summaryrefslogtreecommitdiffstats
path: root/kernel/gsp_sema_service.c
Commit message (Collapse)AuthorAge
* vgsp: complete the X DDX's push-buffer notifications and class-aware display armArthur Hanson Rasmusson20 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Four fixes, built and validated on fresh boots (r1675/r1677): - gsp_display_engine: gsp_disp_update_armed() is class-aware. NVC57D (core) carries the NOTIFY bit (12:12); NVC57E (window) has no NOTIFY bit, so a bound notifier ctxDMA is the arm. Every c57e window flip computed armed=0 before this, so FINISHED and the channel event were never authored and the DDX's composite/flip waits sat out their timeout. - gsp_sema_service: complete the bfef family's NvNotification status (0x8000 -> 0) in svc_client_slot_sweep(). The DDX marks the record IN_PROGRESS before a submit and the GPU (or RM) must write it back to 0; the emulation never did. - gsp_sema_service: sema_gl_hold_apply (default 0) applies a decoded GL release forward-only at svc_gl_flush() out: when the draw section is not captured, with a stale-value and 1 MB jump guard. - gsp_sema_service: extend the 0x8000 sweep to the X DDX's own RM channels (h=0x01xxxxxx). pb_armNotifiers() writes 0x8000 at notif+0xe and pb_wait() polls it back to 0; the bfef-only filter skipped these channels, so the 8 s submit wait expired ("WAIT (2, 8, 0x8000, ...)" then "Wait for channel idle timed out") even though the class2d NOTIFY ack had zeroed the same page before the arm. Evidence: r1675 keeps the X alive past the old 212 s crash point with 0 "Caught signal" lines; the DDX's 2D pipeline runs (get word advances), the host decodes live 3D method streams (VP-METHOD ... 0x1618 BEGIN topology) and the release sweep applies thousands.
* vgsp-sema: read a channel's push through the VAS it declaredArthur Hanson Rasmusson24 hours
| | | | | | | | | | Several VA spaces can map the same GPU VA. The push read's learned/pin chain is global over VASes, so the GL client's CE channel 0xcaf00012 (which pushes at 0x120000000) was answered with a zero page from another VAS and every entry was 'unreadable' while the channel's own VAS mapped the real method stream. Try the channel's declared VAS first; fall back to the existing source chain when it has no published directory or the walk misses.
* vgsp-sema: keep the scrubber release alive while the event pump blocksArthur Hanson Rasmusson24 hours
| | | | | | | | | | | | | | | | | | The guest's PMA scrub wait and the host's status-queue pump can deadlock: the X server's scrub wait holds the guest RM lock the status consumer needs, the ring fills, and every critical event post then waits out its full 200 ms ring-full budget. A service pass can take many seconds, so the next pass's scrub step - the only thing that can release the scrub wait - is starved and the guest never makes progress. Run the scrub step from inside the send path's ring-full wait (service thread only), and re-resolve the scrubber's finish/host-sema words on every pass instead of once: the guest re-creates its RM kernel VAS and re-maps the channel buffer under the same GPU VA (observed: gpfifo VA 0x120064000 moved from PA 0x127e6a000 to 0x1122e9000), so a once-only resolution authored a page the guest no longer polled. Prefer the RM kernel VAS (h=0xc) RAM mapping over a client VAS vidmem mapping, and force re-resolution when a scrubber re-registers.
* vgsp-sema: resolve the scrubber's finish words through the GPU page tablesArthur Hanson Rasmusson25 hours
| | | | | | | | | | | | | | | | | | | | | | The guest PMA scrubber's host-side completion (channel buffer + pbSize + entries*8) was resolved through the learned VA->PA pair map first. When the guest reused the scrubber's GPU VA for a new channel buffer, that map still named the previous allocation's page, and the host authored the finish payload there while the guest polled the new page through its kernel VAS (h=0xc). r1667 live proof: walk_probe 0x12006c000 -> only VAS[1] (h=0xc) resolves to PA 0x10812a000 (the page the guest's vmalloc mapping of the channel buffer points at, and the value it polls); the pair map returned 0x10526a000. Writing the finish value to the correct page (via the guest scanner registration) immediately released Xorg from the RM memory-manager wait and the queued GSP status records drained. Changes: - svc_scrub_pass(): resolve hsem/fin through svc_walk_vaspaces() first, fall back to the pair map only when no VAS maps the VA. - Struct svc_scrub gains authored_gen; a new pa_gen (fresh scanner registration or a corrected derivation) forces one authoring pass even when the scrubber's PUT did not advance, so an already-waiting guest is released without a new submission.
* vgsp-sema: derive and register the guest scrubber finish-payload wordsArthur Hanson Rasmusson27 hours
| | | | | | | | | | | | | | | | | | | | The X DDX's NV_ESC_RM_VID_HEAP_CONTROL (ioctl 0x4a) allocates scrubbed pages through the guest PMA's CeUtils scrubber channel; it waits on the channel buffer's finish payload (channelWaitForFinishPayload), which the host's svc_scrub_pass was supposed to author but never did because the guest scanner had not registered fin_pa/hsem_pa (pa_ok=0 in every run). The channel buffer is pb + GPFIFO + sema + finish, and the scrubber's GPFIFO VA is pb + pbSize, so the host semaphore is gpfifo_va + entries*8 and the finish payload is that +4. Resolve that VA through the learned map or the VAS walk at the first pass and register the PAs in place (SYS aperture only). r1665: `scrub geometry hsem_va=0x12006c000 fin_va=0x12006c004 -> hsem_pa=0x10f46a000 fin_pa=0x10f46a004`, then `scrub author put=1..11` and the X server left the kernel scrub spin entirely: perf on Xorg is now 100 % in nvidia_drv.so+0xaee70 (a DDX userspace loop, next wall) with no _nv018351rm/_nv015102rm samples.
* vgsp-sema: capture the X DDX kick arm without a USERD and author its completionArthur Hanson Rasmusson27 hours
| | | | | | | | | | | | | | | | The X server's class2d kick channel (bfef0002) has a 2-entry ring at a page end (0x1203cfff0) and an FB userd offset the guest never writes; the pump's USERD-miss path returned before the entry-0 arm decode, so the class2d SET_NOTIFY target was never captured and every kick push had no address. Decode the ring head directly when the USERD is missing (the ring PA still resolves) and author the zeroed NvNotification at the captured target. r1664: the first bfef0002 instance still missed, but the re-registered one adopted its USERD on the PUT step (put 1 -> 2) at pa=0x10fecc000, decoded its pushes at 0x1203c0000 (len 32/64, have_rel=1), and the notify2d writes fire at va=0x12000d0b0. Xorg's spin moved off the control wait (_nv015102rm 66 % -> 0) and now sits in _nv018351rm (30 %); GZDoom still spins in glcore.
