| Commit message (Collapse) | Author | Age |
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(TCS-off DS A/B)
c788 achieved DRAW_IAB (MME-FAST macro-status=00122266 mpc=614
mac=0x22 run=1 via MME-DRAW-MOVE) but the draw latched DS 0x84000420
(SPH5 VSB c1, SPH10 TCS c2, M_PIPE_STAGE TI) and stores stayed 0
(NOWRITE-CONFIRMED wrote=0). The DS-ESR post-clear=84000420 then the
retire reads ds=80000000, so the pending validation error is the draw's.
The per-stage disable mask was only honoured with sema_gl_sph_bind=0,
so the all-slots boot could not disable TCS while keeping the window's
own VSB bind and the other synth slots. Read the mask unconditionally;
default 0 keeps the emitted bytes identical. params-r1624 sets
sema_gl_sph_stage_disable=0x04 (TCS disable record 0x2080<-0x20, synth
j2 bind skipped) for the next A/B.
|
| |
|
|
| |
deterministic (c772), slot-34/SA[34] settled (0x265), call order is the blocker; eng64 chains the release behind the pack carrier; STATE-CURRENT snapshot
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
carrier's gate
c779: the pack-continuation carrier completed the pack
(MME-CARRY-COMPLETE gen=4 off=2799/2799) and armed the release
(MME-CARRY-ARM mode=release), but its launch poll held the single
forwarding slot for 2801 ms; the armed release then deferred
request-inflight until the beef channel unregistered at +2.2 s, so the
release ended in MME-CARRY-HOLD reason=no-channel.
- svc_fwd_gr_work: after a successful synthetic pack carrier, wait out
the release grace in the same slot, claim it and run the release work
directly (chained MME-CARRY-FIRE mode=release ... receipt). Gate:
sema_gl_mme_release_chain (default 1; release carrier still default 0).
- pump pack-carry block: an armed due carrier that cannot go out now
names its blocker (MME-CARRY-WAIT reason=no-channel/client-candidate/
request-inflight/fe-defer), so the c781-class silent stall is visible.
- booter: gsp_phys_gr_mme_release_waiting()/chain_enabled() helpers.
c783-c785 (a03a68ea build) were all shallow (author=0, no MME window).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
the setup calls
c780 (9a087063): the release launch ran and MME-SA-REARM re-pointed
7 slots (slot 34 client=0x265 golden=0x265), but the replay executed
mac=0x33/0x0/0x39 only. The 728 B state window carries the slot-34
CALL at off=0x340 AFTER its 0x33/0x39 setup calls; the earlier 0x39
macro latches DS 0x84000420 and the MFE never reaches CALL(34) (mme
mac stays 0x39, then idle). c716's 324 B DRAW window puts CALL(34)
first and ran mac=0x22.
Release launches only (release_sa_arm): locate the window's first
CALL run and the slot-34 run (+ its immediately preceding 0x1644
pair), and emit the window with that run moved ahead of the first
CALL run. MME-DRAW-PLAN/MOVE receipts; default off path unchanged.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
release-launch SA re-arm
c776 proved the saved-window release replay carries the slot-34
CALL_MME_MACRO run (MME-WINRUN off=340 op=5 cnt=10 mthd=3910) but the
macros ran 0x33/0x0/0x39: the release launch sets emit_prelude=0, and
the client capture had no slot 34 (c774 fill published golden entry
0x265 host-side only), so the stale engine SA[34] resolved the call to
IR 0 (mac=0x0).
- MME-CALL-CENSUS/MME-CALL-TARGET: decode the held window's CALL runs
with the hold/drop run grammar (op 1/3 walk method+4k, op 5 only the
header method, op 4 one method) and print targets + slot34 with the
client/golden/used entry.
- release_save: among DRAW_IAB-bearing windows prefer the smaller raw
DRAW stream (324 B/81 words, the c716 mac=0x22 shape) over the 728 B
state window; keep=draw-win receipt.
- sema_gl_mme_release_sa_arm (default 0; params-r1624 enables it):
run the SA re-arm + golden fill on the release launch so
CALL_MME_MACRO(34) points at the golden DRAW_IAB body (IR 0x265).
