summaryrefslogtreecommitdiffstats
path: root/kernel/gsp_sema_service.c
Commit message (Collapse)AuthorAge
* vgsp-gl: deliver the real pixel-stage image and receipt the active draw's ↵Arthur Hanson Rasmusson8 hours
| | | | topology/index args
* vgsp-gr: deliver empty FB fetch pages from real FBMEM, discover the CB per ↵Arthur Hanson Rasmusson9 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | boot, clear the DS latch after each window The active indexed draw's vertex/index buffers resolve through the client's page tables to vidmem pages whose emulated BAR1 shadow is empty (no emulated upload path ever populated it), so the engine fetched zeros and the draw stored nothing. Three delivery paths now cover the page: a real-FB VID leaf for launch fetch pages (QMD pointers, never the data-fill surface) and for vertex streams when every shadow byte is zero; a sysmem-backing copy when the same VA also has a nonzero SYS mapping; otherwise the existing shadow page is used untouched. Render-target pages keep their shadow identity so the copy-out can still ship stores back to the guest. The fixed constant buffer is discovered per boot: the captured SET_MME_SHADOW_SCRATCH(0x18) value is authoritative, the historically observed base is a gated fallback, and a resolved real page is remembered for later misses. The DS HWW ESR latch is now also cleared (W1C) after each replayed window, so a failed window cannot poison the next window's entry state. Validated with three supervised cycles (r1497-r1499): the active streams read the client's real vertex floats, the real MVP resolves, poison stays at 0-1 per run, and the engine clears the render target to opaque black (dump_vidmem 0x200000 = ff000000) with the guest window still all black - the remaining wall is geometry coverage, not data delivery.
* vgsp-gr: keep the validated fixed CB across launches and map each VTG stream ↵Arthur Hanson Rasmusson10 hours
| | | | | | | | | | | | | | | | | | | | | | | contiguously - Remember the last fixed-CB page that resolved through a SYS source and passed the matrix gate; a later resolution miss (or a method-page answer) reuses it instead of zeroing the seed page with the synthetic identity. Only a boot with no validated read ever uses the identity fallback. Do not skip the write on an unchanged hash: the seed page lives in the client's screen allocation and the guest can rewrite it between launches. - Treat the CALL_MME_MACRO(2) vertex stream as one range: map [base,end) into a fresh contiguous fetch line and rewrite both ends from it, preserving the client's stream length across 4 KB boundaries. Unresolvable pages map the module zero page (a zero vertex, never a fault). The generic per-word pass remains the fallback. - Diagnostics: cb-copy logs the first 8 seed-page words and the cached flag; MME-VSTREAM-LINE dumps the resolved base page (client VA, HPA, page count, first 8 words). - Evidence: r1494 (poison 11/17 -> 1/16, real vertex floats at the stream bases, CB cache verified live with src=vaswalk -> src=cached-real) and r1495/r1496 (the active draw's vertex/index page is an all-zero vidmem shadow page while the data exists in guest sysmem - the new wall).
* vgsp-gr: read the fixed CB from the engine-visible page and never deliver a ↵Arthur Hanson Rasmusson11 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | header-only VS image The GL draw's VS was reading two wrong inputs. First, the fixed-CB copy resolved the client VA through a learned/FB layer first, so it read the emulated BAR1 vidmem shadow - a buffer the engine never writes - and delivered unrelated vidmem (r1490 first=09037223 00000004; r1482 oscillated between a float row, method words and zeros). Resolve the CB the way the engine does: channel VAS, every registered VAS page-table walk, then the GR relocation resolver; only a SYS answer is content-valid and an FB answer is flagged. The matrix gate now requires four normal-magnitude floats in c[0x0][0x80..0xbc] (r1492 accepted a method page as a matrix); a rejected read authors the identity MVP. Second, the captured 1536 B VTG upload is spliced at a page boundary: the delivered image was the SPH header plus ZERO SASS, so the VS executed no code. Reject captured program images whose SASS body [0x80,min(len,0x200)) is zero (the real-upload ring record, the 020a0481 cache and the window's own upload all pass the gate) and deliver the built-in known-good VTG image (the client's own SPH V4T1 020a0481 + SASS) at the bind VA instead; sema_gl_vs_img=0 restores the old behaviour. Diagnostics: cb-matrix/cb-const dumps of every VS-read constant block, SPH-ALIAS code4 words at the bind, and MME-VSTREAM post-relocation stream/limit/address payloads. r1491-r1493 (VP_MODE=6, RT0=1): the bind page now shows the real SASS (code4=ff047321 0000a0ff ...) and the CB/identity delivery is logged, but the draw still produces no fragments (retirement 0-3/900 = the forced MME seed pages only; xwd decoration rows only). Next wall: the vertex attribute/staging fetch (slot-57 0x39c8 data and the staging scratch 0x36/0x37), not the shader image or the fixed CB.
* vgsp-gr: hold calls on a stream-damaged push so a dropped chunk cannot run ↵Arthur Hanson Rasmusson13 hours
| | | | | | | | | | | | | | | | | | LOAD_CONSTANT_BUFFER without its selector state A chunked GL draw whose earlier chunk was dropped (prelude LOAD-ONLY or the r1447 arming window hold) replayed the remaining chunks' calls alone; the constant-buffer selector (0x2380) lived in the dropped chunk, so the bug2548370 macro's LOAD_CONSTANT_BUFFER(0x2390) class-errored (ErrorCode 3) and the engine poisoned (badf1201 sentinel: pc=513/mac=0xf1 are its artifact, not a macro). Propagate the stream-relative chunk offset through the candidate and submit path, keep a per-push STREAM-DAMAGE record of the lowest dropped chunk, emit later chunks calls-held (the proven-safe shape), never arm the arming window-hold on a damaged stream, and start a fresh section at stream_rel==0. r1487: the exact r1485 damaging shape now retires clean (events=5, no poison) and the next chunk is captured; r1486 (holds off) still poisons because the first launch runs against a partially packed prelude, confirming the dropped chunk is the cause, not the hold release.
