summaryrefslogtreecommitdiffstats
path: root/kernel
Commit message (Collapse)AuthorAge
* vgsp: CONT-94 - svc_init_push_scan (per-beef-push census of ↵Arthur Hanson Rasmusson5 hours
| | | | SET_SHADER_LOCAL_MEMORY_A..D 0x790-0x79c + host-side verbatim capture first >=4KiB beef push per boot INIT-CAP) + gsp-phys-init-push debugfs - lmem lead REFUTED 4 ways: INIT-CAP h=0xbeef0100 va=0x4021004 len=60216 lmem_runs=0; 60216B init push decodes to words:15054 distinct methods:2 = pure MME microcode (0x114x213/0x11c x213), 0 lmem hits; addr=0x79[0-9a-c] in 64 pushraw dumps = 0; whole-RAM scans no genuine run (x86 code bytes only); driver emission point exists (gf100Init.c:1344 gf100program.c:1479) but 570.144 never pushes it here; per-window latch unchanged ds=a6000e20 x5 + first a2000a00 sph=0,00600900,00600200,0,0,00600000 rr=0,0; oracle DS_HWW_ESR 80000000 DS_REPORT_MASK 0 DS_SPH_REGION_A/B 0/0 GR_FIFO 00000001; wedge persists (PARK-RECOVER #11 rc=-110); next: prove client's promoted GR context buffer engine-visible on replay channel at launch - instrument PROMOTE_CTX engine=1 entry[0] pa=0x234200000/va=0x120420000 size=0x133000 bInitialize=1 binding; if absent install it (SPH validation vs zero context matches rr=0/0); parallel decode fwimage DS_HWW_ESR handler (off 0x11a908 SPH0..30) w/ risc-v-gsp-rm-debugger - SESSION 153 r1321
* vgsp: CONT-93 - sema_gl_sph_8k + pair-line (PTE0=program page ↵Arthur Hanson Rasmusson5 hours
| | | | PTE1=family+0x1000 single fetch line); sema_sph_version_val forced SET_SPH_VERSION A/B; sema_gr_park_recover (TSG-preempt+resched re-arm on warm-sem wedge); gsp-phys-pgraph-rw debugfs (live PGRAPH snapshot + bounded writes 0x400000-0x410000); sema_sph_region_legacy (0x1608/0x160c pair) - refutations vs per-window latch: region 'write lands' refuted (same push ds=a6000e20 vs a6000e66 not region-caused); 8K tail no change (SPH-PAIR line=0x620000 hpa0=0x14444f000 hpa1=0x10a418000 + INLINE-APPLY-ALIAS -> ds=a4000e20); version windows 00040004/00050005/00060006/00010003 all a6000e20; PD filter pgraph-rw 0x00406020 57610001->17610001 no change; bind scope: client's own program also rejected (no SPH-BIND emitted still a4000e20); park not recoverable (WEDGE-REARM preempt status=0x0 rpc=0x0 ret=0 probe rc=-110); next: emit SET_SHADER_LOCAL_MEMORY_A/B/C/D (0x790-0x79c) download-state push, only missing client channel-init class, SPH carries LOCAL_MEMORY_LOW/HIGH_SIZE fields DS validates, capture from guest-RAM scrape like init block; pgraph-rw as live oracle - SESSION 153 r1311-r1320
* vgsp: CONT-92 - sema_gl_prog_guest_va=0 knob (keep program operands at guest ↵Arthur Hanson Rasmusson6 hours
| | | | VAs; DECISIVE NEGATIVE: MMU Fault ENGINE GRAPHICS HUBCLIENT_PD @ 0x04350000 FAULT_PTE VIRT_READ - guest VAs not engine-fetchable even with Tier-1 PDE install, knob default 0); gsp_phys_rmcall_gr_pte_leaf applies pte_kind bits 63:56 to scratch-pool/Tier-1 leaves; per-window DS-ESR W1C clear + DS-ESR pre-clear log; POSITIVE: region write LANDS - sema_sph_region_base=0x600000 changed same retrying window latch a6000e20->a6000e66 (+SPH bits 1,2,6), deterministic per-draw re-validation; pte_kind=6 refuted; client init-push decoded: no program-region write exists, Turing hasProgramRegion=0 per NVIDIA caps table; next: sweep sema_sph_region_base 0x600900/0x601000/0x610000/0x1e0000 + both encodings vs per-window latch for SPH set below {5,9,10,11}; fallback SASS tail crossing 0x1000 never contig-mapped at SPH_VA+0x1000 - SESSION 153 r1307-r1310
