wall-2 session-80: ALL low-aperture window records found via the 'liat'-tag fix (the record tag is the u32 0x7461696c whose on-disk bytes are 'liat', not 'tail'); wall2_recscan.py scans them; the GR init semaphore windows identified and injected (0x4b17000->0x12a76f000 verified by content: +0xbb0=3/+0xe30=1 = the release payloads; 0x4b19000->0x122f9b000, release applied there) - releases now land on the semaphore pages; the NvOgl wait still spins (the A8 loop's per-entry counter tables are the remaining completion condition)

1 files changed, 26 insertions, 0 deletions

diff --git a/tools/guest-diag/wall2/README-session77.md b/tools/guest-diag/wall2/README-session77.md
index 5d3c70b..2eac8f4 100644
--- a/tools/guest-diag/wall2/README-session77.md
+++ b/tools/guest-diag/wall2/README-session77.md
@@ -128,3 +128,29 @@
   NvOgl wait spins. Find their PAs (client mapping pages / RM
   VA-tracker / live poll-watch), inject, and the pending releases
   should apply.
+
+## ADDENDUM (r686, session 80) — ALL low-aperture window records found (the "liat" tag fix); the semaphore windows identified and their releases applying
+
+* **The record scan fix**: the RM window record is 0x40 bytes
+  {u64 tag; u64 VA; u64 SIZE; u64 0; u32 0x7461696c; u32 0}. The tag is
+  stored as the u32 0x7461696c - on disk the BYTES are "liat", NOT
+  "tail" (the hex display `7461696c` reads as "tail" only as a number).
+  Searching for b'tail' finds nothing; `wall2_recscan.py` searches for
+  the byte pattern 6c 69 61 74 and decodes {tag,VA,SIZE} at
+  -0x20/-0x18/-0x10. It found **all 75 records** in one pass.
+* **The GR init semaphore windows** (r686):
+  `va=0x4b17000 size=0x2000 -> pa=0x12a76f000` (verified by content:
+  +0xbb0=3, +0xe30=1 - exactly the rel=0x4b17bb0 pay=3 /
+  rel=0x4b17e30 pay=1 payloads) and
+  `va=0x4b19000 size=0x1000 -> pa=0x122f9b000` (after injection the
+  release applied there: +0xb10 became 2). Injections:
+  `echo 0x4b17000,0x12a76f000,0x2000,1 > sema_map_add` and
+  `echo 0x4b19000,0x122f9b000,0x1000,1 > sema_map_add`.
+* **State after the injections**: the low-VA releases decode
+  (`have_rel=1`) and apply to the semaphore pages; `pending` hovers at
+  ~418 (the client re-kicks continuously); the NvOgl wait still spins
+  (the A8 loop compares per-entry counter tables r14+0x5e8 vs the
+  wanted set - the completion is not just the semaphore value). Next:
+  the A8 counter tables' source (what fills r14+0x5e8 / the "wanted"
+  table - likely the GR channel's own progress counters) or the GR
+  forward/ucode execution (`forwarded=0 gr_nocap=7` still).