* vgsp-gr: capture the full 4K-word GL draw window, emit SET_SHADER_EXCEPTIONS ↵Arthur Hanson Rasmusson14 hours
| | | | | | | | | | | | | | | | | | | | | | as immd13, and base the SPH region on the bound program's shadow page - SVC_GR_PUSH_WORDS / GSP_PHYS_GR_RAW_WORDS raised 2048 -> 4096: the beef full-frame push is 12288 B / 3072 words, so the 2048-word capture tail failed the 3D mark (raw_ok=0 fit_ok=0) and the launch fell back to a 239-word stub, losing the real 2115-word draw. Now '3D stream chunked window=1429 words -> 4 chunk(s)'. - SET_SHADER_EXCEPTIONS (0x1528) is emitted as the client's immd13 (0x8000054a) and skipped when the window already carries it; the remaining 0x1528 in the log is the client's own benign write. - sema_gl_sph_region_bind (default 1): the SPH region base is the first bound program's relocated shadow page, not the forced 0x1500000 pool base; r1484 latched the fetched SPHs (0,019a0f00,019a0200,0,0,019a0000) with ds=86040646 (region mismatch), r1485 uses base 0x19b0000 bind 0x19b0900 and the DS accepts (ds=80000000). - r1484/r1485: the screen now shows gear-class pixels (xwd bbox spanning the 800x600 window, multicolor); GUEST-WIT shows RT0 page 0 written. The remaining wall is the MME draw macro 0xf1 / pc 513 poison on the first calls+window launch after the arming hold is released.
* vgsp-gr: bind the beef GL draw to the captured 900-page screen surface, not ↵Arthur Hanson Rasmusson14 hours
| | | | | | | | | | | | | | | | | | | | | | | a cross-VAS 10-page operand buffer The PS SPH has MRT_ENABLE=0 (writes RT0); the beef window binds no colour target of its own, so the last trusted 0x800..0xbff run (the X screen surface 0x120400000, 1280x720, 900 pages) is the render target. Its pages were resolved through the global VA-keyed pin/ledger, which conflated clients: the beef client's own injected pin for VA 0x120400000 (a SYS staging/operand buffer holding SASS/method words) shadowed the X server's surface VAS and cut the set at 10 pages. Capture the surface's source VAS and resolve its pages through that VAS in the fill, bypassing the pin override for this page set. Re-patch the SURF prelude when the launch's rec base differs from the cached one, and copy the emitted SURF run's target/geometry into the RT0 run so RT0 == RT1 every launch (was hardcoded to the 0xa relocation half). r1483: the beef retirement is now 0/900 pages of the visible surface (was 0/10), RT0-BIND target=0xa000000, data[0] va=0x120400000 pa=0x100000, n_data =900, 6 launches, poison=0. The engine still stores nothing: GR-STATE sph is zero at retire and the launch traps at method 0x1528, so the next wall is making the pipeline program bind visible to the DS, not the RT VA.
* vgsp-gr: deliver the real GL shader images and the client fixed constant ↵Arthur Hanson Rasmusson15 hours
| | | | | | | | | | | | | | | | | | | | | | | | | buffer to the engine-visible pages - inline-apply writes the image into the guest HPA whenever the page is kept at the guest VA (code_keep_guest), not only for stream3d windows; a shadow copy is useless when the engine fetches the guest page (r1470: guest=0 VS then lost to the window-0 shadow copy). - the standalone 0x180/0x1b0 context-init upload pair (outside any C597 section) is also recorded in the GRCE destination ring, so a later draw window can find the client's real VTG image at its bind VA. - sema_gl_cb_copy_to / sema_gl_cb_src_va: copy the client fixed-CB page into the forced, mapped MME seed page before the launch, so the vertex shader reads the client's transform constants instead of screen/stale data. Falls back to a synthetic identity MVP when the client VA cannot be walked. - cache any push chunk whose first word is a real SPH (020a0481 VTG / 000a1482 PS) and use it as the program-record fallback when the window's own bind-VA upload was never captured (the init push's continuation chunks are otherwise judged implausible and never reach the ring). - r1481/r1482: the real VS SPH+code and PS are applied guest=1 at the bind VA, the client CB page resolves and is copied, poison=0 over 9-10 launches; render-target writes still zero - the remaining wall is the draw's render-target/colour-target binding (the beef window's output retirement set is 10 pages of shader-like data, not the 900-page screen surface).