* vgsp: CONT-91 - svc_gr_inline_retarget re-roots captured program-family ↵Arthur Hanson Rasmusson7 hours
| | | | inline records (page not in launch prog_va family nor prog_bind_va[]) onto launch family offset-preserved, page-crossing tails follow head, wired into svc_gr_req_fill; svc_gr_page_inline_covers widened; sema_ds_mask_clear=1 clears DS_HWW_REPORT_MASK/_2 (0x405844/c) ahead of every 3D window; gsp-phys-ds-spy debugfs; GR-STATE retire logs sph= (STAGE0..5 START/UPPER) + rr= (PROGRAM_REGION) + MME shadow readback; sema_gl_sph_region + sema_sph_region_base emit Volta+ program region (SET_MME_SHADOW_SCRATCH 0x78/0x79 = 0x35e0/0x35e4) - r1298 real V4 image at exact bind VA (INLINE-APPLY len=1536 first=020a0481 + INLINE-RB rb=020a0481); same launch DS flags sph=0,00620900,00620200,0,0,00620000 rr=0,0 ds=a4000e20 w/ correct bytes + region A/B 0/0 unchanged; DS rejects all bound stages -> unresolved variable = address space DS validates in (our shadow VAs 0x6xxxxx vs client guest VA region); next A/B: knob leaving program operands at ORIGINAL guest VAs when page identity-mappable (skip shadow rewrite for that pair only) - SESSION 153 r1298-r1306
* vgsp: CONT-90 - mapping EXONERATED (canary proof: sema_gl_sph_canary=1 maps ↵Arthur Hanson Rasmusson8 hours
| | | | program VAs to canary hpa=0x10bdc3000 w8=cc00cc40..., DS error set moves {5,9,10,11}->{1,2,5,9,10,11,18,26} = DS reads exactly what our PTE maps, content-driven; SPH-ALIAS pages/resolve/canary receipts w8 readback; shadow-win A/B no structural change); sema_gl_shader_exc=1 emits SET_SHADER_EXCEPTIONS(0x1528)<-0 (nv3dInitChannelTuring order) - 5/9/10/11 persists; real image rejected (INLINE-APPLY dst=0x4350900 len=1536 first=020a0481 -> 0.2s later 5/9/10/11 + Class Error Offset 0000022c Data 00000800); NEW delivery-lag bug r1297: stage-image/real-upload pinned old family while windows bind fam=0x42d0000/0x41c0000/0x4400000, fetch page all zeros, zero INLINE-APPLY that boot (r1294-96: 24-28) - next: make delivery follow req->prog_va family / fallback-author synthetic SPH at every bind target with zero page - SESSION 153 r1294-r1297
* vgsp: CONT-89 - INLINE-APPLY-ALIAS real bug fix (inline records landing on ↵Arthur Hanson Rasmusson9 hours
