| Commit message (Collapse) | Author | Age |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
The real RM initialises every GPC's NV_PGPC_PRI_MMU_CTRL (0x500880 +
gpc*0x8000) from NV_PFB_PRI_MMU_CTRL (0x100C80) using the TU102
hub-to-GPC matching fields (VM_PG_SIZE, COMP_FAULT, MISS_GRAN, CACHE_MODE,
USE_PDB_BIG_PAGE_SIZE, ATOMIC_CAPABILITY_MODE, ATOMIC_CAPABILITY_SYS_NCOH;
ext-tree gr_gk104.c:3340-3380 + gr_tu102.c:229-238). Our ladder never
programmed it (grep-verified). The m93 INST dump shows the server's SC(0)
PDB carries USE_VER2_PT_FORMAT + BIG_PAGE_SIZE=1, so a GPC/hub MMU_CTRL
mismatch is a candidate for the GPC-side walker refusing the SM I-fetch
with MMU_NACK while hub-side reads resolve. Gated by
gsp_phys_rmcall_gr_gpc_mmu_init (default 0); sampler now reads
GPC0/GPC1_MMU_CTRL (0x500880/0x508880) and PFB_MMU_CTRL (0x100C80).
|
| |
|
|
|
|
|
|
| |
m90 decoded the TPC0 SM0 warp error as ESR.ERROR=0x20 ADDR_ERROR_TYPE=0xb
= MMU_NACK (the ESR.ERROR field is an enum, not a bitmask). Add the 4R
companion words (ESR_MASK 0x734, PC 0x738, PC_HI 0x73c) for GPC0/TPC0/SM0
and GPC1/TPC0/SM0 plus the per-GPC GPCMMU ESR at +0x324 so the next cycle
captures the faulting PC and the MMU-side latch.
|
| |
|
|
|
|
|
|
| |
GPC0/TPC0 and GPC1/TPC0 raised the exception (GPC_EXCEPTION bit16 = TPC0
bitmap). SM warp ESR registers (TPC aperture = GPC base + 0x4000 +
tpc*0x800; SM stride 0x80; ESR 0x730, INFO 0x76c) at 0x504730.. and 0x50c730..
carry the exact error code (ILLEGAL_INSTR_ENCODING 0x9, INVALID_CONST_ADDR_LDC
0x12, MMU_FAULT 0x17, MISALIGNED_PC 0x5, ...) plus the VEID/warp info.
|
| |
|
|
|
|
|
|
|
|
| |
PGRAPH_EXCEPTION bit24 (GPC) with EXCEPTION1 GPC1:0=0b11 fires at every
forwarded QMD activation and the engine then saves/unloads. The per-GPC PRI
window (BAR0 0x500000 + gpc*0x8000) carries NV_PGPC_PRI_GPCCS_GPC_EXCEPTION
(0x2c90: PROP/ZCULL/GCC/SETUP/PES/TPC/GPCMMU0/GPCCS bits),
GPC_ACTIVITY1.GPCMMU0 (0x2c84: FAULTED=6) and the GPCMMU GLOBAL_ESR (0x324):
the post-mortem and the external sampler now record them to name the failing
GPC sub-unit (or the GPC MMU).
|
| |
|
|
|
|
|
|
| |
The m81 window still shows SEMAPHORE|EXCEPTION pending at QMD activation (the
PM VA mapping did not clear it). NV_PGRAPH_EXCEPTION (0x400108) and its GPC/BE
companions name which subunit raised the exception (FE/MEMFMT/PD/SCC/DS/
SSYNC/MME/SKED/GPC/BE), which discriminates an engine-context-restore fault
from a method/instruction fault.
|
| |
|
|
|
|
|
|
|
|
| |
The m75/m78/m79 launch windows show FECS_CTXSW_STATUS_FE_0.GR_INTR_REQ
(bit17) asserted through the SKED CWD ACTIVE state and a following CTXSW_REQ
(bit0) that results in the context save/unload. The real driver carries
GR_INTR only transiently during its context load and clears it before ACTIVE.
