From c3a295efd1b1132bbaa5d422cd05b3fa8e89a8bf Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 21 Sep 2026 13:06:51 -0400 Subject: kernel: Fix GSP emulation shadow binding, eventfd wiring, RPC livelocks + docs suite + repo reorg CRITICAL FIXES (guest driver bring-up): - gsp_emulation.c: emulation engine bound to the WRONG BAR0 - it polled the host physical BAR0 (bars[0].vaddr ioremap) for the doorbell and read RPCs from a local dma_alloc_wc buffer, while the guest writes land in the vzalloc'd bar0_shadow. The RPC path could never work; PBA writes even corrupted the host GPU's physical BAR0+0x3000. gsp_emu_init now binds exclusively to bar0_shadow (doorbell/mailbox/PBA aliases; shared_mem_dma==0 marks the alias so cleanup never dma_free's it). - main.c SET_IRQS: DATA_EVENTFD eventfds were DISCARDED ('TODO' + kfree) - the guest never received MSI-X completions. Full wiring now: eventfd_ctx_fdget per vector, fd -1 clears, dev_close releases refs. gsp_emu_inject_completion_interrupt looks up vgpu->irqs[0].trigger LIVE (init-time copy was permanently NULL since QEMU wires after gsp_emu_init). - gsp_rpc_client.c: BAR_TRAP/MIGRATE in emulation mode called gsp_rpc_submit_raw which rings the SAME doorbell the thread polls - self-triggered RPC livelock + multi-second stalls. Now fail fast with -ENOTSUPP + pr_warn_ratelimited (guest BAR access is direct MMIO). MORE FIXES: - main.c: nv_vgpu_config_write returned SIZE_MAX (while(count--) wrap) and was dead code while the VFIO write handler did unfiltered byte copies (guest could rewrite vendor ID/BARs). Return fixed; VFIO write handler now routes through the per-register filter. - kernel/Makefile: M=$(PWD) used the env var which is stale when invoked via the top-level make (pointed at repo root -> kbuild silently built NOTHING; explains every 'stale .ko' incident). Now M=$(CURDIR). - Warnings sweep: header prototypes for mdev/type functions, format casts in gsp_comm.c DRY-RUN logs, unused variable. ROBUSTNESS (harness/tooling): - vgpu_vm.py: run had no timeout (start could block forever); guest_shell recv could block forever on a wedged guest. Both now bounded; guest_shell pre-flights guest-ping and reports wedge diagnostics. - stack_manager.sh: qemu/qemu-debug now launch via the vgpu_vm.py harness (workflow rule: never raw QEMU). REPO REORGANIZATION: - driver/ (legacy guest-side gsp-vgpu.ko) moved to legacy-driver-guest/ (reference only, not built; README explains). 3 legacy un-buildable test files moved to legacy-driver-guest/kernel-tests/. Top-level Makefile cleaned of the dead DRIVER_DIR reference. DOCUMENTATION SUITE (new): - docs/GSP_EMULATION_ARCHITECTURE.md - emulator deep-dive: shadow BAR0 model, doorbell protocol, dispatch table, MSI-X path, lifecycle, memory- model caveats - docs/DEBUGGING.md - QEMU GDB stub workflow, serial console, QMP NMI, failure taxonomy, full bring-up validation checklist, EPT-livelock case study, version-matrix discipline - docs/ONBOARDING.md - repo tour, coding standards (incl. virt_to_phys / dma_addr_t / get-put rules), first build & test - docs/VERSION_UPGRADE.md - end-to-end new-driver-version procedure (firmware fetch, Ghidra analysis, configs, signatures, validation) - docs/PERFORMANCE.md - bare-metal A/B methodology + targets - README.md doc index; STATE.md refreshed; DEVELOPMENT_WORKFLOW.md corrected (load order: open-iov-vfio BEFORE nvidia; stock-driver blacklist note) --- README.md | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index 17bf93d..36b66ca 100644 --- a/README.md +++ b/README.md @@ -75,7 +75,8 @@ No Open-IOV component depends on a specific wrapper. kernel/ open-iov-vfio.ko host driver (mdev, VFIO, GSP emulation, firmware analyzer, dynamic RPC dispatcher, arch/version layers) userspace/ libiov.so management library, examples, tests -driver/ legacy guest driver (being removed in the host-only refactor) +legacy-driver-guest/ historical guest-side driver, preserved for reference + only - NOT built (see its README) firmware/ GSP analysis: scripts, docs, address maps (blobs NOT in git - fetched by install.sh from linux-firmware.git) patches/nvidia/ patch series applied to NVIDIA open-gpu-kernel-modules @@ -103,15 +104,30 @@ images/ISOs, Ghidra project databases, and any local VM-wrapper stacks. ## Documentation +Start here: **[Developer onboarding](docs/ONBOARDING.md)** — repo tour, +coding standards, first build & test. + - [STATE.md](STATE.md) — current state, limitations, bug tracker -- [Portable architecture](docs/PORTABLE_ARCHITECTURE.md) -- [Host-only GSP emulation design](docs/refactored-architecture.md) +- [GSP emulation engine architecture](docs/GSP_EMULATION_ARCHITECTURE.md) — + how the host-side emulator works (shadow BAR0, doorbell protocol, dispatch, + MSI-X injection) +- [Debugging guide](docs/DEBUGGING.md) — QEMU GDB stub, serial console, + failure taxonomy, bring-up validation checklist +- [Version upgrade guide](docs/VERSION_UPGRADE.md) — supporting a new NVIDIA + driver/GSP version end-to-end (Ghidra workflow) +- [Performance testing](docs/PERFORMANCE.md) — bare-metal A/B methodology +- [Portable architecture](docs/PORTABLE_ARCHITECTURE.md) — multi-version, + multi-hardware design +- [Host-only GSP emulation design](docs/refactored-architecture.md) — + original refactor plan - [Implementation TODO](docs/refactored-implementation-to-do.md) -- [Firmware analysis](wiki/GSP-570.144W-Firmware-Analysis.md) — +- [Development workflow reference](docs/DEVELOPMENT_WORKFLOW.md) — exhaustive + command reference +- Firmware canon: [analysis](wiki/GSP-570.144W-Firmware-Analysis.md) — [RPC format](wiki/RPC-Message-Format.md) — [BAR emulation](wiki/BAR-Emulation-Specification.md) — - [Migration protocol](wiki/Migration-Protocol.md) — - [Address reference](wiki/Address-Reference.md) + [migration protocol](wiki/Migration-Protocol.md) — + [address reference](wiki/Address-Reference.md) ## License -- cgit v1.2.3