summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* wiki: refresh the graphics frontier to the DS stage-image gate (eng51 ↵HEADmasterArthur Hanson Rasmusson46 min.
| | | | landed; draw macro executes, store pending)
* wiki: refresh the graphics frontier to the DS stage-image gate (eng51 ↵Arthur Hanson Rasmusson55 min.
| | | | landed; draw macro executes, store pending)
* vgsp: eng51 - emit the SPH-BIND stage block (budget fix), admit RT0-bearing ↵Arthur Hanson Rasmusson57 min.
| | | | | | | | | | | | | | | | | | | | | | | draw-synth windows, preserve the last beef push, and default the DS stage-image A/B safe - gsp_phys_booter.c: the synthesized SPH-BIND stage-block guard double-counted the already-emitted raster words (101 > 96), silently skipping j0/j2/j4/j5; pre=29 -> pre=84 and the DS stage VAs populate. Add the SPH-BIND-STAGE-SKIP receipt. - gsp_sema_service.c: sema_gl_win_rt0_admit (default 1) admits a beef draw-synth window whose FIRST colour-target write is a usable surface-class bind (RT0-FIRST-MISS witness); preserve the most recent beef push (>=256 B) for the gsp-phys-last-push debugfs dump; skip the non-RAM windows in the linear ring scan; fix the MME shadow-RAM index shift to (mthd >> 2) & 0xfff. - gsp_phys_booter.c: sema_gl_sph_vtg600 (default 0) and sema_gl_sph_vtg_j1 (default 0) are the stage-image A/B: binding family+0x600 poisons the DS (the engine-visible alias shadow there is the client's SASS upload), so keep the historical +0x900 zero page until a real VTG SPH is authored at an engine-visible VA. - tools/guest-diag/params-r1624.txt: enable sema_gl_win_rt0_admit. - wiki/Project-Status.md: 2026-11-15 status (MME chain completes and executes DRAW_IAB; DS stage image is the named gate).
* vgsp: keep the synthesized SPH-BIND prelude intact by omitting the ↵Arthur Hanson Rasmusson6 hours
| | | | | | | | | | | | | | auto-dropped 0x22c run (eng50) The SPH-BIND prelude emitted '0x22c <- 0x800', which is on win_drop_auto_match's drop list: the patch pass removed exactly 2 words, so kept=29/31, on==nfin failed and the WHOLE prelude was discarded on every beef window -> VSA/TCS/GS unbound -> DS latch a2040a04 (stage[1] fetch VA 0x01df0300) -> DRAW_IAB (mac=0x22) never rasterized. Fix: omit the auto-dropped run from the synthesized prelude (knob-consistent) + a WIN-DROP diagnostic. Built (srcversion 2D8F375AB343FC73EA26286); end-to-end validation blocked in-window (c704-6: draw-synth RT-guard refusal + WEDGE-REARM rc=-110 before SPH-BIND was reached).
* vgsp: channel-agnostic svc_mme_census + sema-mme-xscan diagnostic (eng48)Arthur Hanson Rasmusson11 hours
| | | | | | | | | Follows the same any-channel rule as sema_mme_prelude_cap_any and emits 'sema-mme-xscan: ... hits=0' when a push yields no MME-family ops (scan coverage evidence). c693: X-lane pushes (0x120010000/0x1200a0000/0x120010004) show hits=0 - the indirect-mode X pushes carry no MME setup runs, so the prelude feed has nothing; the MME setup runs likely ride the beef ring (whose entries the walk skips as garbage in the read lottery).
* tools: enable sema_mme_prelude_cap_any=1 in params-r1624 (eng48: X-lane ↵Arthur Hanson Rasmusson14 hours
| | | | prelude feed for the indirect replay chain; A/B pending)
* vgsp: admit any channel's MME setup runs into the prelude capture ↵Arthur Hanson Rasmusson14 hours
| | | | | | | | | | | (sema_mme_prelude_cap_any, default 0) (eng48) The X DDX indirect lane (h=0x1000013) replays its 3D windows verbatim but never builds the MME pack because svc_mme_prelude_capture rejects every non-beef channel, so pl_n=0 and emit_prelude skips. c487 proved the X lane emits a 2799-word pack when pl_n>0. New bool sema_mme_prelude_cap_any=1 bypasses the beef gate and feeds the same signature-deduped capture; default 0 keeps legacy beef-only behaviour bit-for-bit. Validation pending.
* tools: enable sema_gl_mme_cb_alias=1 in params-r1624 (eng45: fixed-CB 7-page ↵Arthur Hanson Rasmusson17 hours
| | | | alias for the post-REARM macro path; A/B pending)
* vgsp: alias a contiguous 7-page fixed-CB region in the scratch PT pool ↵Arthur Hanson Rasmusson17 hours
| | | | | | | | | | | | | | (sema_gl_mme_cb_alias, default 0) (eng45) Macro 57 (LOAD_CONSTANT_BUFFER) reads the 0x7000-byte fixed CB at seed-shadow +0x5000, but only the single seed page was mapped (the pre-existing fixed-CB+0x4000 class), producing FAULT_PTE VIRT_READ at 0x0_015a5000 11 ms after the released calls (post-REARM). The alias maps a contiguous 7-page region in the scratch PT pool (page 0 = CB image/MVP; unservable tail = dummy zero page), wired into the scratch-0x18 and d19 seed paths, logged MME-CB-ALIAS. Safety-validated c654 (alias exercised, 0 MMU faults, 0 badf1201, 0 poison all boot); the beef macro chain was not reproduced in-window, so end-to-end validation is pending.
