summaryrefslogtreecommitdiffstats
path: root/kernel
Commit message (Collapse)AuthorAge
* vgsp: CONT-108 - sema_gl_mme_iram_gate_break (default 0) + ↵Arthur Hanson Rasmusson10 hours
| | | | sema_gl_mme_iram_gate_build (default 1) independently control the two gsp_phys_gr_mme_iram_gate() readback sites (poll-break ~28019, pre-doorbell builder ~20300; comment records r1374 healthy->FULL chronology + CONT-107 probe-park note) - TASK-1 SUPERSEDED: 'LOAD0 stall at slot 58' EXPLAINED+DISMISSED: no call to slot 58 exists (all 8 3D-raw windows CALL_MME_MACRO runs hit only lanes {0,2,34,39,40,48,51,57}; 0x39d0 CALL_MME_MACRO(58) ZERO times; SA complete MME-PRE-SA[57] entry=0x364 / [58] entry=0x3a3); word-exact: slot 57 = mmeCodeOGL_C597_LOAD_CONSTANT_BUFFER_BUG2548370 (63 instrs 0x364..0x3a2), slot 58 = mmeCodeOGL_C597_LOAD_CONSTANT_BUFFER_OFFSET (2 instrs 0x3a3..0x3a4); Mesa sim: slot-57 with real params ends after last instr 5/5 consumed -> next fetch 0x364+63=0x3a3 = observed pc = POST-COMPLETION FETCH POINTER not stalled LOAD0; INFO_EX=0x4 = DATA_FIFO_SIZE constant not exception; A/B VERDICT r1376 break=0 build=1 still wedges at first calls-bearing launch; r1377 BOTH SITES OFF still wedges but RECOVERS (WEDGE-RECOVER priv-error poison seen grfifo=0x1 self-cleared) -> debug-port readback NOT the wedge cause, wedge is IN THE FIRST WINDOW REPLAY ITSELF; FIRST NONZERO STORES r1377 output retirement wait 2/901 pages changed 214ms settled + GUEST-WIT retire 4/908 changed va=0x4500000 pa=0x5ac146000 pre=0x3fb2ca25c057d17b post=0x0 engine-authored writes; MME executed r1376 pc=931 ir=71cc0301,18c0034a,1c34238f; r1377 never started (pc_valid=0, gate off => no live promotion); GATE1 black - next: bisect wedge-causing window content at first window+live launch (r1377 config no readbacks): A/B keep_mask=0 nop_drop=all (ALL call runs dropped) vs default; wedge gone => executed macros' emitted methods (0x2390/0x34a4 CB writes) park FE; persists => non-call families (SURF-PRELUDE/SHADER-EXC 0x1528/SPH-REGION/SA-REARM) then bisect win_drop families; follow-up readback-free live-promotion trigger (MME pc!=0 witness) - SESSION 153 r1375-r1377
* vgsp: CONT-107 - IRAM READBACK GATE THAT FIXES THE ZERO-IR FETCH: ↵Arthur Hanson Rasmusson11 hours
| | | | gsp_phys_mme_iram_read3() spec-correct MME debug read per NV_PGRAPH_PRI_MME_DEBUG (ENABLE bit1 -> PC|RD-trigger bit2 -> poll DONE -> data in HWW_ESR_INFO4/3/2); gsp_phys_gr_mme_iram_gate() reads every covered SA entry compares to packed image auto-calibrates port address unit (resolved INSTRUCTION not word); gate at poll-break (before live-gen promotion) + builder (before releasing calls); on fail: hold calls clear prelude latch rewind pack/drain cursors; MME-LOAD-ONLY carriers (window elided while unverified so 0x114/0x118 IRAM load cannot be interrupted by window's DS/SPH poison); knobs sema_gl_mme_iram_gate/_max/_probe sema_gl_mme_hold_fe_idle - MILESTONE r1374: MME-IRAM-BASE resolved=instruction (entry) at entry=0x5; MME-IRAM-GATE pass break h=0xbeef0100 gen=3 base=1 checked=54 + pass build run=1,2,3; MME-LOAD-ONLY carrier window dropped until gate verifies; ILLEGAL_OPCODE = 0 OCCURRENCES (was every prior boot); live readback 4044d0=0x01B20006 (IRAM_PC=0x364) -> 0x40449c=31c28300 0x4044a8=1a05834a 0x4044ac=00000003 EXACTLY THE GOLDEN MACRO-57 GROUP; MME fetch latch mme_esr_info=100003a3(pcv=1 pc=931) ir=71cc0301,18c0034a,1c34238f MATCHING reconstructed image at 931; new wall: calls released yet beef launches park grfifo=07071602 (FIFO not-empty+FULL count 22) MME at pc=931 (slot 58 entry ENDNEXT waiting on LOAD0 INFO_EX=4); GATE1 black 0/900 - next: explain LOAD0 stall at slot 58 entry 0x3a3 (decode full released window call runs win_dec.py on MME-WINRUN dump: is slot 58 genuinely called or macro 57 falls through predicated ENDNEXT 0x3a0/0x3a1 not taken); if fall-through snapshot/seed MME STATE predicate reads; if real call feed params or stub slot 58 to proven stub PC; r1374 first boot where full program runs this deep - SESSION 153 r1369-r1374
* vgsp: CONT-106 - IR-word register FIX: every past info2_ir= read ↵Arthur Hanson Rasmusson12 hours
| | | | 0x404498=NV_PGRAPH_PRI_MME_CONFIG, real INFO2/3/4 = 0x40449c/0x4044a8/0x4044ac (tu104 dev_graphics_nobundle.h), fixed in gsp_phys_mme_fast_sample/mme_regs_log/fault_regs_log/gr_state_rb_log/sked sample[17]/reg-probe; MME-FAST budget 48->256 launches; sema_mme_post_ms post-timeout re-spin (2000/12000/20000); DS-FAST per-stage SPH/region snapshot at DS latch transition + DS-FAST2 report-mask clear 0x405844/c; MME_STATUS_MACRO 0x4044b4 - DECISIVE: at trap PC 0x364 (macro 57 entry) MME fetched IR words are ZERO (MME-FAST info=10000364 pc_valid=1 pc=868 mac=0x0 ir=00000000,00000000,00000000; MME-REGS timeout esr=80000000 pc=868 ir zeros) NOT the golden group 0x00000003,0x1a05834a,0x31c28300 - host-sided pack verified verbatim CONT-105; IRAM debug port 0x4044d0 also reads zero at 0x364 while r1364 same port read golden first words at PC=0 (port real); DS-FAST first-sight: ds a2040a00->badf1201 poison floods whole PRI incl macro-status=badf1201(mpc=513 run=1), clears ~1ms later; SPH bind falsified as DS wall (bind=0 r1364/65/68 poison SPH10+18 a2040800/a2040a00 M_PIPE_STAGE=VSA|PS vs bind=1 r1363 same); trap timing r1367: ILLEGAL_OPCODE relayed +14.0s after GR LAUNCH FAILED timeout 1500ms yet GUEST GR LAUNCH OK elapsed_ms=35870 ok=7 block completes gr_swrel=0 engine-authored release; GATE1 black 0/901 - next: after each prelude pack read back IRAM via 0x4044d0 (IRAM_PC<<15|RD=2 data in INFO4/3/2) and re-emit/gate pack until IRAM reads back golden words at slot entries (prime suspect: 0x114 pack writes issued while PRI block poisoned, capturable at every DS fault); once fetch at 0x364 returns golden words ILLEGAL_OPCODE vanishes and macro 57 completes - SESSION 153 r1364-r1368
* vgsp: CONT-105 - sema_gl_mme_state_seed + sema_mme_state_d26..d2a (emit [IMM ↵Arthur Hanson Rasmusson12 hours