* vgsp-diag: whole-vidmem page-hash bracket - sema_gl_vidmem_bracket hashes ↵Arthur Hanson Rasmusson31 hours
| | | | every 4KB page of the BAR1 shadow before the GR publish and diffs after the output-retirement wait, reporting any changed page outside the sampled output set; vidmem_hash_snap/vidmem_hash_diff manual module params; default 0 is a strict no-op
* vgsp-mme: CONT-118 strict release + FE-busy deferral - ↵Arthur Hanson Rasmusson41 hours
| | | | sema_gl_mme_hold_strict (calls release only when pre_words_out==0 && fe_idle() && live_gen==pl_gen) and sema_gl_mme_fe_defer (busy-defer the load-only carrier at svc_gr_request before fill/consume, bounded 4 consecutive defers/gen with GIVEUP log) - both default 1, independent live A/B, 0 = legacy-equivalent
* vgsp-sph: d24/d25 seed extension - capture 0x3490/0x3494 (scratch24/25) + ↵Arthur Hanson Rasmusson2 days
| | | | params sema_mme_state_d24/d25 + fail-closed seed emissions after d19 (param>captured>skip, 3d-reloc) - the d28-forced slow path reads the 0x349x states after d19; +235/-1
* vgsp-sph: C4 - capture scratch 0x19 (CB selector, mthd 0x3464) + seed STATE ↵Arthur Hanson Rasmusson2 days
| | | | 0xD19 emission (param sema_mme_state_d19 > captured, 3d-reloc, fail-closed) - the d28-forced slow path reads an unseeded d19 and faults the consumer at VA 0 (HUBCLIENT_PD); +129/-1
* vgsp-sema: exempt injected pins from the push-read PA ceiling + ↵Arthur Hanson Rasmusson3 days
| | | | pinrej/pushfail visibility (carrier read >=6 GiB)
* vgsp: CONT-101 - sema-scratch18 watch (scan every decoded push on every ↵Arthur Hanson Rasmusson4 days
| | | | channel for 0x3460 SET_MME_SHADOW_SCRATCH(0x18), log up to 24 hits, publish first value via gsp_sema_mme_scratch18_get) + sema_gl_mme_seed/seed_val/seed_xlat (emit [op1 cnt1 m=0x3460][value] ahead of every replayed 3D window; xlat translates value page through launch shadow mapper before >>8) - DECISIVE: client NEVER writes 0x3460 (0 hits across r1348-52 all channels); seed works end-to-end (MME-SEED scratch 0x18 <- 0x000a0000 va=0xa000000 xlat=1) but wall not cleared: MME-FAST trap=80002058 data=019b0900 grfifo 04041602->00000001 park events=2 - trap is window's own relocated program pair (pair addr=0x2054 va=0x4350900 -> 0x19b0900) and fires BEFORE MME consumes seed; DESIGNED FIX WORKS LIVE: sema_gl_prog_guest_va=Y -> PROG-GUEST-VA keep addr=0x2054 va=0x4400900 (Tier-1 identity; operand verbatim) -> ZERO trap=80002058 thereafter; r1352 (keep from boot) got session's FIRST MME-generated evidence (gen0=1) then lottery outcome events=4 (poison) esr->0xbadf1201 WEDGE-REARM engine still wedged; GATE1 black 0/900 pages NO-STORES - next: boot r1347 richest config (nop_drop=1<<0 slot 0 dropped) PLUS sema_gl_prog_guest_va=1 from insmod (removes 0x2058 trap class the seed cannot touch); check stores before re-arming slot 0 with seed; 0xd18 golden value open but subordinate (vGPU client never emits it) - SESSION 153 r1348-r1352
* vgsp: CONT-95 - PROMOTE_CTX recorder (gsp_sema_service_ctx_promote_note/get ↵Arthur Hanson Rasmusson4 days
| | | | w/ bInitialize from emulated promote loop) + CTX-BIND launch receipt (client MAIN/PATCH vs engine ctx + first-words readback) + gsp-phys-ctx-dump + engine-ctx CE readback (CE forbidden on GR ladder channel) - DECISIVE: r1323 CTX-BIND client-main=seen pa=0x114e00000 va=0x1200d0000 size=0x133000 attr=0x6 binit=1; client-patch=seen pa=0x12dcc8000 binit=1; replay-ctx pa=0x1f4000000 size=0x133000 fbmem=1 va=0x2200000 srv_ctxva=0; installed=0 (engine ctx is ladder's buffer NOT client promote); client-main content[0..7]=0, host read 100% zero bytes -> client promoted GR ctx carries no state; fw DS handler decoded (vaddr 0x52b8290 per-bit reporter: esr=a6000e20->0x73 SPH5; validation HW-side) - next: read engine ctx buffer VA 0x2200000/FBMEM 0x1f4000000 via secondary stage-3 COPY0 channel on same VAS (0xc5b5 copy block, dump gsp-phys-ctx-dump); structured -> drive fill, zeros -> reproduce GSP golden-ctx init - SESSION 153 r1322-r1323
* vgsp: CONT-94 - svc_init_push_scan (per-beef-push census of ↵Arthur Hanson Rasmusson4 days