* tools: enable sema_gl_mme_keep_done_across_recycle=1 in params-r1624 (eng43: ↵Arthur Hanson Rasmusson18 hours
| | | | keep the MME pack completion record + cursor across the beef owner channel re-register so the first post-recycle prelude launch is non-emitting and MME-PACK-REARM fires; A/B pending)
* vgsp: eng43 - keep the MME pack completion record and packed cursor across ↵Arthur Hanson Rasmusson18 hours
| | | | | | | | | | | | | | | | | | | an owner channel re-register (sema_gl_mme_keep_done_across_recycle, default 0) c579: the first eng42-module completion (2799/2799) was followed 1.09 s later by the beef owner re-register; the eng40 chan_ctx_reset treated the recycle as a context loss, rewound the pack cursor and wiped pack_done_gen/ch, so every later prelude launch re-emitted (pre_words_out > 0 -> the r1222 clause correctly withheld the release) and MME-PACK-REARM could never fire. The knob keeps pack_done_h/gen/ch and the cursor (pack_off/pack_sa/load accounting) across the re-register so the first prelude launch on the re-incarnated channel is non-emitting and the REARM clause releases the held calls against the engine-resident program. The per-incarnation latch/live/release state is still cleared, and every genuine context wipe (WEDGE-RECOVER/CWD-CLEAR, park recovery, iram-gate failure, non-keep_gen generation rewind, FLR via reload) clears the record on its own path. Default 0 = legacy invalidate (validation pending).
* vgsp: eng42 - engine-global MME pack completion: record the pack completion ↵Arthur Hanson Rasmusson21 hours
| | | | globally (pack_done_gen/ch) so the post-completion call release fires for cross-lane completions (c552: part 1 on X, completion on beef -> pack_done_h withheld, REARM unreachable); restart the owner-less wedged cursor (poff==maxa && done_h==0) so a later window can re-emit the deterministic golden image (validation pending)
* vgsp: per-channel MME pack completion accounting + rearm release + ↵Arthur Hanson Rasmusson22 hours
| | | | | | | | | | | | | | | context-reset invalidation (eng40, validation pending) After the multi-part beef pack completes (2799/2799; keep_gen=1 works), the prelude generation drifts and the pack branch refuses re-emission (poff==maxa), so calls stay held forever (pcv=0, shadow draws 0, wrote=0). This adds: (1) per-channel contiguous-load accounting + pack_done_h so the completion is remembered for the loaded channel; (2) an MME-PACK-REARM call release when a completed pack's channel launches again; (3) gsp_phys_gr_mme_chan_ctx_reset(h) invalidation on context wipes/channel re-registers (the client recycles the beef channel between pushes, c496), shown firing safely. Validation: the fix was not yet observed completing on a green window with a same-incarnation draw; committed for reproducibility per house style.
* tools: enable sema_gl_mme_pack_keep_gen=1 in params-r1624 (eng39: the beef ↵Arthur Hanson Rasmusson23 hours
| | | | multi-part pack restarts on prelude-generation churn between parts; keep the packed cursor across churn when golden_force=1; A/B pending)
* vgsp: eliminate the part-launch FE poison - redirect replayed client ↵Arthur Hanson Rasmusson23 hours
| | | | SET_REPORT_SEMAPHORE/SET_NOTIFY targets to the mapped module scratch slot (sema_gl_report_sem_scratch, default 1); add sema_gl_mme_pack_keep_gen (default 0) to keep the packed-part cursor across deterministic-image generation changes (eng39)
* docs(wiki): 2026-11-14 status refresh - direct-GL submission decoded ↵Arthur Hanson Rasmusson25 hours
| | | | (macro-driven), push rescues land, draw-state push reaches the engine; MME multi-part completion is the wall; STATE-CURRENT snapshot
* tools: enable sema_gl_mme_partial_keep_window=1 in params-r1624 (eng36/37: ↵Arthur Hanson Rasmusson26 hours
| | | | let partial MME pack parts keep their windows so the multi-part beef program can complete and promote live_gen; A/B pending)
* vgsp: keep partial-part MME pack launches' windows via ↵Arthur Hanson Rasmusson27 hours
| | | | | | | | | | | | | | | | | sema_gl_mme_partial_keep_window (default 0 = legacy) (eng36/eng37) The load-only carrier gate turns every 3D window launch windowless while the packed MME program generation is not latched+live. A launch that emits only a PART of the packed program (block room exhausted) cannot make the program resident, so dropping its window also discards the draw's state and defers the completion to an unrelated later push, where it dies (GP_GET-frozen / MISSING_MACRO_DATA) and the generation never promotes. New knob sema_gl_mme_partial_keep_window (default 0 = legacy drop-everything): when set, only a launch that emits the FINAL part of the pack stays a windowless carrier; partial-part launches keep their window in the calls-held shape so client state accumulates and the completing carrier can promote the generation and let the next window run real calls.
* tools: enable sema_gl_rt0_bind=1 in params-r1624 (eng34: the client clear ↵Arthur Hanson Rasmusson28 hours
| | | | targets RT0 - MRT_SELECT=0 in CLEAR_SURFACE 0x3c - while the window binds RT1; bind RT0 to the same surface so the clear has a target)
* vgsp: relocate a CODESRC-SUSPECT GR program page to the engine-mapped ↵Arthur Hanson Rasmusson29 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | window-0 shadow instead of leaving the QMD pointer at an unmapped guest VA (eng33) The client's MME-expanded draw builds a QMD whose program page (qmd[48]) classifies CODESRC-SUSPECT (empty-page): the engine's GPCCLIENT_GCC I-fetch then read the guest VA above every engine-PDB window, raised FAULT_PDE and the FIFO parked for the rest of the boot (the TSG re-arm cannot revive a parked PBDMA). c361-c368 receipts. With gsp_phys_gr_codesrc_reloc=1 (default) the builder copies the page into the window-0 shadow (empty sources only; PTE/module pages are never republished), overlays the client's own known-good SPH+SASS stage image at the original QMD program offset (gsp_sema_gl_prog_img, stage-typed from the section bind; truncated at a 128-bit boundary with a terminal EXIT when the image is larger than the remaining page), and the existing QMD w48/49 + prefetch rewrite publishes the shadow VA. If the shadow mapping cannot be installed the page stays unmapped and the existing refusal drops the launch, so an unmapped QMD program pointer is never published. 0 restores the old guest-VA behaviour for a one-flip A/B. Validation (c373, params-r1624): 31 CODESRC-RELOC events (img_len=384, off=0xb00, 0 truncations), 51 GR LAUNCH submitted, 11 MME-FAST end events=3, 79 FETCH-WIT with GP_GET advancing engine-fetched, 0 FAULT_PDE, 0 vgsp-fault, 0 WEDGE-REARM/PARK-RECOVER; work_gr backend_ok=35 fault=0. The draws still write nothing (NOWRITE, no clear run in the emitted window), so px0 stays 0 - the store wall is unchanged and is the next target.
