summaryrefslogtreecommitdiffstats
path: root/kernel/gsp_phys_booter.c
Commit message (Collapse)AuthorAge
* vgsp-gr: bind the beef GL draw to the captured 900-page screen surface, not ↵Arthur Hanson Rasmusson9 hours
| | | | | | | | | | | | | | | | | | | | | | | a cross-VAS 10-page operand buffer The PS SPH has MRT_ENABLE=0 (writes RT0); the beef window binds no colour target of its own, so the last trusted 0x800..0xbff run (the X screen surface 0x120400000, 1280x720, 900 pages) is the render target. Its pages were resolved through the global VA-keyed pin/ledger, which conflated clients: the beef client's own injected pin for VA 0x120400000 (a SYS staging/operand buffer holding SASS/method words) shadowed the X server's surface VAS and cut the set at 10 pages. Capture the surface's source VAS and resolve its pages through that VAS in the fill, bypassing the pin override for this page set. Re-patch the SURF prelude when the launch's rec base differs from the cached one, and copy the emitted SURF run's target/geometry into the RT0 run so RT0 == RT1 every launch (was hardcoded to the 0xa relocation half). r1483: the beef retirement is now 0/900 pages of the visible surface (was 0/10), RT0-BIND target=0xa000000, data[0] va=0x120400000 pa=0x100000, n_data =900, 6 launches, poison=0. The engine still stores nothing: GR-STATE sph is zero at retire and the launch traps at method 0x1528, so the next wall is making the pipeline program bind visible to the DS, not the RT VA.
* vgsp-gr: deliver the real GL shader images and the client fixed constant ↵Arthur Hanson Rasmusson9 hours
| | | | | | | | | | | | | | | | | | | | | | | | | buffer to the engine-visible pages - inline-apply writes the image into the guest HPA whenever the page is kept at the guest VA (code_keep_guest), not only for stream3d windows; a shadow copy is useless when the engine fetches the guest page (r1470: guest=0 VS then lost to the window-0 shadow copy). - the standalone 0x180/0x1b0 context-init upload pair (outside any C597 section) is also recorded in the GRCE destination ring, so a later draw window can find the client's real VTG image at its bind VA. - sema_gl_cb_copy_to / sema_gl_cb_src_va: copy the client fixed-CB page into the forced, mapped MME seed page before the launch, so the vertex shader reads the client's transform constants instead of screen/stale data. Falls back to a synthetic identity MVP when the client VA cannot be walked. - cache any push chunk whose first word is a real SPH (020a0481 VTG / 000a1482 PS) and use it as the program-record fallback when the window's own bind-VA upload was never captured (the init push's continuation chunks are otherwise judged implausible and never reach the ring). - r1481/r1482: the real VS SPH+code and PS are applied guest=1 at the bind VA, the client CB page resolves and is copied, poison=0 over 9-10 launches; render-target writes still zero - the remaining wall is the draw's render-target/colour-target binding (the beef window's output retirement set is 10 pages of shader-like data, not the 900-page screen surface).
* vgsp-gr: sema_gl_pair_orphan_drop (default 1) - drop orphan END runs (method ↵Arthur Hanson Rasmusson22 hours
| | | | 0x1614) when the pair model is closed and restore pair_open/open_split from the launch-entry snapshot when a window is dropped/held, so dropped windows are pair-state no-ops; fixes the EC0x0d 0x1614/0x2098 poison that follows a held/dropped BEGIN
* vgsp-gr: authoritative viewport/RT closure - sema_gl_vp_prelude modes 5/6 ↵Arthur Hanson Rasmusson22 hours
| | | | use live slot 33 (CALL 0x3908) / raw driver words with scaleY=+360, clip 0x0c00/0x0c04 and 0x193c=0x21800 (ZERO_ONE|FRUSTUM_XYZ); sema_gl_rt0_bind binds SET_COLOR_TARGET(0)=0x800 plus SET_CT_SELECT count=2 (the PS has MRT_ENABLE=0 and writes RT0 while the client binds only RT1); both preludes gated to windows with a CALL run so Xorg 2D windows are untouched; r1465: CALL(33) executes (mac=0x21) on the beef window, RT0 bound, DRAW blocked by the 0x1614 pair poison
* vgsp-gr: sema_gl_vp_prelude_pos - insert the synthesized viewport before the ↵Arthur Hanson Rasmusson23 hours
| | | | first CALL run (default 1) so the 0x2080 SET_PIPELINE bind lands first, or before the first 0x3910 (pos 2); mode 4 = clip rect with the verified (size<<16)|origin pixel encoding; r1462: 3 DRAWs executed with pos=1 VP and still zero RT stores
* vgsp-gr: sema_gl_vp_prelude - synthesize the missing Turing viewport ↵Arthur Hanson Rasmusson24 hours
| | | | scale/offset (mode 1) plus optional pixel-centre/clip-control (2) and clip-rect (3) at the head of replayed 3D windows; the client push never writes the viewport family; default 0 = legacy bytes; r1459: FE accepts the words, draws still store nothing -> insertion position vs pipeline-group binding is the next variable
* vgsp-diag: whole-vidmem page-hash bracket - sema_gl_vidmem_bracket hashes ↵Arthur Hanson Rasmusson25 hours
| | | | every 4KB page of the BAR1 shadow before the GR publish and diffs after the output-retirement wait, reporting any changed page outside the sampled output set; vidmem_hash_snap/vidmem_hash_diff manual module params; default 0 is a strict no-op
* vgsp-mme: pair_chain cross-launch state - persist pair_open/open_split ↵Arthur Hanson Rasmusson27 hours
| | | | across windows + entry snapshot; PAIR-CHAIN-ENTRY-ELIDE post-branch compaction (drop [0x2054,0x2158] runs on windows that enter with a pair already open, gated pair_chain && entry_open && pairs_gen!=0) fixing the r1453b #11 0x2058/BEGIN_END_ACTIVE leak; resets at both wipe sites; 0=legacy
* vgsp-mme: sema_gl_pair_chain (default 1) - EC0x0d = BEGIN_END_ACTIVE decode: ↵Arthur Hanson Rasmusson28 hours
| | | | drain (WAIT_FOR_IDLE<-0) before each following normal/normal BEGIN so each END closes exactly one pair; held-call branch pair elision gated on pairs_gen==pl_gen; per-launch/context-wipe resets; guest BEGIN data carried verbatim (no normalisation site exists); 0=legacy bytes