| | | | m=0x3498] 0xD26 .. [0x34a8] 0xD2A ahead of every replayed 3D window; exact method<->state mapping verified gf100mme.h RM_MME_FIRST_USABLE_SHADOW_SCRATCH=8 -> 0x1E/0x1F/0x20/0x21/0x22+8) + sema_gl_mme_pack_split (default 1; pack drains SA-once + whole-instruction 0x114 ONEINC IR chunks across launches, generation-keyed cursor reset alongside drain cursor, latch only on final chunk) - BOTH CONT-104 NEXT FIXES FALSIFIED AS WALL: r1362 state seed d26..d2a=00000000/80000000 still ESR 0x404490=0x80000004; r1363 pack split works mechanically (pack-part ir_words=1332/2799 sa=54 split=1 -> pack ir_words=2799 runs=55) wall unchanged; OFFLINE PROOF r1363: 55x 0x114 runs sum 2799 == image words zero overlaps pack==verbatim for every slot, live macro 57 body = golden 189/189 words - THE IR IMAGE IS COMPLETE AND CORRECT; NEW CHRONOLOGY r1363: GR LAUNCH FAILED timeout 1500ms want=0xc0ffee02 -> 'Shader Program Header 11/18 Error' + ESR 0x405840=0xa0040800 -> WEDGE-REARM -> FIRST ILLEGAL_OPCODE + ESR 0x404490=0x80000004 -> WEDGE-RECOVER priv-error poison grfifo=0xbadf1201 recovery #1; DS SPH POISON + TIMEOUT PRECEDE MME TRAP -> candidate chain: PRI poison 0xbadf1201 drops replay writes -> MME fetch reads poisoned path; GATE1 black 0/901 zero stores - next: catch MME latch WITH ITS INFO at first sight (host ESR/INFO/INFO2 sampler or hook before GSP-RM clears it) to settle whether live fetch at pc=0x364 matches proven-correct image + fix DS SPH-poison chronology: run sema_gl_sph_bind=0 from boot and/or verify poisoned-PRI write-drop via 0x114 shadow (if PRI poison drops replay writes no IR-content fix can ever land) - SESSION 153 r1362-r1363
* vgsp: CONT-104 - gsp_phys_gr_fe_idle() (grfifo 0x400504==0x00000001 witness) ↵Arthur Hanson Rasmusson13 hours
| | | | + mme_hold_calls also holds real CALL runs while front-end not settled (MME-CALL-HOLD log gains '[FE-not-idle (CONT-104)]'; prevents r1359 MME-ILLEGAL_OPCODE race - calls executing while previous prelude carrier's SA/IR writes still in flight) - 0x2390 IDENTIFIED + FIX VALIDATED: 0x2390 = NVC597_LOAD_CONSTANT_BUFFER(0); live trap reproduces exactly offline on real captured macro (./mme_ref slot57_gold.bin 1 5 -> EMIT mthd=0x2390 data=0x00000005 + mthd=0x34a4 data=0x00000004); root cause: winning config dropped slot 0 (nop_drop=0x5) and slot 0 = SETUP_FIXED_CONST emits CB selector setup (0x2380<-0x7000, 0x2384/0x2388<-STATE 0xd18 parts, 0x238c<-arg*4); without it FE rejects first CB write class error 3 ERROR_INVALID_OPERATION and parks; r1358 (slot 0 kept + seed): MME-FAST end events=1 NO class error NO 0x2390 - MME RAN and CB writes LANDED; wall moved to CB mapping: r1358 MMU Fault SCC @ 0x0_019d4000 FAULT_PTE VIRT_READ (seeded CB +0x4000, seed xlat mapped one page only); r1359 (seed to surface alias MME-SEED scratch 0x18 <- 0x000a3000 xlat=1): FIRST STORES EVER 'output retirement wait: 2/901 pages changed after 221 ms (settled)'; new wall r1361: calls-kept launch idle FE full prelude gen=3 words=3083 -> ILLEGAL_OPCODE ESR 0x404490=0x80000004, MME PC=0x364 / macro 0x39 = illegal instruction INSIDE macro 57 (golden MME runtime state wall); GATE1 black - next: seed golden MME runtime state slot 57 reads STATE 0xD26-0xD2A (gf100mme.h bug2548370: PAGE_ALLOCATION_COUNT/ZERO_VIEW_OFFSET/LAST_UPDATED_CB_SELECTOR_B_C/LOAD_CONSTANT_BUFFER_OFFSET/LAST_UPDATED_LOAD_OFFSET; methods 0x3498/0x349c/0x34a0/0x34a4/0x34a8) ahead of window, or prove/repair IR image at instruction 0x364 (split packed drain; single-block pack needs ~2960 words > 2048 cap) - SESSION 153 r1358-r1361
* vgsp: CONT-103 - TWO ROOT CAUSES FOUND: (1) '(engine fetch NONE)' was an ↵Arthur Hanson Rasmusson14 hours
| | | | ARTIFACT - qmd_dst_mem never set for stream3d (all three sites !stream3d-guarded 25707/25733/25741) so the sentinel test was vacuous; GP_GET proves the engine fetches (FETCH-WIT h=0xbeef0100 slot=4 gpget 4->5 engine-fetched); (2) DEADLOCK: calls-kept launch was 2126-2142 words (1613-word prelude re-emit) > CONT-79 ~2050-wall so it never started (r1345/47/48 begin grfifo=00000001 events=0 timeout) - FIXES: sema_gl_mme_prelude_live_skip (default 1; skip forced 1613-word prelude re-emission once the generation's final part was carried by an engine-executed launch; live-gen set at poll break only when GP_GET advanced, cleared on timeout) + sema_gl_mme_nop_pair (default 0; elide program-pair runs method space [0x2054,0x2158]) + FETCH-WIT instrumentation (poll break/timeout gpget A->B engine-fetched, gpget/gpput in GR LAUNCH submitted, honest 'engine fetch n/a (no QMD deposit...sentinel vacuous)' wording); r1356 fix1: words=500, launch starts (FETCH-WIT timeout slot=6 gpget 6->7) then traps CONT-101 pair trap=80002058 data=019a0900; r1357 fix1+2: MME-PAIR-DROP 25 word(s) window=386->361, words=475, 0x2058 gone, FE advances to CALL runs: trap=80102390 data=00000005 (mmegen=1) park grfifo 0f0f1602->00000001 = FIRST MME-GENERATED METHOD WRITE AT THE WALL; GATE1 black 0/900 pages - next: FE rejects first MME-generated method 0x2390 (mmegen=1 data=5): identify 0x2390 role (macro-port family; check MME-WINRUN/3D win dumps + mmeref + direct lane h=0x1000013) and why generated write traps (CONT-80: bare DATA/macro-port write without open macro context parks; generated port may need macro context conserved); keep mode stays OFF - SESSION 153 r1356-r1357
* vgsp: CONT-101 - sema-scratch18 watch (scan every decoded push on every ↵Arthur Hanson Rasmusson15 hours
| | | | channel for 0x3460 SET_MME_SHADOW_SCRATCH(0x18), log up to 24 hits, publish first value via gsp_sema_mme_scratch18_get) + sema_gl_mme_seed/seed_val/seed_xlat (emit [op1 cnt1 m=0x3460][value] ahead of every replayed 3D window; xlat translates value page through launch shadow mapper before >>8) - DECISIVE: client NEVER writes 0x3460 (0 hits across r1348-52 all channels); seed works end-to-end (MME-SEED scratch 0x18 <- 0x000a0000 va=0xa000000 xlat=1) but wall not cleared: MME-FAST trap=80002058 data=019b0900 grfifo 04041602->00000001 park events=2 - trap is window's own relocated program pair (pair addr=0x2054 va=0x4350900 -> 0x19b0900) and fires BEFORE MME consumes seed; DESIGNED FIX WORKS LIVE: sema_gl_prog_guest_va=Y -> PROG-GUEST-VA keep addr=0x2054 va=0x4400900 (Tier-1 identity; operand verbatim) -> ZERO trap=80002058 thereafter; r1352 (keep from boot) got session's FIRST MME-generated evidence (gen0=1) then lottery outcome events=4 (poison) esr->0xbadf1201 WEDGE-REARM engine still wedged; GATE1 black 0/900 pages NO-STORES - next: boot r1347 richest config (nop_drop=1<<0 slot 0 dropped) PLUS sema_gl_prog_guest_va=1 from insmod (removes 0x2058 trap class the seed cannot touch); check stores before re-arming slot 0 with seed; 0xd18 golden value open but subordinate (vGPU client never emits it) - SESSION 153 r1348-r1352