| | | | qmd_word=NONE page never applied - 1408B real program @0x4350f00 was head-only 256B at engine; live fix INLINE-APPLY-ALIAS dst=0x4351000 len=1152 pa=0x85e0f4000 first=0d0d7623); full init-push pipeline block into SPH-BIND prelude in client order (0x2040<-0x11 SET_PIPELINE_SHADER(1), 0x204c<-0x1a,0 REGISTER_COUNT/BINDING(1), 0x21c<-0x1001 INVALIDATE_SHADER_CACHES, 0x155c/0x1574 TEX pools, 0x310<-0x705, 0x22c<-0x800, 0x1128<-ffffffff x2; emission-count bug fixed - uncounted emission caused SPH-BIND skipped reloc=6/4) - 9/11 (and 5/10) PERSISTS on executing launch reading real image (r1293 SPH-BIND fam=0x4390000 j1-type=0x11 rc=0x1a initblk=17 win=306 + INLINE-RB rb=020a0481 -> S/5/9/10/11; r1292 full block visible in-window) -> wall is emulated GMMU/PTE view; next A/B gsp_phys_rmcall_gr_shadow_win0=0 vs 1, canary at SPH offset via second alias - SESSION 153 r1287-r1293
* vgsp: CONT-88 - real program payload delivery engine-visible: ↵Arthur Hanson Rasmusson10 hours
| | | | GSP_BRIDGE_INLINE_BYTES/SVC_GR_INLINE_BYTES/GSP_PHYS_GR_INLINE_BYTES 256->2048 (+static_asserts; svc_gl_flush prs[] static); svc_grce_dst_newest harvests window's REAL captured upload from svc_grce_dst_ring, svc_gl_flush attaches real 1536B@0x4350900 + 1408B@0x4350f00 (w0=0x020a0481) as inline records at own dst VAs (page-crossing split, tail page candidate); svc_grce_inline_write dual-writes engine-visible injected-pin page (svc_grce_land_write page-clamped); SPH-BIND also emits SET_PIPELINE_SHADER(2)<-0x21/(5)<-0x51 - delivery WORKS: real-upload record va=0x4350900 len=1536 first=020a0481 (engine-visible delivery), INLINE-APPLY guest=1, INLINE-RB rb=020a0481 pa=0x64cfd6000, page[7] va=0x4350000 hpa=0x64cfd6000 (r1283); wall survives real image (9/11 + ESR 0xa0000a00 +14ms; V4 window still 9/11); bind+type+real-image combo never seen on executing launch (lane wedges 1-3 launches); stores 0/900-901; next: healthy boot >=3 bind-carrying launches then harvest client init-push pipeline state (20010810 00000011 SET_PIPELINE_SHADER(1)<-0x11 + 0x204c pair) into SPH-BIND prelude - SESSION 153 r1282-r1286
* vgsp: CONT-87 - sema_gl_sph_bind (window's own binds + client's missing TESS ↵Arthur Hanson Rasmusson10 hours
| | | | j=2 / PIXEL j=5 binds relocated by window pass; SPH version derives from loaded blob; INLINE-RB readback witness); stage-typed images at family VAs (TESS=vs image SHADER_TYPE->2), real-upload-wins record skip, gsp_sema_gl_sph_blob_version, prog_binds plumbing, pin-first arm - all three stages now fetch from authored VAs (sph=0,00620900,00620200,0,0,00620000); error 18 CLEARED (9/11/18->9/11); authored bytes engine-visible (INLINE-RB rb=000a0461); 9/11 survives every content A/B (V4 retag, SASS5, real w0 0x020a0481, REGISTER_COUNT, own-binds prelude, empty-blob) -> pipeline-state wall not content; real driver images in window inline writes dst=0x4350900 bytes=1536 + dst=0x4350f00 bytes=1408 (w0=0x020a0481 SPH V4) land in vGPU VRAM shadow NOT engine-read page; next: raise GSP_PHYS_GR_INLINE_BYTES 256->2048 + carry payloads in per-VA inline record or land svc_grce_inline_write via pin/fill - SESSION 153 r1276-r1281
* vgsp: CONT-86 - sema_gl_sph_version (emits Turing channel-init pair 200205a9 ↵Arthur Hanson Rasmusson11 hours