Pack-carry/release receipts unchanged; release carrier still default 0.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
sdl_cap.c wrote the same 32 in the GZF2 record format field for every
capture path, so gzf2_video.py's auto mode decoded ARGB8888/X-surface
frames (BGRA byte order on little-endian) as RGBA and swapped red and
blue. Make the field the documented pixel-order tag: 32 = RGBA8 from
the GL swap path (glReadPixels GL_RGBA), 33 = BGRA8 from
SDL_RenderReadPixels(ARGB8888) and X window surfaces; xgrab.c tags its
ZPixmap BGRA records 33 as well.
gzf2_video.py continues to accept both tags (and old all-32 captures
via --pix-fmt bgra), checks ffmpeg/ffprobe before indexing, and keeps
the final resampled endpoint so a 90-frame 60 fps capture encodes as
90 frames instead of 88.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
default off
The golden overlay writes all 55 slot bodies, but the CALL_MME_MACRO(34)
DRAW_IAB run targets SA[34]; the client's captured SA table only covered
slots 0-11 (c772), so slot 34 resolved to IR 0 (the slot-0 body) and the
macro never produced mac=0x22. Add sema_gl_mme_sa_golden_fill (bool, 0):
for every slot whose client SA entry is missing/zero and whose golden body
exists (kernel/golden-mme-tu104.h golden_mme_tu104_sa[64]), set the SA entry
to the golden body's IR entry (slot 34 = 0x265, 75 words) and mark it
present. Nonzero client entries are never overwritten. Fill runs in the
golden overlay, in the submit path before the stub/call-drop walk, and in
the SA re-arm (the release-carrier path); the release path re-fetches and
emits the filled 0x11c pairs. New MME-GOLDEN sa-fill/sa-census receipts.
c774 proves the fill: `MME-GOLDEN sa-fill slot=34 entry=0x265
(client=missing)`. Enable in params-r1624. Build rc 0; the mac=0x22
validation needs a c772-class release boot.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(diagnostic + robustness)
The saved-window release carrier replays the client's held window with the
CALL runs kept. Save the raw window after scanning it for the
CALL_MME_MACRO(34) DRAW_IAB run (method 0x3910, the 0xA00A0E44 ten-data
run); if the saved record already carries it and a later held window does
not, keep the saved one (bounded MME-CARRY-SAVE-PREFER receipts).
Caveat established from c772: its 728 B window also carries the 0xA00A0E44
slot-34 run at raw[113], so the DRAW_IAB window bytes are not the
discriminator; the c772 replay ran 0x33/0x0/0x39 because SA[34]/the golden
IR entry was stubbed, not because the window lacked the call. The next
lever is the SA[34]/golden-body residency census, not the window choice.
Build rc 0; validation pending.
|
| |
|
|
| |
params-r1624 (c772: identity CARRY-FIRE mode=release -> synthetic push 0x6d6d6500 -> REARM gen=5 -> DS 0x84000420)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
recycle; defer non-ready takes
c765/c766: the release carrier saved the held 324/728 B window, then the
client re-registered the beef channel before the pack completed. The
follow-up's chan_ctx_reset cancelled the saved record unconditionally
(consumed=true, valid=false) even though keep_done_across_recycle=1 means
the engine context and packed program survive; the pack-completion arm then
early-returned and the release never fired.
With keep_done_across_recycle=1 the re-register is a client-handle recycle,
not a context loss: keep the release record. Cancel it only in the genuine
!keep_done wipe path. Also make release_take defer (not consume) on
not-armed/grace/pack-not-resident with bounded MME-CARRY-HOLD receipts;
only terminal conditions or a failed fire consume. release_rearm now runs
unconditionally with the knob on and release_arm gates on pack_done, so the
record survives the save->completion gap.
Build rc 0; validation pending.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
re-arm in the pump
The saved-window release carrier was armed inside the pack-completing
launch's own build, and the client-first cancel treated that same launch
(and its retries) as the next client launch, silently dropping the claim.
c762: MME-CARRY-SAVE (win=240 held=68) -> MME-CARRY-ARM mode=release ->
the arming launch ran mac=0 (LOAD-ONLY, window dropped, held CALLs still
owed) -> no FIRE, no synthetic push, no mac=0x22.
Track the arming launch identity (h + push) and keep the claim armed across
it; only the MME-PACK-REARM edge (calls actually released), a real consumer,
context/handle changes, or a launch error cancels/consumes. Add a pump-side
re-arm once pack_done_gen is set, and bounded MME-CARRY-HOLD receipts for
every skip. One fire per pack completion, no retries.
Build rc 0; validation pending (c762-class boot with
sema_gl_mme_pack_release=1).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(default off)
When a 324 B draw window holds its CALL runs while the 2799-word pack is
incomplete, the pack can complete later (X lane or a 728 B window) but the
next client launch that would release the held calls is a per-frame lottery
(c756: MME-CALL-HOLD 18, pack complete, no next launch -> no REARM/mac=0x22).