* vgsp-mme: log-only non-blind d24/d25 capture - print shadow[c597] ↵Arthur Hanson Rasmusson28 hours
| | | | 0x3490/0x3494/0xd24/0xd25 via gsp_phys_mme_shadow_read (8/boot cap, zero behavior change) so sema_mme_state_d24/d25 can be seeded from the engine's own state instead of blind values
* vgsp-gr: sema_gl_attr_sph_drop (default 1) - drop the attr-prelude ↵Arthur Hanson Rasmusson31 hours
| | | | SET_PIPELINE(2) runs (method 0x2080; the guest's cold 0x20 word is refused EC4 by the FE on a windowless LOAD-ONLY carrier); exact mask (op in {1,3,5}, cnt!=0, (hdr&0xfff)<<2==0x2080), once-per-gen log + counter, 0=legacy; SPH-BIND log caps 16->64
* vgsp-mme: sema_gl_mme_sph_bind_binding (default 0) - drop the synthesized ↵Arthur Hanson Rasmusson32 hours
| | | | BINDING(2)/(5)=0 data writes from the SPH-BIND emission (the FE rejects the 0x2090 word with Class Error EC4 when walking the window; the real client never emits 0x2090), keep the REG_COUNT(2)/(5)=0x1a runs; size guard 19->17 when dropped; 1 = legacy bytes
* vgsp-mme: golden-only completion + mme-audit tool - accept golden slot 0 ↵Arthur Hanson Rasmusson33 hours
| | | | (entry=0 valid) + sema_gl_mme_golden_only=1 force-blanks non-golden called slots (stub/drop their CALL runs), overlay logs inspected/blank/maxa; tools/mme-audit: stdlib overlay-sim + booter-grammar walk + operand map + cross-boot table (decodes the r1448 slot-57 stall: IR 899-900 emits PIPELINE_BINDING(2) @0x2090 rejected only when the program-address pairs are carried)
* vgsp-mme: CONT-118 hold_window + strict_grace - sema_gl_mme_hold_window=1 ↵Arthur Hanson Rasmusson34 hours
| | | | moves the window drop to the one arming launch/gen (MME-WINDOW-HOLD) so the release launch carries calls+window together (the only 22x-clean r1443b shape; poison fires while the MME validates the loaded program on the first post-pack window launch); sema_gl_mme_strict_grace=8 fails the strict release's FE-idle term open (gsp_phys_gr_fe_idle is inert: ==1 exact vs real 0x0e0e0001-class); resets mirror CONT-118; 0=legacy
* vgsp-mme: CONT-118 strict release + FE-busy deferral - ↵Arthur Hanson Rasmusson35 hours
| | | | sema_gl_mme_hold_strict (calls release only when pre_words_out==0 && fe_idle() && live_gen==pl_gen) and sema_gl_mme_fe_defer (busy-defer the load-only carrier at svc_gr_request before fill/consume, bounded 4 consecutive defers/gen with GIVEUP log) - both default 1, independent live A/B, 0 = legacy-equivalent
* vgsp-mme: CONT-118 one-launch-delay settle hold (sema_gl_mme_hold_settle, ↵Arthur Hanson Rasmusson44 hours
| | | | default 1) - calls run only after the carrier executed AND settled, fixing the first-carrier pc=513/word-1539 part-2 pre-residency poison; resets in iram_gate_fail/WEDGE/PARK-RECOVER; seed-log caps 16->64; +60 net
* vgsp-sph: d24/d25 seed extension - capture 0x3490/0x3494 (scratch24/25) + ↵Arthur Hanson Rasmusson2 days
| | | | params sema_mme_state_d24/d25 + fail-closed seed emissions after d19 (param>captured>skip, 3d-reloc) - the d28-forced slow path reads the 0x349x states after d19; +235/-1
* vgsp-sph: C4 - capture scratch 0x19 (CB selector, mthd 0x3464) + seed STATE ↵Arthur Hanson Rasmusson2 days
| | | | 0xD19 emission (param sema_mme_state_d19 > captured, 3d-reloc, fail-closed) - the d28-forced slow path reads an unseeded d19 and faults the consumer at VA 0 (HUBCLIENT_PD); +129/-1
* vgsp-sph: emit j=2/j=5 REGISTER_COUNT/BINDING records in the SPH-bind ↵Arthur Hanson Rasmusson2 days
| | | | prelude (guard 13u->19u, headers 0x20020823/0x20020853, values 0x1a/0x0) - supplies the per-stage validation input the DS checks on the synthesized stage slots (a2040x00/SPH9 wall); constants shaped from the captured j=1 record, fail-closed (no relocation)
* vgsp-gr: CONT-114 golden MME slot overlay (sema_gl_mme_golden) - the capture ↵Arthur Hanson Rasmusson3 days
| | | | lottery loses on partial boots (13/55 slots; r1405/6/10/11/12) and the called DRAW_IAB slot 34 gets keep-clamped+call-dropped, so no draw ever executes; this overlay serves called-but-uncaptured SA slots from the driver's own generated macro code (word-exact vs a live full capture: 34=0x265/75w, 39=0x29f/69w, 40=0x2b6/69w, 48=0x337/21w, 51=0x350/12w, 57=0x364/189w) via an untracked .gitignore'd build input kernel/golden-mme-tu104.h: slot_kept/slot_stubbed consult it, the window scan counts golden slots as covered (no stub pair, calls survive), and the pack builder overlays the golden words+SA pairs into ir_pack after the capture fill (mode 1 = uncovered only, force=2 = overwrite all); golden-filled slots are byte-shape-identical to captured ones (0x11c pairs + one 0x114 ONEINC chunk) so the IRAM gate and downstream consumers are unchanged
* vgsp: CONT-113 - clamp keep_mask to capture-covered slots (r1405 poison root ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | cause) The r1405 priv-error wedge traced live: the draw window calls CALL_MME_MACRO(34)/(57) while the MME capture holds 13 SA slots (0..12, IR <= 0xe9); keep_mask=~0 exempted every slot from stubbing, so those calls ran, the MME fetched an instruction the packed program does not hold (info=badf1201 pc_valid=1 pc=513 mac=0x1f1 miss=1 ir=badf1201) and poisoned the lane; the second recovery's hard re-arm left the engine unresponsive (probe rc=-110, GP_GET frozen). Fix (one variable): gsp_phys_gr_slot_kept() - a keep_mask slot is only honored when the capture covers it (SA entry present AND its IR instruction entered the replay); otherwise the proven r1186 safe combination applies: SA stub + CALL-run drop, never a fetch of non-resident code. The decision reads the live SA table per window, so a later capture generation that covers the slot releases it automatically. Bounded MME-KEEP-CLAMP witness. Knob sema_gl_mme_keep_clamp (default 1; 0 = r1405 all-real A/B).
