured words=511; beef context still tears down (submissions=0); demand races dmesg ring (manual demand fixed r1090); host / was 100%, freed ~6G - SESSION 153 r1088-r1090
* vgsp: svc_push_page_heal (beef push all-zero read re-resolves via ↵Arthur Hanson Rasmusson12 days
| | | | launch-page chain, pin/cache, src=10; sema-pushzero len cap 1024), mme-reloc-rsv (MME-family payload miss resolves via RELOC-FIXED ledger/pin/walk shadow-map), pin_gr_stream pushzero 4K-page bulk demand (48/batch); HW retire only with A+0x34a8+C dropped - draw payloads live in exactly the refused families (0x1c00-0x1c20 MME macro-code uploads / 0x3810 CALL_MME_MACRO); Graphics Exception ChID 0001 Class 0x0000c597 Offset 0 - SESSION 153 r1070-r1072
* vgsp: 3D flush gate fix (built-in chunk bound, not bisect knob), pushzero ↵Arthur Hanson Rasmusson12 days
| | | | zero-content rescue (probe PROMOTE_CTX, src=9), CHUNK1 dump, SET_INDEX_BUFFER+vertex-stream collection; publish GPFIFO entry at engine GP_GET (PUT-GET=1); win_drop 0x parser fix - beef chunks still PBDMA-stop at 0x1160 attr run (hdr=20030458 INC m=0x1160 cnt=3) while X retires ch_rel=0xc0ffee02 same boot - SESSION 153 r1034-r1041
* vgsp: sysmem GR USERD RAM scan (sliced, ring-entry validated) + ↵Arthur Hanson Rasmusson14 days
| | | | unreadable-push demand regex (SESSION 153 WIP: liveness latch pending)
* vgsp: GL ring scan fixed (ring-own-offset entries, either-side window, ↵Arthur Hanson Rasmusson14 days
| | | | va1==va0; scan top param) + ring VA demand regex (SESSION 153)
* vgsp GL path: widened pin prefixes, ring-scan PROMOTE_CTX ordering evidence, ↵Arthur Hanson Rasmusson14 days
| | | | graphics-execution plan (SESSION 153)
* tools/guest-diag: working guest-GL capture and input for virtio-gpu virgl ↵Arthur Hanson Rasmusson14 days
| | | | guests (SDL swap-hook capture; XSendEvent input - SDL ignores XTEST here; region capture, focus query, window resize)
* tools/guest-diag: guest frame capture + input driving for the two-VM GZDoom ↵Arthur Hanson Rasmusson14 days
| | | | video (Xvfb XGetImage capture, SDL present shim, window resize, XTEST input, QGA range fetch)
* tools: r18 GPU animation + QGA guest-file fetch - forwarded kernels must fit ↵Arthur Hanson Rasmusson2026-10-28
| | | | ONE 4 KB code page (SESSION 150)
* tools/guest-diag: fbcopy_pub maps BAR1 at any offset (nonzero-offset mmaps ↵Arthur Hanson Rasmusson2026-10-28
| | | | work on this mdev; offset-0 64 MB window fallback kept, pread beyond window) - SESSION 149
* vgsp: notify keepalive on registered notifier slots + 8GB demo guestArthur Hanson Rasmusson2026-10-27
| | | | | | | | | | | | | | | | | r864 ground truth while wedged: both the RC-watchdog channel (0x31415900) and the X/GL channel (0x1000013) sit with their class2d notification ARMED (u16 status 0xFFFF at notifier_pa + 0x3E = slot-3 struct status) and nothing ever clears them (X notified=0 after 459 submissions), so the guest krcWatchdog fires 'GPU is probably locked' every ~8.2 s and the whole X/GL stack wedges (glxgears poll() never returns; late XOOM death). Under the mirrored flow the watchdog ring reads go unreadable (rc=-2), so the decode-time ack and the notify2d_va path both miss. svc_notify2d_keepalive(): every pass, every GR channel with a registered notifier PA, read slots 0..3; for each slot armed exactly 0xFFFF write the zeroed 16-byte NvNotification and post the channel event - the same effects as svc_notify_complete without any ring read. Also bump the demo harness guest RAM to 8GB (launch_qemu_rootport.sh) to survive the observed emulation-path allocation growth during accelerated runs.