* vgsp-sema: discover direct-GL CE userd pages; complete kick slots; ↵Arthur Hanson Rasmusson27 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | post-reboot diagnostics The direct-GL GL client's CE channels (beef0101/0102) declare a pool-relative FB control page (0x244f800 / 0x244f400 in r1656) while their GPFIFO ring is mapped in guest RAM, and their ring publishes from slot 2 (entry 0 stays zero). The entry-0 layout gate could never fire, the BAR0 fallback rejects offsets past its 16 MB shadow, and the GR-only VRAM shape scan never ran for them, so the channels retired with submissions=0 and the client's CE releases were never applied. r1661/r1663 evidence: enabling the VRAM shape scan for the beef CE family (hole-tolerant entry validation, newest-slot required, a GET bounded to one ring) finds the real control page (fb 0xa00000, put=1) and the CE push at 0x40e0000 decodes; beef0101 now retires submissions=1 with its semaphore releases applied. Also: - resolve the non-pool direct-GL semaphore window (0x4000000..0x4300000) through every published VAS translation (the general resolver can name a stale page while the client polls the beef0300 walk page); - author 0xffffffff in the beef channel's 128 kick-slot records (the glcore 570.144 kick wait polls exactly that payload; r1662 writes are visible in the guest page, but this is not yet the X-server wall); - one-shot nonzero-word dump of the beef0100 push (r1663 proved the GR init push's host semaphore is a true 32-bit VA 0x4238000 payload 1 with hi=0 in v1, so that release is correct); - name CE/GR in the VRAM-scan adoption line. Next wall (r1663): the X server spins in _nv015102rm/os_schedule (66 %) and _nv018351rm (30 %) after the GL client's GLX request; GZDoom blocks in _xcb_wait_for_reply. The display UPDATE completion event was posted and re-posted at 12:12:20, so this is the flip/GLX-sync path, not the lost UPDATE event.
* vgsp-sema: scope GR release deferral to the push's own candidate; fan ↵Arthur Hanson Rasmusson30 hours
| | | | | | | | | | | | | | | | | | | | | | | direct-GL completions The GL client's direct-GL init push (beef0100, va=0x4000000) decoded its release (rel=0x4238000 pay=1) but never applied it: svc_fwd_defer_arm() is global over the cross-pass GR candidate ring, so stale unoffered CUDA/RC candidates made any later push "defer" its release. The record was then wiped by the next decode pass (the r824 failure mode) - no sema-sw, pending or deferred line, and the client's fence never advanced. Apply the r824 rule already used by the C56F site to the SET_REPORT_SEMAPHORE and LAUNCH_DMA sites: defer only when the candidate ring entry belongs to this push (push_va match). A release whose push owns no candidate applies inline. Also queue svc_rel_apply_906f() releases on a translation miss instead of dropping them, add a bounded low-VA sema-sw provenance window, and fan direct-GL semaphore completions (0x4000000..0x4300000) through every published VAS translation (the general resolver can name a stale page while the client polls the beef0300 walk page). Evidence: backups/evidence-20261002-victory/r1656 (beef0100 release decoded, never applied) and r1657 (sema-sw va=0x4238000 rb_ok=1 after the fix).
* vgsp-sema: carry/decode the class2d kick notification targetArthur Hanson Rasmusson30 hours
| | | | | | | | | | | | | | | | | | | | | | | | The GL client arms its class2d kick channel with SET_NOTIFY_A/B + NOTIFY in the first GPFIFO entry, then submits short kick pushes (NOTIFY only) that rely on the target staying programmed in the channel context. Two host gaps left the short NOTIFY with no address, so no completion was authored and the client spun in its kick/fence wait: - a same-handle channel re-registration memset() erased notify2d_va even though the guest kept using the target from the previous incarnation; - the pump's walk seed consumes only the newest entries ending at the live PUT, so entry 0 (the arm) could be skipped forever. Preserve notify2d_va across a same-vgpu, same-handle, same-session re-registration; fall back to it in the GL kick executor when the section did not re-arm; decode the skipped head entries (bounded, up to 8) on discovery and from the pump when the kick-family channel still has no target; and name a NOTIFY that arrives with no target instead of dropping it silently. Evidence: backups/evidence-20261002-victory/r1652..r1655 (kick channel 0xbfef0002, short NOTIFY without SET_NOTIFY, walk seed last_get skipping entry 0). Not yet observed clearing the GL client's glcore spin.
* vgsp: retry deferred display completions; escalate the UVM init-slot releaseArthur Hanson Rasmusson30 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Two live walls from the r1649/r1650 windowed-GZDoom runs: 1. Display completion wake-up. All NV01_EVENT registrations carry hSrcResource=0, so gsp_rm_post_channel_event() always takes the shotgun fallback, which skips events posted within the 250 ms hint dedup. When the display UPDATE is the channel's last push, the pump's retry was gated on new work (put != consumed) and never ran, so the X server's flip wait spun in _nv018351rm/os_schedule forever. Add gsp_rm_post_channel_event_force() (bypasses only the hint dedup; the event burst cap and status-ring free-space discipline still apply), a per-channel event_retry_at, and an idle-pass retry every 250 ms that logs "re-posted after deferral". Also move event_burst_at after the cap check so refused retries cannot keep the window fresh. 2. UVM channel init slot. r1651 gdb proved the channel's tracker entry waits for value 2 while the authored pool word reads 1; a manual write of 2 cleared uvm_push_end_and_wait. The channel's control-entry + init pushes are boot-time configuration, so keep the rank slot moving for 10 s after first submission: one attempt per 250 ms per rank, escalating 1->2->3->4 through every published VAS translation. Values beyond that need the real CE push decode. Evidence: backups/evidence-20261002-victory/r1649/ (X spin perf, event journal), r1650/ (re-post lines), r1651/ (tracker entry value=2, manual write clears the spin).