* vgsp: CONT-100 - mme_ir_pack UNITS FIX: ptr is an MME instruction address ↵Arthur Hanson Rasmusson16 hours
| | | | (driver codeOffset += codeSize/3, mmeDownload.cpp:5775), each instruction = 3 IR words; old gsp_phys_gr_mme_ir_pack[ptr+k] emitted a pointer-0 image covering only ~312 of 933 instructions, now [ptr*3+k] with next-SA clamp in instructions + maxa in words; correct units need 2960 words > working block ceiling so pack falls back to drain (do not re-enable pack=1 without A/B) - BISECT DONE: culprit macro = slot 0 SETUP_FIXED_CONST (r1345 nop_drop=0x5 slots{0,2}: MME-CALL-DROP 36 word(s) dropped_mask=0x5, 12 beef launches poisons=0; r1347 nop_drop=0x1 slot0 only: MME-CALL-DROP 11 word(s) dropped_mask=0x1, 11 beef launches poisons=0 WITH slot 2 executing); post-call wall both no-poison boots: trap=80002058 data=019a0900 grfifo 06061602->00000001 (method 0x2058=SET_PIPELINE_PROGRAM_ADDRESS_B(1) <- relocated 0x2054-pair operand, then park); offline engine-faithful sim: all executed macros ENDNEXT clean, slot 34 emits draw 0x1618<-0x61000008/0xd74/0xd78/0x1614, slot 0 emits 0x2380<-0x7000 + 0x2384/0x2388<-STATE 0xd18 parts (0 under replay) = incomplete CB selector; driver slot-0 calls carry VPC_CONSTANT_DWORD(VPC_VIEW_ID) gf100varray.c:56; 0xbadf1201 is fixed priv-error constant (pc=513 artifact) - GATE1 black 0/900 pages - next: seed golden STATE 0xd18 (SET_MME_SHADOW_SCRATCH(0x18) method 0x3460) before calls (SETUP_FIXED_CONST merges it into CB_SELECTOR_B/C); find real value in client setup pushes (scan 0x3460 write / fixed-constant base) or golden run; poison-free control nop_drop=1<<0 - SESSION 153 r1345-r1347
* vgsp: CONT-99 - sema_gl_mme_prelude_ir_only + sema_gl_mme_prelude_pack ↵Arthur Hanson Rasmusson16 hours
| | | | (partitioned IR: each SA region its own upload run clipped at next SA entry; SA pairs + one contiguous 0x114 ONE_INC run ~1270 words so SA+IR+calls ship in same <=2048-word block; static gsp_phys_gr_mme_ir_pack[4096]) - decisive offline: capture is sum of OVERLAPPING per-macro upload runs; run 34 (ptr=0x265, 75 words) == driver mmeCodeOGL_C597_DRAW_IAB word-for-word (0/75 diffs) but later runs overwrite its tail so capture-order image differs at 50/75 words; r1343/44 packed same-launch: MME-PRELUDE pack ir_words=937 runs=55 sa=54, held launch retires words=1515, first call-bearing launch words=1633 STILL POISONS in 8.7ms; unified failure 6 boots: MME-FAST end events=1 (poison) + ILLEGAL_OPCODE + ESR 0x404490=0x80000004 (bit2 NV_PGRAPH_PRI_MME_HWW_ESR, dev_graphics_nobundle.h:2046); r1340 nop_drop {48,51,57} 40x drops still faults {0,2,34,39,40}; r1341 block_cap=4096 words=3441/3623 never retire (block ceiling); sema_gl_mme_version=0 identical (version exonerated); GATE1 black 0/900 pages; next: macros' runtime STATE wrong - they branch on MME shadow-RAM STATE (slot-57 reads 0xd04..0xd2a) replay leaves zero + prelude's 6 non-SA/IR scratch writes (0x3470/0x34a8/0x3484) + client 0x124 mode not established; capture golden MME ctx state from real run and replay before calls; fallback per-boot nop_drop bisect {0,2,34,39,40} to name faulting macro then read g_tu100mmecode.h - SESSION 153 r1340-r1344
* vgsp: CONT-97 - gsp_phys_ds_spy re-clears DS_REPORT_MASK/_2 every sample + ↵Arthur Hanson Rasmusson21 hours
| | | | maskholds/last_mask logging (W1C confirmed: pgraph-rw 0x405840<-0x20 reads back 00000000, no synthetic calibration possible); slots NAMED: c597 SetPipeline[j] only j=0..5, window binds j=1/2/5 ProgramAddressA=0x19a0900/0x19a0200/0x19a0000 byte-equal SPH_INFO stage VAs; DS_HWW_ESR bits 0..23 = SPH0..23 checks (RM DS_SPH<n>_ERR=0x6e+n) so j=9/10/11 binds cannot exist - {5,9,10,11} are per-SPH validation checks; pgraph-rw A/B: golden PATCH DS writes are TGA constraint logic ALREADY LIVE (0x700/0x800) not SPH-related; DS-spy captures: hits all badf1201 poison or zero (timing anomaly recorded); GATE1 black 3 boots ds=a4000e20 sph=0,019a0900,019a0200 0/900 pages; guest root capture 99.92% black; next: beef window's only call form is op=4 IMMD_DATA_METHOD on CallMme[0].Macro 0x3800 (MME-WINRUN off=a0 op=4 cnt=48 mthd=3800) never executed by MME (pcv=0; held windows retire, call-bearing park) while prelude resident - decode run vs MME call spec offline (mme_replay_slots81.txt) + re-emit client's own call shape (trigger 0x3800 + params 0x3804); if op=4 correct run pure-method window test keep_mask=0+hold=N to decide if replay needs MME at all - SESSION 153 r1326-r1327
* vgsp: CONT-96 - secondary COPY0 lane (own TSG 0xcaf000c8 + V5-shape channel ↵Arthur Hanson Rasmusson22 hours
| | | | 0xcaf000cc engineType 9 on same ladder VAS, own symem memdescs, GPFIFO/PB small-PT slots 0x10d/0x10e, full COPY0 BIND/schedule/token seq, 0xc5b5 copy submit; gsp_phys_rmcall_ce_lane default 1 best-effort); engine-ctx readback MAIN 307p + PATCH 5p = 1277952 B; gsp-phys-ctx-read 0200 re-arm; rmcall_ctx_valid fix (mode-35 F2 promote; was silently 0) - DECISIVE: engine ctx IS golden-initialized: CTX-READBACK pa=0x1f4000000 copied=1277952 bytes on CE lane, head 00000000 000f2d00 00000006 cafe0000 02340000 02200000 02350000 (54800 nonzero bytes MAIN, PATCH 95 PGRAPH addr<-value golden pairs); CE lane READY token=0x2 runlistId=0 chId=0x2 gpFifoVa=0x10d000 pbVa=0x10e000 valid=1; new negative: no SET_PIPELINE_SHADER for j=9/10/11 anywhere in 8GiB guest RAM yet DS SPH {9,11} fail invariantly; GATE1 black ds=a6000e20 sph=0,01990900,01990200 0/901 pages; next: background cat gsp-phys-ds-spy 15-20s before beef lane's first window (hit path prints esr/esr2 + REGION_A/B + all 6 SPH stage LO/UP + esr_after naming invariant slots 9/11); pgraph-rw A/B (golden PATCH DS writes 0x405830<-0x700 0x40585c<-0x800) - SESSION 153 r1324-r1325
* vgsp: CONT-95 - PROMOTE_CTX recorder (gsp_sema_service_ctx_promote_note/get ↵Arthur Hanson Rasmusson22 hours