* tools: add sema_gr_grace_ms=500 to params-r1624 (eng28/eng29: engine contact ↵Arthur Hanson Rasmusson31 hours
| | | | for the beef state-push launches requires the shorter MME grace; 8000 showed no contact)
* vgsp: rescue the direct-GL draw-state pushes from the LOW fb band, admit ↵Arthur Hanson Rasmusson45 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | them to the 3D replay lane, and let the forced golden MME overlay satisfy the prelude maturity gate (eng28) The direct-GL client's draw-state pushes (476/624/728/324 B; invariant lead 90110087 = IMMD NVC597_INVALIDATE_SHADER_CACHES 0x21C<-0x1011) are intermittently unreadable while byte-identical copies park in the LOW framebuffer; the copies do not share the VA's in-page offset, so the page-stepped rescue scan could never land on them. Add a word-granular LOW-band sweep gated on the two recognisable push images (state lead via the method-stream window gate; 256-B VTG SPH upload by exact signature) and pin hits exactly like the existing rescue. The same pushes carry the frame's real state (SET_COLOR_CLEAR_VALUE 0xD80, NVC597_CLEAR_SURFACE 0x19D0, MME macro calls, vertex state) but no BEGIN/RT opener, so they never opened a C597 section and the state stream never reached the replay lane; admit the 0x21C lead as an opener on beef channels and exempt state-led windows from the eng25 colour-target guard (the guard's data-blob rejects continue unchanged - only the invariant state lead passes). Where the client's 0x114 IRAM upload is not captured (code words stay <= 4 on every boot observed), the forced golden overlay (sema_gl_mme_golden + _force; golden-only, fail-closed) can serve every called macro slot; add gsp_phys_gr_golden_ready() and skip the IMMATURE-SKIP software completion while it holds (see the golden-slot/pack machinery). Live (c348/c350/c351, r1624 params): the LOW-band rescue fired (VTG SPH 256-B push -> fb 0x2010200, pinned); the 324-B state push opened a section, captured (recs=4 nprog=1) and was marked for the verbatim 3D lane; with the bypass the lane submitted it to the engine for the first time (GR LAUNCH submitted + GUEST GR LAUNCH OK, MME-PRELUDE pack 1701 IR words, MME-GOLDEN slot 0 accepted). The emitted 51-word window still omits the 0xD80/0x19D0 clear runs (marked window 81), so pixel stores remain 0 and frames black; receipts under /tmp/opencode/eng28-*. Refs: CONT.490.
* vgsp: add sema_draw_census - bounded draw-marker census over every client ↵Arthur Hanson Rasmusson46 hours
| | | | | | | | | | | | | | | | | | | | | push (eng26 instrument) One green cycle must answer 'which push carries the direct-GL draw'. The census scans every non-engine push with the canonical op/cnt run grammar and logs one bounded row per push containing any draw-family method id (BEGIN 0x1618, END 0x1614, VA_START 0xd74, DRAW_VERTEX_ARRAY 0xd78, index 0x17c8/0x17d8/0x17e0, draw list 0x1b0, vertex streams 0x1c00/0x1c10), with the hit's word index inside its run so a run that merely NUMERICALLY spans a method address is distinguishable from a real method data word. Beef pushes without hits are enumerated once per (va,len) so the cycle yields a full push inventory. Module param sema_draw_census (default 0), 256 hit + 256 push rows, read-only. Live result (c346): full beef push inventory captured; every marker 'hit' is a k>0 lattice artifact of a data blob (e.g. the 59580-B push's single m=0 run at off=0x78 covers 0x1b0..0x1c10 at fixed word indices, and its BEGIN-address word value changes between reads - 0x00058202 then 0x01047220), i.e. no push carries a real draw method stream. Companion to a4215afa; docs in CONT.487.
* vgsp: reject beef draw-synth windows whose last colour-target bind is ↵Arthur Hanson Rasmusson46 hours
| | | | | | | | | | | | | | | | | | | | | | unusable (eng25 correctness guard) The direct-GL lane's draw-synth captures join the verbatim 3D replay lane by numerical run-cover alone, so a non-method data blob whose INC run merely spans the C597 RT block is replayed as state: its last A/B/W/H write per colour target is an unmapped 40-bit VA (c344: RT1 -> 0xff000480a0) and the engine retires with no stores (NOWRITE wrote=0). Gate the beef 'd' admission (single-block and chunk-split) on svc_gl_window_rt_valid(): walk the window with the run grammar, keep the last A/B/W/H write per colour target, and require at least one usable bind (A[7:0]<=1, B<2^30 aligned, 1<=W,H<=0x4000). Validated live (c346, mdev 53dc06b5, ENG26 instrument cycle): 23 bounded '3D mark rejected (beef draw-synth: no valid last colour-target bind)' rows, including the 14865-word 59580-B blob window @off=0x78 and the 542-word 0x4010ed0 twin; the one timing-variant window that does carry a usable RT bind still passed and replayed (wrote=0), and the X lane is unregressed (15x '3D stream marked h=0x1000013' + 'GUEST GR LAUNCH OK' ok=16/17). Refs: CONT.486/487; eng25/eng26 evidence under /tmp/opencode/eng26-*.