Save the held window at MME-CALL-HOLD (raw pre-relocation stream + the
launch capture fields) into module memory. When the pack is complete and
resident and no client launch consumes the release within
sema_gl_mme_pack_release_ms, re-submit the saved capture through the normal
fill/build path with the held CALL runs KEPT (mme_hold_calls=false), no
prelude emission, and gr_synthetic/no guest release. The released
CALL(34) runs DRAW_IAB against the resident pack, the shape c716 proved.
New: sema_gl_mme_pack_release (bool, 0) / _ms (uint, 100); MME-CARRY-SAVE /
ARM/FIRE/COMPLETE/CANCEL/ABORT mode=release receipts. Beef-only, one fire per
pack completion, fail-closed on context/handle changes or launch errors. The
existing pack-continuation carrier is unchanged with its knob off.
Build rc 0; validation pending.
|
| |
|
|
| |
stage TYPE/COUNT before the address pairs; DS A/B)
|
| |
|
|
| |
(st0=st1=020a0481; DS 0x84000420, two boots); draw-issue mac=0x22 and stores remain; STATE-CURRENT snapshot
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
image, and harden the author window-head decode
- gsp_phys_booter.c: after authoring the VTG SPH at family+0x900, scan the
patched 3D window for its own 0x2054 slot-1 pair and rewrite an operand
whose low 12 bits are 0x600/0x300 (client family VA or pair-cache shadow
line) to <page>|0x900. The window's own later pair otherwise overwrites
the synthesized prelude j1 and the DS validates the client's SASS page
(c743: DS-IMAGE st1=0b0b7208). New SPH-SLOT1-REWRITE / SPH-SLOT1 receipts.
- gsp_phys_booter.c: reject an inline VTG candidate whose IMAP word (w6,
offset 24) is zero; fall back to the builtin image. A 640 B w6=0 record
authored a zero-map SPH and the DS went to the FECS/PRI sentinel
(c749 fam 0x4350000: ds 80000000->badf1201).
- gsp_sema_service.c: the DDX ring-head decode scans past zero-payload
and unreadable entries within the 8-entry bound instead of stopping
(c746: the ring head is a zero dummy and the C36F release sits later);
it still never fabricates a payload.
Validation: c749 is the first boot with DS-IMAGE st0=st1=020a0481
(code ff007321, the authored VSA/VSB image), a clean slot-1 rewrite
(old=0x01e00300 new=0x01e00900), beef MME-PACK-REARM, and the DS latch
reduced from 86040626 to 84000420; stores are still 0 and the DRAW_IAB
macro is the next gap.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
decode, MME pack carrier, and the pump atomic-sleep hoist
- gsp_phys_booter.c: sema_gl_sph_vtg_auth (default 1) authors the client's
live VTG SPH image at family+0x900 and binds VSA/VSB there; new
SPH-AUTHOR / SPH-ALIAS-auth receipts and a DS-IMAGE stage census at the
DS latch (stage-start w0 + code word through the pair cache).
- gsp_phys_booter.c: sema_gl_mme_pack_carry (default 0) + _ms (default 100)
host-initiated windowless continuation carrier for a split MME pack;
MME-CARRY-ARM/FIRE/COMPLETE/CANCEL/ABORT receipts, beef-only, bounded.
- gsp_sema_service.c: sema_ddx_tracker_auth (default 0) ring-head decode
for the DDX channel when the USERD is missing/reset (guest-authored
C36F release applied verbatim); sema_gr_scan_top default raised to
0x300000000 for the 12 GiB campaign guest.
- gsp_sema_service.c: hoist the r707e VAS candidate verify out of
svc.chan_lock (its vfio_dma_rw path can sleep) and add in_atomic guards
to svc_read/svc_write; fixes the gsp-sema-svc "scheduling while atomic"
pump stall that lost the marked draw-window launch.
- tools: enable sema_ddx_tracker_auth=1 in params-r1624; use timeout -k in
the guest GL/GZDoom wrappers so a wedged GPU wait cannot hang a cycle.
Validation: c741/c743 boots (VTG author byte readback, cross-lane and beef
pack completion + REARM, DS-IMAGE census) and the c743 DS-FAST chain; A/B
for the carrier and the tracker decode is still open.
|
| |
|
|
| |
landed; draw macro executes, store pending)
|
| |
|
|
| |
landed; draw macro executes, store pending)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
draw-synth windows, preserve the last beef push, and default the DS stage-image A/B safe
- gsp_phys_booter.c: the synthesized SPH-BIND stage-block guard
double-counted the already-emitted raster words (101 > 96), silently
skipping j0/j2/j4/j5; pre=29 -> pre=84 and the DS stage VAs populate.