| | | | w/ bInitialize from emulated promote loop) + CTX-BIND launch receipt (client MAIN/PATCH vs engine ctx + first-words readback) + gsp-phys-ctx-dump + engine-ctx CE readback (CE forbidden on GR ladder channel) - DECISIVE: r1323 CTX-BIND client-main=seen pa=0x114e00000 va=0x1200d0000 size=0x133000 attr=0x6 binit=1; client-patch=seen pa=0x12dcc8000 binit=1; replay-ctx pa=0x1f4000000 size=0x133000 fbmem=1 va=0x2200000 srv_ctxva=0; installed=0 (engine ctx is ladder's buffer NOT client promote); client-main content[0..7]=0, host read 100% zero bytes -> client promoted GR ctx carries no state; fw DS handler decoded (vaddr 0x52b8290 per-bit reporter: esr=a6000e20->0x73 SPH5; validation HW-side) - next: read engine ctx buffer VA 0x2200000/FBMEM 0x1f4000000 via secondary stage-3 COPY0 channel on same VAS (0xc5b5 copy block, dump gsp-phys-ctx-dump); structured -> drive fill, zeros -> reproduce GSP golden-ctx init - SESSION 153 r1322-r1323
* vgsp: CONT-94 - svc_init_push_scan (per-beef-push census of ↵Arthur Hanson Rasmusson23 hours
| | | | SET_SHADER_LOCAL_MEMORY_A..D 0x790-0x79c + host-side verbatim capture first >=4KiB beef push per boot INIT-CAP) + gsp-phys-init-push debugfs - lmem lead REFUTED 4 ways: INIT-CAP h=0xbeef0100 va=0x4021004 len=60216 lmem_runs=0; 60216B init push decodes to words:15054 distinct methods:2 = pure MME microcode (0x114x213/0x11c x213), 0 lmem hits; addr=0x79[0-9a-c] in 64 pushraw dumps = 0; whole-RAM scans no genuine run (x86 code bytes only); driver emission point exists (gf100Init.c:1344 gf100program.c:1479) but 570.144 never pushes it here; per-window latch unchanged ds=a6000e20 x5 + first a2000a00 sph=0,00600900,00600200,0,0,00600000 rr=0,0; oracle DS_HWW_ESR 80000000 DS_REPORT_MASK 0 DS_SPH_REGION_A/B 0/0 GR_FIFO 00000001; wedge persists (PARK-RECOVER #11 rc=-110); next: prove client's promoted GR context buffer engine-visible on replay channel at launch - instrument PROMOTE_CTX engine=1 entry[0] pa=0x234200000/va=0x120420000 size=0x133000 bInitialize=1 binding; if absent install it (SPH validation vs zero context matches rr=0/0); parallel decode fwimage DS_HWW_ESR handler (off 0x11a908 SPH0..30) w/ risc-v-gsp-rm-debugger - SESSION 153 r1321
* vgsp: CONT-93 - sema_gl_sph_8k + pair-line (PTE0=program page ↵Arthur Hanson Rasmusson23 hours
| | | | PTE1=family+0x1000 single fetch line); sema_sph_version_val forced SET_SPH_VERSION A/B; sema_gr_park_recover (TSG-preempt+resched re-arm on warm-sem wedge); gsp-phys-pgraph-rw debugfs (live PGRAPH snapshot + bounded writes 0x400000-0x410000); sema_sph_region_legacy (0x1608/0x160c pair) - refutations vs per-window latch: region 'write lands' refuted (same push ds=a6000e20 vs a6000e66 not region-caused); 8K tail no change (SPH-PAIR line=0x620000 hpa0=0x14444f000 hpa1=0x10a418000 + INLINE-APPLY-ALIAS -> ds=a4000e20); version windows 00040004/00050005/00060006/00010003 all a6000e20; PD filter pgraph-rw 0x00406020 57610001->17610001 no change; bind scope: client's own program also rejected (no SPH-BIND emitted still a4000e20); park not recoverable (WEDGE-REARM preempt status=0x0 rpc=0x0 ret=0 probe rc=-110); next: emit SET_SHADER_LOCAL_MEMORY_A/B/C/D (0x790-0x79c) download-state push, only missing client channel-init class, SPH carries LOCAL_MEMORY_LOW/HIGH_SIZE fields DS validates, capture from guest-RAM scrape like init block; pgraph-rw as live oracle - SESSION 153 r1311-r1320
* vgsp: CONT-92 - sema_gl_prog_guest_va=0 knob (keep program operands at guest ↵Arthur Hanson Rasmusson24 hours
| | | | VAs; DECISIVE NEGATIVE: MMU Fault ENGINE GRAPHICS HUBCLIENT_PD @ 0x04350000 FAULT_PTE VIRT_READ - guest VAs not engine-fetchable even with Tier-1 PDE install, knob default 0); gsp_phys_rmcall_gr_pte_leaf applies pte_kind bits 63:56 to scratch-pool/Tier-1 leaves; per-window DS-ESR W1C clear + DS-ESR pre-clear log; POSITIVE: region write LANDS - sema_sph_region_base=0x600000 changed same retrying window latch a6000e20->a6000e66 (+SPH bits 1,2,6), deterministic per-draw re-validation; pte_kind=6 refuted; client init-push decoded: no program-region write exists, Turing hasProgramRegion=0 per NVIDIA caps table; next: sweep sema_sph_region_base 0x600900/0x601000/0x610000/0x1e0000 + both encodings vs per-window latch for SPH set below {5,9,10,11}; fallback SASS tail crossing 0x1000 never contig-mapped at SPH_VA+0x1000 - SESSION 153 r1307-r1310
* vgsp: CONT-91 - svc_gr_inline_retarget re-roots captured program-family ↵Arthur Hanson Rasmusson25 hours
| | | | inline records (page not in launch prog_va family nor prog_bind_va[]) onto launch family offset-preserved, page-crossing tails follow head, wired into svc_gr_req_fill; svc_gr_page_inline_covers widened; sema_ds_mask_clear=1 clears DS_HWW_REPORT_MASK/_2 (0x405844/c) ahead of every 3D window; gsp-phys-ds-spy debugfs; GR-STATE retire logs sph= (STAGE0..5 START/UPPER) + rr= (PROGRAM_REGION) + MME shadow readback; sema_gl_sph_region + sema_sph_region_base emit Volta+ program region (SET_MME_SHADOW_SCRATCH 0x78/0x79 = 0x35e0/0x35e4) - r1298 real V4 image at exact bind VA (INLINE-APPLY len=1536 first=020a0481 + INLINE-RB rb=020a0481); same launch DS flags sph=0,00620900,00620200,0,0,00620000 rr=0,0 ds=a4000e20 w/ correct bytes + region A/B 0/0 unchanged; DS rejects all bound stages -> unresolved variable = address space DS validates in (our shadow VAs 0x6xxxxx vs client guest VA region); next A/B: knob leaving program operands at ORIGINAL guest VAs when page identity-mappable (skip shadow rewrite for that pair only) - SESSION 153 r1298-r1306
* vgsp: CONT-90 - mapping EXONERATED (canary proof: sema_gl_sph_canary=1 maps ↵Arthur Hanson Rasmusson26 hours
| | | | program VAs to canary hpa=0x10bdc3000 w8=cc00cc40..., DS error set moves {5,9,10,11}->{1,2,5,9,10,11,18,26} = DS reads exactly what our PTE maps, content-driven; SPH-ALIAS pages/resolve/canary receipts w8 readback; shadow-win A/B no structural change); sema_gl_shader_exc=1 emits SET_SHADER_EXCEPTIONS(0x1528)<-0 (nv3dInitChannelTuring order) - 5/9/10/11 persists; real image rejected (INLINE-APPLY dst=0x4350900 len=1536 first=020a0481 -> 0.2s later 5/9/10/11 + Class Error Offset 0000022c Data 00000800); NEW delivery-lag bug r1297: stage-image/real-upload pinned old family while windows bind fam=0x42d0000/0x41c0000/0x4400000, fetch page all zeros, zero INLINE-APPLY that boot (r1294-96: 24-28) - next: make delivery follow req->prog_va family / fallback-author synthetic SPH at every bind target with zero page - SESSION 153 r1294-r1297