| | | | 00040004 00040004 after SET_OBJECT on replayed 3D windows); gsp_phys_fault_regs_log (MME_HWW_ESR/INFO/IR + DS_HWW_ESR/ESR_2 + SPH stage starts beside every GR-class 0x1006); SDM-DROP forensic log; block-cap hardening <=4096-128; attr-prelude capture range 0x2000..0x2200 (8 pipeline records) - fault witness: failing SPH stage1 fetched from relocated shadow VA 0x620900; minimal V3 blobs rejected STRUCTURALLY (V4 retag no help); SDM drops all 0001fff0 SET_SUB_DEV_MASK legit; missing binds: j=2 va=0x4300200 TESS + j=5 va=0x4300000 PIXEL never in windows/preludes; next: author client's REAL SPH+SASS bytes at relocated program VAs (VA 0x4300900-family from unreplayed init push) as sema_gl_vs_hex/ps_hex + replay stage-2/5 binds - SESSION 153 r1273-r1275
* vgsp: sema_gl_mme_sa_rearm (bool default 1) gating SA re-arm block for ↵Arthur Hanson Rasmusson12 hours
| | | | same-boot A/B - CONT-85: newest emissions EXONERATED (version=0 track=-1 flips did not stop poison; 0xbadf1201 = NV_PPRIV_SYS_PRI_ERROR_CODE_FECS_PRI_RESET ringstation latch not MME exception); r1270 first call-launch poisoned with calls HELD + no prelude -> macro execution not required for poison; r1272 rearm=0 EXECUTED launches but Shader Program Header 9/11/18 Error + ESR 0xa2040a00 x5 + ILLEGAL_OPCODE 0x80000004 + Class Error Offset 0000238c Data 00020020, 0 GR-STATE retires; SA-REARM A/B neutral; next: wire missing SPH state for draw (DS SPH 9/11/18) - leading candidate SDM-family entries that sema_gl_sdm_drop=1 drops, replay ahead of window + capture MME_HWW_ESR_INFO 0x404494 at ILLEGAL_OPCODE for PC witness - SESSION 153 r1271-r1272
* vgsp: CONT-84 - SA-REARM moved before window copy (was appended after, calls ↵Arthur Hanson Rasmusson13 hours
| | | | ran against prelude SA clobber); WIN-PATCH reaches beef path at last (sweep runs=383 matched=4, 0x124 off65 0x2->0x1 x4); prelude-capture pages bitmask + ring-drop log 8->64 - capture completeness FIXED (pages=0x7fff -> words=3083 covered=55 sa_mask=0x63fffefffffffff code_words=2854); sema_map_add_max=4096 guard (stale host writer re-injecting stale mapping every ~2s racing per-page pins - REFUSED, first-read capture complete); sema_gl_mme_version=1 (SET_MME_VERSION 0x234, absent from capture) + sema_gl_mme_track (0x124<-0) - no change observed; GATE1 black: call-bearing launches park+poison every boot (r1245/1250/1265/1270) even w/ complete prelude+rearm+TRACK+VERSION, gen0=0 MME never starts, shadow2[c597] 0x3810=0x11 0x3910=0; trap=80001614 + transient ds a2040a00 noted; next: A/B version=0/track=-1 (lane destabilized vs MME never starts), shadow port read at first call launch, track=2 PASSTHROUGH - SESSION 153 r1237-r1270
* vgsp: store-side emission forensics (DS_HWW_ESR, SPH_INFO_STAGE_START ↵Arthur Hanson Rasmusson14 hours
| | | | x6+UPPER+REGION, MME_HWW_ESR_INFO, FE_DECODE_STATE, MME shadow-RAM port reads w/ CALL trigger probes) + MME-SA-REARM (re-emit [0x11c]=j,[0x120]=sa_ent[j] for every macro slot the emitted window calls) - root-caused replayed-prelude ordering bug: stream ended SA[34]=0 so every draw call resolved to macro 0; rearm now fires 4/5/9/11/12 slots live; healthy boots DS clean sph unbound=0 (0xa2040a00 lead does NOT reproduce); MME executes macros (pc_valid=1 pc=513 mac=0xf1); calls reach MME (shadow2[c597] 0x3810=00000011) but draw methods NEVER emitted (0xd74=0 0xd78=0 0x1618=0); stores still 0/900-902; win_patch=124:1 knob never reached beef path; next: repair win_patch application point + sweep 124:1 TRACK, strip leading CALL-run header variants, compare CALL-run encoding vs nvk P_1INC shape - SESSION 153 r1229-r1236
