1 files changed, 29 insertions, 0 deletions
diff --git a/tools/guest-diag/wall2/README-session77.md b/tools/guest-diag/wall2/README-session77.md
index 2eac8f4..82e162b 100644
--- a/tools/guest-diag/wall2/README-session77.md
+++ b/tools/guest-diag/wall2/README-session77.md
@@ -154,3 +154,32 @@
   the A8 counter tables' source (what fills r14+0x5e8 / the "wanted"
   table - likely the GR channel's own progress counters) or the GR
   forward/ucode execution (`forwarded=0 gr_nocap=7` still).
+
+## ADDENDUM (r686, session 81) — the counter-autoreg gap analysed: the counter page 0x20400f000 is unresolvable; the manual `sema_counter` registration is the bypass
+
+* `svc_counter_autoreg` (per-pass for eng==0 channels, n_gr=20) needs a
+  translation for the rank slot VA `0x20400fec0 + (19-r)*0x10`
+  (r = gr_index = rank by ascending handle among the guest's GR
+  channels): either an ipin pin (`svc_ipin_lookup`, 9275 entries live
+  from the guest pin stream) or `svc_counter_derive` (the
+  vaspaces/discovered/targeted walk chain, `sema_counter_derive=1`
+  default). Both miss for the counter page -> no "counter auto" log,
+  `pub_calls=0` -> the A8 loop's per-entry counter tables never fill and
+  the NvOgl wait spins.
+* The client does NOT map the counter pool: `/proc/<pid>/pagemap` for
+  0x20400f000/0x20400ffd0/0x20400ffc0/0x20400ffb0 is all-zero (not
+  present) and no VMA covers it - it is a UVM kernel-side object, so the
+  pin stream cannot resolve it through the client's page tables. The
+  stream's log shows `sem=0` (zero semaphore resolutions) even though
+  the want-list (`/tmp/guest_want_vas.txt`, host-written) contains 44
+  `20400f` entries; the stream's "channel-anchored expansion" for the
+  UVM tracking sems (guest_pin_stream.py ~line 950-1010) is the
+  machinery that must find them (it is written for the CUDA second-client
+  stall - "the only live uvmt event is the spinning sem").
+* Bypass available now: the `sema_counter` parameter registers a channel
+  slot manually - `echo <h_object>,<pa> > .../parameters/sema_counter`.
+  Once the counter page's PA is known (via the guest kcore/UVM walk),
+  this wires the publish path without a kernel rebuild.
+* The rank slots for the GL client's channels (handles 0xbeec0100,
+  0xbeec0104, 0xbeee0100 -> ranks 0,1,2): 0x20400ffd0 / 0x20400ffc0 /
+  0x20400ffb0.