* vgsp: CONT-112 - changed-page copy-out witness budget + MME IR-word A/B ↵Arthur Hanson Rasmusson3 days
| | | | patch knob (sema_gl_mme_irpatch_off/_val)
* vgsp: CONT-111 - sema_gl_wit_shown (uint default 4) replaces hardcoded ↵Arthur Hanson Rasmusson4 days
| | | | 4-page GUEST-WIT shown budget ('if (shown < gsp_phys_gr_wit_shown)') so a store-rich launch dumps the full changed va/pa list; recipes carry 1024 - TASK 1 ANSWERED (surface): xwd/window path reads the RT va=0x120400000 pitch 5120 (proof via server GetImage ops sema-op2d h=0x1000013 dst=0x120350000 src=0x120658000 spitch=5120 so=1/480 => src base 0x120658000-480*5120=0x120400000); FIRST ENGINE-CHANGED RT PAGES of the campaign r1385: output retirement wait 2/900 pages changed (settled) + bounce copy-out 2 pages written back 2 changed by engine + OUT-ALIAS-WIT va=0x120705000 partner_va=0x120700000; but FB shadow at those pages reads same uniform weave invisible; GATE1 BLACK+STATIC: xwd root nz 0, shim frames=217 mean=0.0283 diff 0, FB shadow static while glxgears 445 FPS (8MB diff over 10s, md5 e85173d8 identical 5/5) - new /proc/kcore reader kcoredump.py/kscan*.py (region nv_vgpu_bar_init+0x15a SVC_VIDMEM base 0x120200000); HAZARD recorded: 64KB host probes into unverified regions panicked guest kernel (anon_vma), regions restored, SINGLE-PAGE PROBES ONLY - next: give changed pages priority in copy-out witness (OUT-PAGE-WIT with own budget; 12-line budget exhausted by OUT-UNCH flood so va->hpa of engine-changed pages never printed); then diff FB shadow via kcore reader across that copy-out to capture the engine's exact pixels; if weave then DRAW (0xd78) still isn't rasterizing and A/B moves to an IR-word patch knob on slot34's emitted BEGIN/SET_VERTEX_ARRAY_START/DRAW_VERTEX_ARRAY/END - SESSION 153 r1382-r1385
* vgsp: CONT-109 - FOUR FIXES: (1) WEDGE-RECOVER now rewinds pack_off/pack_sa ↵Arthur Hanson Rasmusson4 days
| | | | + invalidates live_gen (r1377 deadlock: recovery reset pre_emit_off=0 but left pack_off at end -> split emitter can=0->packed=1 zero words -> MME-PRELUDE part gen=3 off=0 words=0/3083 forever, latch never re-set, MME never started); (2) PARK-RECOVER same rewinds; (3) gsp_phys_gr_fetch_miss_log promotes live_gen on GP_GET advance (readback-free promotion on timeout path; r1377 lost it FETCH-WIT timeout engine-fetched then pending_gen cleared); (4) gsp_phys_mme_fast_sample latches poisoned when sample's FIRST read is poison (r1378 MME-FAST begin esr=badf1201 ds=badf1201 grfifo=badf1201 -> esr badf1201->80000000 was missed; stale latch+live then ran macro 57 on wiped context sked mme_esr=80000004 mme_mac=0x39, FE parked pc=513 mac=0xf1 mmegen=1) - PROGRESS (not gate claim): r1378 MME-FAST launch macro-status=000393a2(mpc=930 mac=0x39 run=0) MACRO 57 EXECUTED TO ITS LAST INSTRUCTION; STORES GREW 9/909 -> 238/906 -> 305/903 (r1378); r1379 clean boot (0x mme_esr=80000004, no WEDGE-RECOVER) float-vertex stores 4/906 50/970; guest 5447 frames in 12.1s = 448.994 FPS (fence-level only not pixels); GATE1 BLACK both boots: r1378/r1379 xwd 1280x720 nonblack 0 max 0; r1379 staging page-note va=0x4500000 pa=0x1035f1000 has 2517 nonzero bytes but content is a DESCRIPTOR TABLE (28cd1000 00000001 68cd1000 ffff8a74) not pixels; every retire 0/903 - A/B bisect inconclusive (flipped live but no new beef launches, client moved to software release; needs insmod arming) - next: arm wedge bisect at insmod on fresh boot (sema_gl_mme_keep_mask=0 sema_gl_mme_nop_drop=0xffffffffffffffff before client launches): clean => executed macros' emitted methods (0x2390/0x34a4 CB writes) park FE; still poisons => win_drop non-call families (SURF-PRELUDE/SHADER-EXC 0x1528/SPH-REGION/SA-REARM); then output retirement must move off 0/N before sema_screen_blit (src=drawable GPA dst_off=0x200000 pitch 5120) can present - SESSION 153 r1378-r1379
* vgsp: CONT-108 - sema_gl_mme_iram_gate_break (default 0) + ↵Arthur Hanson Rasmusson4 days
| | | | sema_gl_mme_iram_gate_build (default 1) independently control the two gsp_phys_gr_mme_iram_gate() readback sites (poll-break ~28019, pre-doorbell builder ~20300; comment records r1374 healthy->FULL chronology + CONT-107 probe-park note) - TASK-1 SUPERSEDED: 'LOAD0 stall at slot 58' EXPLAINED+DISMISSED: no call to slot 58 exists (all 8 3D-raw windows CALL_MME_MACRO runs hit only lanes {0,2,34,39,40,48,51,57}; 0x39d0 CALL_MME_MACRO(58) ZERO times; SA complete MME-PRE-SA[57] entry=0x364 / [58] entry=0x3a3); word-exact: slot 57 = mmeCodeOGL_C597_LOAD_CONSTANT_BUFFER_BUG2548370 (63 instrs 0x364..0x3a2), slot 58 = mmeCodeOGL_C597_LOAD_CONSTANT_BUFFER_OFFSET (2 instrs 0x3a3..0x3a4); Mesa sim: slot-57 with real params ends after last instr 5/5 consumed -> next fetch 0x364+63=0x3a3 = observed pc = POST-COMPLETION FETCH POINTER not stalled LOAD0; INFO_EX=0x4 = DATA_FIFO_SIZE constant not exception; A/B VERDICT r1376 break=0 build=1 still wedges at first calls-bearing launch; r1377 BOTH SITES OFF still wedges but RECOVERS (WEDGE-RECOVER priv-error poison seen grfifo=0x1 self-cleared) -> debug-port readback NOT the wedge cause, wedge is IN THE FIRST WINDOW REPLAY ITSELF; FIRST NONZERO STORES r1377 output retirement wait 2/901 pages changed 214ms settled + GUEST-WIT retire 4/908 changed va=0x4500000 pa=0x5ac146000 pre=0x3fb2ca25c057d17b post=0x0 engine-authored writes; MME executed r1376 pc=931 ir=71cc0301,18c0034a,1c34238f; r1377 never started (pc_valid=0, gate off => no live promotion); GATE1 black - next: bisect wedge-causing window content at first window+live launch (r1377 config no readbacks): A/B keep_mask=0 nop_drop=all (ALL call runs dropped) vs default; wedge gone => executed macros' emitted methods (0x2390/0x34a4 CB writes) park FE; persists => non-call families (SURF-PRELUDE/SHADER-EXC 0x1528/SPH-REGION/SA-REARM) then bisect win_drop families; follow-up readback-free live-promotion trigger (MME pc!=0 witness) - SESSION 153 r1375-r1377
* vgsp: CONT-107 - IRAM READBACK GATE THAT FIXES THE ZERO-IR FETCH: ↵Arthur Hanson Rasmusson4 days