* vgsp: CONT-89 - INLINE-APPLY-ALIAS real bug fix (inline records landing on ↵Arthur Hanson Rasmusson27 hours
| | | | qmd_word=NONE page never applied - 1408B real program @0x4350f00 was head-only 256B at engine; live fix INLINE-APPLY-ALIAS dst=0x4351000 len=1152 pa=0x85e0f4000 first=0d0d7623); full init-push pipeline block into SPH-BIND prelude in client order (0x2040<-0x11 SET_PIPELINE_SHADER(1), 0x204c<-0x1a,0 REGISTER_COUNT/BINDING(1), 0x21c<-0x1001 INVALIDATE_SHADER_CACHES, 0x155c/0x1574 TEX pools, 0x310<-0x705, 0x22c<-0x800, 0x1128<-ffffffff x2; emission-count bug fixed - uncounted emission caused SPH-BIND skipped reloc=6/4) - 9/11 (and 5/10) PERSISTS on executing launch reading real image (r1293 SPH-BIND fam=0x4390000 j1-type=0x11 rc=0x1a initblk=17 win=306 + INLINE-RB rb=020a0481 -> S/5/9/10/11; r1292 full block visible in-window) -> wall is emulated GMMU/PTE view; next A/B gsp_phys_rmcall_gr_shadow_win0=0 vs 1, canary at SPH offset via second alias - SESSION 153 r1287-r1293
* vgsp: CONT-88 - real program payload delivery engine-visible: ↵Arthur Hanson Rasmusson28 hours
| | | | GSP_BRIDGE_INLINE_BYTES/SVC_GR_INLINE_BYTES/GSP_PHYS_GR_INLINE_BYTES 256->2048 (+static_asserts; svc_gl_flush prs[] static); svc_grce_dst_newest harvests window's REAL captured upload from svc_grce_dst_ring, svc_gl_flush attaches real 1536B@0x4350900 + 1408B@0x4350f00 (w0=0x020a0481) as inline records at own dst VAs (page-crossing split, tail page candidate); svc_grce_inline_write dual-writes engine-visible injected-pin page (svc_grce_land_write page-clamped); SPH-BIND also emits SET_PIPELINE_SHADER(2)<-0x21/(5)<-0x51 - delivery WORKS: real-upload record va=0x4350900 len=1536 first=020a0481 (engine-visible delivery), INLINE-APPLY guest=1, INLINE-RB rb=020a0481 pa=0x64cfd6000, page[7] va=0x4350000 hpa=0x64cfd6000 (r1283); wall survives real image (9/11 + ESR 0xa0000a00 +14ms; V4 window still 9/11); bind+type+real-image combo never seen on executing launch (lane wedges 1-3 launches); stores 0/900-901; next: healthy boot >=3 bind-carrying launches then harvest client init-push pipeline state (20010810 00000011 SET_PIPELINE_SHADER(1)<-0x11 + 0x204c pair) into SPH-BIND prelude - SESSION 153 r1282-r1286
* vgsp: CONT-87 - sema_gl_sph_bind (window's own binds + client's missing TESS ↵Arthur Hanson Rasmusson29 hours
| | | | j=2 / PIXEL j=5 binds relocated by window pass; SPH version derives from loaded blob; INLINE-RB readback witness); stage-typed images at family VAs (TESS=vs image SHADER_TYPE->2), real-upload-wins record skip, gsp_sema_gl_sph_blob_version, prog_binds plumbing, pin-first arm - all three stages now fetch from authored VAs (sph=0,00620900,00620200,0,0,00620000); error 18 CLEARED (9/11/18->9/11); authored bytes engine-visible (INLINE-RB rb=000a0461); 9/11 survives every content A/B (V4 retag, SASS5, real w0 0x020a0481, REGISTER_COUNT, own-binds prelude, empty-blob) -> pipeline-state wall not content; real driver images in window inline writes dst=0x4350900 bytes=1536 + dst=0x4350f00 bytes=1408 (w0=0x020a0481 SPH V4) land in vGPU VRAM shadow NOT engine-read page; next: raise GSP_PHYS_GR_INLINE_BYTES 256->2048 + carry payloads in per-VA inline record or land svc_grce_inline_write via pin/fill - SESSION 153 r1276-r1281
* vgsp: CONT-86 - sema_gl_sph_version (emits Turing channel-init pair 200205a9 ↵Arthur Hanson Rasmusson29 hours
| | | | 00040004 00040004 after SET_OBJECT on replayed 3D windows); gsp_phys_fault_regs_log (MME_HWW_ESR/INFO/IR + DS_HWW_ESR/ESR_2 + SPH stage starts beside every GR-class 0x1006); SDM-DROP forensic log; block-cap hardening <=4096-128; attr-prelude capture range 0x2000..0x2200 (8 pipeline records) - fault witness: failing SPH stage1 fetched from relocated shadow VA 0x620900; minimal V3 blobs rejected STRUCTURALLY (V4 retag no help); SDM drops all 0001fff0 SET_SUB_DEV_MASK legit; missing binds: j=2 va=0x4300200 TESS + j=5 va=0x4300000 PIXEL never in windows/preludes; next: author client's REAL SPH+SASS bytes at relocated program VAs (VA 0x4300900-family from unreplayed init push) as sema_gl_vs_hex/ps_hex + replay stage-2/5 binds - SESSION 153 r1273-r1275
* vgsp: sema_gl_mme_sa_rearm (bool default 1) gating SA re-arm block for ↵Arthur Hanson Rasmusson30 hours
| | | | same-boot A/B - CONT-85: newest emissions EXONERATED (version=0 track=-1 flips did not stop poison; 0xbadf1201 = NV_PPRIV_SYS_PRI_ERROR_CODE_FECS_PRI_RESET ringstation latch not MME exception); r1270 first call-launch poisoned with calls HELD + no prelude -> macro execution not required for poison; r1272 rearm=0 EXECUTED launches but Shader Program Header 9/11/18 Error + ESR 0xa2040a00 x5 + ILLEGAL_OPCODE 0x80000004 + Class Error Offset 0000238c Data 00020020, 0 GR-STATE retires; SA-REARM A/B neutral; next: wire missing SPH state for draw (DS SPH 9/11/18) - leading candidate SDM-family entries that sema_gl_sdm_drop=1 drops, replay ahead of window + capture MME_HWW_ESR_INFO 0x404494 at ILLEGAL_OPCODE for PC witness - SESSION 153 r1271-r1272
* vgsp: CONT-84 - SA-REARM moved before window copy (was appended after, calls ↵Arthur Hanson Rasmusson31 hours
| | | | ran against prelude SA clobber); WIN-PATCH reaches beef path at last (sweep runs=383 matched=4, 0x124 off65 0x2->0x1 x4); prelude-capture pages bitmask + ring-drop log 8->64 - capture completeness FIXED (pages=0x7fff -> words=3083 covered=55 sa_mask=0x63fffefffffffff code_words=2854); sema_map_add_max=4096 guard (stale host writer re-injecting stale mapping every ~2s racing per-page pins - REFUSED, first-read capture complete); sema_gl_mme_version=1 (SET_MME_VERSION 0x234, absent from capture) + sema_gl_mme_track (0x124<-0) - no change observed; GATE1 black: call-bearing launches park+poison every boot (r1245/1250/1265/1270) even w/ complete prelude+rearm+TRACK+VERSION, gen0=0 MME never starts, shadow2[c597] 0x3810=0x11 0x3910=0; trap=80001614 + transient ds a2040a00 noted; next: A/B version=0/track=-1 (lane destabilized vs MME never starts), shadow port read at first call launch, track=2 PASSTHROUGH - SESSION 153 r1237-r1270