* vgsp: route direct-GL draw-synth captures through the verbatim 3D replay ↵Arthur Hanson Rasmusson46 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lane; beef rel_mod launches may take the ch_rel release branch (eng24) Clause 1 (gsp_sema_service.c, svc_gl_flush): the direct-GL (beef-family) section captures opened by the eng23 inside-run openers carry synthesized PROG/PARAM/REL (src=draw-synth) but a REAL method window; include 'd' in the stream-3d marking (single 448-word block and the method-aligned chunk split) so the window replays verbatim on the engine like the X/stream/hold lanes, instead of waiting on a synthesized compute-QMD release the engine never writes. Verified live: '3D stream chunked h=0xbeef0100 push=0x4250110 window=779 words -> 3 chunk(s)' and 'GR LAUNCH submitted h=0xbeef0100 ... polling qmd_rel=0'. Clause 2 (gsp_phys_booter.c, gsp_phys_backend_guest_gr_submit): a beef-family launch whose QMD release0 was redirected to the module semaphore with the rel_mod sentinel (0x600df00d) may break its poll on the channel release alone (the X lane's proven branch) once the engine has retired the method block; witnessed by 'GR LAUNCH OK ch_rel branch (beef rel_mod; ...)'. Verified live: 4+ beef launches now complete (engine fetch OK, GUEST GR LAUNCH OK ok=22..25) where the c338 shape timed out (qmd_rel=0xc0ffee01 want=0x600df00d). Known residual (unchanged by this commit): the replayed beef windows retire without stores (NOWRITE-CONFIRMED/AMBIGUOUS, wrote=0 -> px0=0), the same engine-store wall the X lane shows; and with the default sema_mme_immature_skip=1 the service soft-completes replayed beef windows before any engine contact (A/B with the knob at 0 was used to put the real window on the engine).
* tools: add sema_gl_draw_synth=1 to params-r1624 (eng23: required for the ↵Arthur Hanson Rasmusson47 hours
| | | | direct-GL draw-section capture path)
* vgsp: RM-record 3D attach + inside-run C597 openers for the direct-GL ↵Arthur Hanson Rasmusson47 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | channel (eng23, mechanism validated) The direct-GL (GZDoom/glx) channel family 0xbeef01xx never opened a C597 section because its class bind is channel-side: the client allocates TURING_A (0xc597) with hParent = its own channel (measured: alloc 0xc597 h=0xbeef9097 parent=0xbeef0100 client=0xc1d00013) and never re-emits a SET_OBJECT push, so the section recognizer's sticky-attachment gate (svc_gl_att_accept_run) dropped every push. The X lane binds inline in its init push and was unaffected. - gsp_rm_emulation.c: report the 0xc597 allocation's hParent to the sema service (gsp_sema_service_gl_attach), which applies it as the sticky 3D attach on its own thread (pending-slot queue; no cross-thread writes to the attachment tables). - gsp_sema_service.[ch]: the queue + drain (svc_thread pass), and accept the inside-run opener shapes on attached channels: the direct-GL client emits NVC597_BEGIN (0x1618) and the RT-setup family (0x840) as methods INSIDE multi-method INC runs (measured: run addr=0x80c count=256 covers 0x840..0xc0c; census decoded method=0x1618 op=1 from a run payload), not as the one-word IMMD form the X lane emits. - Also carries the eng22-rescue scan-cap widening (0x4000000 -> full 2 GiB shadow; observed live: "no content-gated window in 0x80000000 shadow"). Validated live (c335/c337/c338, receipts /tmp/opencode/eng23-receipts-c331.txt): - RM-record attach fires and applies for 0xbeef0100 (c335 12:49:04, c338). - sections now open (c337) and capture (c338) on 0xbeef0100 incl. the 59556-B setup push and the 6400-B draw push (src=draw-synth). - first GR LAUNCH submitted for 0xbeef0100 (c338 13:01:58) - fails at the physical QMD release (qmd_rel=0xc0ffee01 want=0x600df00d); new frontier. - px0 still 00000000; mission not launched. A/B control: the same X-lane lottery behaviour was reproduced with the pre-change module (c333), so no X-lane regression is attributable here.
* tools: add sema_gr_fb_push=1 to params-r1624 (eng21: required for the ↵Arthur Hanson Rasmusson2 days
| | | | FB-shadow push rescue at insmod)
* docs(wiki): refresh status to 436cbf9d - DDX/X-stability walls closed, ↵Arthur Hanson Rasmusson2 days
| | | | sections execute, push bodies decode above 10 GiB; remaining wall = direct-GL payload delivery (setup push recycled; draws 0x4250000)
* vgsp: content-gated FB-shadow push rescue for recycled client pushes (eng20, ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | end-to-end validation pending) The direct-GL client's one-shot 59,556 B setup push (VA 0x4001004) reads zero at decode time: the live page is recycled before our decode runs, so no C597 bind attaches for h=0xbeef0100. The rescue recovers the push body from the FB shadow with strict content gates: reject fill windows (require >=2 multi-word INC runs + >=8 distinct headers), scan at the push VA's in-page offset (0x4041004 starts 4 B into a page), and log the channel handle. eng20 refuted the unregistered-VAS hypothesis: the payload pages DO walk via VAS 0xbeef0300 (0x4000000->pa=0x342ead000, 0x4001000->pa=0x342eae000, consistent delta). Also found: sema_gl_xlate (absent from params-r1780; default 0) gates every C597 section-recognition site - with it on, the lane produced its first C597 captures (127x c305, 20x c307). Validation cyclic c308 (guest init panic) / c309 (QGA wedge) blocked; no observation yet. Unvalidated end to end.