* vgsp: perf tracing + map-verified rescue + us RPC quanta (session 148)Arthur Hanson Rasmusson2026-10-27
| | | | | | | | | | | | | | | | | - sema_trace_h + sema-perf logs: per-second channel state (put/last/armed/ counter) and publish-gate reasons, plus maprescue attempt outcomes. Instrument added after window tuning failed to move the 22.4 s/frame glxgears cadence; it located the real blocker in one run. - svc_rescue_push_page: content-verified full-chain map rescue (works for GR channels, whose rescue was previously refused outright). - gsp_phys_booter: RPC reply waits now usleep_range(150-350us) instead of msleep(5) (termbin review suggestion, in-tree constant verified; no FPS change measured, kept as correctness-neutral latency reduction). Evidence: r843-r847 dmesg_live logs; measured constant 22.4 s/frame for glxgears across all param windows (grace/poll/first-poll), showing the pacer is elsewhere - traced to client pushbuffer pages (va=0x3f06270-class) failing svc_lookup (-ENOENT) while the client is alive.
* vgsp: channel-scoped VA resolution via the channel's own VAS (r835)Arthur Hanson Rasmusson2026-10-27
| | | | | | | | | | | | | | | | | | | | | | | | | | Every RM client maps different objects at the same numeric VAs (all clients' windows sit at 0x1200xxxxx), so the global VA-keyed pin/lat/map layers conflate them across clients. Live walk_probe evidence (r834): the X server's ring VA 0x120090000 resolved through the GL client's page tables (vas h=0xcaf00005 -> a zero page) while the X client's own VAS (vas h=0x10005) holds the real page (pa=0x1294fa000). That conflation is what wedged the X server's readback wait and starved the RC watchdog's ring (its pushes decoded as empty). * Parse NV_CHANNEL_ALLOC_PARAMS.hVASpace (@28; layout confirmed by the struct's own known offsets) at channel registration and carry it on svc_channel. * svc_chanvas_lookup: resolve a VA through the serviced channel's own VAS page tables first (svc_cur_vas, refreshed per channel turn and in the decode path). The hook sits at the head of svc_lookup_trusted, so ring, push, release and notifier resolution all inherit it; a failed walk falls through to the old chain unchanged. Live r835: X's XShmGetImage readback, previously never completing, returned after its long wait and a frame reached the kvmfr BAR (first frame content still black and readback latency still ~87 s; the guest-side fbcopy_pub framebuffer reader tool is added for the direct-VRAM capture path, find/pub/test modes).
* guest-diag/pin scanner: allow Xorg/X as pin targets (GL path)Arthur Hanson Rasmusson2026-10-27
| | | | | | | | | The nvidia-push DMA test in Xorg screen init fails with 'Failed to initialize DMA / Failed to allocate push buffer' (observed r816) because the X server's pages are never pinned - the scanner excluded Xorg/X alongside the nvidia-smi/persistenced transients. Xorg is long-lived and a legitimate GL client of the vGPU, so it is now a valid pin target; the transient exclusions stay.
* tools/guest-diag: fenceword_assist.py marked SUPERSEDED (SESSION 126 fence ↵Arthur Hanson Rasmusson2026-10-25
| | | | fold, 95e7f57e) - the service now authors the Vulkan fence releases itself via the sema_gr_ahead ring-continuation sweep (r717 evidence: sema-ahead h=0xbeec0100 put=11 swept=10 rels=4 -> sema-svc: deferred release va=0x45ba090 payload=1 (was cur=0) x3, VKFRAME seq/DONE with NO assist); keep as A/B fallback for boots without the fold (sema_gr_ahead=0); evidence in backups/evidence-20261002-victory/r717-fencefold/ (gitignored)
* tools/guest-diag: fenceword_assist.py - host assist that releases the live ↵open-iov2026-10-25
| | | | vk_frame120 Vulkan fence wait word (session 125): the fence word is the +0x90 slot of the same 16 KB /dev/nvidiactl BO whose +0x80 slot carries the t122 BW init wait word; the assist finds the BO in the client's rw-s mappings (init word 1, fence word 0) and writes 1 to +0x90 per submit. With it, the t122 client reaches VKFRAME seq=1..3/DONE and writes real PPMs to /tmp/vkout (r715: vk-0001..0003.ppm, content still black - the GR shader work is the next gate, not the fence). This tool is the direct predecessor of the service-side fold: the submit push carries an INC-5 group targeting the same slot (observed [2005c017][0x45ba090][0][payload 1][0][0x02100001]) and the service's translation for that VA is correct (verified against the client pagemap), but the group sits in a push region the decoded entry windows do not cover - next: dump the full 11-entry rings and find/cover that entry.