The PGRAPH interrupt latch (0x400100) names what the engine is signaling
(e.g. ILLEGAL_METHOD bit4, SEMAPHORE bit1, NOTIFY); sampled by the external
sampler and dumped in the launch post-mortem.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
caches/tasktables
The dispatch-time comparison against the live driver needs the GR context's
floor-sweep state (CWD_FS expected 0x1806 on TU104) and the SKED debug
interiors (HWW_INFO_1/2/3, CWD_T2, CACHE_0/1, L15_CACHE_0, TASKTABLE_0/1/2).
Recorded 2026-10-07: the distro driver's executing steady state shows
CWD_FS=0x1806, CWD_T0=0x3f002400 (VEID 63), SKED_ACTIVITY=0x600000c0,
PGRAPH_STATUS=0x01242001, FECS_CURRENT valid and frozen for the kernel's
lifetime, TASKTABLE zero.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
transition recorder, sysmem instance selector
m72: append the vendor turingLocalMemUpdate block (SET_SHADER_LOCAL_MEMORY_A/B
0x790/0x794, NON_THROTTLED_A/B 0x2e4/0x2e8, WINDOW_A/B 0x7b0/0x7b4) to the
forwarded GR launch prelude; without it the channel local-memory state is zero
and the m64-m69 sampler shows SKED_HWW_ESR bit12 = SKEDCHECK05
LOCAL_MEMORY_TOTAL_SIZE latching while the CWD entry is allocated then
deallocated. Base/per-TPC size are module params for A/B.
m72: change-detecting SKED transition recorder in the launch poll (CWD_T0/1/2,
HWW_INFO_1/2, ACTIVITY, HWW_ESR, GRFIFO, FECS current/new/ctxsw status) and
extended post-mortem readbacks (HWW_ESR_EN, INFO_1/2/3, CWD_T2, watermarks).
m72-r2 sampler result: the QMD enters SKED (CWD_T0=0x11300 STATUS=ACTIVE,
CWD_T1=0x1070) and HWW_ESR stays 0 with the lmem block, but the FECS context
load never completes: NEW_CTX=0x001f42b0 (V7 FBMEM instance, VALID=0) then
CURRENT=0; the task frees (CWD_T0=0x12000 DEP=PENDING_TASK_COMPLETE). m63
(sysmem instance) had VALID=1 on the same load. m73 adds the sysmem
instance/RAMFC selector (gsp_phys_rmcall_gr_inst_sys; default 0 = FBMEM
capture shape) for the A/B.
|
| |
|
|
|
|
|
|
|
|
|
| |
reg_sampler.py: high-rate read-only MMIO sampler for the physical GPU's
PGRAPH/FECS/SKED/PFIFO registers (FECS current-context valid + pointer,
SKED CWD table occupancy/activity, GRFIFO, FE QMD-virt, PMC_ENABLE) with
analyze_regs.py for value distributions and transition timelines. Recorded
ground truth and register semantics in tools/gr-regs/README.md. Used to
capture the live distro-driver CUDA reference (FECS VALID=1, CWD table
0x3f002000 while running) and to observe the ladder's forwarded launch
(CWD entry + SKED processing after the mode-35 lane enable).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The no-claim emulation path now runs a stock CUDA program end to end:
device properties, cudaMalloc, a GPU-authored string kernel read back
byte-for-byte, two 4 MB host-to-device copies, a 1 M-element vectorAdd
executed on the physical GPU through the host bridge, and the
device-to-host copy-back verified element by element. Three consecutive
supervised cycles report MAIL + VADD bad=0 checksum=392344090.500000 +
STATUS OK with identical input/output hashes.
Two data-path correctness fixes make the transfers sound:
- Once-only op execution per GPFIFO entry. The pump replays recently
consumed ring entries when translation batches are injected so missed
releases can land; re-executing a CE copy is not idempotent because
its source is a client staging buffer that may have been refilled.
Slots now record their raw entry words and a replayed entry matching
that identity suppresses operations while still processing releases.