* vgsp-sema: fan pool releases through every published VAS translationArthur Hanson Rasmusson31 hours
| | | | | | | | | | | | | | | | | | | | | r1647 showed the pool semaphore page can move between the RM memdesc, the self-discovered directory and the per-client VAS directories. The first-success walk landed on a stale directory that mapped the pool VA to the old page (0x2600000) while the guest polled the live page (0x126502000): the UVM channel-init tracker read 0 and GZDoom spun in uvm_push_end_and_wait. A manual write to the live page cleared the spin. Add svc_walk_vaspaces_collect(), which walks one VA through every registered VAS and returns the distinct translations, and svc_pool_write_all_vas(), which writes a pool value through each (forward only, read-back proven, identity and unreadable pages skipped, bounded log). Pool releases and the tracker-slot fallback now fan out through the collected translations in addition to the boot primary/secondary candidates. The counter is forward-only, so a duplicate on a stale semaphore page is harmless. Evidence: r1649 (all six UVM channels authored; GZDoom leaves uvm_spin_loop and advances to the GL client path).
* vgsp-sema: author the UVM init-push release at the channel's own rank slotArthur Hanson Rasmusson31 hours
| | | | | | | | | | | | | | | | | | | | | | | | r1645 live proof fixes the channel-pool slot mapping: UVM allocates one tracking semaphore per channel in channel-creation order, so channel rank N owns pool slot N, and channel_init() waits for payload 1 at that slot. The r1642 rank+1 fallback pre-satisfied the next rank before its uvm_gpu_semaphore_alloc() zeroed the slot; the value was lost and the guest spun in uvm_push_end_and_wait (r1644/r1645: manual write of 1 to the rank-1 slot cleared the spin). - pool-tracker apply now targets slot = ce_index and fans the value out to the secondary pool-page candidate, which flaps between the RM memdesc and the guest's VAS walk (r1645: the guest polled the walk page while the boot cache named a stale, reused page). - first-submission authoring no longer requires an unlatched ring. A latch with put=get=0 still needs the release (rank 5, r1646), so every UVM CE pool channel authors its own rank slot once when the work-submit notifier clears; one-shot per rank, forward-only, idempotent. - widen the UVM CE GPFIFO window filter to 0x121800000. Evidence: backups/evidence-20261002-victory/r1645 (channels advanced once the rank slot was written) and r1646 (ranks 0-4 green; rank 5 exposed the latched-but-undecoded gap).
* vgsp-sema: release the UVM channel tracker slot tooArthur Hanson Rasmusson43 hours
| | | | | | | | | | | | r1642 gdbstub proved the guest polls pool map slot 1 while the push releases slot 0: rank-0 UVM channel's uvm_gpu_tracking_semaphore resolves map_base + index*4 (index=1) = 0x121000004 (PA 0x104ea2004), the release decoded from its push targets 0x121000000, and writing the payload into 0x104ea2004 cleared uvm_push_end_and_wait. When a CE channel releases the pool map page, also apply the forward-only value to map_base + 4*(rank+1) through the verified pool resolver (read-back proven), and log pool-tracker-wr.
* vgsp-sema: backfill a promoted pool semaphore pageArthur Hanson Rasmusson44 hours
| | | | | | | | | | | | | | r1640: UVM's channel-pool release was written to the boot-cache page (pa=0x2600000) and 54 ms later a verified VAS walk promoted a different page (pa=0x103ac0000, sysmem) to primary. The value was never carried over, so the guest tracker polling the walk page read 0 and GZDoom spun forever in uvm_channel_manager_create -> uvm_push_end_and_wait -> uvm_spin_loop. On every primary/secondary swap in svc_pool_boot_store(), max-merge the old primary page into the new primary page (semaphore words are forward-only monotonic counters; read both pages first, never write on a read failure, never merge a page into itself) and log pool-merge.
* vgsp-disp: host-side EVO display engine (channels, push buffer, notifier, ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | raster) The guest nvidia-modeset drives the display through per-channel NV-DMA push buffers kicked via the BAR0 UDISP control windows. Emulate that engine contract host-side, unmodified guest: - channel registration: display-channel RM objects (core 0xc57d, window 0xc57e, cursor 0xc57b, 0xc57a) are noted from the alloc stream, and the internal control NV2080_CTRL_CMD_INTERNAL_DISPLAY_CHANNEL_PUSHBUFFER (0x20800a58) records each push buffer (guest PA, size, class, instance, validity); - PUT polling + GET publication in the channel control pages (core 0x680000, window 0x690000+n*0x1000, cursor 0x6D8000+n*0x1000); - NV-DMA method parser (METHOD/ONE_INC/NONINC/JUMP/SET_SUBDEVICE_MASK) with the wrap-JUMP follow; - completion: SET_CONTEXT_DMA_NOTIFIER / SET_NOTIFIER_CONTROL tracking, exact notifier-surface resolution through the display instance hash table (no heuristic writes), NV_DISP_NOTIFIER FINISHED on UPDATE (0x200), and the channel completion event post; - free-running 1080p60 raster line for NVC57E_GET_LINE. All effects are behind independent knobs (disp_engine, disp_finish, disp_vblank, disp_events, disp_notifier_pa) with verbose diagnostics (disp_dbg, disp_dump), so the previous behaviour stays one load away.
* vgsp-sema: ack the class-2d IMMD NOTIFY from the X DDX syncArthur Hanson Rasmusson3 days
| | | | | | | | | | | | | The X server's nvFermiSync queues the class-2d completion as IMMD_DATA methods (SET_NOTIFY_A/B + NOTIFY 0x10c WRITE_ONLY). The run-shaped watchdog form was already handled; the IMMD form fell into the default case, so the zeroed NvNotification was never authored and the server spun in WAIT (0,8,0x8000,...) with the status left IN_PROGRESS. Handle the IMMD form and treat the 0x8000 IN_PROGRESS status as armed in the keepalive scan. The mode-set then completes and the 2D sync acks (verified on the emulated vGPU: no WAIT, sema-notify2d zeroed). The A/B knob sema_2d_notify_immd=0 restores the old dropped-NOTIFY behaviour.