| | | | SET_SHADER_LOCAL_MEMORY_A..D 0x790-0x79c + host-side verbatim capture first >=4KiB beef push per boot INIT-CAP) + gsp-phys-init-push debugfs - lmem lead REFUTED 4 ways: INIT-CAP h=0xbeef0100 va=0x4021004 len=60216 lmem_runs=0; 60216B init push decodes to words:15054 distinct methods:2 = pure MME microcode (0x114x213/0x11c x213), 0 lmem hits; addr=0x79[0-9a-c] in 64 pushraw dumps = 0; whole-RAM scans no genuine run (x86 code bytes only); driver emission point exists (gf100Init.c:1344 gf100program.c:1479) but 570.144 never pushes it here; per-window latch unchanged ds=a6000e20 x5 + first a2000a00 sph=0,00600900,00600200,0,0,00600000 rr=0,0; oracle DS_HWW_ESR 80000000 DS_REPORT_MASK 0 DS_SPH_REGION_A/B 0/0 GR_FIFO 00000001; wedge persists (PARK-RECOVER #11 rc=-110); next: prove client's promoted GR context buffer engine-visible on replay channel at launch - instrument PROMOTE_CTX engine=1 entry[0] pa=0x234200000/va=0x120420000 size=0x133000 bInitialize=1 binding; if absent install it (SPH validation vs zero context matches rr=0/0); parallel decode fwimage DS_HWW_ESR handler (off 0x11a908 SPH0..30) w/ risc-v-gsp-rm-debugger - SESSION 153 r1321
* vgsp: CONT-91 - svc_gr_inline_retarget re-roots captured program-family ↵Arthur Hanson Rasmusson5 days
| | | | inline records (page not in launch prog_va family nor prog_bind_va[]) onto launch family offset-preserved, page-crossing tails follow head, wired into svc_gr_req_fill; svc_gr_page_inline_covers widened; sema_ds_mask_clear=1 clears DS_HWW_REPORT_MASK/_2 (0x405844/c) ahead of every 3D window; gsp-phys-ds-spy debugfs; GR-STATE retire logs sph= (STAGE0..5 START/UPPER) + rr= (PROGRAM_REGION) + MME shadow readback; sema_gl_sph_region + sema_sph_region_base emit Volta+ program region (SET_MME_SHADOW_SCRATCH 0x78/0x79 = 0x35e0/0x35e4) - r1298 real V4 image at exact bind VA (INLINE-APPLY len=1536 first=020a0481 + INLINE-RB rb=020a0481); same launch DS flags sph=0,00620900,00620200,0,0,00620000 rr=0,0 ds=a4000e20 w/ correct bytes + region A/B 0/0 unchanged; DS rejects all bound stages -> unresolved variable = address space DS validates in (our shadow VAs 0x6xxxxx vs client guest VA region); next A/B: knob leaving program operands at ORIGINAL guest VAs when page identity-mappable (skip shadow rewrite for that pair only) - SESSION 153 r1298-r1306
* vgsp: CONT-88 - real program payload delivery engine-visible: ↵Arthur Hanson Rasmusson5 days
| | | | GSP_BRIDGE_INLINE_BYTES/SVC_GR_INLINE_BYTES/GSP_PHYS_GR_INLINE_BYTES 256->2048 (+static_asserts; svc_gl_flush prs[] static); svc_grce_dst_newest harvests window's REAL captured upload from svc_grce_dst_ring, svc_gl_flush attaches real 1536B@0x4350900 + 1408B@0x4350f00 (w0=0x020a0481) as inline records at own dst VAs (page-crossing split, tail page candidate); svc_grce_inline_write dual-writes engine-visible injected-pin page (svc_grce_land_write page-clamped); SPH-BIND also emits SET_PIPELINE_SHADER(2)<-0x21/(5)<-0x51 - delivery WORKS: real-upload record va=0x4350900 len=1536 first=020a0481 (engine-visible delivery), INLINE-APPLY guest=1, INLINE-RB rb=020a0481 pa=0x64cfd6000, page[7] va=0x4350000 hpa=0x64cfd6000 (r1283); wall survives real image (9/11 + ESR 0xa0000a00 +14ms; V4 window still 9/11); bind+type+real-image combo never seen on executing launch (lane wedges 1-3 launches); stores 0/900-901; next: healthy boot >=3 bind-carrying launches then harvest client init-push pipeline state (20010810 00000011 SET_PIPELINE_SHADER(1)<-0x11 + 0x204c pair) into SPH-BIND prelude - SESSION 153 r1282-r1286
* vgsp: CONT-87 - sema_gl_sph_bind (window's own binds + client's missing TESS ↵Arthur Hanson Rasmusson5 days
| | | | j=2 / PIXEL j=5 binds relocated by window pass; SPH version derives from loaded blob; INLINE-RB readback witness); stage-typed images at family VAs (TESS=vs image SHADER_TYPE->2), real-upload-wins record skip, gsp_sema_gl_sph_blob_version, prog_binds plumbing, pin-first arm - all three stages now fetch from authored VAs (sph=0,00620900,00620200,0,0,00620000); error 18 CLEARED (9/11/18->9/11); authored bytes engine-visible (INLINE-RB rb=000a0461); 9/11 survives every content A/B (V4 retag, SASS5, real w0 0x020a0481, REGISTER_COUNT, own-binds prelude, empty-blob) -> pipeline-state wall not content; real driver images in window inline writes dst=0x4350900 bytes=1536 + dst=0x4350f00 bytes=1408 (w0=0x020a0481 SPH V4) land in vGPU VRAM shadow NOT engine-read page; next: raise GSP_PHYS_GR_INLINE_BYTES 256->2048 + carry payloads in per-VA inline record or land svc_grce_inline_write via pin/fill - SESSION 153 r1276-r1281
* vgsp: CONT-86 - sema_gl_sph_version (emits Turing channel-init pair 200205a9 ↵Arthur Hanson Rasmusson5 days
| | | | 00040004 00040004 after SET_OBJECT on replayed 3D windows); gsp_phys_fault_regs_log (MME_HWW_ESR/INFO/IR + DS_HWW_ESR/ESR_2 + SPH stage starts beside every GR-class 0x1006); SDM-DROP forensic log; block-cap hardening <=4096-128; attr-prelude capture range 0x2000..0x2200 (8 pipeline records) - fault witness: failing SPH stage1 fetched from relocated shadow VA 0x620900; minimal V3 blobs rejected STRUCTURALLY (V4 retag no help); SDM drops all 0001fff0 SET_SUB_DEV_MASK legit; missing binds: j=2 va=0x4300200 TESS + j=5 va=0x4300000 PIXEL never in windows/preludes; next: author client's REAL SPH+SASS bytes at relocated program VAs (VA 0x4300900-family from unreplayed init push) as sema_gl_vs_hex/ps_hex + replay stage-2/5 binds - SESSION 153 r1273-r1275