Add the SPH-BIND-STAGE-SKIP receipt.
- gsp_sema_service.c: sema_gl_win_rt0_admit (default 1) admits a beef
draw-synth window whose FIRST colour-target write is a usable
surface-class bind (RT0-FIRST-MISS witness); preserve the most recent
beef push (>=256 B) for the gsp-phys-last-push debugfs dump; skip the
non-RAM windows in the linear ring scan; fix the MME shadow-RAM index
shift to (mthd >> 2) & 0xfff.
- gsp_phys_booter.c: sema_gl_sph_vtg600 (default 0) and
sema_gl_sph_vtg_j1 (default 0) are the stage-image A/B: binding
family+0x600 poisons the DS (the engine-visible alias shadow there is
the client's SASS upload), so keep the historical +0x900 zero page
until a real VTG SPH is authored at an engine-visible VA.
- tools/guest-diag/params-r1624.txt: enable sema_gl_win_rt0_admit.
- wiki/Project-Status.md: 2026-11-15 status (MME chain completes and
executes DRAW_IAB; DS stage image is the named gate).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
auto-dropped 0x22c run (eng50)
The SPH-BIND prelude emitted '0x22c <- 0x800', which is on
win_drop_auto_match's drop list: the patch pass removed exactly 2 words, so
kept=29/31, on==nfin failed and the WHOLE prelude was discarded on every beef
window -> VSA/TCS/GS unbound -> DS latch a2040a04 (stage[1] fetch VA
0x01df0300) -> DRAW_IAB (mac=0x22) never rasterized. Fix: omit the
auto-dropped run from the synthesized prelude (knob-consistent) + a WIN-DROP
diagnostic. Built (srcversion 2D8F375AB343FC73EA26286); end-to-end validation
blocked in-window (c704-6: draw-synth RT-guard refusal + WEDGE-REARM rc=-110
before SPH-BIND was reached).
|
| |
|
|
|
|
|
|
|
| |
Follows the same any-channel rule as sema_mme_prelude_cap_any and emits
'sema-mme-xscan: ... hits=0' when a push yields no MME-family ops (scan
coverage evidence). c693: X-lane pushes (0x120010000/0x1200a0000/0x120010004)
show hits=0 - the indirect-mode X pushes carry no MME setup runs, so the
prelude feed has nothing; the MME setup runs likely ride the beef ring (whose
entries the walk skips as garbage in the read lottery).
|
| |
|
|
| |
prelude feed for the indirect replay chain; A/B pending)
|
| |
|
|
|
|
|
|
|
|
|
| |
(sema_mme_prelude_cap_any, default 0) (eng48)
The X DDX indirect lane (h=0x1000013) replays its 3D windows verbatim but
never builds the MME pack because svc_mme_prelude_capture rejects every
non-beef channel, so pl_n=0 and emit_prelude skips. c487 proved the X lane
emits a 2799-word pack when pl_n>0. New bool sema_mme_prelude_cap_any=1
bypasses the beef gate and feeds the same signature-deduped capture;
default 0 keeps legacy beef-only behaviour bit-for-bit. Validation pending.
|
| |
|
|
| |
alias for the post-REARM macro path; A/B pending)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
(sema_gl_mme_cb_alias, default 0) (eng45)
Macro 57 (LOAD_CONSTANT_BUFFER) reads the 0x7000-byte fixed CB at
seed-shadow +0x5000, but only the single seed page was mapped (the
pre-existing fixed-CB+0x4000 class), producing FAULT_PTE VIRT_READ at
0x0_015a5000 11 ms after the released calls (post-REARM). The alias maps a
contiguous 7-page region in the scratch PT pool (page 0 = CB image/MVP;
unservable tail = dummy zero page), wired into the scratch-0x18 and d19
seed paths, logged MME-CB-ALIAS. Safety-validated c654 (alias exercised,
0 MMU faults, 0 badf1201, 0 poison all boot); the beef macro chain was not
reproduced in-window, so end-to-end validation is pending.
|
| |
|
|
| |
keep the MME pack completion record + cursor across the beef owner channel re-register so the first post-recycle prelude launch is non-emitting and MME-PACK-REARM fires; A/B pending)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
an owner channel re-register (sema_gl_mme_keep_done_across_recycle, default 0)
c579: the first eng42-module completion (2799/2799) was followed 1.09 s later
by the beef owner re-register; the eng40 chan_ctx_reset treated the recycle
as a context loss, rewound the pack cursor and wiped pack_done_gen/ch, so
every later prelude launch re-emitted (pre_words_out > 0 -> the r1222 clause
correctly withheld the release) and MME-PACK-REARM could never fire.