* STATE-CURRENT: hourly check-back snapshot (2026-11-13 11:12:01)Arthur Hanson Rasmusson2 days
|
* vgsp: extend the live PA acceptance bound to the registered guest-RAM top ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | (svc_pa_max/svc_push_pa_ceiling) The direct-GL client parks its VAS page directory and push pages in the 4-14 GiB high RAM band while the runtime bound stopped at 10 GiB (param/compile), so svc_ap_ok rejected every walk read above 10 GiB before vfio_dma_rw could answer: the client ring walk reported 'L0 read fail' / 'walk rc=-2' on the one boot the RAM content scan latched the real ring (c296), and the push bodies stayed unreadable (src=3 window garbage / src=255). svc_pa_max() now never shrinks below the registered guest-RAM top (sanity-clamped to the scan max), and svc_push_pa_ceiling() floors on the same live bound. c297 (first boot with the fix): 'RING-VAS h=0xbeef0100 gpfifo=0x4020000 mapped by VAS 0xbeef0300 (pdb=0x110aae000) -> pa=0x23771f000' and pushdec 'src=4 plausible=1' with the read ceiling witness ceil=0x380000000.
* vgsp: reject the dense-lookalike class in svc_gr_ram_ring_scan ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | (entry0==entry1 gate) The GL client ring content scan admitted the lookalike page measured at pa 0x10a828000 / 0x10ad3e000 (dword 0x04000100 repeating) whose entry0 and entry1 decode identically (va=0x4000100 len=262144) and which passed every window/terminus gate. The pump then read a phantom 256 KiB push at VA 0x4000100 forever (sema-rdw rc=-2, sema-entry: unread, unregistered submissions=0; c271/c285), poisoning the client-VAS verify chain. A real ring does not repeat one entry verbatim in slots 0/1. Partial validation: c288 (fixed module) resolved the REAL ring pair via the VAS (pa=0x235f7c000, entry0 va=0x4000000 len=2236) and decoded real client pushes (submissions=15, CB-DIAG match=67). End-to-end pixel validation (gl_frames px0 != 0) is still pending; c286/c287 did not exercise the scan (no channel created).
* vgsp: exclude the 0x40706c read sentinel from the pre-replay CWD-clear ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | predicate; add sema_gl_cwd_clear (A/B knob) FALSIFIED NOTE (eng16, c271/c272): the eng15 lead that the always-fire CWD-clear rode on the 0x40706c sentinel and caused the zero-store wall is FALSIFIED. A/B on the same launch shapes (h=0x1000013 push=0x1200107e4 words=50 / push=0x1200106bc words=53): - c260 (old code, clear fires 7x/boot on the sentinel): wrote=0. - c272 (clear fully off, sema_gl_cwd_clear=0): wrote=0 both launches, pbfetch=block end, intr0=0 - identical to c260. - c271 (predicate fixed, knob on): 0 CWD-CLEAR all boot (the sentinel no longer arms it; esr=80000000 / grfifo pending counts are clean). The change still lands because the old predicate was a bug either way: 0x40706c reads 0xbadf5040 always (read-only hardware sentinel; eng15 write test 0x0 -> 0xbadf5040), so every stream3d launch ran a TSG preempt/resched + MME latch wipe before a noQMD replay that never re-loads context - an unjustified per-launch context reset. The zero-store wall is unchanged and now localized: the stream3d lane only replays X DDX setup-only windows (c272 decode: INC6@0x840 SET_COLOR_TARGET_A(1) VA=0x0c000000 1920x1080 X8R8G8B8, INVALIDATE_*, INC5@0x180 LINE_LENGTH_IN/OFFSET_OUT - no BEGIN 0x1618 / no draw 0xd74 / no CALL run), while the pbuffer client's own push entry (0xbeef0100 va=0x4000100 len=262144) is unreadable host-side (rc=-2, channel unregistered, submissions=0) - so no draw reaches any lane.
* vgsp: eng15 diagnostics - 3D window 48->256, WINPROBE 64->2048, ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | NOWRITE-PBDMA dump Diag-only commit (eng15 receipts: /tmp/opencode/eng15-receipts-c260.txt). - gr3d_win_log 48 -> 256: keep the raw 3D window dump for the gl_frames-era replays (the 48/boot budget was consumed by earlier launches). - winprobe_log 64 -> 2048: keep WINPROBE samples for every stream3d launch. - NEW NOWRITE-PBDMA dump (stream3d-only, 256/boot): all 12 PBDMA instances' intr0/gp_put/pbfetch/off-in-block/hdr/pbcnt at the zero-write verdict. Produced the decisive c260 data: pbfetch == 0x101000+words*4 exactly (deposit fully fetched per launch), intr0=0. No behaviour change; logging only.
* vgsp: CB parser decode fix + pre-replay FE context clear attempt (cwd3 latch ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | | | | | | | survives; zero-store persists) (a) svc_gl_cb_upload_scan decode now follows the class definitions (cla16f.h: method 11:0, subchannel 15:13): addr=(hdr&0xfff)<<2, subch=(hdr>>13)&7; selector B/C swapped (0x2384=B=ADDRESS_UPPER high dword, 0x2388=C=lower, cla097.h); 0x238c runs apply [offset][constants...] inline data. CB-DIAG prints subch. Other classes untouched. (b) Pre-replay CWD poison clear for the stream3d lane: new gsp_phys_gr_cwd_clear_locked() (checks 0x404490/0x40706c/0x400504 for 0xbadf, runs the wedge recovery's bounded TSG preempt/resched re-arm + shared latch wipe) before build_gr_launch; once per launch, stream3d+sema_gr_wedge_recover gated (CUDA/CE unaffected). Validation (c250-c254, rich args, ladder armed): the re-arm probes green ('WEDGE-REARM probe rc=0 (engine ALIVE)') but the cwd3 latch does NOT move ('CWD-CLEAR after re-arm ... cwd3=badf5040') and wrote=0 persists (0/1024) with the 0x1528 trap gone under sema_gl_shader_exc=0 - clause (b) is falsified as sufficient: the poison is not the TSG/PBDMA context the re-arm touches. CB-DIAG on these draws shows n3800/n39c8/n2390=0 because bit 12 is 0 on that stream (old/new decodes identical there) - the parser fix stands on the class definition. X regressed to the DDX DMA wall on these cycles (DMA-init 0x51 + per-start SIGSEGVs), so clean gl_frames windows were rare.