* vgsp: store-side emission forensics (DS_HWW_ESR, SPH_INFO_STAGE_START ↵Arthur Hanson Rasmusson32 hours
| | | | x6+UPPER+REGION, MME_HWW_ESR_INFO, FE_DECODE_STATE, MME shadow-RAM port reads w/ CALL trigger probes) + MME-SA-REARM (re-emit [0x11c]=j,[0x120]=sa_ent[j] for every macro slot the emitted window calls) - root-caused replayed-prelude ordering bug: stream ended SA[34]=0 so every draw call resolved to macro 0; rearm now fires 4/5/9/11/12 slots live; healthy boots DS clean sph unbound=0 (0xa2040a00 lead does NOT reproduce); MME executes macros (pc_valid=1 pc=513 mac=0xf1); calls reach MME (shadow2[c597] 0x3810=00000011) but draw methods NEVER emitted (0xd74=0 0xd78=0 0x1618=0); stores still 0/900-902; win_patch=124:1 knob never reached beef path; next: repair win_patch application point + sweep 124:1 TRACK, strip leading CALL-run header variants, compare CALL-run encoding vs nvk P_1INC shape - SESSION 153 r1229-r1236
* vgsp: sema_gl_mme_hold_calls (default 1) - elide window's remaining ↵Arthur Hanson Rasmusson33 hours
| | | | CALL_MME_MACRO/DATA runs while prelude generation not latched OR while this launch itself uploads generation code; real calls resume next launch; 0=legacy wedge - complete-generation hold PASS: r1228 real {0,2,34,39,40}+attr_prelude retire_delta=6 fail_delta=0 over 32s no wedge; r1225 MME-CALL-HOLD 36 word(s) window=222->186 then prelude gen=3 words=3083 - stores still 0/900-901 (gen0=0, no MME-emitted method witnessed); new localization: +slot48 Class Error Offset 0000238c Data 00020020, +slot51 Offset 00001614 Data 00000000 + WEDGE-RECOVER; next: store-side emission forensics SPH_INFO_STAGE_START 0x405c00+si*4 + DS_HWW_ESR - SESSION 153 r1221-r1228
* vgsp: sema_gl_mme_nop_drop (slots in mask have CALL runs dropped entirely - ↵Arthur Hanson Rasmusson37 hours
| | | | r1144-r1177 proven-safe retire) + force-stub semantics (nop_drop slot stubbed in drop filter + SA end-noop stub kept - r1186 lesson: keep|57 removes SA[57] stub, mis-detected kept run executes faulting macro) - validation: (a) keep=5 retires PROVEN (7/14/15 retires, poll break ch=0xc0ffee02 after 94us); (b) keep=5|1<<57 PARKS confirmed; (c) nop-retarget VALIDATED NEGATIVE (DATA-port run without open macro context parks); (d) all-real unresolved (bad boots baseline ILLEGAL_OPCODE too); boot lottery 7 healthy of ~28; stores 0/900-901 all session; next: apply nop_drop=1<<57+sa_stub_all=N within ~10s of first retire on a healthy boot, bisect slots via nop_drop (34=146650112133693440) - SESSION 153 r1180-r1208
* vgsp: sema_gl_mme_block_cap=2048 (blocks >~2050 words never start on engine ↵Arthur Hanson Rasmusson39 hours
| | | | - CONT-78 wall root cause), run-aligned prelude drain with generation-keyed cursor (3089-word program over 2 launches, latch on final part, WEDGE-RECOVER rewinds), attr prelude same cap, sema_gl_mme_nop_param_mask (parameter-conserving NOP: call-run header rewritten to CALL_MME_DATA port) - r1177: full program ships (words=3089 covered=55) + blocks 1327-2048 all retire; bisect: slot 57 PARKS (keep=5|1<<57 -> 0 retires/6 fails, grfifo frozen events=0, no poison; r1142 CALL_MME_MACRO(57) class); NOP transform fires (26 runs retargeted) but unvalidated on wedged boots; next: healthy boot validation sequence (a)keep=5 (b)+1<<57 parks (c)+nop_param=1<<57 (d)sa_stub_all=0 -> N/N stores - SESSION 153 r1173-r1179
* vgsp: SVC_MME_PRELUDE_WORDS 1024->3584 + SIGS 2048, 4-page module pushbuffer ↵Arthur Hanson Rasmusson41 hours
| | | | (VA_PB3/4 at PT slots 0x103/0x104, VA_DST->0x10b, VA_SEM->0x10c, METHOD_WORDS 4096, pb2 chunk 1->3 pages) - SA table extended past slot 12 (55 slots 0..35,37..53,57,58; mission slots [34,39,40,48,51,57] all IN table), prelude doubled (words=2048 ir_end=0x265 covered=34 code_words=1873); still stubbed by one PC (collect_mask [34..57]; slot 34 entry=0x265==ir_end); temporal pattern: window pages valid only inside channel context, new PA per context, zero at resolve time; next: session re-streaming full-SA push (0x402094c ~2min after GL context) then confirm dropped_mask->0 - SESSION 153 r1162-r1165
* vgsp: setup-page demand decoupled from hold (demand rows even at hold=0), ↵Arthur Hanson Rasmusson43 hours
| | | | immediate stale-ring heal at re-registration, walk-fallback USERD re-resolution (r496b FB sweep retries via svc_walk_vaspaces) + userdp diagnostics - ~12s churn ROOT-CAUSED+FIXED: hold_ms=20000 blocked the ring behind the unreadable setup entry (with 0: 458.9 FPS, submissions=7784 vs 0..112); MME wall unchanged (zero 0x114/0x118/0x11c/0x120 hits anywhere; 8GB+FB-shadow scans zero); GATE 1 RED (nonblack 765/921600, 1-row strip); next: correlate pinned client CPU pages (0x7f757af31000->0x12d800000) with GVA families by content parse, pin GVA->PA - SESSION 153 r1158-r1159
* vgsp: channel-registered logs vas=%x vas_known (0xbeef0100 hVASpace NULL = ↵Arthur Hanson Rasmusson43 hours
| | | | attach-to-TSG; 0xbeef0101/102 vas=0xbeef0300 known) + svc_gr_ring_stale_heal (once/s stale-pin self-heal via client VAS walk, GR ring re-pin) - r1156 held push was a PHANTOM (e0 0x3e4ccccd=0.2f+e1 0x81e40e00 decode to 123916; float data from reused ring page) - r1157 pipeline real (9000 entry decodes, 1499 launches, chunked 1429 words, prelude gen=4 words=773); store wall = missing MME macro carrier (real 60216B push 0x4001004 head zeros, no parseable content in any client mapping); next: post-re-registration USERD resolution (channel churns every ~12s: RAM scan found no candidate) - SESSION 153 r1157
* vgsp: GUEST-WIT direct-write witness (every relocated operand destination ↵Arthur Hanson Rasmusson44 hours
| | | | guest page fingerprinted pre-doorbell + retire rescans with +150ms settle control) - r1156: 0/905 relocated-operand guest pages changed NONE (no direct guest writes); draw stream complete-looking (colour target 1280x720 fmt=0xe6 relocated to bounce 0x0a000000 + DRAW_CONTROL + index/program/vertex floats); draw rasterizes nothing in ANY watched channel; missing state = MME macro programs for called slots 34/39/40/48/51/57 (replayed IR tiny ir_end=0xe9 covered=13) while big push HELD unresolved (GR setup hold entry=131 va=0x3e4ccccc len=123916); next: resolve/capture that push, extend SA beyond slot 12, pushbuffer past 2 pages - SESSION 153 r1154-r1156