The knob keeps pack_done_h/gen/ch and the cursor (pack_off/pack_sa/load
accounting) across the re-register so the first prelude launch on the
re-incarnated channel is non-emitting and the REARM clause releases the held
calls against the engine-resident program. The per-incarnation
latch/live/release state is still cleared, and every genuine context wipe
(WEDGE-RECOVER/CWD-CLEAR, park recovery, iram-gate failure, non-keep_gen
generation rewind, FLR via reload) clears the record on its own path.
Default 0 = legacy invalidate (validation pending).
|
| |
|
|
| |
globally (pack_done_gen/ch) so the post-completion call release fires for cross-lane completions (c552: part 1 on X, completion on beef -> pack_done_h withheld, REARM unreachable); restart the owner-less wedged cursor (poff==maxa && done_h==0) so a later window can re-emit the deterministic golden image (validation pending)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
context-reset invalidation (eng40, validation pending)
After the multi-part beef pack completes (2799/2799; keep_gen=1 works), the
prelude generation drifts and the pack branch refuses re-emission (poff==maxa),
so calls stay held forever (pcv=0, shadow draws 0, wrote=0). This adds:
(1) per-channel contiguous-load accounting + pack_done_h so the completion is
remembered for the loaded channel; (2) an MME-PACK-REARM call release when a
completed pack's channel launches again; (3) gsp_phys_gr_mme_chan_ctx_reset(h)
invalidation on context wipes/channel re-registers (the client recycles the
beef channel between pushes, c496), shown firing safely. Validation: the fix
was not yet observed completing on a green window with a same-incarnation draw;
committed for reproducibility per house style.
|
| |
|
|
| |
multi-part pack restarts on prelude-generation churn between parts; keep the packed cursor across churn when golden_force=1; A/B pending)
|
| |
|
|
| |
SET_REPORT_SEMAPHORE/SET_NOTIFY targets to the mapped module scratch slot (sema_gl_report_sem_scratch, default 1); add sema_gl_mme_pack_keep_gen (default 0) to keep the packed-part cursor across deterministic-image generation changes (eng39)
|
| |
|
|
| |
(macro-driven), push rescues land, draw-state push reaches the engine; MME multi-part completion is the wall; STATE-CURRENT snapshot
|
| |
|
|
| |
let partial MME pack parts keep their windows so the multi-part beef program can complete and promote live_gen; A/B pending)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
sema_gl_mme_partial_keep_window (default 0 = legacy) (eng36/eng37)
The load-only carrier gate turns every 3D window launch windowless while the
packed MME program generation is not latched+live. A launch that emits only a
PART of the packed program (block room exhausted) cannot make the program
resident, so dropping its window also discards the draw's state and defers the
completion to an unrelated later push, where it dies (GP_GET-frozen /
MISSING_MACRO_DATA) and the generation never promotes.
New knob sema_gl_mme_partial_keep_window (default 0 = legacy drop-everything):
when set, only a launch that emits the FINAL part of the pack stays a
windowless carrier; partial-part launches keep their window in the calls-held
shape so client state accumulates and the completing carrier can promote the
generation and let the next window run real calls.
|
| |
|
|
| |
targets RT0 - MRT_SELECT=0 in CLEAR_SURFACE 0x3c - while the window binds RT1; bind RT0 to the same surface so the clear has a target)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
window-0 shadow instead of leaving the QMD pointer at an unmapped guest VA (eng33)
The client's MME-expanded draw builds a QMD whose program page (qmd[48])
classifies CODESRC-SUSPECT (empty-page): the engine's GPCCLIENT_GCC I-fetch
then read the guest VA above every engine-PDB window, raised FAULT_PDE and
the FIFO parked for the rest of the boot (the TSG re-arm cannot revive a
parked PBDMA). c361-c368 receipts.
With gsp_phys_gr_codesrc_reloc=1 (default) the builder copies the page into
the window-0 shadow (empty sources only; PTE/module pages are never
republished), overlays the client's own known-good SPH+SASS stage image at
the original QMD program offset (gsp_sema_gl_prog_img, stage-typed from the
section bind; truncated at a 128-bit boundary with a terminal EXIT when the
image is larger than the remaining page), and the existing QMD w48/49 +
prefetch rewrite publishes the shadow VA. If the shadow mapping cannot be
installed the page stays unmapped and the existing refusal drops the launch,
so an unmapped QMD program pointer is never published. 0 restores the old
guest-VA behaviour for a one-flip A/B.