* vgsp: sema_gl_mme_hold_calls (default 1) - elide window's remaining ↵Arthur Hanson Rasmusson15 hours
| | | | CALL_MME_MACRO/DATA runs while prelude generation not latched OR while this launch itself uploads generation code; real calls resume next launch; 0=legacy wedge - complete-generation hold PASS: r1228 real {0,2,34,39,40}+attr_prelude retire_delta=6 fail_delta=0 over 32s no wedge; r1225 MME-CALL-HOLD 36 word(s) window=222->186 then prelude gen=3 words=3083 - stores still 0/900-901 (gen0=0, no MME-emitted method witnessed); new localization: +slot48 Class Error Offset 0000238c Data 00020020, +slot51 Offset 00001614 Data 00000000 + WEDGE-RECOVER; next: store-side emission forensics SPH_INFO_STAGE_START 0x405c00+si*4 + DS_HWW_ESR - SESSION 153 r1221-r1228
* vgsp: sema_gl_mme_nop_drop (slots in mask have CALL runs dropped entirely - ↵Arthur Hanson Rasmusson18 hours
| | | | r1144-r1177 proven-safe retire) + force-stub semantics (nop_drop slot stubbed in drop filter + SA end-noop stub kept - r1186 lesson: keep|57 removes SA[57] stub, mis-detected kept run executes faulting macro) - validation: (a) keep=5 retires PROVEN (7/14/15 retires, poll break ch=0xc0ffee02 after 94us); (b) keep=5|1<<57 PARKS confirmed; (c) nop-retarget VALIDATED NEGATIVE (DATA-port run without open macro context parks); (d) all-real unresolved (bad boots baseline ILLEGAL_OPCODE too); boot lottery 7 healthy of ~28; stores 0/900-901 all session; next: apply nop_drop=1<<57+sa_stub_all=N within ~10s of first retire on a healthy boot, bisect slots via nop_drop (34=146650112133693440) - SESSION 153 r1180-r1208
* vgsp: sema_gl_mme_block_cap=2048 (blocks >~2050 words never start on engine ↵Arthur Hanson Rasmusson21 hours
| | | | - CONT-78 wall root cause), run-aligned prelude drain with generation-keyed cursor (3089-word program over 2 launches, latch on final part, WEDGE-RECOVER rewinds), attr prelude same cap, sema_gl_mme_nop_param_mask (parameter-conserving NOP: call-run header rewritten to CALL_MME_DATA port) - r1177: full program ships (words=3089 covered=55) + blocks 1327-2048 all retire; bisect: slot 57 PARKS (keep=5|1<<57 -> 0 retires/6 fails, grfifo frozen events=0, no poison; r1142 CALL_MME_MACRO(57) class); NOP transform fires (26 runs retargeted) but unvalidated on wedged boots; next: healthy boot validation sequence (a)keep=5 (b)+1<<57 parks (c)+nop_param=1<<57 (d)sa_stub_all=0 -> N/N stores - SESSION 153 r1173-r1179
* vgsp: SVC_MME_PRELUDE_WORDS 1024->3584 + SIGS 2048, 4-page module pushbuffer ↵Arthur Hanson Rasmusson23 hours