* vgsp: CONT-84 - SA-REARM moved before window copy (was appended after, calls ↵Arthur Hanson Rasmusson5 days
| | | | ran against prelude SA clobber); WIN-PATCH reaches beef path at last (sweep runs=383 matched=4, 0x124 off65 0x2->0x1 x4); prelude-capture pages bitmask + ring-drop log 8->64 - capture completeness FIXED (pages=0x7fff -> words=3083 covered=55 sa_mask=0x63fffefffffffff code_words=2854); sema_map_add_max=4096 guard (stale host writer re-injecting stale mapping every ~2s racing per-page pins - REFUSED, first-read capture complete); sema_gl_mme_version=1 (SET_MME_VERSION 0x234, absent from capture) + sema_gl_mme_track (0x124<-0) - no change observed; GATE1 black: call-bearing launches park+poison every boot (r1245/1250/1265/1270) even w/ complete prelude+rearm+TRACK+VERSION, gen0=0 MME never starts, shadow2[c597] 0x3810=0x11 0x3910=0; trap=80001614 + transient ds a2040a00 noted; next: A/B version=0/track=-1 (lane destabilized vs MME never starts), shadow port read at first call launch, track=2 PASSTHROUGH - SESSION 153 r1237-r1270
* vgsp: SVC_MME_PRELUDE_WORDS 1024->3584 + SIGS 2048, 4-page module pushbuffer ↵Arthur Hanson Rasmusson5 days
| | | | (VA_PB3/4 at PT slots 0x103/0x104, VA_DST->0x10b, VA_SEM->0x10c, METHOD_WORDS 4096, pb2 chunk 1->3 pages) - SA table extended past slot 12 (55 slots 0..35,37..53,57,58; mission slots [34,39,40,48,51,57] all IN table), prelude doubled (words=2048 ir_end=0x265 covered=34 code_words=1873); still stubbed by one PC (collect_mask [34..57]; slot 34 entry=0x265==ir_end); temporal pattern: window pages valid only inside channel context, new PA per context, zero at resolve time; next: session re-streaming full-SA push (0x402094c ~2min after GL context) then confirm dropped_mask->0 - SESSION 153 r1162-r1165
* vgsp: setup-page demand decoupled from hold (demand rows even at hold=0), ↵Arthur Hanson Rasmusson5 days
| | | | immediate stale-ring heal at re-registration, walk-fallback USERD re-resolution (r496b FB sweep retries via svc_walk_vaspaces) + userdp diagnostics - ~12s churn ROOT-CAUSED+FIXED: hold_ms=20000 blocked the ring behind the unreadable setup entry (with 0: 458.9 FPS, submissions=7784 vs 0..112); MME wall unchanged (zero 0x114/0x118/0x11c/0x120 hits anywhere; 8GB+FB-shadow scans zero); GATE 1 RED (nonblack 765/921600, 1-row strip); next: correlate pinned client CPU pages (0x7f757af31000->0x12d800000) with GVA families by content parse, pin GVA->PA - SESSION 153 r1158-r1159
* vgsp: channel-registered logs vas=%x vas_known (0xbeef0100 hVASpace NULL = ↵Arthur Hanson Rasmusson5 days
| | | | attach-to-TSG; 0xbeef0101/102 vas=0xbeef0300 known) + svc_gr_ring_stale_heal (once/s stale-pin self-heal via client VAS walk, GR ring re-pin) - r1156 held push was a PHANTOM (e0 0x3e4ccccd=0.2f+e1 0x81e40e00 decode to 123916; float data from reused ring page) - r1157 pipeline real (9000 entry decodes, 1499 launches, chunked 1429 words, prelude gen=4 words=773); store wall = missing MME macro carrier (real 60216B push 0x4001004 head zeros, no parseable content in any client mapping); next: post-re-registration USERD resolution (channel churns every ~12s: RAM scan found no candidate) - SESSION 153 r1157
* vgsp: sema_gl_mme_keep_mask (u64, slots never stubbed/dropped), MME-PRE-DUMP ↵Arthur Hanson Rasmusson5 days
| | | | one-shot (raw words+sa_mask+IR coverage), SA data-port capture (0x120 runs), gsp_sema_mme_code_words_get - offline MME64 sim proves macro(0) loads CB offsets (0x238c<-0x320 etc) and macro(2) binds vertex streams with observed args, no poison; live A/B keep_mask works (dropped 115 vs 181 words); r1146 boot beef did NOT retire (timeout 2500ms, elapsed 8842ms, 0/902 pages) vs r1144 94us retire - re-establish r1144 state (prelude 901 vs 773 words, pages 7 shadow 6 vs 8/5, warm-sem wedged) then rerun keep 0x4/0x1 - SESSION 153 r1145-r1146
* vgsp: stub IR write real encoding SEC_OP_ONE_INC=5 (op=1 walked ↵Arthur Hanson Rasmusson6 days
| | | | 0x114->0x118/0x11c/0x120 clobbering SA[0]=1 = r1131 MISSING_MACRO_DATA), stub PC at IR-end, byte-exact END body, coverage-aware stubbing, ONE_INC ghost CALL fix (18->6 real), MME-WINRUN dump, prelude latch keyed (generation,h_object); mme_ir_end/ir_cov bitmap + USERD adopt latch clear - ATTRIBUTION ANSWERED: non-retire is NONE of the attachments (window-only also ILLEGAL_OPCODE 0/901; all-macro-noop sa_stub_all=1 still ILLEGAL_OPCODE 0/902); r1111 retire was a different frame class (5016B no-CALL) vs draw-class (7148B CALL_MME_MACRO(0)); next: MME reg sample BEFORE WEDGE-RECOVER reset + stub landing verify (stub_pc 0xf0 test) - SESSION 153 r1132-r1141