- Per-page translation of virtual operands. svc_copy resolved only the
first page of a VA range and walked the PA linearly; client staging
ranges are frequently split (observed 195 + 61 pages), so the tail of
alternating chunks was read from unrelated memory. Multi-page copies
now re-resolve each 4 KB page through the trusted resolver.
Also carries the earlier uncommitted emulation fixes that got the client
to the launch (QMD address-window gate, counter registration
persistence, 512 MiB emulated FB, bridge slot hygiene) and bounded
diagnostics (sema-bigop, sema-bigcopy, bridge-in/out hashes, daemon
INCHECK/OUTCHECK/dumps).
|
| |
|
|
|
|
|
|
| |
- kernel: gsp_cuda_bridge (QMD launch capture, debugfs job/out/done, param+output resolution cached from inline writes), sema drain fixes (never hold/starve a channel), GR ring autopin + counter autoreg, per-page push reads, counter-derive gate; module builds clean
- tools/cuda-bridge: CUDA driver-API daemon executing mail/vadd kernels on the physical GPU, CUBB2/CBD2 v2 protocol, layout check + self-tests
- tools/guest-diag + tools/cuda-ab: scanner/pin fixes, victory push-only mode
- debug/risc-v-gsp-rm-vm: Phase S simulator wave (GSP device model, boot ladder, triage/re-demo harnesses, docs 30-41), GPGPU-sim scaffolding
- STATE-CURRENT/docs updates
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
registry variant; complete vgsp rename; docs/tooling refresh
- gsp_phys_booter: GR promote bisection modes 4-17 (two-phase zero-field VA,
batched entries, hVirtMemory, bare VA, KMD SKIP_CTXBUFFER_ALLOC channel,
old-interface GPU_INITIALIZE_CTX, FBMEM context buffer, UVM-faithful PA-only,
PATCH/PM auxiliary promotes, server-managed no-promote path); PATCH/PM
geometry queries and buffers; pre-boot SET_REGISTRY profile selection
- gsp_phys_gpu: gsp_phys_rmcall_gr_promote clamp 0..17 and gsp_phys_srv_ctxbuf
parameter; registry image variant with RMSetClientRMAllocatedCtxBuffer=0
- vgsp rename across kernel, scripts, tools and docs (module vgsp.ko,
/sys/kernel/debug/vgsp/, vgsp-<subsystem>: log prefixes)
- risc-v-gsp-rm-debugger user-facing rename and docs/CI refresh; guest-diag
tool updates; README/SBOM/install/Makefile sync
Live status: CE ladder and P6 guest-copy forwarding green; GR engine context
commit still open (all promote shapes accepted or cleanly refused; the channel
stays CTXNOTVALID) - see Handoff-vGPU-IO.md Addendum 21 (local).
|
| |
|
|
| |
untracked; drop built RM tool binaries (source and Makefiles stay)
|
| |
|
|
| |
plugin, value-validation demos, CI pipeline, toolchain docs; add host RM tools rmtool/rmtop
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- file-backed guest RAM (launcher memory-backend-file share=on) and
in-kernel GPA->HPA translation through the shared file page cache
(read_cache_page + page_to_phys + pfn_valid), opened O_LARGEFILE;
new default-off gsp_phys_guest_mem parameter
- debugfs gsp-phys-guest-ram (path + gpa/off/size ranges) and
gsp-phys-guest-gpa (one pinned GPA per boot); rm-call triggers 6/7 run
host->guest and guest->host 4 KiB CE copies; trigger 8 is a PTE
self-test through a fresh slot
- guest page-table slots are pre-built during ladder stage 3: runtime
PTE writes into an already-walked page-table line are not observed
without a TLB invalidate
- guest RAM layout (q35 4.2, 4 GiB): below-4G GPA == file offset,
above-4G offset = GPA - 0x80000000 (2 GiB PCI hole)
- tests: tools/test/gpage_test.c guest probe; docs + STATE-CURRENT
record the live green (G2H/W2G with semaphore release, guest observed
the write, smoke ALL OK 64/64, clean latched release)
|
| |
|
|
| |
third-party references
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Host-freeze fix bundle (validated 2/2 supervised cycles):