Validation (c373, params-r1624): 31 CODESRC-RELOC events (img_len=384,
off=0xb00, 0 truncations), 51 GR LAUNCH submitted, 11 MME-FAST end
events=3, 79 FETCH-WIT with GP_GET advancing engine-fetched, 0 FAULT_PDE,
0 vgsp-fault, 0 WEDGE-REARM/PARK-RECOVER; work_gr backend_ok=35 fault=0.
The draws still write nothing (NOWRITE, no clear run in the emitted
window), so px0 stays 0 - the store wall is unchanged and is the next
target.
|
| |
|
|
| |
for the beef state-push launches requires the shorter MME grace; 8000 showed no contact)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
them to the 3D replay lane, and let the forced golden MME overlay satisfy the prelude maturity gate (eng28)
The direct-GL client's draw-state pushes (476/624/728/324 B; invariant lead
90110087 = IMMD NVC597_INVALIDATE_SHADER_CACHES 0x21C<-0x1011) are
intermittently unreadable while byte-identical copies park in the LOW
framebuffer; the copies do not share the VA's in-page offset, so the
page-stepped rescue scan could never land on them. Add a word-granular
LOW-band sweep gated on the two recognisable push images (state lead via the
method-stream window gate; 256-B VTG SPH upload by exact signature) and pin
hits exactly like the existing rescue.
The same pushes carry the frame's real state (SET_COLOR_CLEAR_VALUE 0xD80,
NVC597_CLEAR_SURFACE 0x19D0, MME macro calls, vertex state) but no BEGIN/RT
opener, so they never opened a C597 section and the state stream never
reached the replay lane; admit the 0x21C lead as an opener on beef channels
and exempt state-led windows from the eng25 colour-target guard (the guard's
data-blob rejects continue unchanged - only the invariant state lead passes).
Where the client's 0x114 IRAM upload is not captured (code words stay <= 4
on every boot observed), the forced golden overlay (sema_gl_mme_golden +
_force; golden-only, fail-closed) can serve every called macro slot; add
gsp_phys_gr_golden_ready() and skip the IMMATURE-SKIP software completion
while it holds (see the golden-slot/pack machinery).
Live (c348/c350/c351, r1624 params): the LOW-band rescue fired (VTG SPH
256-B push -> fb 0x2010200, pinned); the 324-B state push opened a section,
captured (recs=4 nprog=1) and was marked for the verbatim 3D lane; with the
bypass the lane submitted it to the engine for the first time (GR LAUNCH
submitted + GUEST GR LAUNCH OK, MME-PRELUDE pack 1701 IR words, MME-GOLDEN
slot 0 accepted). The emitted 51-word window still omits the 0xD80/0x19D0
clear runs (marked window 81), so pixel stores remain 0 and frames black;
receipts under /tmp/opencode/eng28-*.
Refs: CONT.490.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
push (eng26 instrument)
One green cycle must answer 'which push carries the direct-GL draw'. The
census scans every non-engine push with the canonical op/cnt run grammar and
logs one bounded row per push containing any draw-family method id (BEGIN
0x1618, END 0x1614, VA_START 0xd74, DRAW_VERTEX_ARRAY 0xd78, index
0x17c8/0x17d8/0x17e0, draw list 0x1b0, vertex streams 0x1c00/0x1c10), with
the hit's word index inside its run so a run that merely NUMERICALLY spans a
method address is distinguishable from a real method data word. Beef pushes
without hits are enumerated once per (va,len) so the cycle yields a full push
inventory. Module param sema_draw_census (default 0), 256 hit + 256 push rows,
read-only.
Live result (c346): full beef push inventory captured; every marker 'hit' is
a k>0 lattice artifact of a data blob (e.g. the 59580-B push's single m=0 run
at off=0x78 covers 0x1b0..0x1c10 at fixed word indices, and its BEGIN-address
word value changes between reads - 0x00058202 then 0x01047220), i.e. no push
carries a real draw method stream. Companion to a4215afa; docs in CONT.487.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
unusable (eng25 correctness guard)
The direct-GL lane's draw-synth captures join the verbatim 3D replay lane by
numerical run-cover alone, so a non-method data blob whose INC run merely
spans the C597 RT block is replayed as state: its last A/B/W/H write per
colour target is an unmapped 40-bit VA (c344: RT1 -> 0xff000480a0) and the
engine retires with no stores (NOWRITE wrote=0). Gate the beef 'd' admission
(single-block and chunk-split) on svc_gl_window_rt_valid(): walk the window
with the run grammar, keep the last A/B/W/H write per colour target, and
require at least one usable bind (A[7:0]<=1, B<2^30 aligned, 1<=W,H<=0x4000).