* vgsp: WEDGE-RECOVER race fix (MME-FAST sample returns poison observation; ↵Arthur Hanson Rasmusson45 hours
| | | | gate = live badf || fast_poison - validated r1151 catches self-cleared poison, recovery #1, retires continue), GR-STATE retire one-shot readback (fed0..3/trap/mthd/mmegen/DS/grfifo, beef <=48), MME-FAST fed= transition lines, force-prelude while keep_mask!=0 - mask train: stores 0 under EVERY mask; kept-macro execution proven (slot-2 macro ran); r1153 cleanest (keep=5, nothing dropped, prelude every launch, fast retires, 0 poison/ILLEGAL, still 0/900) = store wall DOWNSTREAM of macro execution; degrade intrinsic ~66s; next: write witness over relocated operand VAs + MME shadow-scratch (not only 900 RT pages) - SESSION 153 r1151-r1153
* vgsp: sema_gl_mme_keep_mask (u64, slots never stubbed/dropped), MME-PRE-DUMP ↵Arthur Hanson Rasmusson47 hours
| | | | one-shot (raw words+sa_mask+IR coverage), SA data-port capture (0x120 runs), gsp_sema_mme_code_words_get - offline MME64 sim proves macro(0) loads CB offsets (0x238c<-0x320 etc) and macro(2) binds vertex streams with observed args, no poison; live A/B keep_mask works (dropped 115 vs 181 words); r1146 boot beef did NOT retire (timeout 2500ms, elapsed 8842ms, 0/902 pages) vs r1144 94us retire - re-establish r1144 state (prelude 901 vs 773 words, pages 7 shadow 6 vs 8/5, warm-sem wedged) then rerun keep 0x4/0x1 - SESSION 153 r1145-r1146
* vgsp: Mesa mme_tu104_builder_finish terminator stub body (old body emitted ↵Arthur Hanson Rasmusson2 days
| | | | SET_OBJECT(0)<-0 twice = Class 0xc597 Offset 0 Data 0 poison), ONEINC cnt 7, sa_block 8+3n; sema_mme_fast_ms pre-reset MME sample (spin ESR/INFO/INFO2/DS/grfifo/trap right after doorbell; poison floods PRI in <6ms, raw latch never visible); sema_gl_mme_stub_pc override; sema_gl_mme_call_drop=1 (drop stubbed-slot CALL runs) - DRAW-CLASS WINDOW RETIRES: MME-CALL-DROP 164 words dropped (window=220), poll break ch=0xc0ffee02 after 94us, 11 poll breaks 0 ILLEGAL_OPCODE 0 WEDGE-RECOVER, ok=11; stores still 0 (0/900 no writes); next: re-enable real macro execution one slot at a time (sim covered macro offline first) - SESSION 153 r1142-r1144
* vgsp: stub IR write real encoding SEC_OP_ONE_INC=5 (op=1 walked ↵Arthur Hanson Rasmusson2 days
| | | | 0x114->0x118/0x11c/0x120 clobbering SA[0]=1 = r1131 MISSING_MACRO_DATA), stub PC at IR-end, byte-exact END body, coverage-aware stubbing, ONE_INC ghost CALL fix (18->6 real), MME-WINRUN dump, prelude latch keyed (generation,h_object); mme_ir_end/ir_cov bitmap + USERD adopt latch clear - ATTRIBUTION ANSWERED: non-retire is NONE of the attachments (window-only also ILLEGAL_OPCODE 0/901; all-macro-noop sa_stub_all=1 still ILLEGAL_OPCODE 0/902); r1111 retire was a different frame class (5016B no-CALL) vs draw-class (7148B CALL_MME_MACRO(0)); next: MME reg sample BEFORE WEDGE-RECOVER reset + stub landing verify (stub_pc 0xf0 test) - SESSION 153 r1132-r1141
* vgsp: svc_lat_drop + trust sub-source tag (sub= in sema-pushdec) + SVC_ZRW ↵Arthur Hanson Rasmusson2 days
| | | | zero-streak table (src>=2 all-zero x2 -> drop lat/re-walk, pin when src==2), gl_win_start arms only on hdr!=0 (root cause of 5-boot capture drought: window armed on zero no-op), svc_gl_flush zero-lead advance, svc_push_pa_ceiling from gsp_phys_guest_ram_top - capture drought BROKEN (r1131 win=1429 words, 1007 section captures, 0 zero-head refusals); MME-PRELUDE ships in one launch FIRST TIME (gen=4 words=901 + window=390 -> GR LAUNCH words=1348); stores still 0 (engine fetch NONE, MISSING_MACRO_DATA ESR 0x80000001; 8.8s fallback); next: one-variable attribution (sa_stub=0 then surf_prelude=0) + same-generation SA/program capture - SESSION 153 r1129-r1131
* vgsp: replay/block capacity 1024->2048 words (r1126 drop was arithmetic: ↵Arthur Hanson Rasmusson2 days
| | | | window 390+prelude 901+sa 47 > 1024), two-page module pushbuffer (VA_PB2 0x102000 small-PT 0x102, CE SRC->0x109000, warm-sem probe page 0x10a000), gsp_phys_gr_pb_copy page-wise, static_asserts - planted verified (r1127 pb page2+probe planted before first fetch); >4KB path never exercised (5 boots beef never forwarded; walk PA 0x23921d000=8.89GB outside 8GB image); guest setup push NOT in guest RAM (ram_content_pin accepted 0/74); next: drop+re-walk src=4 all-zero reads, reject PA>guest-RAM top - SESSION 153 r1127
* vgsp+diag: strict replay/hold plumbing + pushfail/unread diagnostics + ↵Arthur Hanson Rasmusson2 days
| | | | demand-record ex; guest_pin_stream vmap full-sweep resolver (unknown-family anchors), zero-head first-page acceptance, strict retry throttles - MME-PRELUDE MATURED (gen=4 words=901) but replay DROPS it (window=390 prelude=901 sa=47 exceeds block; replaying window alone) -> every launch prelude=0 timeout; GR-DEC data produced (5657 lines); retirement 0/900 no writes; next: raise replay/block capacity or two-pass prelude - SESSION 153 r1126
* vgsp+diag: anchored demand record (sema_setup_demand prints VA/off/len), ↵Arthur Hanson Rasmusson2 days
| | | | ipin-table eviction (32768 slots silently dropped demand pins; nodrop + alt stash), MME prelude 512->1024 words + SIGS 512; guest_pin_stream resolve_va_strict (host svc_stream_parse port + client-mem /proc/pid/mem+pagemap), pin_gr_stream chunked script push (MAX_ARG_STRLEN) - setup-push read NOW SUCCEEDS (plausible=1 ipin=1 unreadable=0, pa=0x2387b9000), SA table captured, MME-PRELUDE gen=3 words=443, GR LAUNCH words=934, retire 0/903 pages (no writes); new wall: NO 0x114 instruction-RAM upload in any parseable window (code=0) - prelude immature; next: bind setup-hold to the entry carrying the 0x114 uploads - SESSION 153 r1121-r1124
* vgsp+diag: SA-RAM table captured unbounded (entry[64], sema-mme-sa log), ↵Arthur Hanson Rasmusson2 days
| | | | surf geometry accessor + completeness recs, fill seeds RT candidate 0 full span (<=1024 pages, completeness only on fully-resolved run); MME slot stub (called-but-uncaptured slots end-noop IR 0xC0, sema_gl_mme_sa_stub=1), reloc prefers tracked rec bounce VA; pin family += 0x4200000 - 0x238c wall root-caused (capture truncated buffer full=28 words=512, SA[0x22]=0 jump IR 0; sim proves slot-0 emits EMIT 0x238c=0x20020); fixes never executed (setup-push read lost, unreadable=1 first8=00040000 00001000); next: trustworthy pagemap resolve or accept ipin first-chunk - SESSION 153 r1117-r1120