* vgsp: svc_lat_drop + trust sub-source tag (sub= in sema-pushdec) + SVC_ZRW ↵Arthur Hanson Rasmusson6 days
| | | | zero-streak table (src>=2 all-zero x2 -> drop lat/re-walk, pin when src==2), gl_win_start arms only on hdr!=0 (root cause of 5-boot capture drought: window armed on zero no-op), svc_gl_flush zero-lead advance, svc_push_pa_ceiling from gsp_phys_guest_ram_top - capture drought BROKEN (r1131 win=1429 words, 1007 section captures, 0 zero-head refusals); MME-PRELUDE ships in one launch FIRST TIME (gen=4 words=901 + window=390 -> GR LAUNCH words=1348); stores still 0 (engine fetch NONE, MISSING_MACRO_DATA ESR 0x80000001; 8.8s fallback); next: one-variable attribution (sa_stub=0 then surf_prelude=0) + same-generation SA/program capture - SESSION 153 r1129-r1131
* vgsp+diag: strict replay/hold plumbing + pushfail/unread diagnostics + ↵Arthur Hanson Rasmusson6 days
| | | | demand-record ex; guest_pin_stream vmap full-sweep resolver (unknown-family anchors), zero-head first-page acceptance, strict retry throttles - MME-PRELUDE MATURED (gen=4 words=901) but replay DROPS it (window=390 prelude=901 sa=47 exceeds block; replaying window alone) -> every launch prelude=0 timeout; GR-DEC data produced (5657 lines); retirement 0/900 no writes; next: raise replay/block capacity or two-pass prelude - SESSION 153 r1126
* vgsp+diag: anchored demand record (sema_setup_demand prints VA/off/len), ↵Arthur Hanson Rasmusson6 days
| | | | ipin-table eviction (32768 slots silently dropped demand pins; nodrop + alt stash), MME prelude 512->1024 words + SIGS 512; guest_pin_stream resolve_va_strict (host svc_stream_parse port + client-mem /proc/pid/mem+pagemap), pin_gr_stream chunked script push (MAX_ARG_STRLEN) - setup-push read NOW SUCCEEDS (plausible=1 ipin=1 unreadable=0, pa=0x2387b9000), SA table captured, MME-PRELUDE gen=3 words=443, GR LAUNCH words=934, retire 0/903 pages (no writes); new wall: NO 0x114 instruction-RAM upload in any parseable window (code=0) - prelude immature; next: bind setup-hold to the entry carrying the 0x114 uploads - SESSION 153 r1121-r1124
* vgsp+diag: SA-RAM table captured unbounded (entry[64], sema-mme-sa log), ↵Arthur Hanson Rasmusson6 days
| | | | surf geometry accessor + completeness recs, fill seeds RT candidate 0 full span (<=1024 pages, completeness only on fully-resolved run); MME slot stub (called-but-uncaptured slots end-noop IR 0xC0, sema_gl_mme_sa_stub=1), reloc prefers tracked rec bounce VA; pin family += 0x4200000 - 0x238c wall root-caused (capture truncated buffer full=28 words=512, SA[0x22]=0 jump IR 0; sim proves slot-0 emits EMIT 0x238c=0x20020); fixes never executed (setup-push read lost, unreadable=1 first8=00040000 00001000); next: trustworthy pagemap resolve or accept ipin first-chunk - SESSION 153 r1117-r1120
* vgsp: SURF-PRELUDE (replays captured C597 colour-target bind ↵Arthur Hanson Rasmusson6 days
| | | | alias-scanned+pair-relocated ahead of targetless stream3d windows - the NO-STORE cause: windows carry no render target; emitted words=7 window=391), ATTR sanitize (drops active attr words with width=0; r1113 torn 0x81a4 fixed), MME-miss census into MISS-ABORT+demand, MME-IMMATURE-SKIP; r1116: draw reaches engine, trap moved to 0x238c LOAD_CONSTANT_BUFFER_OFFSET Data=0x20020 then PBENTRY; GATE 1 static nz=2551 mean=0.083 DIFF 0 - SESSION 153 r1112-r1116
* vgsp: re-arm on MISS-ABORT (candidate re-offered unwon, releases re-parked, ↵Arthur Hanson Rasmusson6 days
| | | | 1500ms tick, 55s/64-try episode bound; GSP_PHYS_GR_RC_MISSABORT -ENOMSG), junk-operand filter (0x10000000..0x100000000 reloc misses not demanded - float constants), MME prelude latch cleared on WEDGE-RECOVER - **FIRST-EVER nonzero beef submit+retire** (GR LAUNCH submitted push=0xcf3d724 len=5016 pages=9 words=389, poll break ch=0xc0ffee02 after 64us, 12 poll breaks, 0 poisons; client 0.077->287-436 FPS); still NO-STORES (bounce 0 pages changed by engine); next: SKED CTA counters for prove dispatch-vs-degenerate + fix vertex/index operand state - SESSION 153 r1109-r1111
* vgsp: demand set 64->512 + ring-overwrite (no silent drop; ↵Arthur Hanson Rasmusson6 days