Validated live (c346, mdev 53dc06b5, ENG26 instrument cycle): 23 bounded
'3D mark rejected (beef draw-synth: no valid last colour-target bind)' rows,
including the 14865-word 59580-B blob window @off=0x78 and the 542-word
0x4010ed0 twin; the one timing-variant window that does carry a usable RT
bind still passed and replayed (wrote=0), and the X lane is unregressed
(15x '3D stream marked h=0x1000013' + 'GUEST GR LAUNCH OK' ok=16/17).
Refs: CONT.486/487; eng25/eng26 evidence under /tmp/opencode/eng26-*.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
lane; beef rel_mod launches may take the ch_rel release branch (eng24)
Clause 1 (gsp_sema_service.c, svc_gl_flush): the direct-GL (beef-family)
section captures opened by the eng23 inside-run openers carry synthesized
PROG/PARAM/REL (src=draw-synth) but a REAL method window; include 'd' in
the stream-3d marking (single 448-word block and the method-aligned chunk
split) so the window replays verbatim on the engine like the X/stream/hold
lanes, instead of waiting on a synthesized compute-QMD release the engine
never writes. Verified live: '3D stream chunked h=0xbeef0100 push=0x4250110
window=779 words -> 3 chunk(s)' and 'GR LAUNCH submitted h=0xbeef0100 ...
polling qmd_rel=0'.
Clause 2 (gsp_phys_booter.c, gsp_phys_backend_guest_gr_submit): a
beef-family launch whose QMD release0 was redirected to the module
semaphore with the rel_mod sentinel (0x600df00d) may break its poll on the
channel release alone (the X lane's proven branch) once the engine has
retired the method block; witnessed by 'GR LAUNCH OK ch_rel branch (beef
rel_mod; ...)'. Verified live: 4+ beef launches now complete (engine fetch
OK, GUEST GR LAUNCH OK ok=22..25) where the c338 shape timed out
(qmd_rel=0xc0ffee01 want=0x600df00d).
Known residual (unchanged by this commit): the replayed beef windows retire
without stores (NOWRITE-CONFIRMED/AMBIGUOUS, wrote=0 -> px0=0), the same
engine-store wall the X lane shows; and with the default
sema_mme_immature_skip=1 the service soft-completes replayed beef windows
before any engine contact (A/B with the knob at 0 was used to put the real
window on the engine).
|
| |
|
|
| |
direct-GL draw-section capture path)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
channel (eng23, mechanism validated)
The direct-GL (GZDoom/glx) channel family 0xbeef01xx never opened a C597
section because its class bind is channel-side: the client allocates
TURING_A (0xc597) with hParent = its own channel (measured: alloc 0xc597
h=0xbeef9097 parent=0xbeef0100 client=0xc1d00013) and never re-emits a
SET_OBJECT push, so the section recognizer's sticky-attachment gate
(svc_gl_att_accept_run) dropped every push. The X lane binds inline in
its init push and was unaffected.
- gsp_rm_emulation.c: report the 0xc597 allocation's hParent to the sema
service (gsp_sema_service_gl_attach), which applies it as the sticky 3D
attach on its own thread (pending-slot queue; no cross-thread writes to
the attachment tables).
- gsp_sema_service.[ch]: the queue + drain (svc_thread pass), and accept
the inside-run opener shapes on attached channels: the direct-GL client
emits NVC597_BEGIN (0x1618) and the RT-setup family (0x840) as methods
INSIDE multi-method INC runs (measured: run addr=0x80c count=256 covers
0x840..0xc0c; census decoded method=0x1618 op=1 from a run payload),
not as the one-word IMMD form the X lane emits.
- Also carries the eng22-rescue scan-cap widening (0x4000000 -> full 2 GiB
shadow; observed live: "no content-gated window in 0x80000000 shadow").
Validated live (c335/c337/c338, receipts /tmp/opencode/eng23-receipts-c331.txt):
- RM-record attach fires and applies for 0xbeef0100 (c335 12:49:04, c338).
- sections now open (c337) and capture (c338) on 0xbeef0100 incl. the
59556-B setup push and the 6400-B draw push (src=draw-synth).
- first GR LAUNCH submitted for 0xbeef0100 (c338 13:01:58) - fails at the
physical QMD release (qmd_rel=0xc0ffee01 want=0x600df00d); new frontier.
- px0 still 00000000; mission not launched.