* vgsp-gl: author the PS/TCS stage images for the emitted mask slotsArthur Hanson Rasmusson4 days
|
* vgsp-gl: GS SPH placement/maps/context A/B knobsArthur Hanson Rasmusson4 days
|
* vgsp-gl: GS-mode/FASTGS variants for the synth GS SPHArthur Hanson Rasmusson4 days
|
* vgsp-gl: synthesized GS SPH image + map variants for the SPH18 gateArthur Hanson Rasmusson4 days
|
* vgsp-gl: bounded setup-push hold for maturity debuggingArthur Hanson Rasmusson4 days
| | | | | | | | | | sema_gr_setup_hold_ms (default 0, clamp 2000 ms) holds/defer the draw window while the 60216-byte setup push pin is landing, replacing the ~50% IMMATURE-SKIP lottery. Measured: 2000 ms stalls the ring behind the unreadable 0x4021004 entry (8 launches then silence), so the default stays 0; the param is a debug gate only. r1557 with hold=0 produced 64 beef launches and the DS A/B baseline 80000000->a0040a06. Evidence: Handoff cont 8.
* vgsp-gl: spend the draw-coverage receipts on real-CB drawsArthur Hanson Rasmusson4 days
| | | | | | | | | The GL-COVER 12/boot budget was consumed by the pre-CB (synthetic identity) draws, so no clip-coverage receipt ever described a draw that used the client's real fixed CB. Emit the receipts only while svc_gl_cb_img_valid and re-arm the counter whenever a new CB image passes the strict projection gate, so the first draws after the real matrix lands carry the cover receipt.
* vgsp-gl: deliver the fixed CB to the engine-visible seed page directlyArthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | | | | | The r1515/r1520 decode assembles the client's real fixed-CB image, but svc_gl_cb_copy()'s write to the forced seed VA (0x120700000) is refused by the r1506 authoring-VAS rule: the seed page belongs to the X server's VAS, so the beef channel write only updated the VA shadow while the engine kept reading the black screen page at pa 0x500000 (r1521 seed dump: the image never arrived; the engine fetched the RT clear). The seed is a service-forced engine input, not a client write, so resolve its VA through the VAS/walk/trusted chain and write the backing shadow/FB page directly with svc_write_ap(), bypassing the ownership rule. A bounded CB-SEED receipt reports the destination PA, aperture and the m80 words. Validated in r1522: the seed backing store at dpa 0x500000 holds the assembled image (m80 = the client's projection, e.g. 40a00000/40d55555/ bf9745d1/4211745c/bf800000/42200000) and cb-copy uses src=const-upload (ssrc=15).
* vgsp-gl: decode the 570.144 MME-wrapper fixed-CB upload formArthur Hanson Rasmusson4 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | The guest GL driver streams the fixed constant buffer through the C597 MME macros, not the native SET_CONSTANT_BUFFER_SELECTOR/LOAD_CONSTANT_BUFFER methods the r1515 scanner decodes: - CALL_MME_MACRO(0) = SETUP_FIXED_CONST arrives as an IMMD run at method 0x3800 carrying the VPC dword offset (the macro converts it to a byte address, so the fixed-CB offset is imm << 2). - CALL_MME_MACRO(57) = LOAD_CONSTANT_BUFFER_BUG2548370 arrives as a run at 0x39c8 whose payload is [count][count dwords]; the macro writes the data at the current fixed-CB offset and auto-increments it. - CALL_MME_MACRO(58) = LOAD_CONSTANT_BUFFER_OFFSET arrives at 0x39d0 with [offsetBytes]. r1517's own CHUNK1 dump of the 7144-byte draw window carries the real glxgears MVP this way (pixel-space 5.0/6.667 scales, -1.1818/36.3636 near/far row and the -1/40 w row = glFrustum(-1,1,-0.75,0.75,5,60) x translate(0,0,-40)); the old scanner ignored those runs, assembled only the 10 state-patch words, and the strict gate never passed, so every launch ran with the synthetic identity and the geometry clipped. With the wrapper form decoded the assembled 4 KB image carries the client's real MVP at c[0x0][0x80..0xbc], passes svc_gl_cb_mvp_ok(), and svc_gl_cb_copy() delivers it to the forced MME seed page as src=const-upload (src_ssrc=15) instead of synthetic-id.
* vgsp-gl: decode the client fixed-CB upload runs and gate the assembled imageArthur Hanson Rasmusson5 days
|
* vgsp-gl: receipt the draw's clip coverage and refuse non-MVP fixed-CB pagesArthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r1512 adds one bounded GL-COVER receipt per replayed draw. It decodes the window's index buffer (0x17c8/0x17d8 + size), the stream-0 stride (0x1c00) and position offset (0x1160), resolves the CALL_MME_DATA (0x3810) stream base, reads the referenced vertices and evaluates the clip-space position in Q16.16 integer math with the exact c[0x0][0x80..0xbc] block the replay delivers, printing per-vertex clip codes plus clip/NDC/screen bboxes and the injected viewport scale/offset/clip. It also prints the fixed-CB copy provenance and tries the client's own scratch18 page read-only. Measured (r1512): real gear vertices (stride 24, position offset 0, 3.549 0.852 -0.5) but the delivered "matrix" was a rotation block (row3 = 0.1268 0.9922 0 1), giving clip w ~= 1.1 instead of the camera distance (~40) and 57/64 sampled vertices outside clip. The draw was clipped by a non-projection constant block, not by zero/garbage VS output. r1513/r1514 fix the source: the fixed-CB copy now prefers the client's SET_MME_SHADOW_SCRATCH(0x18) page and the client-CB VAs its own writes published (0x43e0000/0x4450000), requires a strict projection shape (|row3.x|,|row3.y| < 0.02 and row3.z/w not both zero), and the resolver no longer accepts an unresolved PA 0 page. Non-MVP pages (including the old forced 0x0cd70000 page) can no longer become the seed; when no real page is found the r1476 identity positive control is used. r1513/r1514 receipts: the strict gate finds no readable client MVP page on these boots (the client's fixed-CB content is not materialised in the emulated memory), so the seed is the controlled identity and the identity still clips gear radii > 1 (12 launches r1514, 20 poison, no fragments; root xwd 2 nonblack pixels at (216,0)-(409,2) 0x77edc). Next wall: get the client's fixed-CB contents into its own page (emulate the VPC/ LOAD_CONSTANT_BUFFER writes from the init push) so the VS receives a real MVP. Build: make -C kernel (green). Evidence: backups/evidence-20261002-victory/r1512..r1514.