| | | | (VA_PB3/4 at PT slots 0x103/0x104, VA_DST->0x10b, VA_SEM->0x10c, METHOD_WORDS 4096, pb2 chunk 1->3 pages) - SA table extended past slot 12 (55 slots 0..35,37..53,57,58; mission slots [34,39,40,48,51,57] all IN table), prelude doubled (words=2048 ir_end=0x265 covered=34 code_words=1873); still stubbed by one PC (collect_mask [34..57]; slot 34 entry=0x265==ir_end); temporal pattern: window pages valid only inside channel context, new PA per context, zero at resolve time; next: session re-streaming full-SA push (0x402094c ~2min after GL context) then confirm dropped_mask->0 - SESSION 153 r1162-r1165
* vgsp: setup-page demand decoupled from hold (demand rows even at hold=0), ↵Arthur Hanson Rasmusson24 hours
| | | | immediate stale-ring heal at re-registration, walk-fallback USERD re-resolution (r496b FB sweep retries via svc_walk_vaspaces) + userdp diagnostics - ~12s churn ROOT-CAUSED+FIXED: hold_ms=20000 blocked the ring behind the unreadable setup entry (with 0: 458.9 FPS, submissions=7784 vs 0..112); MME wall unchanged (zero 0x114/0x118/0x11c/0x120 hits anywhere; 8GB+FB-shadow scans zero); GATE 1 RED (nonblack 765/921600, 1-row strip); next: correlate pinned client CPU pages (0x7f757af31000->0x12d800000) with GVA families by content parse, pin GVA->PA - SESSION 153 r1158-r1159
* vgsp: channel-registered logs vas=%x vas_known (0xbeef0100 hVASpace NULL = ↵Arthur Hanson Rasmusson25 hours
| | | | attach-to-TSG; 0xbeef0101/102 vas=0xbeef0300 known) + svc_gr_ring_stale_heal (once/s stale-pin self-heal via client VAS walk, GR ring re-pin) - r1156 held push was a PHANTOM (e0 0x3e4ccccd=0.2f+e1 0x81e40e00 decode to 123916; float data from reused ring page) - r1157 pipeline real (9000 entry decodes, 1499 launches, chunked 1429 words, prelude gen=4 words=773); store wall = missing MME macro carrier (real 60216B push 0x4001004 head zeros, no parseable content in any client mapping); next: post-re-registration USERD resolution (channel churns every ~12s: RAM scan found no candidate) - SESSION 153 r1157
* vgsp: GUEST-WIT direct-write witness (every relocated operand destination ↵Arthur Hanson Rasmusson26 hours
| | | | guest page fingerprinted pre-doorbell + retire rescans with +150ms settle control) - r1156: 0/905 relocated-operand guest pages changed NONE (no direct guest writes); draw stream complete-looking (colour target 1280x720 fmt=0xe6 relocated to bounce 0x0a000000 + DRAW_CONTROL + index/program/vertex floats); draw rasterizes nothing in ANY watched channel; missing state = MME macro programs for called slots 34/39/40/48/51/57 (replayed IR tiny ir_end=0xe9 covered=13) while big push HELD unresolved (GR setup hold entry=131 va=0x3e4ccccc len=123916); next: resolve/capture that push, extend SA beyond slot 12, pushbuffer past 2 pages - SESSION 153 r1154-r1156
* vgsp: WEDGE-RECOVER race fix (MME-FAST sample returns poison observation; ↵Arthur Hanson Rasmusson27 hours
| | | | gate = live badf || fast_poison - validated r1151 catches self-cleared poison, recovery #1, retires continue), GR-STATE retire one-shot readback (fed0..3/trap/mthd/mmegen/DS/grfifo, beef <=48), MME-FAST fed= transition lines, force-prelude while keep_mask!=0 - mask train: stores 0 under EVERY mask; kept-macro execution proven (slot-2 macro ran); r1153 cleanest (keep=5, nothing dropped, prelude every launch, fast retires, 0 poison/ILLEGAL, still 0/900) = store wall DOWNSTREAM of macro execution; degrade intrinsic ~66s; next: write witness over relocated operand VAs + MME shadow-scratch (not only 900 RT pages) - SESSION 153 r1151-r1153