| | | | head/total/evicted in debugfs sema_setup_demand), EBADMSG return authors software release (suppresses synth), ZEROWIN-SKIP (all-zero 3D window software-released, no engine submit) - verified: demand 197 VAs past cap, MISS-ABORT convergence (submit only at miss=0), ZEROWIN-SKIP no-poison; store-bearing window still not achieved (r1106 retire root-caused zero window); r1108 slow-death (Wait for channel idle timed out + red screen on SKIP edge); next: re-arm candidate on MISS-ABORT (not consume) - SESSION 153 r1107-r1108
* vgsp: PBENTRY first-sighting watch (all 12 PBDMA intr0 bit18, ↵Arthur Hanson Rasmusson6 days
| | | | PB_HEADER/COUNT/DATA0/HDR_SHADOW dump pre-rearm, 8/boot) + PB-FAULT-DUMP voff/tail/past-end; sema_gl_sdm_drop (op-0/2/6 single-word SDM entries from preludes+window); reloc level-2 fallback; sema_gl_miss_abort (pre-doorbell abort on residual MISS, feeds pin demand); gsp_sema_demand_note + attr-prelude ptr pages demand-recorded + sema_attr_settle_ms=8000 - **FIRST BEEF WINDOW RETIRES ON REAL HW** (poll break ch=0xc0ffee02 after 68us, 737-word block) but no-store retire (0/4 pages changed, NO-STORES); residual MISS flood (miss=11..17) blocked by FULL demand set (64/64 MAX) - SESSION 153 r1103-r1106
* vgsp+diag: attr/pipeline prelude (families 0x1100-0x1200/0x2000-0x2060, ↵Arthur Hanson Rasmusson6 days
| | | | dedup, 512w, program-pair VA record; emitted via patch_window relocation, run-aligned after MME prelude), mature-prelude gate (>=64 0x114 code words, sema_gr_prelude_gate_ms=60000 busy-defer), pin_gr_stream 0.75s pass, trap regs in sked sampler - first clean DS+MME (ds_esr=80000000 mme_esr=80000000, a2040a00 gone); 0x1168 CLASS ERROR persists as MME-MACRO-GENERATED WRITE (no 0x1168 header in emitted stream; macro(2) args [0,0,600000,0,610800]); next: disassemble macro (2) at pc 0xa + trapped-addr read pre-latch - SESSION 153 r1095-r1100
* vgsp+diag: debugfs sema_setup_demand (armed setup-hold VA set, 0444 ↵Arthur Hanson Rasmusson6 days
| | | | seq_file) + pin_gr_stream demand loop reads it (kills dmesg-ring race; 20s resend/300s expiry), bounded 3D raw dump of pre-drop window - MME-PRELUDE emitted gen=2 words=512 (context alive submissions=760); NEW WALL: first beef window loads context + clean MME (mme_esr=80000000) then Class Error ChId 0001 Class 0xc597 Offset 0x1168 (SET_VERTEX_ATTRIBUTE_A(2)) ErrorCode 0x5 + poison; emitted attr runs byte-faithful; next: attr/pipeline prelude (0x1100-0x1200/0x2000-0x2060) + gate first launch on mature prelude - SESSION 153 r1091-r1094
* vgsp+diag: resolver GL pushbuffer families (0x4000000/0x42000000 learn-once ↵Arthur Hanson Rasmusson6 days
| | | | byte-exact, raw-tail newest-first scan), setup-hold demand cap 0x8000->0x10000 (60216B push=16 pages), pin_gr_stream harvest 2MB - r1089 target reached: setup push readable (unreadable=0), MME prelude captured words=511; beef context still tears down (submissions=0); demand races dmesg ring (manual demand fixed r1090); host / was 100%, freed ~6G - SESSION 153 r1088-r1090
* vgsp: sema_gr_setup_hold_ms param (default 0) - setup-push detect (>=12288B ↵Arthur Hanson Rasmusson6 days
| | | | or MME-setup families in scan), hold arm on first unreadable read with 8x4K demand to stalled-VA channel, deadline consult at consume gate; r1079-readable setup captured words=511 (contrast r1083/85/87 zeros = setup-push read lottery root); hold fired but guest resolver covers only 0x120000000-0x121000000 - next: extend resolver to GL pushbuffer VA families - SESSION 153 r1083-r1087
* vgsp: MME setup prelude - capture client MME context-setup runs ↵Arthur Hanson Rasmusson6 days
| | | | (0x114..0x124/0x234/0x550..0x568/0x3400..0x34fc) verbatim, exact-run dedup, 512-word buf + gen counter (sema_mme_prelude_cap); one-time-per-generation preplay in GR launch build (sema_gl_mme_prelude); capture verified - full macro program 11 SA/IR pairs ~206 code words, MME-PRELUDE emitted gen=5 words=444; no further mme_esr=80000004 after prelude (r1079); remaining: setup push unreadable=1 skip before pin demand; r1082-class content-independent dispatch stall - SESSION 153 r1078-r1082
* vgsp: in-flight MME/fault capture (ds_esr/mme_esr/mme_pc/mac/ir/mth regs at ↵Arthur Hanson Rasmusson6 days
| | | | 5ms sked sampler), PB-FAULT-DUMP+WINPROBE+window-dump budgets raised, BLOCKVAL stream validator, subdrop (multi-word runs subchannel!=0 dropped), sema_mme_census - ROOT CAUSE: real MME ILLEGAL_OPCODE on CALL_MME_MACRO(2)=0x3810 with no macro program loaded (mme_esr=80000004 mme_pc=0 mme_ir=1); client's MME setup (0x120 LOAD_MME_START_ADDRESS_RAM, 0x124, 0x3400 scratch) never forwarded; 0x1c00+j*16=SET_VERTEX_STREAM_A_FORMAT(j); next: MME setup prelude injection - SESSION 153 r1073-r1077
* vgsp: svc_push_page_heal (beef push all-zero read re-resolves via ↵Arthur Hanson Rasmusson6 days