A/B control: the same X-lane lottery behaviour was reproduced with the
pre-change module (c333), so no X-lane regression is attributable here.
|
| |
|
|
| |
FB-shadow push rescue at insmod)
|
| |
|
|
| |
sections execute, push bodies decode above 10 GiB; remaining wall = direct-GL payload delivery (setup push recycled; draws 0x4250000)
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
end-to-end validation pending)
The direct-GL client's one-shot 59,556 B setup push (VA 0x4001004) reads
zero at decode time: the live page is recycled before our decode runs, so
no C597 bind attaches for h=0xbeef0100. The rescue recovers the push body
from the FB shadow with strict content gates: reject fill windows (require
>=2 multi-word INC runs + >=8 distinct headers), scan at the push VA's
in-page offset (0x4041004 starts 4 B into a page), and log the channel
handle. eng20 refuted the unregistered-VAS hypothesis: the payload pages
DO walk via VAS 0xbeef0300 (0x4000000->pa=0x342ead000,
0x4001000->pa=0x342eae000, consistent delta). Also found: sema_gl_xlate
(absent from params-r1780; default 0) gates every C597 section-recognition
site - with it on, the lane produced its first C597 captures
(127x c305, 20x c307). Validation cyclic c308 (guest init panic) / c309
(QGA wedge) blocked; no observation yet. Unvalidated end to end.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(svc_pa_max/svc_push_pa_ceiling)
The direct-GL client parks its VAS page directory and push pages in the 4-14
GiB high RAM band while the runtime bound stopped at 10 GiB (param/compile),
so svc_ap_ok rejected every walk read above 10 GiB before vfio_dma_rw could
answer: the client ring walk reported 'L0 read fail' / 'walk rc=-2' on the
one boot the RAM content scan latched the real ring (c296), and the push
bodies stayed unreadable (src=3 window garbage / src=255). svc_pa_max() now
never shrinks below the registered guest-RAM top (sanity-clamped to the scan
max), and svc_push_pa_ceiling() floors on the same live bound. c297 (first
boot with the fix): 'RING-VAS h=0xbeef0100 gpfifo=0x4020000 mapped by VAS
0xbeef0300 (pdb=0x110aae000) -> pa=0x23771f000' and pushdec 'src=4
plausible=1' with the read ceiling witness ceil=0x380000000.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(entry0==entry1 gate)
The GL client ring content scan admitted the lookalike page measured at
pa 0x10a828000 / 0x10ad3e000 (dword 0x04000100 repeating) whose entry0 and
entry1 decode identically (va=0x4000100 len=262144) and which passed every
window/terminus gate. The pump then read a phantom 256 KiB push at VA
0x4000100 forever (sema-rdw rc=-2, sema-entry: unread, unregistered
submissions=0; c271/c285), poisoning the client-VAS verify chain. A real
ring does not repeat one entry verbatim in slots 0/1.
Partial validation: c288 (fixed module) resolved the REAL ring pair via the
VAS (pa=0x235f7c000, entry0 va=0x4000000 len=2236) and decoded real client
pushes (submissions=15, CB-DIAG match=67). End-to-end pixel validation
(gl_frames px0 != 0) is still pending; c286/c287 did not exercise the scan
(no channel created).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
predicate; add sema_gl_cwd_clear (A/B knob)
FALSIFIED NOTE (eng16, c271/c272): the eng15 lead that the always-fire
CWD-clear rode on the 0x40706c sentinel and caused the zero-store wall is
FALSIFIED. A/B on the same launch shapes (h=0x1000013 push=0x1200107e4
words=50 / push=0x1200106bc words=53):
- c260 (old code, clear fires 7x/boot on the sentinel): wrote=0.
- c272 (clear fully off, sema_gl_cwd_clear=0): wrote=0 both launches,
pbfetch=block end, intr0=0 - identical to c260.
- c271 (predicate fixed, knob on): 0 CWD-CLEAR all boot (the sentinel no
longer arms it; esr=80000000 / grfifo pending counts are clean).
The change still lands because the old predicate was a bug either way:
0x40706c reads 0xbadf5040 always (read-only hardware sentinel; eng15
write test 0x0 -> 0xbadf5040), so every stream3d launch ran a TSG
preempt/resched + MME latch wipe before a noQMD replay that never
re-loads context - an unjustified per-launch context reset.
The zero-store wall is unchanged and now localized: the stream3d lane
only replays X DDX setup-only windows (c272 decode: INC6@0x840
SET_COLOR_TARGET_A(1) VA=0x0c000000 1920x1080 X8R8G8B8, INVALIDATE_*,
INC5@0x180 LINE_LENGTH_IN/OFFSET_OUT - no BEGIN 0x1618 / no draw 0xd74 /
no CALL run), while the pbuffer client's own push entry (0xbeef0100
va=0x4000100 len=262144) is unreadable host-side (rc=-2, channel
unregistered, submissions=0) - so no draw reaches any lane.
|