* vgsp-gl: sweep the beef ring head for the client's init uploads and ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | | | | | | | quarantine the screen/code-heap overlap The GL client's one-shot LOAD_INLINE_DATA uploads (code images, vertex and index buffers) sit at the head of its GPFIFO ring, but the first observed GP_PUT can already be far past them (r1508: put=8982), so the continuation sweep never decoded them and the FB fetch pages stayed zero. Sweep the head once per beef channel in inline-only mode with the read-arbitrated, tail-aware decoder: r1509 receipts show 'sema-utilsweep swept=64 writes=16' and 'inline write dst=0x44ff000 -> pa=0xb9f000 bytes=1550 data8=9a996940...', after which sema_probe reads the client's real vertex floats and the u16 index stream at 0xb9d410/0xb9fcc8. The guest's shader/code-heap BAR1 upload can also land on the captured X screen's pages (r1508/r1510: vidmem 0x200000 held a program image while the X screen VA 0x120400000 maps there). Snapshot the captured surface at bind time; before a launch whose surface page 0 carries the code-heap/SPH signature, restore the surface from that snapshot (a black X-clear baseline when the bind happened after the upload). The quarantine is content-gated, preserves raster stores that follow, and r1509/r1511 show the clean page 0 (0xff000000) with no code bytes.
* vgsp-gl: scope client inline writes to the authoring VAS and receipt surface ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | | | | | | | | ownership The captured 1280x720 colour-target bind is the X server's screen (VA 0x120400000, 900 contiguous FB pages from 0x200000 to 0x583000 in the emitting VAS 0x10005). The GL client uses the same 0x1200xxxxx VAs for its own allocations; its fixed-CB write (0x120700000) was resolved through the X VAS by the global cross-VAS walk and overwrote screen page 0x500000 with the CB matrix. Resolve client inline writes through the authoring channel's own VAS (GR handle 0xbeef0100 inherits its CE siblings' VAS 0xbeef0300) and refuse cross-VAS translation for a channel-owned page whose own VAS does not map it (VA shadow instead). Receipts: SURF-OWNER (emitting channel, VAS span coverage first/mid/last PA, retarget) and GRCE owner-vas. Add viewport mode 7 (the client's 800x600 window viewport) and a VP-METHOD census of viewport-family runs in trusted pushes; a bounded BAR1 screen-range write witness. r1506: the CB no longer touches the screen (vidmem 0x500000 reads the black clear), screen ownership proven. r1507/r1508: the active indexed draw's vertex/index pages are all-zero in its own FB shadow in those boots, so no fragments; the client never emits a real 0x0a00 viewport block (the 0xa00 hits are misaligned vertex floats), so the viewport stays synthesized.
* vgsp-gl: scope program pages to the emitting VAS, make the MME prelude ↵Arthur Hanson Rasmusson5 days
| | | | boot-independent, and discover the fixed CB by content
* vgsp-gl: deliver the real pixel-stage image and receipt the active draw's ↵Arthur Hanson Rasmusson5 days
| | | | topology/index args
* vgsp-gr: deliver empty FB fetch pages from real FBMEM, discover the CB per ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | | | | | | | | | boot, clear the DS latch after each window The active indexed draw's vertex/index buffers resolve through the client's page tables to vidmem pages whose emulated BAR1 shadow is empty (no emulated upload path ever populated it), so the engine fetched zeros and the draw stored nothing. Three delivery paths now cover the page: a real-FB VID leaf for launch fetch pages (QMD pointers, never the data-fill surface) and for vertex streams when every shadow byte is zero; a sysmem-backing copy when the same VA also has a nonzero SYS mapping; otherwise the existing shadow page is used untouched. Render-target pages keep their shadow identity so the copy-out can still ship stores back to the guest. The fixed constant buffer is discovered per boot: the captured SET_MME_SHADOW_SCRATCH(0x18) value is authoritative, the historically observed base is a gated fallback, and a resolved real page is remembered for later misses. The DS HWW ESR latch is now also cleared (W1C) after each replayed window, so a failed window cannot poison the next window's entry state. Validated with three supervised cycles (r1497-r1499): the active streams read the client's real vertex floats, the real MVP resolves, poison stays at 0-1 per run, and the engine clears the render target to opaque black (dump_vidmem 0x200000 = ff000000) with the guest window still all black - the remaining wall is geometry coverage, not data delivery.
* vgsp-gr: keep the validated fixed CB across launches and map each VTG stream ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | | | | | | contiguously - Remember the last fixed-CB page that resolved through a SYS source and passed the matrix gate; a later resolution miss (or a method-page answer) reuses it instead of zeroing the seed page with the synthetic identity. Only a boot with no validated read ever uses the identity fallback. Do not skip the write on an unchanged hash: the seed page lives in the client's screen allocation and the guest can rewrite it between launches. - Treat the CALL_MME_MACRO(2) vertex stream as one range: map [base,end) into a fresh contiguous fetch line and rewrite both ends from it, preserving the client's stream length across 4 KB boundaries. Unresolvable pages map the module zero page (a zero vertex, never a fault). The generic per-word pass remains the fallback. - Diagnostics: cb-copy logs the first 8 seed-page words and the cached flag; MME-VSTREAM-LINE dumps the resolved base page (client VA, HPA, page count, first 8 words). - Evidence: r1494 (poison 11/17 -> 1/16, real vertex floats at the stream bases, CB cache verified live with src=vaswalk -> src=cached-real) and r1495/r1496 (the active draw's vertex/index page is an all-zero vidmem shadow page while the data exists in guest sysmem - the new wall).
* vgsp-gr: read the fixed CB from the engine-visible page and never deliver a ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | header-only VS image The GL draw's VS was reading two wrong inputs. First, the fixed-CB copy resolved the client VA through a learned/FB layer first, so it read the emulated BAR1 vidmem shadow - a buffer the engine never writes - and delivered unrelated vidmem (r1490 first=09037223 00000004; r1482 oscillated between a float row, method words and zeros). Resolve the CB the way the engine does: channel VAS, every registered VAS page-table walk, then the GR relocation resolver; only a SYS answer is content-valid and an FB answer is flagged. The matrix gate now requires four normal-magnitude floats in c[0x0][0x80..0xbc] (r1492 accepted a method page as a matrix); a rejected read authors the identity MVP. Second, the captured 1536 B VTG upload is spliced at a page boundary: the delivered image was the SPH header plus ZERO SASS, so the VS executed no code. Reject captured program images whose SASS body [0x80,min(len,0x200)) is zero (the real-upload ring record, the 020a0481 cache and the window's own upload all pass the gate) and deliver the built-in known-good VTG image (the client's own SPH V4T1 020a0481 + SASS) at the bind VA instead; sema_gl_vs_img=0 restores the old behaviour. Diagnostics: cb-matrix/cb-const dumps of every VS-read constant block, SPH-ALIAS code4 words at the bind, and MME-VSTREAM post-relocation stream/limit/address payloads. r1491-r1493 (VP_MODE=6, RT0=1): the bind page now shows the real SASS (code4=ff047321 0000a0ff ...) and the CB/identity delivery is logged, but the draw still produces no fragments (retirement 0-3/900 = the forced MME seed pages only; xwd decoration rows only). Next wall: the vertex attribute/staging fetch (slot-57 0x39c8 data and the staging scratch 0x36/0x37), not the shader image or the fixed CB.
