open-iov.git/kernel/gsp_phys_booter.c, branch lottery-m156-gate-attempt

vgsp-gr: m156 fail-closed release gate - backend half (witness + deferred release0)

2026-10-15T21:50:52+00:00

The engine's QMD/channel completion ack is a front-end retirement, not an execution witness. r155 live evidence: streams2's launch logged qmd_rel=6/ch_rel=0xc0ffee02 while the retirement wait saw '0/205 pages changed' on the initial attempt and all three outcome retries; the backend then returned success and the client read all-zero output (STREAMS bad=32768). The r152 matmul/smiley boots show the same signature. For a data-bearing launch (resolved operand pages + working bounce window): - new param gsp_phys_rmcall_gr_failclosed (default 1) forces release0 to the module semaphore (the m64 rel-mod shape), so the engine's ack cannot reach the guest's release word before an executor is witnessed; - when the retirement wait still saw zero writes after the bounded retries, the backend returns -EIO instead of success and logs 'FAIL-CLOSED: ... success withheld', so the sema service can withhold the guest release and fail loudly (companion commit). Set gsp_phys_rmcall_gr_failclosed=0 to restore the historical fail-open behavior. Build: make -j8 (kernel), green.

vgsp-gr: m155 extend the re-arm with the mode-35 lane-enable tail (HF-3)

2026-10-15T16:41:14+00:00

r154: after the second client's idle period the FECS saved/unloaded the context (SKED rec: cwd0=0x12486 fecs_cur=b0633ee3 -> cwd0=0x2086 fecs_cur=0 and no change ever after) and every later forwarded launch acked (qmd_rel/ch_rel) while dispatching nothing - including all three outcome retries with fresh ring entries (0/205 changed, 720 ms no-writes, x4). Re-issuing only GPFIFO_SCHEDULE+TSG_GPFIFO_SCHEDULE+doorbell did not revive dispatch. The extended re-arm now replays the mode-35 lane-enable tail first (GR_SET_CTXSW_PREEMPTION_MODE CILP + SET_TIMESLICE + DEVICE_SCHED - the proven-accepted stage-4 sequence, HF-3 design), then the schedules and the doorbell. Poison variants (explicit PREEMPT/tail, BIND, PROMOTE) remain excluded.

vgsp-gr: m153 retry only on zero writes (drop wrong-place heuristic)

2026-10-15T14:44:19+00:00

Live r153 evidence: the highest-reloc data entry (bi=204) is a UVM-internal buffer that correct launches never write, so the 'top operand untouched' condition fired on correct executions and re-executed them up to 3x - a correctness hazard for side-effecting kernels (atomics/printf) and pure waste otherwise. The honest execution witness is the retirement wait's changed count; only zero-writes retries now (safe by construction: a kernel that wrote nothing has nothing to duplicate). Read-only kernels pay the bounded extra polls.

vgsp-gr: m152 fix - extension scratch pool as 48 single-page chunks

2026-10-15T14:26:45+00:00

The server refuses multi-page client memdescs for these buffers (a 48-page chunk aborted stage 2 with rpc_result 0x1f + firmware ASSERT 0x5ab0214 at ALLOC_MEMORY buffer 30); the only accepted shape is the existing single-page-per-PD0-slot pattern. GUEST_PT_EXT0..47 are 48 separate single-page chunks; BUF_COUNT 33 -> 81 (handle range still inside the meta assert bound).

vgsp-gr: m152 scratch-PT alias cache + extended pool; m153 outcome-verifying launch retry

2026-10-15T14:20:13+00:00

m152: the Tier-2 shadow alias pool consumed one never-reused 128 B fetch line per mapping per launch (512 lines/boot), so a normal launch mix exhausted it permanently: every later launch that needed a new mapping was refused (the deterministic r152 'launch refused: no Tier-1 mapping' loop). Two fixes: (a) an HPA-keyed alias cache in map_shadow_locked that returns the existing never-rewritten VA for a page already mapped, so repeat launches of the same buffers/sem pages consume nothing; a hit reports line_out = ~0 so contiguity bookkeeping never extends an old line; (b) a 48-window extension pool at VA 0x04000000 (PD0 indices 32..79, one 48-page PT chunk) raising capacity to 2048 lines/boot. m153: the intermittent per-boot mis-execution classes (engine wrote nothing; or wrote into a lower operand window while the output operand stayed untouched - both complete with qmd_rel/ch_rel satisfied, live evidence in r152 smiley: passes wrote b into the a window / nothing / correct-after-10s-retry) are now detected by the m151 retirement wait and retried: refill the bounce window from the guest inputs, re-publish the same method block on a fresh ring entry, re-issue schedule, re-poll, re-wait - bounded by the timeout path's attempt budget. Gate param gsp_phys_rmcall_gr_nowrite_retry (default 1).