| | | | gsp_phys_mme_iram_read3() spec-correct MME debug read per NV_PGRAPH_PRI_MME_DEBUG (ENABLE bit1 -> PC|RD-trigger bit2 -> poll DONE -> data in HWW_ESR_INFO4/3/2); gsp_phys_gr_mme_iram_gate() reads every covered SA entry compares to packed image auto-calibrates port address unit (resolved INSTRUCTION not word); gate at poll-break (before live-gen promotion) + builder (before releasing calls); on fail: hold calls clear prelude latch rewind pack/drain cursors; MME-LOAD-ONLY carriers (window elided while unverified so 0x114/0x118 IRAM load cannot be interrupted by window's DS/SPH poison); knobs sema_gl_mme_iram_gate/_max/_probe sema_gl_mme_hold_fe_idle - MILESTONE r1374: MME-IRAM-BASE resolved=instruction (entry) at entry=0x5; MME-IRAM-GATE pass break h=0xbeef0100 gen=3 base=1 checked=54 + pass build run=1,2,3; MME-LOAD-ONLY carrier window dropped until gate verifies; ILLEGAL_OPCODE = 0 OCCURRENCES (was every prior boot); live readback 4044d0=0x01B20006 (IRAM_PC=0x364) -> 0x40449c=31c28300 0x4044a8=1a05834a 0x4044ac=00000003 EXACTLY THE GOLDEN MACRO-57 GROUP; MME fetch latch mme_esr_info=100003a3(pcv=1 pc=931) ir=71cc0301,18c0034a,1c34238f MATCHING reconstructed image at 931; new wall: calls released yet beef launches park grfifo=07071602 (FIFO not-empty+FULL count 22) MME at pc=931 (slot 58 entry ENDNEXT waiting on LOAD0 INFO_EX=4); GATE1 black 0/900 - next: explain LOAD0 stall at slot 58 entry 0x3a3 (decode full released window call runs win_dec.py on MME-WINRUN dump: is slot 58 genuinely called or macro 57 falls through predicated ENDNEXT 0x3a0/0x3a1 not taken); if fall-through snapshot/seed MME STATE predicate reads; if real call feed params or stub slot 58 to proven stub PC; r1374 first boot where full program runs this deep - SESSION 153 r1369-r1374
* vgsp: CONT-106 - IR-word register FIX: every past info2_ir= read ↵Arthur Hanson Rasmusson4 days
| | | | 0x404498=NV_PGRAPH_PRI_MME_CONFIG, real INFO2/3/4 = 0x40449c/0x4044a8/0x4044ac (tu104 dev_graphics_nobundle.h), fixed in gsp_phys_mme_fast_sample/mme_regs_log/fault_regs_log/gr_state_rb_log/sked sample[17]/reg-probe; MME-FAST budget 48->256 launches; sema_mme_post_ms post-timeout re-spin (2000/12000/20000); DS-FAST per-stage SPH/region snapshot at DS latch transition + DS-FAST2 report-mask clear 0x405844/c; MME_STATUS_MACRO 0x4044b4 - DECISIVE: at trap PC 0x364 (macro 57 entry) MME fetched IR words are ZERO (MME-FAST info=10000364 pc_valid=1 pc=868 mac=0x0 ir=00000000,00000000,00000000; MME-REGS timeout esr=80000000 pc=868 ir zeros) NOT the golden group 0x00000003,0x1a05834a,0x31c28300 - host-sided pack verified verbatim CONT-105; IRAM debug port 0x4044d0 also reads zero at 0x364 while r1364 same port read golden first words at PC=0 (port real); DS-FAST first-sight: ds a2040a00->badf1201 poison floods whole PRI incl macro-status=badf1201(mpc=513 run=1), clears ~1ms later; SPH bind falsified as DS wall (bind=0 r1364/65/68 poison SPH10+18 a2040800/a2040a00 M_PIPE_STAGE=VSA|PS vs bind=1 r1363 same); trap timing r1367: ILLEGAL_OPCODE relayed +14.0s after GR LAUNCH FAILED timeout 1500ms yet GUEST GR LAUNCH OK elapsed_ms=35870 ok=7 block completes gr_swrel=0 engine-authored release; GATE1 black 0/901 - next: after each prelude pack read back IRAM via 0x4044d0 (IRAM_PC<<15|RD=2 data in INFO4/3/2) and re-emit/gate pack until IRAM reads back golden words at slot entries (prime suspect: 0x114 pack writes issued while PRI block poisoned, capturable at every DS fault); once fetch at 0x364 returns golden words ILLEGAL_OPCODE vanishes and macro 57 completes - SESSION 153 r1364-r1368
* vgsp: CONT-105 - sema_gl_mme_state_seed + sema_mme_state_d26..d2a (emit [IMM ↵Arthur Hanson Rasmusson4 days
| | | | m=0x3498] 0xD26 .. [0x34a8] 0xD2A ahead of every replayed 3D window; exact method<->state mapping verified gf100mme.h RM_MME_FIRST_USABLE_SHADOW_SCRATCH=8 -> 0x1E/0x1F/0x20/0x21/0x22+8) + sema_gl_mme_pack_split (default 1; pack drains SA-once + whole-instruction 0x114 ONEINC IR chunks across launches, generation-keyed cursor reset alongside drain cursor, latch only on final chunk) - BOTH CONT-104 NEXT FIXES FALSIFIED AS WALL: r1362 state seed d26..d2a=00000000/80000000 still ESR 0x404490=0x80000004; r1363 pack split works mechanically (pack-part ir_words=1332/2799 sa=54 split=1 -> pack ir_words=2799 runs=55) wall unchanged; OFFLINE PROOF r1363: 55x 0x114 runs sum 2799 == image words zero overlaps pack==verbatim for every slot, live macro 57 body = golden 189/189 words - THE IR IMAGE IS COMPLETE AND CORRECT; NEW CHRONOLOGY r1363: GR LAUNCH FAILED timeout 1500ms want=0xc0ffee02 -> 'Shader Program Header 11/18 Error' + ESR 0x405840=0xa0040800 -> WEDGE-REARM -> FIRST ILLEGAL_OPCODE + ESR 0x404490=0x80000004 -> WEDGE-RECOVER priv-error poison grfifo=0xbadf1201 recovery #1; DS SPH POISON + TIMEOUT PRECEDE MME TRAP -> candidate chain: PRI poison 0xbadf1201 drops replay writes -> MME fetch reads poisoned path; GATE1 black 0/901 zero stores - next: catch MME latch WITH ITS INFO at first sight (host ESR/INFO/INFO2 sampler or hook before GSP-RM clears it) to settle whether live fetch at pc=0x364 matches proven-correct image + fix DS SPH-poison chronology: run sema_gl_sph_bind=0 from boot and/or verify poisoned-PRI write-drop via 0x114 shadow (if PRI poison drops replay writes no IR-content fix can ever land) - SESSION 153 r1362-r1363
* vgsp: CONT-104 - gsp_phys_gr_fe_idle() (grfifo 0x400504==0x00000001 witness) ↵Arthur Hanson Rasmusson4 days
| | | | + mme_hold_calls also holds real CALL runs while front-end not settled (MME-CALL-HOLD log gains '[FE-not-idle (CONT-104)]'; prevents r1359 MME-ILLEGAL_OPCODE race - calls executing while previous prelude carrier's SA/IR writes still in flight) - 0x2390 IDENTIFIED + FIX VALIDATED: 0x2390 = NVC597_LOAD_CONSTANT_BUFFER(0); live trap reproduces exactly offline on real captured macro (./mme_ref slot57_gold.bin 1 5 -> EMIT mthd=0x2390 data=0x00000005 + mthd=0x34a4 data=0x00000004); root cause: winning config dropped slot 0 (nop_drop=0x5) and slot 0 = SETUP_FIXED_CONST emits CB selector setup (0x2380<-0x7000, 0x2384/0x2388<-STATE 0xd18 parts, 0x238c<-arg*4); without it FE rejects first CB write class error 3 ERROR_INVALID_OPERATION and parks; r1358 (slot 0 kept + seed): MME-FAST end events=1 NO class error NO 0x2390 - MME RAN and CB writes LANDED; wall moved to CB mapping: r1358 MMU Fault SCC @ 0x0_019d4000 FAULT_PTE VIRT_READ (seeded CB +0x4000, seed xlat mapped one page only); r1359 (seed to surface alias MME-SEED scratch 0x18 <- 0x000a3000 xlat=1): FIRST STORES EVER 'output retirement wait: 2/901 pages changed after 221 ms (settled)'; new wall r1361: calls-kept launch idle FE full prelude gen=3 words=3083 -> ILLEGAL_OPCODE ESR 0x404490=0x80000004, MME PC=0x364 / macro 0x39 = illegal instruction INSIDE macro 57 (golden MME runtime state wall); GATE1 black - next: seed golden MME runtime state slot 57 reads STATE 0xD26-0xD2A (gf100mme.h bug2548370: PAGE_ALLOCATION_COUNT/ZERO_VIEW_OFFSET/LAST_UPDATED_CB_SELECTOR_B_C/LOAD_CONSTANT_BUFFER_OFFSET/LAST_UPDATED_LOAD_OFFSET; methods 0x3498/0x349c/0x34a0/0x34a4/0x34a8) ahead of window, or prove/repair IR image at instruction 0x364 (split packed drain; single-block pack needs ~2960 words > 2048 cap) - SESSION 153 r1358-r1361