* vgsp-sema: bounded channel rewind (sema_chan_rewind: hex h_object or 'all' ↵Arthur Hanson Rasmusson2026-10-25
| | | | -> clears slot_done_epoch + last_get + the per-entry rescue state so entries skipped before the VAS pdb anchor re-decode) + bounded per-chunk push-read failure witness (sema-pushfail: va/chunk/page/last_rc/trusted_rc/ipin/alt/win per failed chunk); wall2: runbook.py (trigger the anchor then rewind). Session 118: the anchor+rewind path is wired; the automated rewind scheduler missed (dmesg churn) and the pushfail trace still needs one clean capture
* wall2: pdbtick.py loops (retry content-location + trigger every 1 s); ↵Arthur Hanson Rasmusson2026-10-25
| | | | session 117 evidence: the host-triggered pdb anchoring WORKS end-to-end (sema-pdb-disc -> 'VAS 0xfade0002 page directory registered after verified ring walk (pdb=0x109277000 entries=4 ap=1)'), the small GR pushes decode after the anchor (sema-push: h=0xbeec0100 va=0x4ca096c/0x4ca52c0), but the large ones (976/1432/17316 B) still skip after 210-275 rescues and the fence never releases - next: why the multi-page push reads/plausibility fail for the big pushes (the compute dispatch and the tracker), and give the pump a rewind/replay so already-skipped entries re-decode
* vgsp-sema/wall2: host-triggered VAS pdb discovery (sema_pdb_discover va,pa ↵Arthur Hanson Rasmusson2026-10-25
| | | | -> verify the parked COPY_SERVER_PDES candidates against a content-verified ring pair, then fall back to the vidmem walk-root sweep) and a runtime-tunable candidate age-out (sema_vas_cand_ms; the default 15 s ages the client's candidate out exactly when its channels first register); tools: fasttick.py (triggers on the GR0 ring resolution line) and pdbtick.py (content-locates the ring page and triggers) - r706/r707 evidence: three parked candidates (0x11cd3d000/0x11cd48000/0x11cd50000 entries=4), the ring pair appears only at channel registration (the same second as the age-out), ring resolution is racy across runs (r706 rc=0 / r707 rc=-2), the skip starts 145-194 rescues (~8-10 s) after the submit; next run: keep candidates parked + trigger within the window
* wall2 session 115: decompose the first-fence wall - the sema service cannot ↵Arthur Hanson Rasmusson2026-10-25
| | | | decode the submit's GR pushes because the client VAS page directory is undiscoverable (walk_probe: discovered pdb=0x0; the COPY_SERVER_PDES candidate is garbage; the r496f vidmem discovery never runs) and the pushbuffer is noncontiguous; the RAM ring scan gives up after 12 slices before the pushes exist; ring pages ARE content-locatable by their GPFIFO entries and injectable via sema_map_add (fence_assist.py) but the ring pair alone does not unlock the push decode; next = extract the pdb from the guest kernel's RM objects (PDB injection) or scan vidmem with the ring pair as verifier
* wall2 session 114: the COMPR+2MB VidHeap class (attr&0xF000==0x2000, owner ↵Arthur Hanson Rasmusson2026-10-25
| | | | 0x474C0000) is the last allocation gate - a live attr flip (COMPR_ANY->NONE at the ioctl) lets vkAllocateMemory through and the client runs the whole pipeline to the FIRST vkQueueSubmit, then times out on the FIRST fence (30 s, the new wall); the zero-touch create recipe is BC (eglcore+0xB33D30 marker clears) + BW (eglcore+0xDCEBD9 device wait-word chaser, the missing piece) + the a8clear count gate; the fence release (push-page readability/completion after the submit) is the only remaining gate to VKFRAME
* tools/vk: vk_frame gains an optional 7th arg (tiling: 0=optimal default, ↵Arthur Hanson Rasmusson2026-10-25
| | | | 1=linear) and a buffer-allocation type-retry loop; wall2: the QEMU-gdbstub kernel-breakpoint script (module VAs insert+patch but never fire - the stub's memory context does not resolve module VAs) and the kcore symbol dumper; session findings: the vkAllocateMemory -2 = the image's internal COMPR 2MB-page 64KB sub-allocation failing NV_ERR_NO_MEMORY after the image data alloc succeeds (both tilings)