| | | | launch-page chain, pin/cache, src=10; sema-pushzero len cap 1024), mme-reloc-rsv (MME-family payload miss resolves via RELOC-FIXED ledger/pin/walk shadow-map), pin_gr_stream pushzero 4K-page bulk demand (48/batch); HW retire only with A+0x34a8+C dropped - draw payloads live in exactly the refused families (0x1c00-0x1c20 MME macro-code uploads / 0x3810 CALL_MME_MACRO); Graphics Exception ChID 0001 Class 0x0000c597 Offset 0 - SESSION 153 r1070-r1072
* vgsp: sema_gl_mme_reloc (CALL_MME_MACRO/DATA payload relocation via launch ↵Arthur Hanson Rasmusson6 days
| | | | pages, raw-operand fault fix), MME-page collection + 4KB ptr dedup, 0x1b00 pair-relocation, sema_gr_wedge_recover (TSG-preempt re-arm on 0xbadf, revived channel: REAL GR SEM OK 0xc0ffee01), win_drop_auto += 0x1b00 - BEEF LAUNCHES RETIRE (h=0xbeef0100 ch_rel=0xc0ffee02 elapsed_ms=0 ok=6, 3 consecutive); full-perimeter windows still wedge in [0x1200,0x7ffc); client registration 5/5 with keeper - SESSION 153 r1058-r1063
* vgsp: 3D flush gate fix (built-in chunk bound, not bisect knob), pushzero ↵Arthur Hanson Rasmusson6 days
| | | | zero-content rescue (probe PROMOTE_CTX, src=9), CHUNK1 dump, SET_INDEX_BUFFER+vertex-stream collection; publish GPFIFO entry at engine GP_GET (PUT-GET=1); win_drop 0x parser fix - beef chunks still PBDMA-stop at 0x1160 attr run (hdr=20030458 INC m=0x1160 cnt=3) while X retires ch_rel=0xc0ffee02 same boot - SESSION 153 r1034-r1041
* vgsp: 3D stream chunking for client pushes - GR push words 512->2048, ↵Arthur Hanson Rasmusson6 days
| | | | candidates 4->8, method-aligned <=384-word chunks in ring order with 8-pending backpressure (sema_gl_chunk_words knob), zero-head guard, PBDMA chunk-end fault fix, 3DSTREAM dump; first client src=stream capture (h=0xbeef0100 push=0x54eefd4 len=1580 nprog=2 recs=2), ch_rel=0xc0ffee02 submitted; beef windows still don't retire (scheduler stall vs X retiring same boot) - SESSION 153 r1028-r1033
* vgsp: zero-put-skip for GR chan userd (fixes r1025 poisoned latch; ↵Arthur Hanson Rasmusson6 days
| | | | submissions regression FIXED 32501/33646), revert op-translate walk-first (oops with flowing submissions; keep fill walk), NEW sema_screen_blit param - present blit PROVEN byte-exact (src=0x130e38000 spitch=1200 w=300 h=300 -> off=0x200000 rows_done=300 rc=0; window md5 b237eb04->4b751df8); remaining: client draws must execute (GR LAUNCH FAILED timeout ch_rel=0x00000000 want=0xc0ffee02, zero src=stream) - SESSION 153 r1026-r1027
* vgsp: op-translate + fill floor walk-first for below-floor (sub-1TiB) VAs ↵Arthur Hanson Rasmusson6 days
| | | | via guest page tables - kills LOWFILL-REFUSED va=0x120458c00 pa=0x120458c00 that froze DDX screen repaints (fresh boot: fills done=3686400 rc=0, LOWFILL-REFUSED=0); xwd path proven byte-exact vs vidmem 0x200000 fill artifact; window still black (client re-presents static frame; no client content in vidmem); r1025 beef0100 pump regression (GPFIFO va=0xa0d8f54 all-zero, submissions=0 vs 208) - SESSION 153 r1024-r1025
* vgsp: svc_client_slot_sweep - per-pass (~2ms) clear of armed 0xffff ↵Arthur Hanson Rasmusson6 days
| | | | completion slots for live beef channels; attempts now submit heavily (submissions 29->208, GP_PUT advancing put=14, sema-consume idx=94 put=95, ops_runs=2, copyent total=131068); client shim frames have content (mean_sum=60.8 nz_frac=0.2843); remaining wall = X presentation (DDX black fill va=0x120400000 vs client copy dst=0x4700000) - SESSION 153 r1024
* vgsp: sema_client_slot - clear armed 0xffff completion slots below ↵Arthur Hanson Rasmusson6 days
| | | | beef-family channel-notifier base in svc_notify_complete; first real client submissions (submissions=29, sema-pushall h=0xbeef0100 va=0x421f758 len=1720 allow=1 trusted=1); attempt still recycles ~12s - SESSION 153 r1023
* vgsp: apply userdOffset[subDeviceId] to channel USERD addr (real control ↵Arthur Hanson Rasmusson7 days
| | | | page fb 0x20fc00, not 0x18fe00); low-aperture 0x4000000-class entry window; GR-ring USERD probe accepts g>p/put-cap>1024; own-VAS-first counter derive - USERD wall broken (chan h=0xbeef0100 userd=0x20fc00 as=2 ring rc=0 pa=0x233603000); new wall: client never stores GP_PUT (put=0, FB 0x20fc00+0x8c frozen; last RM call ZCULL_BIND 0x20801208) - SESSION 153 r1016
* vgsp: FB USERD scan time-paced (1/25ms, cap 512) + pristine fallback for ↵Arthur Hanson Rasmusson7 days
| | | | ring_pa==0 - fixes fresh-boot Xorg 10s DMA-init wall (2/2 boots green, DDX channel sub=3402, TWOD fills execute) - SESSION 153 r1014-r1015
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-06 05:26:05 +0000