* vgsp: CONT-103 - TWO ROOT CAUSES FOUND: (1) '(engine fetch NONE)' was an ↵Arthur Hanson Rasmusson4 days
| | | | ARTIFACT - qmd_dst_mem never set for stream3d (all three sites !stream3d-guarded 25707/25733/25741) so the sentinel test was vacuous; GP_GET proves the engine fetches (FETCH-WIT h=0xbeef0100 slot=4 gpget 4->5 engine-fetched); (2) DEADLOCK: calls-kept launch was 2126-2142 words (1613-word prelude re-emit) > CONT-79 ~2050-wall so it never started (r1345/47/48 begin grfifo=00000001 events=0 timeout) - FIXES: sema_gl_mme_prelude_live_skip (default 1; skip forced 1613-word prelude re-emission once the generation's final part was carried by an engine-executed launch; live-gen set at poll break only when GP_GET advanced, cleared on timeout) + sema_gl_mme_nop_pair (default 0; elide program-pair runs method space [0x2054,0x2158]) + FETCH-WIT instrumentation (poll break/timeout gpget A->B engine-fetched, gpget/gpput in GR LAUNCH submitted, honest 'engine fetch n/a (no QMD deposit...sentinel vacuous)' wording); r1356 fix1: words=500, launch starts (FETCH-WIT timeout slot=6 gpget 6->7) then traps CONT-101 pair trap=80002058 data=019a0900; r1357 fix1+2: MME-PAIR-DROP 25 word(s) window=386->361, words=475, 0x2058 gone, FE advances to CALL runs: trap=80102390 data=00000005 (mmegen=1) park grfifo 0f0f1602->00000001 = FIRST MME-GENERATED METHOD WRITE AT THE WALL; GATE1 black 0/900 pages - next: FE rejects first MME-generated method 0x2390 (mmegen=1 data=5): identify 0x2390 role (macro-port family; check MME-WINRUN/3D win dumps + mmeref + direct lane h=0x1000013) and why generated write traps (CONT-80: bare DATA/macro-port write without open macro context parks; generated port may need macro context conserved); keep mode stays OFF - SESSION 153 r1356-r1357
* vgsp: CONT-101 - sema-scratch18 watch (scan every decoded push on every ↵Arthur Hanson Rasmusson4 days
| | | | channel for 0x3460 SET_MME_SHADOW_SCRATCH(0x18), log up to 24 hits, publish first value via gsp_sema_mme_scratch18_get) + sema_gl_mme_seed/seed_val/seed_xlat (emit [op1 cnt1 m=0x3460][value] ahead of every replayed 3D window; xlat translates value page through launch shadow mapper before >>8) - DECISIVE: client NEVER writes 0x3460 (0 hits across r1348-52 all channels); seed works end-to-end (MME-SEED scratch 0x18 <- 0x000a0000 va=0xa000000 xlat=1) but wall not cleared: MME-FAST trap=80002058 data=019b0900 grfifo 04041602->00000001 park events=2 - trap is window's own relocated program pair (pair addr=0x2054 va=0x4350900 -> 0x19b0900) and fires BEFORE MME consumes seed; DESIGNED FIX WORKS LIVE: sema_gl_prog_guest_va=Y -> PROG-GUEST-VA keep addr=0x2054 va=0x4400900 (Tier-1 identity; operand verbatim) -> ZERO trap=80002058 thereafter; r1352 (keep from boot) got session's FIRST MME-generated evidence (gen0=1) then lottery outcome events=4 (poison) esr->0xbadf1201 WEDGE-REARM engine still wedged; GATE1 black 0/900 pages NO-STORES - next: boot r1347 richest config (nop_drop=1<<0 slot 0 dropped) PLUS sema_gl_prog_guest_va=1 from insmod (removes 0x2058 trap class the seed cannot touch); check stores before re-arming slot 0 with seed; 0xd18 golden value open but subordinate (vGPU client never emits it) - SESSION 153 r1348-r1352
* vgsp: CONT-100 - mme_ir_pack UNITS FIX: ptr is an MME instruction address ↵Arthur Hanson Rasmusson4 days
| | | | (driver codeOffset += codeSize/3, mmeDownload.cpp:5775), each instruction = 3 IR words; old gsp_phys_gr_mme_ir_pack[ptr+k] emitted a pointer-0 image covering only ~312 of 933 instructions, now [ptr*3+k] with next-SA clamp in instructions + maxa in words; correct units need 2960 words > working block ceiling so pack falls back to drain (do not re-enable pack=1 without A/B) - BISECT DONE: culprit macro = slot 0 SETUP_FIXED_CONST (r1345 nop_drop=0x5 slots{0,2}: MME-CALL-DROP 36 word(s) dropped_mask=0x5, 12 beef launches poisons=0; r1347 nop_drop=0x1 slot0 only: MME-CALL-DROP 11 word(s) dropped_mask=0x1, 11 beef launches poisons=0 WITH slot 2 executing); post-call wall both no-poison boots: trap=80002058 data=019a0900 grfifo 06061602->00000001 (method 0x2058=SET_PIPELINE_PROGRAM_ADDRESS_B(1) <- relocated 0x2054-pair operand, then park); offline engine-faithful sim: all executed macros ENDNEXT clean, slot 34 emits draw 0x1618<-0x61000008/0xd74/0xd78/0x1614, slot 0 emits 0x2380<-0x7000 + 0x2384/0x2388<-STATE 0xd18 parts (0 under replay) = incomplete CB selector; driver slot-0 calls carry VPC_CONSTANT_DWORD(VPC_VIEW_ID) gf100varray.c:56; 0xbadf1201 is fixed priv-error constant (pc=513 artifact) - GATE1 black 0/900 pages - next: seed golden STATE 0xd18 (SET_MME_SHADOW_SCRATCH(0x18) method 0x3460) before calls (SETUP_FIXED_CONST merges it into CB_SELECTOR_B/C); find real value in client setup pushes (scan 0x3460 write / fixed-constant base) or golden run; poison-free control nop_drop=1<<0 - SESSION 153 r1345-r1347
* vgsp: CONT-99 - sema_gl_mme_prelude_ir_only + sema_gl_mme_prelude_pack ↵Arthur Hanson Rasmusson4 days