- power unlock now latches D0/D3cold by default (new gsp_phys_repower,
default 0); releasing the claim can no longer power-gate the board and
hard-freeze the host on resume
- bounded post-rebind readiness gate before dropping the locks; bounded D0
settle/verify before the unbind
- READY means a live GSP-RM session: the async worker and the module-owned
join only expose READY when init-done is seen and no unload was sent;
otherwise the claim is released fail-open
- FWSEC reads DMEM0/IMEM back before STARTCPU and fails fast when the
staging is not visible
- the claim harness leaves the board latched by default and takes
--restore-power to opt back into the old restore
Guest-wiring:
- P2: generation-keyed fn65 static-config snapshot cache plus a default-off
identity overlay (new gsp_phys_static_live) for name/short-name/VBIOS;
the probe cycle runs once per backend generation at READY
- P3: default-off read-only RM_CONTROL forwarding whitelist (new
gsp_phys_ctrl_forward) with emulated-handle translation to the adopted
server handles and full emulation fallback
- P5 wave 1: default-off shadow execution of guest CE pushes on the ladder
channel (new gsp_phys_work_forward) via a dedicated ordered work item;
the ladder stage-4 submission is refactored into a shared bounded helper
and the software release path stays authoritative
Live: module-owned boot to init-done, guest smoke ALL OK 64/64 with P2/P3
enabled, 514 shadow copies observed on the physical CE; all cycles released
cleanly with WPR2 down and no reboot.
|
| |
|
|
| |
harness
|
| | |
|
| | |
|
| |
|
|
| |
--boot is the only device-writing mode (full boot lifecycle: FWSEC, Booter Load, RISC-V start, FALCON_OS, RM-init poll). --boot-dryrun rehearses the host staging read-only. --keep leaves a green claimed session running. --fwsec is retired and refused at parse time: a FWSEC-only carve is not host-recoverable on this part.
|
| |
|
|
|
|
|
|
| |
Stage 3d stages the GSP-RM boot from host sysmem (FMC, radix3 over the GSP-RM ELF, signature, message queues, libos LOGINIT/LOGRM/RMARGS and GSP arguments) and runs Booter Load on SEC2: GSP RISC-V reset, libos mailbox, IMEM/DMEM direct load, BOOTVEC=0, M0==0, FALCON_OS, RISC-V active. Stage 3e links the status queue and polls for GSP-RM events; it now also executes the inline run-sequencer command buffer (event 0x1002) against BAR0 (REG_WRITE/MODIFY/POLL, DELAY, STORE, CORE_* including CORE_RESUME) and then waits for GSP_INIT_DONE 0x1001.
Gated by gsp_phys_boot / gsp_phys_boot_dryrun (default off; the normal load path writes nothing). gsp_phys_fwsec=1 without gsp_phys_boot=1 is refused: a FWSEC-only carve cannot pass the booter-unload handoff gate. Release quiesces the GSP, runs the existing FWSEC-SB/booter-unload teardown and frees all staging.
tools/gen_gsp_bindata.py decodes the public generated archives into the Booter Load image (prod signature patched at 0x8700) and the GSP-RM boot (FMC) image; both are self-checked at build time.
|
| | |
|
| | |
|
| |
|
|
| |
abort checks)
|
| |
|
|
|
|
|
|
| |
Reproducible TASK 2 harness: fresh boot, sema_dbg=Y with
sema_copy_dst=0x200000 / sema_copy_dst2=0x208000, cdt2 parked at
CDT_CP_PAUSE so the root PD/PT pages can be dumped and walk_probe run
while the client is live. Prints the offending write data (prov= names
the translation layer) and the post-run walk state.
|
| |
|
|
|
|
|
|
|
| |
The DtoH staging buffer lives in the client's high-VA /dev/zero|nvidia
mappings (e.g. devptr+0x3c00100), outside the scanner's fixed CE/GR
windows; only the host's pagemap read can see it. The guest scanner
now walks those VMAs and streams their present pages so the module
pins them. run_cycle.sh learns the sema_dbg master switch (auto-on
when any watch knob is set).