* vgsp: SURF-PRELUDE (replays captured C597 colour-target bind ↵Arthur Hanson Rasmusson2 days
| | | | alias-scanned+pair-relocated ahead of targetless stream3d windows - the NO-STORE cause: windows carry no render target; emitted words=7 window=391), ATTR sanitize (drops active attr words with width=0; r1113 torn 0x81a4 fixed), MME-miss census into MISS-ABORT+demand, MME-IMMATURE-SKIP; r1116: draw reaches engine, trap moved to 0x238c LOAD_CONSTANT_BUFFER_OFFSET Data=0x20020 then PBENTRY; GATE 1 static nz=2551 mean=0.083 DIFF 0 - SESSION 153 r1112-r1116
* vgsp: re-arm on MISS-ABORT (candidate re-offered unwon, releases re-parked, ↵Arthur Hanson Rasmusson2 days
| | | | 1500ms tick, 55s/64-try episode bound; GSP_PHYS_GR_RC_MISSABORT -ENOMSG), junk-operand filter (0x10000000..0x100000000 reloc misses not demanded - float constants), MME prelude latch cleared on WEDGE-RECOVER - **FIRST-EVER nonzero beef submit+retire** (GR LAUNCH submitted push=0xcf3d724 len=5016 pages=9 words=389, poll break ch=0xc0ffee02 after 64us, 12 poll breaks, 0 poisons; client 0.077->287-436 FPS); still NO-STORES (bounce 0 pages changed by engine); next: SKED CTA counters for prove dispatch-vs-degenerate + fix vertex/index operand state - SESSION 153 r1109-r1111
* vgsp: demand set 64->512 + ring-overwrite (no silent drop; ↵Arthur Hanson Rasmusson2 days
| | | | head/total/evicted in debugfs sema_setup_demand), EBADMSG return authors software release (suppresses synth), ZEROWIN-SKIP (all-zero 3D window software-released, no engine submit) - verified: demand 197 VAs past cap, MISS-ABORT convergence (submit only at miss=0), ZEROWIN-SKIP no-poison; store-bearing window still not achieved (r1106 retire root-caused zero window); r1108 slow-death (Wait for channel idle timed out + red screen on SKIP edge); next: re-arm candidate on MISS-ABORT (not consume) - SESSION 153 r1107-r1108
* vgsp: PBENTRY first-sighting watch (all 12 PBDMA intr0 bit18, ↵Arthur Hanson Rasmusson2 days
| | | | PB_HEADER/COUNT/DATA0/HDR_SHADOW dump pre-rearm, 8/boot) + PB-FAULT-DUMP voff/tail/past-end; sema_gl_sdm_drop (op-0/2/6 single-word SDM entries from preludes+window); reloc level-2 fallback; sema_gl_miss_abort (pre-doorbell abort on residual MISS, feeds pin demand); gsp_sema_demand_note + attr-prelude ptr pages demand-recorded + sema_attr_settle_ms=8000 - **FIRST BEEF WINDOW RETIRES ON REAL HW** (poll break ch=0xc0ffee02 after 68us, 737-word block) but no-store retire (0/4 pages changed, NO-STORES); residual MISS flood (miss=11..17) blocked by FULL demand set (64/64 MAX) - SESSION 153 r1103-r1106
* vgsp: sema_gl_attr_zero_fix (default 1) - torn-read zero guard drops ↵Arthur Hanson Rasmusson2 days
| | | | exactly-zero data words in SET_VERTEX_ATTRIBUTE_A/B INC runs (span=(wr-wout)+1), FE-decode trap regs (0x40a630..c MME_PC/MACRO/GENERATED) in sked sampler - 0x1168 fault root-caused to client's own 20030458 38400000 38200040 00000000 run (A(2)=0 ErrorCode 0x5); r1102: ZERO Class Errors (fault class cleared); next wall: PBENTRY fault intr0 bit18 (exceptType=0x20, pbfetch=0x101ebc block end, gp_put=5) - SESSION 153 r1101-r1102
* vgsp+diag: attr/pipeline prelude (families 0x1100-0x1200/0x2000-0x2060, ↵Arthur Hanson Rasmusson2 days
| | | | dedup, 512w, program-pair VA record; emitted via patch_window relocation, run-aligned after MME prelude), mature-prelude gate (>=64 0x114 code words, sema_gr_prelude_gate_ms=60000 busy-defer), pin_gr_stream 0.75s pass, trap regs in sked sampler - first clean DS+MME (ds_esr=80000000 mme_esr=80000000, a2040a00 gone); 0x1168 CLASS ERROR persists as MME-MACRO-GENERATED WRITE (no 0x1168 header in emitted stream; macro(2) args [0,0,600000,0,610800]); next: disassemble macro (2) at pc 0xa + trapped-addr read pre-latch - SESSION 153 r1095-r1100
* vgsp+diag: debugfs sema_setup_demand (armed setup-hold VA set, 0444 ↵Arthur Hanson Rasmusson2 days
| | | | seq_file) + pin_gr_stream demand loop reads it (kills dmesg-ring race; 20s resend/300s expiry), bounded 3D raw dump of pre-drop window - MME-PRELUDE emitted gen=2 words=512 (context alive submissions=760); NEW WALL: first beef window loads context + clean MME (mme_esr=80000000) then Class Error ChId 0001 Class 0xc597 Offset 0x1168 (SET_VERTEX_ATTRIBUTE_A(2)) ErrorCode 0x5 + poison; emitted attr runs byte-faithful; next: attr/pipeline prelude (0x1100-0x1200/0x2000-0x2060) + gate first launch on mature prelude - SESSION 153 r1091-r1094
* vgsp+diag: resolver GL pushbuffer families (0x4000000/0x42000000 learn-once ↵Arthur Hanson Rasmusson2 days
| | | | byte-exact, raw-tail newest-first scan), setup-hold demand cap 0x8000->0x10000 (60216B push=16 pages), pin_gr_stream harvest 2MB - r1089 target reached: setup push readable (unreadable=0), MME prelude captured words=511; beef context still tears down (submissions=0); demand races dmesg ring (manual demand fixed r1090); host / was 100%, freed ~6G - SESSION 153 r1088-r1090
* vgsp: sema_gr_setup_hold_ms param (default 0) - setup-push detect (>=12288B ↵Arthur Hanson Rasmusson2 days
| | | | or MME-setup families in scan), hold arm on first unreadable read with 8x4K demand to stalled-VA channel, deadline consult at consume gate; r1079-readable setup captured words=511 (contrast r1083/85/87 zeros = setup-push read lottery root); hold fired but guest resolver covers only 0x120000000-0x121000000 - next: extend resolver to GL pushbuffer VA families - SESSION 153 r1083-r1087
* vgsp: MME setup prelude - capture client MME context-setup runs ↵Arthur Hanson Rasmusson3 days
| | | | (0x114..0x124/0x234/0x550..0x568/0x3400..0x34fc) verbatim, exact-run dedup, 512-word buf + gen counter (sema_mme_prelude_cap); one-time-per-generation preplay in GR launch build (sema_gl_mme_prelude); capture verified - full macro program 11 SA/IR pairs ~206 code words, MME-PRELUDE emitted gen=5 words=444; no further mme_esr=80000004 after prelude (r1079); remaining: setup push unreadable=1 skip before pin demand; r1082-class content-independent dispatch stall - SESSION 153 r1078-r1082
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-02 17:15:14 +0000