| | | | (partitioned IR: each SA region its own upload run clipped at next SA entry; SA pairs + one contiguous 0x114 ONE_INC run ~1270 words so SA+IR+calls ship in same <=2048-word block; static gsp_phys_gr_mme_ir_pack[4096]) - decisive offline: capture is sum of OVERLAPPING per-macro upload runs; run 34 (ptr=0x265, 75 words) == driver mmeCodeOGL_C597_DRAW_IAB word-for-word (0/75 diffs) but later runs overwrite its tail so capture-order image differs at 50/75 words; r1343/44 packed same-launch: MME-PRELUDE pack ir_words=937 runs=55 sa=54, held launch retires words=1515, first call-bearing launch words=1633 STILL POISONS in 8.7ms; unified failure 6 boots: MME-FAST end events=1 (poison) + ILLEGAL_OPCODE + ESR 0x404490=0x80000004 (bit2 NV_PGRAPH_PRI_MME_HWW_ESR, dev_graphics_nobundle.h:2046); r1340 nop_drop {48,51,57} 40x drops still faults {0,2,34,39,40}; r1341 block_cap=4096 words=3441/3623 never retire (block ceiling); sema_gl_mme_version=0 identical (version exonerated); GATE1 black 0/900 pages; next: macros' runtime STATE wrong - they branch on MME shadow-RAM STATE (slot-57 reads 0xd04..0xd2a) replay leaves zero + prelude's 6 non-SA/IR scratch writes (0x3470/0x34a8/0x3484) + client 0x124 mode not established; capture golden MME ctx state from real run and replay before calls; fallback per-boot nop_drop bisect {0,2,34,39,40} to name faulting macro then read g_tu100mmecode.h - SESSION 153 r1340-r1344
* vgsp: CONT-97 - gsp_phys_ds_spy re-clears DS_REPORT_MASK/_2 every sample + ↵Arthur Hanson Rasmusson4 days
| | | | maskholds/last_mask logging (W1C confirmed: pgraph-rw 0x405840<-0x20 reads back 00000000, no synthetic calibration possible); slots NAMED: c597 SetPipeline[j] only j=0..5, window binds j=1/2/5 ProgramAddressA=0x19a0900/0x19a0200/0x19a0000 byte-equal SPH_INFO stage VAs; DS_HWW_ESR bits 0..23 = SPH0..23 checks (RM DS_SPH<n>_ERR=0x6e+n) so j=9/10/11 binds cannot exist - {5,9,10,11} are per-SPH validation checks; pgraph-rw A/B: golden PATCH DS writes are TGA constraint logic ALREADY LIVE (0x700/0x800) not SPH-related; DS-spy captures: hits all badf1201 poison or zero (timing anomaly recorded); GATE1 black 3 boots ds=a4000e20 sph=0,019a0900,019a0200 0/900 pages; guest root capture 99.92% black; next: beef window's only call form is op=4 IMMD_DATA_METHOD on CallMme[0].Macro 0x3800 (MME-WINRUN off=a0 op=4 cnt=48 mthd=3800) never executed by MME (pcv=0; held windows retire, call-bearing park) while prelude resident - decode run vs MME call spec offline (mme_replay_slots81.txt) + re-emit client's own call shape (trigger 0x3800 + params 0x3804); if op=4 correct run pure-method window test keep_mask=0+hold=N to decide if replay needs MME at all - SESSION 153 r1326-r1327
* vgsp: CONT-96 - secondary COPY0 lane (own TSG 0xcaf000c8 + V5-shape channel ↵Arthur Hanson Rasmusson4 days
| | | | 0xcaf000cc engineType 9 on same ladder VAS, own symem memdescs, GPFIFO/PB small-PT slots 0x10d/0x10e, full COPY0 BIND/schedule/token seq, 0xc5b5 copy submit; gsp_phys_rmcall_ce_lane default 1 best-effort); engine-ctx readback MAIN 307p + PATCH 5p = 1277952 B; gsp-phys-ctx-read 0200 re-arm; rmcall_ctx_valid fix (mode-35 F2 promote; was silently 0) - DECISIVE: engine ctx IS golden-initialized: CTX-READBACK pa=0x1f4000000 copied=1277952 bytes on CE lane, head 00000000 000f2d00 00000006 cafe0000 02340000 02200000 02350000 (54800 nonzero bytes MAIN, PATCH 95 PGRAPH addr<-value golden pairs); CE lane READY token=0x2 runlistId=0 chId=0x2 gpFifoVa=0x10d000 pbVa=0x10e000 valid=1; new negative: no SET_PIPELINE_SHADER for j=9/10/11 anywhere in 8GiB guest RAM yet DS SPH {9,11} fail invariantly; GATE1 black ds=a6000e20 sph=0,01990900,01990200 0/901 pages; next: background cat gsp-phys-ds-spy 15-20s before beef lane's first window (hit path prints esr/esr2 + REGION_A/B + all 6 SPH stage LO/UP + esr_after naming invariant slots 9/11); pgraph-rw A/B (golden PATCH DS writes 0x405830<-0x700 0x40585c<-0x800) - SESSION 153 r1324-r1325
* vgsp: CONT-95 - PROMOTE_CTX recorder (gsp_sema_service_ctx_promote_note/get ↵Arthur Hanson Rasmusson4 days
| | | | w/ bInitialize from emulated promote loop) + CTX-BIND launch receipt (client MAIN/PATCH vs engine ctx + first-words readback) + gsp-phys-ctx-dump + engine-ctx CE readback (CE forbidden on GR ladder channel) - DECISIVE: r1323 CTX-BIND client-main=seen pa=0x114e00000 va=0x1200d0000 size=0x133000 attr=0x6 binit=1; client-patch=seen pa=0x12dcc8000 binit=1; replay-ctx pa=0x1f4000000 size=0x133000 fbmem=1 va=0x2200000 srv_ctxva=0; installed=0 (engine ctx is ladder's buffer NOT client promote); client-main content[0..7]=0, host read 100% zero bytes -> client promoted GR ctx carries no state; fw DS handler decoded (vaddr 0x52b8290 per-bit reporter: esr=a6000e20->0x73 SPH5; validation HW-side) - next: read engine ctx buffer VA 0x2200000/FBMEM 0x1f4000000 via secondary stage-3 COPY0 channel on same VAS (0xc5b5 copy block, dump gsp-phys-ctx-dump); structured -> drive fill, zeros -> reproduce GSP golden-ctx init - SESSION 153 r1322-r1323
* vgsp: CONT-94 - svc_init_push_scan (per-beef-push census of ↵Arthur Hanson Rasmusson4 days
| | | | SET_SHADER_LOCAL_MEMORY_A..D 0x790-0x79c + host-side verbatim capture first >=4KiB beef push per boot INIT-CAP) + gsp-phys-init-push debugfs - lmem lead REFUTED 4 ways: INIT-CAP h=0xbeef0100 va=0x4021004 len=60216 lmem_runs=0; 60216B init push decodes to words:15054 distinct methods:2 = pure MME microcode (0x114x213/0x11c x213), 0 lmem hits; addr=0x79[0-9a-c] in 64 pushraw dumps = 0; whole-RAM scans no genuine run (x86 code bytes only); driver emission point exists (gf100Init.c:1344 gf100program.c:1479) but 570.144 never pushes it here; per-window latch unchanged ds=a6000e20 x5 + first a2000a00 sph=0,00600900,00600200,0,0,00600000 rr=0,0; oracle DS_HWW_ESR 80000000 DS_REPORT_MASK 0 DS_SPH_REGION_A/B 0/0 GR_FIFO 00000001; wedge persists (PARK-RECOVER #11 rc=-110); next: prove client's promoted GR context buffer engine-visible on replay channel at launch - instrument PROMOTE_CTX engine=1 entry[0] pa=0x234200000/va=0x120420000 size=0x133000 bInitialize=1 binding; if absent install it (SPH validation vs zero context matches rr=0/0); parallel decode fwimage DS_HWW_ESR handler (off 0x11a908 SPH0..30) w/ risc-v-gsp-rm-debugger - SESSION 153 r1321
* vgsp: CONT-93 - sema_gl_sph_8k + pair-line (PTE0=program page ↵Arthur Hanson Rasmusson4 days