vgsp-gr: retirement wait - whole-window footprint with adaptive exits

2026-10-15T06:33:03+00:00

Footprint-by-inference (max-reloc contiguous run, launch-page exclusion) failed twice: the fill's candidate list ends with the launch's own bank/ param pages, so the inferred output run was 3-4 pages (r150/r151: '0/3 pages changed after 72 ms (no writes)') and the wait exited before any real output landed. Replace with a whole-window count over every resolved data page plus cheap adaptive exits: - all pages changed -> done (one poll in the normal case), - partial count stable for 3 polls -> stores settled, - no change for 600 ms -> no output for this launch, - hard cap 1.5 s. No inference, no exclusion list, bounded cost.

vgsp-gr: retirement wait - exclude every forwarded page from the footprint

2026-10-15T06:16:23+00:00

r150's first cut excluded only QMD-word pages; the fill also relocates the 0xffffffff (non-QMD) forwarded pages (pushbuffer/indirect/bank pages) as high-VA candidates, so out_base landed on the bank-page group, out_pages came out 3 and the wait exited after 72 ms - losing the late-write capture it exists for (smiley r150: '0/3 pages changed after 72 ms (no writes)' followed by mixed 8-changed/0-changed/32-changed copy-outs and one wrong pass). Now every forwarded page VA is excluded, so the footprint is the real output operand (32 pages for smiley, 64 for matmul).

vgsp-gr: retirement wait - correct footprint (exclude launch pages) + adaptive exits

2026-10-15T04:55:33+00:00

- Footprint: exclude data entries whose guest VA is a forwarded launch page (qmd_word pages) before picking out_base/out_pages. The fill relocates the launch's own param/bank pages as high-VA candidates, which made out_pages the whole 205-page budget and forced the full 1.5 s wait on every launch (r147: '64/205 pages changed ... (TIMEOUT)' on green matmul). - Adaptive exits: no writes at all after 60 ms (identical-rewrite benchmark launches / no-output footprints) or a partial count settled for 3 polls (masked kernels) end the wait early; genuinely late writes are still caught. Log now carries the reason suffix (no suffix = full footprint). Live evidence from r147 with the first cut: the exact failing order mail->matmul->smiley ran green->green->green (smiley recovered to 32/205 changed, C window written; earlier boots showed 0-8 changed and STATUS FAIL). victory_math/vector_add still fail on the >256 KB per-operand window cap (chunked data path is the next wall, not this class).

vgsp-gr: output-footprint retirement wait + two-bank win0 rotation + page hashes

2026-10-15T04:33:49+00:00

Two independent hardening changes for the per-boot 'all-wrong' class: 1. Output-footprint retirement wait (gsp_phys_gr_output_retire_wait): qmd_rel is a schedule/fetch ack, not a data-path retirement - the engine's stores into the bounce pages can land after it. Copy-out (and the next launch's copy-in) before those stores land loses them: the guest observes zeros for a completed launch (matmul csum=0, r146) or stale/mixed content (smiley b-into-a, r143/r145). The wait polls up to 300x5 ms, success path only, until every page of the output footprint (contiguous descending reloc run from the max reloc_va) differs from its copy-in checksum; logs 'output retirement wait: N/N pages changed after T ms'. 2. Two-bank win0 rotation: pool grows 8 -> 16 slots (VAs 0x1e0000..0x1effff, below the mail-injection slot 0x1f0000), bank selected by submission epoch (epoch & 1). A launch's copy into one bank can no longer clobber the pages the previous launch's engine index/data fetches may still read. 3. Evidence: full win0 param page dump rows + FNV-1a pre/post hashes of the win0 param page and the guest param page, so a torn/mixed read source is provable from the log on the next occurrence. static_asserts: pool < mail slot and SLOTS == 2 x BANK. Build clean. Live validation pending (next cycle: mail->matmul->smiley->victory_math-> vector_add).

vgsp-gr: move win0 shadow pool clear of the data bounce window (matmul C rows 0..31)

2026-10-14T19:52:51+00:00

m150 grew the GR data bounce window to 208 pages at main-PT slots 0x110..0x1df but left the win0 QMD shadow pool at VA 0x190000 (slots 0x190..0x197) - inside the new window. The win0 plant is unconditional on every gsp_phys_rmcall_pdb_build() and runs after the one-shot bounce plant, so it hijacked the PTEs for bounce pages 128..135, which hold the first 8 pages of the third operand. victory_matmul's C rows 0..31 (8 pages x 256 floats = 8192 elements) were written into the shadow pages and lost: MATMUL bad=8192, copy-out '56 changed by engine (first bi 136)'. Move GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE to 0x1e0000 (slots 0x1e0..0x1e7), directly above the last bounce/mail/marker page (0x1df000) and below the 0x200000 guest scratch window; both the plant and the launch-time shadow VA derive from the macro. Add a static_assert so any future bounce growth cannot silently re-introduce the overlap, and correct the stale slot-range comments/logs (0x108..0x10f -> the current range). Evidence: /tmp/opencode/dmesg-r143-mailmatmul.log (main PT[190..197] = win0 chunk DMAs; 'window[160] reloc=0x1b0000 changed=1', 'window[128] reloc=0x190000 changed=0'; MATMUL bad=8192). Live validation pending: a fresh cycle's victory_matmul must print bad=0 STATUS OK.