* vgsp: admit short MME preludes and drop the 0x22c init method from replay ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | | | (stream3d zero-write fixes) NOWRITE decode (eng11): wrote=0/tracked=1024 is the retire scan; fe_esr= 0x80000000 is the CLEARED FE latch (not a live fault); trap=0x8000022c/... is PGRAPH_TRAPPED_ADDR naming method 0x22c (C597 SET_GO_IDLE_TIMEOUT, init-only, emitted once at channel init) - the FE traps on the replay of that init write and never reaches the draw. The c220 stack also showed a second defect: 'MME-PRELUDE deferred (window=20 prelude=13 sa=0 cap=2048)' -> MME-REGS esr=badf1201 miss=1 pc=513 -> grfifo poison -> warm sem rc=-110. Fixes (gsp_phys_booter.c): - A: admit a captured prelude shorter than 24 words (pl_room is clamped to pl_n, so pl_room >= 24u could never be true for preludes < 24 words and they were deferred forever). - B: add addr == 0x022c to gsp_phys_rmcall_gr_win_drop_auto_match() (knob sema_gl_win_drop_auto, default 1): drop the replay-hostile init write like the existing 0x10c/0x1b0/0x5e0/0x1b00 triggers. Validation pending (c221 no-capture lottery, c222 X death before the live A/B); receipts: eng11-*.
* vgsp: serve word-34..47 section pages from their resolved PAs; seed the ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | | | | | | | pointer pairs (n_data 0->1024) The final-pixel-wall data window: svc_gr_data_fill discarded a candidate page that HAD resolved in gr_pages (launch_internal blanket skip: c203 evidence 'page[2] va=0x120400000 pa=0xa00000 ap=2 word=34' + '10 candidate ptrs, 0 pages resolved; 7 dropped' -> GR-DEC n_data=0), and the stream3d lane (qmd=0x0) never seeded the capture's decoded operand pairs (inline-QMD words 34..47) as candidates. Serve word-34..47 pages from their resolved gr_pages PA (li_pa, span=1; word 32/48/49 stay excluded as before) and seed the pointer pairs from a request-carried copy (race-free vs the capture ring). Live proof c215: 'li cand va=0x120400000 word=34 pa=0xa00000 ap=2' -> 'GR-DEC n_data=1024' (was 0). Residual: the 1524 B first-frame's pointer pages are not yet resolvable at that instant (n_ptr_req=5 seed_add=0; frames 2+ resolve 1024) - resolver timing, documented. Also documented (no change): the copy-out refusal for dst=0x120700000 (the GL client's fixed-CB page) falls through to the forced-seed path and is benign for pixels; the TRUE px0 blocker is engine-zero-write: every stream3d launch ends 'NOWRITE-CONFIRMED ... n_data=1024 tracked=1024 wrote=0' + 'NOWRITE-REGS fe_esr=0x80000000 trap=0x8000022c/00000800/00000000' even with the full RT window (SURF-PRELUDE target=0xa000000) - the engine executes but stores nothing.
* tools: cycle-r1780.sh arms the GR lane per boot (rm-call ladder + guest-ram ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | | | | activation) Post-reboot cycles lost the pre-reboot 'arm the GR lane' steps, so gsp_phys_backend_gr_ready() stayed false (rmcall_gr_exec_ok=false) and every captured GL section died SILENTLY at svc_gr_request's first gate (c198: work_gr req=73 fallback=73 ok=0 refused=73 submitted=0 exec_ok=0; an ftrace run counted 2282 silent svc_gr_request calls). After 'guest agent up' the cycle now runs, with warnings only (never fails the cycle): echo 5; echo 3; echo 4 > gsp-phys-rm-call (order matters; 4 alone fails by design) echo '<mdev> /dev/shm/vgpu-guest-ram 0x80000000 0x0 0x300000000' > gsp-phys-guest-ram and logs both to <tag>-ladder.txt. Validated c203: 7x 'GR LAUNCH submitted' + 5x 'GUEST GR LAUNCH OK' from the captured GL sections (zero ever before), exec_ok=1, work_gr ok=4 backend_ok=4. Residual: gl_frames still black - GR-DEC n_data=0 dropped=24 (the section's data window resolves empty) and 'sema-grce: owner-vas h=0xbeef0100 ... dst=0x120700000 unmapped; cross-VAS walk refused (client-private page)' for the client copy-out operand - the old n_data/dstpend frontier, now with the forward live.
* vgsp: DDX latch adoption grace + last-proven-block parking (X now lives >10 min)Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | | | | | | | Thread A of the X longevity wall, validated c195/c198 (rich args + tick): - Adoption grace: gr_ram_userd_adopt_at stamped at every DDX fresh-adopt site; svc_userd_ddx_reprobe refuses a speculative switch within 1 s of an adopt (kills the c190/c197 same-pass cascade to frozen lookalikes). - Clause 3: the last CONFIRMED block is parked (pa/as/put/probes) on every DDX confirm; svc_userd_ddx_park_probe checks it first in the re-probe and discovery scan and prefers it when its PUT advances across two probes (kick excluded, half-ring bound, reset re-syncs). Receipts: c195 X GREEN >10 min with 0 DMA failures ('shape scan fb 0x8f0000 -> CONFIRMED 2->6 at +63 ms, zero SWITCHED/DEFERRED/REJECTED all boot'); c198 GREEN >2 min likewise (+69 ms confirm, zero switches). Residual (documented): the RAM-scan 'LIVE' vote can still admit pool lookalikes on a first generation before any block is parked; the grace only delays that switch. Thread B (documented, no change): in c195's green window gl_frames still reads black (px0=0, ~12 s/frame) although the rich args capture the modern-GL sections ('sema-gl: 3D stream marked', 'section captured len=1524' + 2 draw sections, prog-images vs=1408 ps=384) - ZERO GR LAUNCH and zero readback/copy-out lines; the beef0100 channel re-registers every ~13 s with submissions=0. Modern-GL work is section-captured but never executed/forwarded - the next frontier.