* vgsp-gr: hold calls on a stream-damaged push so a dropped chunk cannot run ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | LOAD_CONSTANT_BUFFER without its selector state A chunked GL draw whose earlier chunk was dropped (prelude LOAD-ONLY or the r1447 arming window hold) replayed the remaining chunks' calls alone; the constant-buffer selector (0x2380) lived in the dropped chunk, so the bug2548370 macro's LOAD_CONSTANT_BUFFER(0x2390) class-errored (ErrorCode 3) and the engine poisoned (badf1201 sentinel: pc=513/mac=0xf1 are its artifact, not a macro). Propagate the stream-relative chunk offset through the candidate and submit path, keep a per-push STREAM-DAMAGE record of the lowest dropped chunk, emit later chunks calls-held (the proven-safe shape), never arm the arming window-hold on a damaged stream, and start a fresh section at stream_rel==0. r1487: the exact r1485 damaging shape now retires clean (events=5, no poison) and the next chunk is captured; r1486 (holds off) still poisons because the first launch runs against a partially packed prelude, confirming the dropped chunk is the cause, not the hold release.
* vgsp-gr: capture the full 4K-word GL draw window, emit SET_SHADER_EXCEPTIONS ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | | | | | as immd13, and base the SPH region on the bound program's shadow page - SVC_GR_PUSH_WORDS / GSP_PHYS_GR_RAW_WORDS raised 2048 -> 4096: the beef full-frame push is 12288 B / 3072 words, so the 2048-word capture tail failed the 3D mark (raw_ok=0 fit_ok=0) and the launch fell back to a 239-word stub, losing the real 2115-word draw. Now '3D stream chunked window=1429 words -> 4 chunk(s)'. - SET_SHADER_EXCEPTIONS (0x1528) is emitted as the client's immd13 (0x8000054a) and skipped when the window already carries it; the remaining 0x1528 in the log is the client's own benign write. - sema_gl_sph_region_bind (default 1): the SPH region base is the first bound program's relocated shadow page, not the forced 0x1500000 pool base; r1484 latched the fetched SPHs (0,019a0f00,019a0200,0,0,019a0000) with ds=86040646 (region mismatch), r1485 uses base 0x19b0000 bind 0x19b0900 and the DS accepts (ds=80000000). - r1484/r1485: the screen now shows gear-class pixels (xwd bbox spanning the 800x600 window, multicolor); GUEST-WIT shows RT0 page 0 written. The remaining wall is the MME draw macro 0xf1 / pc 513 poison on the first calls+window launch after the arming hold is released.
* vgsp-gr: bind the beef GL draw to the captured 900-page screen surface, not ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | | | | | | a cross-VAS 10-page operand buffer The PS SPH has MRT_ENABLE=0 (writes RT0); the beef window binds no colour target of its own, so the last trusted 0x800..0xbff run (the X screen surface 0x120400000, 1280x720, 900 pages) is the render target. Its pages were resolved through the global VA-keyed pin/ledger, which conflated clients: the beef client's own injected pin for VA 0x120400000 (a SYS staging/operand buffer holding SASS/method words) shadowed the X server's surface VAS and cut the set at 10 pages. Capture the surface's source VAS and resolve its pages through that VAS in the fill, bypassing the pin override for this page set. Re-patch the SURF prelude when the launch's rec base differs from the cached one, and copy the emitted SURF run's target/geometry into the RT0 run so RT0 == RT1 every launch (was hardcoded to the 0xa relocation half). r1483: the beef retirement is now 0/900 pages of the visible surface (was 0/10), RT0-BIND target=0xa000000, data[0] va=0x120400000 pa=0x100000, n_data =900, 6 launches, poison=0. The engine still stores nothing: GR-STATE sph is zero at retire and the launch traps at method 0x1528, so the next wall is making the pipeline program bind visible to the DS, not the RT VA.
* vgsp-gr: deliver the real GL shader images and the client fixed constant ↵Arthur Hanson Rasmusson5 days
| | | | | | | | | | | | | | | | | | | | | | | | | buffer to the engine-visible pages - inline-apply writes the image into the guest HPA whenever the page is kept at the guest VA (code_keep_guest), not only for stream3d windows; a shadow copy is useless when the engine fetches the guest page (r1470: guest=0 VS then lost to the window-0 shadow copy). - the standalone 0x180/0x1b0 context-init upload pair (outside any C597 section) is also recorded in the GRCE destination ring, so a later draw window can find the client's real VTG image at its bind VA. - sema_gl_cb_copy_to / sema_gl_cb_src_va: copy the client fixed-CB page into the forced, mapped MME seed page before the launch, so the vertex shader reads the client's transform constants instead of screen/stale data. Falls back to a synthetic identity MVP when the client VA cannot be walked. - cache any push chunk whose first word is a real SPH (020a0481 VTG / 000a1482 PS) and use it as the program-record fallback when the window's own bind-VA upload was never captured (the init push's continuation chunks are otherwise judged implausible and never reach the ring). - r1481/r1482: the real VS SPH+code and PS are applied guest=1 at the bind VA, the client CB page resolves and is copied, poison=0 over 9-10 launches; render-target writes still zero - the remaining wall is the draw's render-target/colour-target binding (the beef window's output retirement set is 10 pages of shader-like data, not the 900-page screen surface).