* vgsp: sema_gl_mme_keep_mask (u64, slots never stubbed/dropped), MME-PRE-DUMP ↵Arthur Hanson Rasmusson29 hours
| | | | one-shot (raw words+sa_mask+IR coverage), SA data-port capture (0x120 runs), gsp_sema_mme_code_words_get - offline MME64 sim proves macro(0) loads CB offsets (0x238c<-0x320 etc) and macro(2) binds vertex streams with observed args, no poison; live A/B keep_mask works (dropped 115 vs 181 words); r1146 boot beef did NOT retire (timeout 2500ms, elapsed 8842ms, 0/902 pages) vs r1144 94us retire - re-establish r1144 state (prelude 901 vs 773 words, pages 7 shadow 6 vs 8/5, warm-sem wedged) then rerun keep 0x4/0x1 - SESSION 153 r1145-r1146
* vgsp: Mesa mme_tu104_builder_finish terminator stub body (old body emitted ↵Arthur Hanson Rasmusson30 hours
| | | | SET_OBJECT(0)<-0 twice = Class 0xc597 Offset 0 Data 0 poison), ONEINC cnt 7, sa_block 8+3n; sema_mme_fast_ms pre-reset MME sample (spin ESR/INFO/INFO2/DS/grfifo/trap right after doorbell; poison floods PRI in <6ms, raw latch never visible); sema_gl_mme_stub_pc override; sema_gl_mme_call_drop=1 (drop stubbed-slot CALL runs) - DRAW-CLASS WINDOW RETIRES: MME-CALL-DROP 164 words dropped (window=220), poll break ch=0xc0ffee02 after 94us, 11 poll breaks 0 ILLEGAL_OPCODE 0 WEDGE-RECOVER, ok=11; stores still 0 (0/900 no writes); next: re-enable real macro execution one slot at a time (sim covered macro offline first) - SESSION 153 r1142-r1144
* vgsp: stub IR write real encoding SEC_OP_ONE_INC=5 (op=1 walked ↵Arthur Hanson Rasmusson31 hours
| | | | 0x114->0x118/0x11c/0x120 clobbering SA[0]=1 = r1131 MISSING_MACRO_DATA), stub PC at IR-end, byte-exact END body, coverage-aware stubbing, ONE_INC ghost CALL fix (18->6 real), MME-WINRUN dump, prelude latch keyed (generation,h_object); mme_ir_end/ir_cov bitmap + USERD adopt latch clear - ATTRIBUTION ANSWERED: non-retire is NONE of the attachments (window-only also ILLEGAL_OPCODE 0/901; all-macro-noop sa_stub_all=1 still ILLEGAL_OPCODE 0/902); r1111 retire was a different frame class (5016B no-CALL) vs draw-class (7148B CALL_MME_MACRO(0)); next: MME reg sample BEFORE WEDGE-RECOVER reset + stub landing verify (stub_pc 0xf0 test) - SESSION 153 r1132-r1141
* vgsp: svc_lat_drop + trust sub-source tag (sub= in sema-pushdec) + SVC_ZRW ↵Arthur Hanson Rasmusson32 hours
| | | | zero-streak table (src>=2 all-zero x2 -> drop lat/re-walk, pin when src==2), gl_win_start arms only on hdr!=0 (root cause of 5-boot capture drought: window armed on zero no-op), svc_gl_flush zero-lead advance, svc_push_pa_ceiling from gsp_phys_guest_ram_top - capture drought BROKEN (r1131 win=1429 words, 1007 section captures, 0 zero-head refusals); MME-PRELUDE ships in one launch FIRST TIME (gen=4 words=901 + window=390 -> GR LAUNCH words=1348); stores still 0 (engine fetch NONE, MISSING_MACRO_DATA ESR 0x80000001; 8.8s fallback); next: one-variable attribution (sa_stub=0 then surf_prelude=0) + same-generation SA/program capture - SESSION 153 r1129-r1131