* vgsp: refuse DDX-family garbage USERD candidates (get>put) and bound the ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | | | | | speculative CONFIRM jump Wall (a) garbage-admission fix, validated c190-c194 (rich args + tick): - svc_gr_ram_userd_scan and the FB shape scan (svc_chan_userd) now refuse get > put for the DDX family (svc_userd_ddx_family), dropping the entries>1024 exemption that admitted c181's 'put=1 get=288190567' block; bounded refusal logs ('RAM scan REFUSES ...', 'userdp ... REFUSES fb ... (DDX get>put; c181 garbage class)'). - The pump's speculative CONFIRM bounds a non-wrap DDX (non-kick) forward PUT jump to gpfifo_entries/2 (mirrors the wrap bound); a runaway jump like c181's 'put 1 -> 1170688059' now falls to the DEFERRED/REJECT ladder ('forward PUT jump REFUSED ...'). Kick any-step and wrap paths unchanged; SYS/CE/UVM untouched. Receipts (5 cycles): 146 refusal lines (80 RAM, 66 FB), ZERO huge-jump confirms (all 16 confirms are real small steps), real blocks serving 25+24 submissions from pristine fb 0x8f0000 and RAM 0x11ae6e000. Residual wall (a): a same-pass re-probe switch to a frozen lookalike (c190) and a late 'Failed to idle DMA' at 60-130 s of X life; gl_frames still reads black (px0=0, ~12 s/frame) in the windows it ran (c193/c194).
* vgsp: flip-event delivery defaults to assoc+strict (clears Flip event ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | timeout); DDX latch reset clauses Wall (b) 'Flip event timeout on head 0' fix (validated c171): NVKMS/kernel- callback events register hSrcResource=0, so every display UPDATE completion rode the all-events shotgun (6-7 POST_EVENT records each), the guest's status-queue read cursor fell 20-44 slots behind (rc=-11 ring-full bursts) and flip records arrived past the 3 s NvDrm window. Default the r1765 pair ON - gsp_rm_ev_assoc (hSrc==0 -> alloc-parent channel) and gsp_disp_events_strict (armed UPDATE posts only to that channel's events, no fallback) - the exact combination r1771 measured as '0 flip WARNs'. Validating cycle c171: registrations carry real sources (hEvent=0x1007a hSrc=0x1001b etc.), UPDATE posts are exact 1:1 (posts=27), WARN count 1 for the boot, serial timeouts=0 (c160 pre-fix: 34). Both stay runtime-writable. Also stage the gsp_sema_service.c candidates for wall (a) (the later-DMA 0x51 is a consequence of 'Failed to idle DMA' on a recycled channel): the served-refusal in svc_userd_ddx_reprobe now exempts a latch reset to put==0, and the put-reset latch keep extends to the DDX family (was kick-only). These clauses target c171's observed reset/junk-adopt sequence; validation pending on a roll where wall (a) is otherwise survivable.
* vgsp: display engine re-seeds GET on a driver ring wrap (fixes the ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | nvidia-modeset GET-past-PUT wedge) Root cause of the post-ScreenInit Xorg kernel-mode spin (sysrq-t: Xorg R-state inside nvKmsIoctl -> nvkms_yield, utime frozen, stime 100%): the emulated display engine (core channel c57d) held GET=0xcd8 PAST PUT=0xcc8 for 50 s. gsp_disp_run only publishes GET when the parse reaches PUT exactly (by design, per its r1630 comment), so when the guest driver wraps/resets its push ring (PUT steps backward via nvEvoMakeRoom) the stale consumed can never resync and NVKMS spins forever. When put < s->consumed (wrap/reset), re-seed consumed=0/last_put=0 and republish GET=0 so the wrapped pushes are re-parsed from the ring base; the driver's PUT is authoritative. Validated c160 (rich args): bar0 channels now read PUT==GET (core 0x590, window c57e 0xe2c) with no wedge and flips parse (UPDATE armed=1 -> FINISHED posts=32..34); X advances past the spin and served xdpyinfo once. Remaining walls (next): the push-buffer 0x51 NV_ERR_NO_MEMORY allocation lottery and 'Flip event timeout on head 0' (Xorg D in nv_drm_atomic_commit).
* vgsp: DDX re-probe stops once the latch has served (stops lookalike switch ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | thrash) In svc_userd_ddx_reprobe, refuse to switch while the current latch has just delivered decoded entries (ch->submissions != gr_ram_userd_latch_sub), the same 'served' criterion the pump's DEFERRED clause uses. The switch path resets defers=0, so a defers-based guard would have stopped only the first of c141's six switches; forward-only nput>oput is semantically wrong for DDX generations (a fresh block starts with a tiny put) and would lock onto the junk maximum. Validated c150-c153 (rich args + tick): latch SWITCHED 0/run (was 6-8 at ~2 s), sema-xchan uok=1 continuous, and c152/c153 Xorg logs show ZERO 'Failed to (idle|initialize) DMA'/push-buffer/AddScreen lines - the ScreenInit DMA instance is now stable on the deferral alone. Residual (next): Xorg then spins in-kernel (95% CPU, SIGKILL-immune, xdpyinfo unanswered; userd put=0 get=0 vs last=7098 in sema-xchan is the lead) - gl_frames still hangs at BAR map.