* vgsp-diag: whole-vidmem page-hash bracket - sema_gl_vidmem_bracket hashes ↵Arthur Hanson Rasmusson6 days
| | | | every 4KB page of the BAR1 shadow before the GR publish and diffs after the output-retirement wait, reporting any changed page outside the sampled output set; vidmem_hash_snap/vidmem_hash_diff manual module params; default 0 is a strict no-op
* vgsp-mme: CONT-118 strict release + FE-busy deferral - ↵Arthur Hanson Rasmusson6 days
| | | | sema_gl_mme_hold_strict (calls release only when pre_words_out==0 && fe_idle() && live_gen==pl_gen) and sema_gl_mme_fe_defer (busy-defer the load-only carrier at svc_gr_request before fill/consume, bounded 4 consecutive defers/gen with GIVEUP log) - both default 1, independent live A/B, 0 = legacy-equivalent
* vgsp-sph: d24/d25 seed extension - capture 0x3490/0x3494 (scratch24/25) + ↵Arthur Hanson Rasmusson7 days
| | | | params sema_mme_state_d24/d25 + fail-closed seed emissions after d19 (param>captured>skip, 3d-reloc) - the d28-forced slow path reads the 0x349x states after d19; +235/-1
* vgsp-sph: C4 - capture scratch 0x19 (CB selector, mthd 0x3464) + seed STATE ↵Arthur Hanson Rasmusson7 days
| | | | 0xD19 emission (param sema_mme_state_d19 > captured, 3d-reloc, fail-closed) - the d28-forced slow path reads an unseeded d19 and faults the consumer at VA 0 (HUBCLIENT_PD); +129/-1
* vgsp-sema: exempt injected pins from the push-read PA ceiling + ↵Arthur Hanson Rasmusson8 days
| | | | pinrej/pushfail visibility (carrier read >=6 GiB)
* vgsp: CONT-101 - sema-scratch18 watch (scan every decoded push on every ↵Arthur Hanson Rasmusson9 days
| | | | channel for 0x3460 SET_MME_SHADOW_SCRATCH(0x18), log up to 24 hits, publish first value via gsp_sema_mme_scratch18_get) + sema_gl_mme_seed/seed_val/seed_xlat (emit [op1 cnt1 m=0x3460][value] ahead of every replayed 3D window; xlat translates value page through launch shadow mapper before >>8) - DECISIVE: client NEVER writes 0x3460 (0 hits across r1348-52 all channels); seed works end-to-end (MME-SEED scratch 0x18 <- 0x000a0000 va=0xa000000 xlat=1) but wall not cleared: MME-FAST trap=80002058 data=019b0900 grfifo 04041602->00000001 park events=2 - trap is window's own relocated program pair (pair addr=0x2054 va=0x4350900 -> 0x19b0900) and fires BEFORE MME consumes seed; DESIGNED FIX WORKS LIVE: sema_gl_prog_guest_va=Y -> PROG-GUEST-VA keep addr=0x2054 va=0x4400900 (Tier-1 identity; operand verbatim) -> ZERO trap=80002058 thereafter; r1352 (keep from boot) got session's FIRST MME-generated evidence (gen0=1) then lottery outcome events=4 (poison) esr->0xbadf1201 WEDGE-REARM engine still wedged; GATE1 black 0/900 pages NO-STORES - next: boot r1347 richest config (nop_drop=1<<0 slot 0 dropped) PLUS sema_gl_prog_guest_va=1 from insmod (removes 0x2058 trap class the seed cannot touch); check stores before re-arming slot 0 with seed; 0xd18 golden value open but subordinate (vGPU client never emits it) - SESSION 153 r1348-r1352
* vgsp: CONT-95 - PROMOTE_CTX recorder (gsp_sema_service_ctx_promote_note/get ↵Arthur Hanson Rasmusson9 days
| | | | w/ bInitialize from emulated promote loop) + CTX-BIND launch receipt (client MAIN/PATCH vs engine ctx + first-words readback) + gsp-phys-ctx-dump + engine-ctx CE readback (CE forbidden on GR ladder channel) - DECISIVE: r1323 CTX-BIND client-main=seen pa=0x114e00000 va=0x1200d0000 size=0x133000 attr=0x6 binit=1; client-patch=seen pa=0x12dcc8000 binit=1; replay-ctx pa=0x1f4000000 size=0x133000 fbmem=1 va=0x2200000 srv_ctxva=0; installed=0 (engine ctx is ladder's buffer NOT client promote); client-main content[0..7]=0, host read 100% zero bytes -> client promoted GR ctx carries no state; fw DS handler decoded (vaddr 0x52b8290 per-bit reporter: esr=a6000e20->0x73 SPH5; validation HW-side) - next: read engine ctx buffer VA 0x2200000/FBMEM 0x1f4000000 via secondary stage-3 COPY0 channel on same VAS (0xc5b5 copy block, dump gsp-phys-ctx-dump); structured -> drive fill, zeros -> reproduce GSP golden-ctx init - SESSION 153 r1322-r1323
* vgsp: CONT-94 - svc_init_push_scan (per-beef-push census of ↵Arthur Hanson Rasmusson9 days
| | | | SET_SHADER_LOCAL_MEMORY_A..D 0x790-0x79c + host-side verbatim capture first >=4KiB beef push per boot INIT-CAP) + gsp-phys-init-push debugfs - lmem lead REFUTED 4 ways: INIT-CAP h=0xbeef0100 va=0x4021004 len=60216 lmem_runs=0; 60216B init push decodes to words:15054 distinct methods:2 = pure MME microcode (0x114x213/0x11c x213), 0 lmem hits; addr=0x79[0-9a-c] in 64 pushraw dumps = 0; whole-RAM scans no genuine run (x86 code bytes only); driver emission point exists (gf100Init.c:1344 gf100program.c:1479) but 570.144 never pushes it here; per-window latch unchanged ds=a6000e20 x5 + first a2000a00 sph=0,00600900,00600200,0,0,00600000 rr=0,0; oracle DS_HWW_ESR 80000000 DS_REPORT_MASK 0 DS_SPH_REGION_A/B 0/0 GR_FIFO 00000001; wedge persists (PARK-RECOVER #11 rc=-110); next: prove client's promoted GR context buffer engine-visible on replay channel at launch - instrument PROMOTE_CTX engine=1 entry[0] pa=0x234200000/va=0x120420000 size=0x133000 bInitialize=1 binding; if absent install it (SPH validation vs zero context matches rr=0/0); parallel decode fwimage DS_HWW_ESR handler (off 0x11a908 SPH0..30) w/ risc-v-gsp-rm-debugger - SESSION 153 r1321
* vgsp: CONT-91 - svc_gr_inline_retarget re-roots captured program-family ↵Arthur Hanson Rasmusson9 days