| | | | PTE1=family+0x1000 single fetch line); sema_sph_version_val forced SET_SPH_VERSION A/B; sema_gr_park_recover (TSG-preempt+resched re-arm on warm-sem wedge); gsp-phys-pgraph-rw debugfs (live PGRAPH snapshot + bounded writes 0x400000-0x410000); sema_sph_region_legacy (0x1608/0x160c pair) - refutations vs per-window latch: region 'write lands' refuted (same push ds=a6000e20 vs a6000e66 not region-caused); 8K tail no change (SPH-PAIR line=0x620000 hpa0=0x14444f000 hpa1=0x10a418000 + INLINE-APPLY-ALIAS -> ds=a4000e20); version windows 00040004/00050005/00060006/00010003 all a6000e20; PD filter pgraph-rw 0x00406020 57610001->17610001 no change; bind scope: client's own program also rejected (no SPH-BIND emitted still a4000e20); park not recoverable (WEDGE-REARM preempt status=0x0 rpc=0x0 ret=0 probe rc=-110); next: emit SET_SHADER_LOCAL_MEMORY_A/B/C/D (0x790-0x79c) download-state push, only missing client channel-init class, SPH carries LOCAL_MEMORY_LOW/HIGH_SIZE fields DS validates, capture from guest-RAM scrape like init block; pgraph-rw as live oracle - SESSION 153 r1311-r1320
* vgsp: CONT-92 - sema_gl_prog_guest_va=0 knob (keep program operands at guest ↵Arthur Hanson Rasmusson4 days
| | | | VAs; DECISIVE NEGATIVE: MMU Fault ENGINE GRAPHICS HUBCLIENT_PD @ 0x04350000 FAULT_PTE VIRT_READ - guest VAs not engine-fetchable even with Tier-1 PDE install, knob default 0); gsp_phys_rmcall_gr_pte_leaf applies pte_kind bits 63:56 to scratch-pool/Tier-1 leaves; per-window DS-ESR W1C clear + DS-ESR pre-clear log; POSITIVE: region write LANDS - sema_sph_region_base=0x600000 changed same retrying window latch a6000e20->a6000e66 (+SPH bits 1,2,6), deterministic per-draw re-validation; pte_kind=6 refuted; client init-push decoded: no program-region write exists, Turing hasProgramRegion=0 per NVIDIA caps table; next: sweep sema_sph_region_base 0x600900/0x601000/0x610000/0x1e0000 + both encodings vs per-window latch for SPH set below {5,9,10,11}; fallback SASS tail crossing 0x1000 never contig-mapped at SPH_VA+0x1000 - SESSION 153 r1307-r1310
* vgsp: CONT-91 - svc_gr_inline_retarget re-roots captured program-family ↵Arthur Hanson Rasmusson4 days
| | | | inline records (page not in launch prog_va family nor prog_bind_va[]) onto launch family offset-preserved, page-crossing tails follow head, wired into svc_gr_req_fill; svc_gr_page_inline_covers widened; sema_ds_mask_clear=1 clears DS_HWW_REPORT_MASK/_2 (0x405844/c) ahead of every 3D window; gsp-phys-ds-spy debugfs; GR-STATE retire logs sph= (STAGE0..5 START/UPPER) + rr= (PROGRAM_REGION) + MME shadow readback; sema_gl_sph_region + sema_sph_region_base emit Volta+ program region (SET_MME_SHADOW_SCRATCH 0x78/0x79 = 0x35e0/0x35e4) - r1298 real V4 image at exact bind VA (INLINE-APPLY len=1536 first=020a0481 + INLINE-RB rb=020a0481); same launch DS flags sph=0,00620900,00620200,0,0,00620000 rr=0,0 ds=a4000e20 w/ correct bytes + region A/B 0/0 unchanged; DS rejects all bound stages -> unresolved variable = address space DS validates in (our shadow VAs 0x6xxxxx vs client guest VA region); next A/B: knob leaving program operands at ORIGINAL guest VAs when page identity-mappable (skip shadow rewrite for that pair only) - SESSION 153 r1298-r1306
* vgsp: CONT-90 - mapping EXONERATED (canary proof: sema_gl_sph_canary=1 maps ↵Arthur Hanson Rasmusson4 days
| | | | program VAs to canary hpa=0x10bdc3000 w8=cc00cc40..., DS error set moves {5,9,10,11}->{1,2,5,9,10,11,18,26} = DS reads exactly what our PTE maps, content-driven; SPH-ALIAS pages/resolve/canary receipts w8 readback; shadow-win A/B no structural change); sema_gl_shader_exc=1 emits SET_SHADER_EXCEPTIONS(0x1528)<-0 (nv3dInitChannelTuring order) - 5/9/10/11 persists; real image rejected (INLINE-APPLY dst=0x4350900 len=1536 first=020a0481 -> 0.2s later 5/9/10/11 + Class Error Offset 0000022c Data 00000800); NEW delivery-lag bug r1297: stage-image/real-upload pinned old family while windows bind fam=0x42d0000/0x41c0000/0x4400000, fetch page all zeros, zero INLINE-APPLY that boot (r1294-96: 24-28) - next: make delivery follow req->prog_va family / fallback-author synthetic SPH at every bind target with zero page - SESSION 153 r1294-r1297
* vgsp: CONT-89 - INLINE-APPLY-ALIAS real bug fix (inline records landing on ↵Arthur Hanson Rasmusson4 days
| | | | qmd_word=NONE page never applied - 1408B real program @0x4350f00 was head-only 256B at engine; live fix INLINE-APPLY-ALIAS dst=0x4351000 len=1152 pa=0x85e0f4000 first=0d0d7623); full init-push pipeline block into SPH-BIND prelude in client order (0x2040<-0x11 SET_PIPELINE_SHADER(1), 0x204c<-0x1a,0 REGISTER_COUNT/BINDING(1), 0x21c<-0x1001 INVALIDATE_SHADER_CACHES, 0x155c/0x1574 TEX pools, 0x310<-0x705, 0x22c<-0x800, 0x1128<-ffffffff x2; emission-count bug fixed - uncounted emission caused SPH-BIND skipped reloc=6/4) - 9/11 (and 5/10) PERSISTS on executing launch reading real image (r1293 SPH-BIND fam=0x4390000 j1-type=0x11 rc=0x1a initblk=17 win=306 + INLINE-RB rb=020a0481 -> S/5/9/10/11; r1292 full block visible in-window) -> wall is emulated GMMU/PTE view; next A/B gsp_phys_rmcall_gr_shadow_win0=0 vs 1, canary at SPH offset via second alias - SESSION 153 r1287-r1293
* vgsp: CONT-88 - real program payload delivery engine-visible: ↵Arthur Hanson Rasmusson4 days
| | | | GSP_BRIDGE_INLINE_BYTES/SVC_GR_INLINE_BYTES/GSP_PHYS_GR_INLINE_BYTES 256->2048 (+static_asserts; svc_gl_flush prs[] static); svc_grce_dst_newest harvests window's REAL captured upload from svc_grce_dst_ring, svc_gl_flush attaches real 1536B@0x4350900 + 1408B@0x4350f00 (w0=0x020a0481) as inline records at own dst VAs (page-crossing split, tail page candidate); svc_grce_inline_write dual-writes engine-visible injected-pin page (svc_grce_land_write page-clamped); SPH-BIND also emits SET_PIPELINE_SHADER(2)<-0x21/(5)<-0x51 - delivery WORKS: real-upload record va=0x4350900 len=1536 first=020a0481 (engine-visible delivery), INLINE-APPLY guest=1, INLINE-RB rb=020a0481 pa=0x64cfd6000, page[7] va=0x4350000 hpa=0x64cfd6000 (r1283); wall survives real image (9/11 + ESR 0xa0000a00 +14ms; V4 window still 9/11); bind+type+real-image combo never seen on executing launch (lane wedges 1-3 launches); stores 0/900-901; next: healthy boot >=3 bind-carrying launches then harvest client init-push pipeline state (20010810 00000011 SET_PIPELINE_SHADER(1)<-0x11 + 0x204c pair) into SPH-BIND prelude - SESSION 153 r1282-r1286
* vgsp: CONT-87 - sema_gl_sph_bind (window's own binds + client's missing TESS ↵Arthur Hanson Rasmusson4 days