* wall2 session 111: FB FULLY disproved (whole-256MB fill_vidmem no flip -> ↵Arthur Hanson Rasmusson2026-10-25
| | | | memdesc not FB-backed); refined assist negative; SYS-fill of active neighborhoods wedged the guest (cycle next; never bulk-overwrite active-set-adjacent pages)
* wall2 session 110: the sec2 loop runs CONTINUOUSLY inside one long-lived ↵Arthur Hanson Rasmusson2026-10-25
| | | | ioctl that holds the RM write lock (closes the lock model: tid 1791 read-wait, new clients D-state); the 299-byte reader is a red herring (address never mapped, 5/s); PEBS unavailable; sema-address instruments exhausted short of blind assist
* wall2 session 109: zero-ioctl window vs 24% kernel profile = BURSTY retry ↵Arthur Hanson Rasmusson2026-10-25
| | | | rounds between 200ms heartbeats; the 299-byte reader named as a health-poll candidate; next = name the node and capture the burst with host-RPC correlation
* wall2 session 108: content-diff found 9 active driver pages (counter/staging ↵Arthur Hanson Rasmusson2026-10-25
| | | | semantics catalogued); the stuck loop's read is constant -> the sema is a static cell; next = bounded zero-cell sweep among the constant pages adjacent to the active set
* wall2 session 107: FB assist sweeps negative (320+1024 cells; perf still ↵Arthur Hanson Rasmusson2026-10-25
| | | | 23.13%) - memdesc read not FB-sourced; the byte-identical stream twins (0x1026ad000/0x12afba000) are the memdesc-backing candidates for the next assist sweep
* wall2 session 106: channel buffer is driver-internal (not in ↵Arthur Hanson Rasmusson2026-10-25
| | | | NV_CHANNEL_ALLOC_PARAMS; kprobe was the right path, notrace-blocked); finish-tail sweep + auth-tag hash scan negative; next = transfer-shadow properties or bounded FB assist
* wall2 session 105: kprobe blocked (channelReadChannelMemdesc is notrace; ↵Arthur Hanson Rasmusson2026-10-25
| | | | tracefs mounted, UVM kprobes pre-existing); BAR1-path analysis (pokes landed in the shadow yet no flip -> memdesc page != FB 0x660b10); channel-field offsets enumerated; next = CE channel alloc-params dump for the channel-buffer field
* wall2 session 104: sema VA 0x4b19b10 verified NOT the loop page (converged ↵Arthur Hanson Rasmusson2026-10-25
| | | | FB 0x660b10 pokes landed, no flip; perf still 24.52%); kprobe on channelReadChannelMemdesc names the real authTagBufSemaOffset (offset=%si) + the channel pointer -> memdesc
* wall2 session 103: scrub init stream content-located (pa=0x114e98000 + ↵Arthur Hanson Rasmusson2026-10-25
| | | | twins); release 0x4b17e30 delivered (cur=1); auth-tag sema 0x4b19b10 page ambiguous (FB 0x660b10 garbage did not flip; linear guesses zero); next = validate-by-value walk pick
* wall2 session 102: fd sampler found no transient (bursty reader); no nvidia ↵Arthur Hanson Rasmusson2026-10-25
| | | | debugfs; memdesc paths ranked (content-locate the channel buffer by scrub method shapes / scrubber sema-push decodes / narrower burst sampling)
* wall2 session 101: auth-tag wait loop decoded (sema at ↵Arthur Hanson Rasmusson2026-10-25
| | | | pChannelBufferMemdesc+finishPayloadOffset+4, exits when GetPtr passes nextPut); perf trace (no-ptrace) shows the 10ms futex retry + a transient open/read(299)/close polling reader; next = catch the transient fd path and write the sema
* wall2 session 100: CE userd hunt exhausted standard layouts (registered ↵Arthur Hanson Rasmusson2026-10-25
| | | | FB=zero, ring+0x10000 non-contiguous guesses=zero, PDB-walked gpfifo+0x10000 pages=all-zero); the SEC2 scrub flow is a circular wait (no consumption without the CE pump; no pump without a live userd; no userd without submits); next = write the auth-tag sema in the channel buffer (memdesc) page directly to free the slots
* wall2 session 99: scrubber gate connected to CE channels ok=0 (userd ↵Arthur Hanson Rasmusson2026-10-25
| | | | discovery fails for all CE-class channels; GR ok=1 and pumping); find_userd FB scan = zero; host shape scan too noisy; next = diff-watch to pinpoint the real CE userd page
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-11 16:23:18 +0000