| | | | inline records (page not in launch prog_va family nor prog_bind_va[]) onto launch family offset-preserved, page-crossing tails follow head, wired into svc_gr_req_fill; svc_gr_page_inline_covers widened; sema_ds_mask_clear=1 clears DS_HWW_REPORT_MASK/_2 (0x405844/c) ahead of every 3D window; gsp-phys-ds-spy debugfs; GR-STATE retire logs sph= (STAGE0..5 START/UPPER) + rr= (PROGRAM_REGION) + MME shadow readback; sema_gl_sph_region + sema_sph_region_base emit Volta+ program region (SET_MME_SHADOW_SCRATCH 0x78/0x79 = 0x35e0/0x35e4) - r1298 real V4 image at exact bind VA (INLINE-APPLY len=1536 first=020a0481 + INLINE-RB rb=020a0481); same launch DS flags sph=0,00620900,00620200,0,0,00620000 rr=0,0 ds=a4000e20 w/ correct bytes + region A/B 0/0 unchanged; DS rejects all bound stages -> unresolved variable = address space DS validates in (our shadow VAs 0x6xxxxx vs client guest VA region); next A/B: knob leaving program operands at ORIGINAL guest VAs when page identity-mappable (skip shadow rewrite for that pair only) - SESSION 153 r1298-r1306
* vgsp: CONT-88 - real program payload delivery engine-visible: ↵Arthur Hanson Rasmusson9 days
| | | | GSP_BRIDGE_INLINE_BYTES/SVC_GR_INLINE_BYTES/GSP_PHYS_GR_INLINE_BYTES 256->2048 (+static_asserts; svc_gl_flush prs[] static); svc_grce_dst_newest harvests window's REAL captured upload from svc_grce_dst_ring, svc_gl_flush attaches real 1536B@0x4350900 + 1408B@0x4350f00 (w0=0x020a0481) as inline records at own dst VAs (page-crossing split, tail page candidate); svc_grce_inline_write dual-writes engine-visible injected-pin page (svc_grce_land_write page-clamped); SPH-BIND also emits SET_PIPELINE_SHADER(2)<-0x21/(5)<-0x51 - delivery WORKS: real-upload record va=0x4350900 len=1536 first=020a0481 (engine-visible delivery), INLINE-APPLY guest=1, INLINE-RB rb=020a0481 pa=0x64cfd6000, page[7] va=0x4350000 hpa=0x64cfd6000 (r1283); wall survives real image (9/11 + ESR 0xa0000a00 +14ms; V4 window still 9/11); bind+type+real-image combo never seen on executing launch (lane wedges 1-3 launches); stores 0/900-901; next: healthy boot >=3 bind-carrying launches then harvest client init-push pipeline state (20010810 00000011 SET_PIPELINE_SHADER(1)<-0x11 + 0x204c pair) into SPH-BIND prelude - SESSION 153 r1282-r1286
* vgsp: CONT-87 - sema_gl_sph_bind (window's own binds + client's missing TESS ↵Arthur Hanson Rasmusson9 days
| | | | j=2 / PIXEL j=5 binds relocated by window pass; SPH version derives from loaded blob; INLINE-RB readback witness); stage-typed images at family VAs (TESS=vs image SHADER_TYPE->2), real-upload-wins record skip, gsp_sema_gl_sph_blob_version, prog_binds plumbing, pin-first arm - all three stages now fetch from authored VAs (sph=0,00620900,00620200,0,0,00620000); error 18 CLEARED (9/11/18->9/11); authored bytes engine-visible (INLINE-RB rb=000a0461); 9/11 survives every content A/B (V4 retag, SASS5, real w0 0x020a0481, REGISTER_COUNT, own-binds prelude, empty-blob) -> pipeline-state wall not content; real driver images in window inline writes dst=0x4350900 bytes=1536 + dst=0x4350f00 bytes=1408 (w0=0x020a0481 SPH V4) land in vGPU VRAM shadow NOT engine-read page; next: raise GSP_PHYS_GR_INLINE_BYTES 256->2048 + carry payloads in per-VA inline record or land svc_grce_inline_write via pin/fill - SESSION 153 r1276-r1281
* vgsp: CONT-86 - sema_gl_sph_version (emits Turing channel-init pair 200205a9 ↵Arthur Hanson Rasmusson9 days
| | | | 00040004 00040004 after SET_OBJECT on replayed 3D windows); gsp_phys_fault_regs_log (MME_HWW_ESR/INFO/IR + DS_HWW_ESR/ESR_2 + SPH stage starts beside every GR-class 0x1006); SDM-DROP forensic log; block-cap hardening <=4096-128; attr-prelude capture range 0x2000..0x2200 (8 pipeline records) - fault witness: failing SPH stage1 fetched from relocated shadow VA 0x620900; minimal V3 blobs rejected STRUCTURALLY (V4 retag no help); SDM drops all 0001fff0 SET_SUB_DEV_MASK legit; missing binds: j=2 va=0x4300200 TESS + j=5 va=0x4300000 PIXEL never in windows/preludes; next: author client's REAL SPH+SASS bytes at relocated program VAs (VA 0x4300900-family from unreplayed init push) as sema_gl_vs_hex/ps_hex + replay stage-2/5 binds - SESSION 153 r1273-r1275
* vgsp: CONT-84 - SA-REARM moved before window copy (was appended after, calls ↵Arthur Hanson Rasmusson9 days
| | | | ran against prelude SA clobber); WIN-PATCH reaches beef path at last (sweep runs=383 matched=4, 0x124 off65 0x2->0x1 x4); prelude-capture pages bitmask + ring-drop log 8->64 - capture completeness FIXED (pages=0x7fff -> words=3083 covered=55 sa_mask=0x63fffefffffffff code_words=2854); sema_map_add_max=4096 guard (stale host writer re-injecting stale mapping every ~2s racing per-page pins - REFUSED, first-read capture complete); sema_gl_mme_version=1 (SET_MME_VERSION 0x234, absent from capture) + sema_gl_mme_track (0x124<-0) - no change observed; GATE1 black: call-bearing launches park+poison every boot (r1245/1250/1265/1270) even w/ complete prelude+rearm+TRACK+VERSION, gen0=0 MME never starts, shadow2[c597] 0x3810=0x11 0x3910=0; trap=80001614 + transient ds a2040a00 noted; next: A/B version=0/track=-1 (lane destabilized vs MME never starts), shadow port read at first call launch, track=2 PASSTHROUGH - SESSION 153 r1237-r1270
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-10 20:19:41 +0000