| | | | j=2 / PIXEL j=5 binds relocated by window pass; SPH version derives from loaded blob; INLINE-RB readback witness); stage-typed images at family VAs (TESS=vs image SHADER_TYPE->2), real-upload-wins record skip, gsp_sema_gl_sph_blob_version, prog_binds plumbing, pin-first arm - all three stages now fetch from authored VAs (sph=0,00620900,00620200,0,0,00620000); error 18 CLEARED (9/11/18->9/11); authored bytes engine-visible (INLINE-RB rb=000a0461); 9/11 survives every content A/B (V4 retag, SASS5, real w0 0x020a0481, REGISTER_COUNT, own-binds prelude, empty-blob) -> pipeline-state wall not content; real driver images in window inline writes dst=0x4350900 bytes=1536 + dst=0x4350f00 bytes=1408 (w0=0x020a0481 SPH V4) land in vGPU VRAM shadow NOT engine-read page; next: raise GSP_PHYS_GR_INLINE_BYTES 256->2048 + carry payloads in per-VA inline record or land svc_grce_inline_write via pin/fill - SESSION 153 r1276-r1281
* vgsp: CONT-86 - sema_gl_sph_version (emits Turing channel-init pair 200205a9 ↵Arthur Hanson Rasmusson4 days
| | | | 00040004 00040004 after SET_OBJECT on replayed 3D windows); gsp_phys_fault_regs_log (MME_HWW_ESR/INFO/IR + DS_HWW_ESR/ESR_2 + SPH stage starts beside every GR-class 0x1006); SDM-DROP forensic log; block-cap hardening <=4096-128; attr-prelude capture range 0x2000..0x2200 (8 pipeline records) - fault witness: failing SPH stage1 fetched from relocated shadow VA 0x620900; minimal V3 blobs rejected STRUCTURALLY (V4 retag no help); SDM drops all 0001fff0 SET_SUB_DEV_MASK legit; missing binds: j=2 va=0x4300200 TESS + j=5 va=0x4300000 PIXEL never in windows/preludes; next: author client's REAL SPH+SASS bytes at relocated program VAs (VA 0x4300900-family from unreplayed init push) as sema_gl_vs_hex/ps_hex + replay stage-2/5 binds - SESSION 153 r1273-r1275
* vgsp: sema_gl_mme_sa_rearm (bool default 1) gating SA re-arm block for ↵Arthur Hanson Rasmusson5 days
| | | | same-boot A/B - CONT-85: newest emissions EXONERATED (version=0 track=-1 flips did not stop poison; 0xbadf1201 = NV_PPRIV_SYS_PRI_ERROR_CODE_FECS_PRI_RESET ringstation latch not MME exception); r1270 first call-launch poisoned with calls HELD + no prelude -> macro execution not required for poison; r1272 rearm=0 EXECUTED launches but Shader Program Header 9/11/18 Error + ESR 0xa2040a00 x5 + ILLEGAL_OPCODE 0x80000004 + Class Error Offset 0000238c Data 00020020, 0 GR-STATE retires; SA-REARM A/B neutral; next: wire missing SPH state for draw (DS SPH 9/11/18) - leading candidate SDM-family entries that sema_gl_sdm_drop=1 drops, replay ahead of window + capture MME_HWW_ESR_INFO 0x404494 at ILLEGAL_OPCODE for PC witness - SESSION 153 r1271-r1272
* vgsp: CONT-84 - SA-REARM moved before window copy (was appended after, calls ↵Arthur Hanson Rasmusson5 days
| | | | ran against prelude SA clobber); WIN-PATCH reaches beef path at last (sweep runs=383 matched=4, 0x124 off65 0x2->0x1 x4); prelude-capture pages bitmask + ring-drop log 8->64 - capture completeness FIXED (pages=0x7fff -> words=3083 covered=55 sa_mask=0x63fffefffffffff code_words=2854); sema_map_add_max=4096 guard (stale host writer re-injecting stale mapping every ~2s racing per-page pins - REFUSED, first-read capture complete); sema_gl_mme_version=1 (SET_MME_VERSION 0x234, absent from capture) + sema_gl_mme_track (0x124<-0) - no change observed; GATE1 black: call-bearing launches park+poison every boot (r1245/1250/1265/1270) even w/ complete prelude+rearm+TRACK+VERSION, gen0=0 MME never starts, shadow2[c597] 0x3810=0x11 0x3910=0; trap=80001614 + transient ds a2040a00 noted; next: A/B version=0/track=-1 (lane destabilized vs MME never starts), shadow port read at first call launch, track=2 PASSTHROUGH - SESSION 153 r1237-r1270
* vgsp: store-side emission forensics (DS_HWW_ESR, SPH_INFO_STAGE_START ↵Arthur Hanson Rasmusson5 days
| | | | x6+UPPER+REGION, MME_HWW_ESR_INFO, FE_DECODE_STATE, MME shadow-RAM port reads w/ CALL trigger probes) + MME-SA-REARM (re-emit [0x11c]=j,[0x120]=sa_ent[j] for every macro slot the emitted window calls) - root-caused replayed-prelude ordering bug: stream ended SA[34]=0 so every draw call resolved to macro 0; rearm now fires 4/5/9/11/12 slots live; healthy boots DS clean sph unbound=0 (0xa2040a00 lead does NOT reproduce); MME executes macros (pc_valid=1 pc=513 mac=0xf1); calls reach MME (shadow2[c597] 0x3810=00000011) but draw methods NEVER emitted (0xd74=0 0xd78=0 0x1618=0); stores still 0/900-902; win_patch=124:1 knob never reached beef path; next: repair win_patch application point + sweep 124:1 TRACK, strip leading CALL-run header variants, compare CALL-run encoding vs nvk P_1INC shape - SESSION 153 r1229-r1236
* vgsp: sema_gl_mme_hold_calls (default 1) - elide window's remaining ↵Arthur Hanson Rasmusson5 days
| | | | CALL_MME_MACRO/DATA runs while prelude generation not latched OR while this launch itself uploads generation code; real calls resume next launch; 0=legacy wedge - complete-generation hold PASS: r1228 real {0,2,34,39,40}+attr_prelude retire_delta=6 fail_delta=0 over 32s no wedge; r1225 MME-CALL-HOLD 36 word(s) window=222->186 then prelude gen=3 words=3083 - stores still 0/900-901 (gen0=0, no MME-emitted method witnessed); new localization: +slot48 Class Error Offset 0000238c Data 00020020, +slot51 Offset 00001614 Data 00000000 + WEDGE-RECOVER; next: store-side emission forensics SPH_INFO_STAGE_START 0x405c00+si*4 + DS_HWW_ESR - SESSION 153 r1221-r1228
* vgsp: sema_gl_mme_nop_drop (slots in mask have CALL runs dropped entirely - ↵Arthur Hanson Rasmusson5 days
| | | | r1144-r1177 proven-safe retire) + force-stub semantics (nop_drop slot stubbed in drop filter + SA end-noop stub kept - r1186 lesson: keep|57 removes SA[57] stub, mis-detected kept run executes faulting macro) - validation: (a) keep=5 retires PROVEN (7/14/15 retires, poll break ch=0xc0ffee02 after 94us); (b) keep=5|1<<57 PARKS confirmed; (c) nop-retarget VALIDATED NEGATIVE (DATA-port run without open macro context parks); (d) all-real unresolved (bad boots baseline ILLEGAL_OPCODE too); boot lottery 7 healthy of ~28; stores 0/900-901 all session; next: apply nop_drop=1<<57+sa_stub_all=N within ~10s of first retire on a healthy boot, bisect slots via nop_drop (34=146650112133693440) - SESSION 153 r1180-r1208
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 23:43:30 +0000