* vgsp: DDX-family USERD latch lifetime - served-latch deferral + live ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | re-probe + FB backoff The X DDX's push-on-demand generations allocate a new USERD control block every 11-24 s, but the 15 s no-advance judge dropped the latch that had just passed the DMA test, and the next scan adopted a frozen FB lookalike (put=2 get=0) - the retry window then closed with 'Failed to idle DMA'. For the DDX/kick handle families only (0x01xxxxxx / 0xbfef00xx; SYS/CE/UVM untouched): - svc_userd_ddx_family() gates all of it; - a latch that HAS delivered decoded entries (submissions advanced since adoption, no contradiction) is DEFERRED from rejection (bound 32; timer reset) instead of dropped; - before any latch decision (and on a 2 s cadence while unconfirmed) the content scan re-probes the live path and switches the latch in place to a newly validated block (svc_userd_ddx_reprobe; near-empty page + ring-entry validation + PUT-step liveness are the ownership proof); - after a rejection the FB shape scan backs off 6 s so the RAM scan wins the window; the DDX re-probe is exempt from the retired slice budget (rejects < 255). Validated (c141, rich r1624 args, tick): X ScreenInit passed with ZERO 'Failed to (idle|initialize) DMA' / push-buffer / AddScreen lines; the channel decoded a 5090+-entry burst and served across block moves (latch SWITCHED 0x24128e100 -> 0x103774100 -> 0x122309d00, uok=1 held). Known residual (next refinement): the switch is not yet forward-only/ rate-limited, so lookalike blocks can oscillate at ~2 s and starve the client; make the switch require nput > latch_put and a >=10 s cadence (or stop switching once defers>0), then the real block wins.
* vgsp: X-DMA wall witness for 0x1000013; add params-r1624.txt (rich bring-up set)Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | One rate-limited (0.5 s) sema-xchan line per pass for the X DDX channel: rrc/uok/upa/uas/put/get/last/ring_pa/entry0 - names the decode-gate state independently of the shared userdp budget. Diagnostic only, no behaviour change. params-r1624.txt is the rich r1624 insmod set as a durable tools/guest-diag file (INSMOD_PARAMS=tools/guest-diag/params-r1624.txt). Context (c130/c131 with the rich set): the DDX DMA test now PASSES on most attempts (tracker release decoded + delivered); the remaining gap is the USERD speculative-latch lifetime (a latch that delivered the test kick is REJECTED 15 s later with no PUT advance; the next generation then adopts a stale VRAM block, put=2 get=0, and the retry window closes) plus a later 'Push buffer object allocation failed: 0x51 NV_ERR_NO_MEMORY' (emulated heap accounting; 1872 MiB free).
* tools: fix cycle-r1780.sh env-var comment (INSMOD_PARAMS is what the code reads)Arthur Hanson Rasmusson3 days
|
* tools: mission-gz guest loop (X retry -> gl_frames probe -> GZDoom pbuffer ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | capture); push/verify fixes mission-gz.sh runs the end-to-end guest pass in one shot (X bring-up with ScreenInit retries, GPU GL probe via gl_frames, GZDoom offscreen + gz_pbuf + sdl_cap under the tested wrapper, /tmp/mission-done result flag). push_gl_tools.sh runs vgpu_vm.py under sudo (QGA needs root); gl_verify.sh uses 'pkill -x Xorg' (the -f pattern self-matches the shell when the command line contains the Xorg invocation).
* vgsp: resolve the completion counter through its real aperture (fb/vidmem) ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | and use it on publish/flush The X DDX/kick channels' nvPush progress semaphore is a 4 KB sysmem surface whose GPU mapping resolves to the emulated VIDMEM aperture (va 0x20400ffe0 -> vidmem pa 0x3f8ffe0), while svc_counter_derive only accepted SVC_APERTURE_SYS translations; it therefore kept a false guest-RAM pair (a page holding unrelated data) and svc_counter_publish's put-advance both read and wrote the wrong page through the SYS aperture - the client's tracker never matched and the DDX failed 'Failed to initialize DMA' after its 10 s push-buffer sanity test. Carry the aperture with the registration (new svc_channel.counter_ap, svc_cnt_der[].ap): accept FB translations in the derive chain (chanvas, vaspaces, discovered; targeted stays SYS), probe with the found aperture, keep it through pin override/re-registration; svc_counter_publish and svc_counter_flush_pending read/write through it (release_pa stays SYS). Live receipts (c109/c110, 12 GiB guest, params-r1780): - counter derived h=0x1000013 ... pa=0x211c42fe0 (rank=1) with pub-adv writing 14..26 (was silently skipped on a false page in c107); - the DDX's OWN C36F tracker releases decode and land: 'sema-push h=0x1000013 va=0x1200a0000 ... rel=0x120001000 pay=1 have_rel=1' -> 'sema-sw h=0x1000013 va=0x120001000 pa=0x11cc68000 ap=1 val=0x1 rc=0 rb_ok=1' - the 10 s push-buffer test's exact wait word is delivered and the DDX proceeds to further work (values advancing 0x4017e..0x24024f); previously no release ever decoded. Remaining X-side flakiness (a later DMA init still failing on some instances) is tracked in the handoff.
* docs: 2026-11-12 status refresh - green X/GLX, non-black GPU captures, ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | direct-GL stream frontier Refresh STATE-CURRENT.md and the open-iov.org wiki pages with the 2026-11-12 state: stock-driver X + GLX green (glxinfo 4.6.0 direct rendering, glxgears ~520 FPS), the pbuffer frame path captured 500/500 non-black frames (50 s 640x480 h264) plus the earlier 45.4 s capture, and the named frontier (direct-GL client command-stream delivery: setup push unreadable, CE ring 0xbeef0101 intermittent) alongside the guest-init/sizing fixes (RMInstLoc modprobe single-source, FB info in KB, 256 MiB GART).
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-15 17:14:25 +0000