|
| |
|
|
| |
failure left a boot without pins and the client hung)
|
| |
|
|
|
|
| |
A fresh boot can leave /sys/kernel/tracing as an unmounted mount point;
the probe adds then fail silently (probe count 0) and the whole sem/kptr
pipeline goes blind.
|
| |
|
|
|
|
|
| |
A new CUDA client allocates fresh channel pools at the same GPU VAs; the
watcher kept the previous client's sem kptrs and seen-pin marks, so it
pinned the previous (freed) pool pages and the new client's release writes
went to dead memory. Clear the learned sems/marks on each pid change.
|
| | |
|
| |
|
|
|
|
|
|
|
| |
HMP x/gva2gpa translate with the selected vCPU's CR3; while that CPU runs
user code under PTI the kernel half is hidden, so kernel-VA reads (the
tracking-sem chain and the CE pushbuffer CPU alias) fail and the pin pass
aborts. Try the other vCPUs before giving up: during an active CUDA client
at least one CPU is in kernel mode, so the chain/pin work no longer require
the client to be parked in sleep().
|
| | |
|
| |
|
|
| |
can block)
|
| |
|
|
| |
SIGBUS on truncated file maps)
|
| |
|
|
| |
mechanism probe)
|
| |
|
|
|
|
|
| |
The GR-window pin scanner matched comm=="cdt" exactly, so runs using the
cuda_drv_test2 binary (comm "cdt2") never streamed their mappings: the
GR push pages stayed unresolvable and the client stalled in context
creation. Match the cdt prefix instead.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The 256-byte cuMemcpyHtoD payload never appears in any CE push: CUDA
submits it on the compute channel as a compute-class DMA whose source is
the push's own inline data (LINE_LENGTH_IN=256, OFFSET_OUT=<device VA>,
LAUNCH_DMA=0x41, LOAD_INLINE_DATA 64 dwords, then the channel's
SET_REPORT_SEMAPHORE release). The CE-shaped decoder skipped the data run
(opcode 3) and no GR work ran at all.
- Decode NVC5C0 GRCE methods on subchannel 1 (LINE_LENGTH_IN, LINE_COUNT,
OFFSET_OUT/UPPER, LAUNCH_DMA) and the opcode-3 LOAD_INLINE_DATA run.
- svc_grce_inline_write resolves the destination VA through trusted
sources (pins, map, published page directories, targeted rm_mem
resolve), pins the page and writes into vidmem or guest RAM; budgeted
sema-grce logs name the target or report UNRESOLVED.
- cdt2 test binary gains CDT_CP_PAUSE / CDT_HP_PAUSE for live inspection
of the copy path; pushed by push_guest_tools.sh.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
payload-pattern audit
- CE LAUNCH_DMA releases are now applied after the push's collected work
runs: the client reads copied data as soon as it observes the release,
so release-first let cuMemcpyDtoH observe a copy that had not executed.
- Unreadable CE entries stay pending for a grace window (sema_ce_grace_ms,
default 8s) before the release fallback consumes them, so a translation
that lands within a service pass lets the push be decoded and its work
executed instead of being dropped.
- sema_copy_pat matches an 8-byte value against every copy's src/dst first
word and scans decoded pushes for it, naming the submission that carries
a known payload regardless of size/encoding.
- sema-dma-skip logs transfer-shaped launches that collect no op; op log
lines carry the channel handle; LAUNCH_DMA inventory follows OPS_LOG.
- A real release application now records the release VA, so decoded pushes
no longer trigger a spurious fake release.
|
| |
|
|
| |
CDT_WAIT passthrough
|
| |
|
|
| |
retries until complete)
|
| | |
|
| |
|
|
| |
run_cycle OPS_LOG knob
|
| |
|
|
| |
window has no CPU alias; the vsock stream cannot supply it)
|
| |
|
|
| |
roundtrip diagnostics
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