* vgsp: replay/block capacity 1024->2048 words (r1126 drop was arithmetic: ↵Arthur Hanson Rasmusson32 hours
| | | | window 390+prelude 901+sa 47 > 1024), two-page module pushbuffer (VA_PB2 0x102000 small-PT 0x102, CE SRC->0x109000, warm-sem probe page 0x10a000), gsp_phys_gr_pb_copy page-wise, static_asserts - planted verified (r1127 pb page2+probe planted before first fetch); >4KB path never exercised (5 boots beef never forwarded; walk PA 0x23921d000=8.89GB outside 8GB image); guest setup push NOT in guest RAM (ram_content_pin accepted 0/74); next: drop+re-walk src=4 all-zero reads, reject PA>guest-RAM top - SESSION 153 r1127
* vgsp+diag: strict replay/hold plumbing + pushfail/unread diagnostics + ↵Arthur Hanson Rasmusson34 hours
| | | | demand-record ex; guest_pin_stream vmap full-sweep resolver (unknown-family anchors), zero-head first-page acceptance, strict retry throttles - MME-PRELUDE MATURED (gen=4 words=901) but replay DROPS it (window=390 prelude=901 sa=47 exceeds block; replaying window alone) -> every launch prelude=0 timeout; GR-DEC data produced (5657 lines); retirement 0/900 no writes; next: raise replay/block capacity or two-pass prelude - SESSION 153 r1126
* vgsp+diag: anchored demand record (sema_setup_demand prints VA/off/len), ↵Arthur Hanson Rasmusson35 hours
| | | | ipin-table eviction (32768 slots silently dropped demand pins; nodrop + alt stash), MME prelude 512->1024 words + SIGS 512; guest_pin_stream resolve_va_strict (host svc_stream_parse port + client-mem /proc/pid/mem+pagemap), pin_gr_stream chunked script push (MAX_ARG_STRLEN) - setup-push read NOW SUCCEEDS (plausible=1 ipin=1 unreadable=0, pa=0x2387b9000), SA table captured, MME-PRELUDE gen=3 words=443, GR LAUNCH words=934, retire 0/903 pages (no writes); new wall: NO 0x114 instruction-RAM upload in any parseable window (code=0) - prelude immature; next: bind setup-hold to the entry carrying the 0x114 uploads - SESSION 153 r1121-r1124
* vgsp+diag: SA-RAM table captured unbounded (entry[64], sema-mme-sa log), ↵Arthur Hanson Rasmusson36 hours
| | | | surf geometry accessor + completeness recs, fill seeds RT candidate 0 full span (<=1024 pages, completeness only on fully-resolved run); MME slot stub (called-but-uncaptured slots end-noop IR 0xC0, sema_gl_mme_sa_stub=1), reloc prefers tracked rec bounce VA; pin family += 0x4200000 - 0x238c wall root-caused (capture truncated buffer full=28 words=512, SA[0x22]=0 jump IR 0; sim proves slot-0 emits EMIT 0x238c=0x20020); fixes never executed (setup-push read lost, unreadable=1 first8=00040000 00001000); next: trustworthy pagemap resolve or accept ipin first-chunk - SESSION 153 r1117-r1120
* vgsp: SURF-PRELUDE (replays captured C597 colour-target bind ↵Arthur Hanson Rasmusson37 hours
| | | | alias-scanned+pair-relocated ahead of targetless stream3d windows - the NO-STORE cause: windows carry no render target; emitted words=7 window=391), ATTR sanitize (drops active attr words with width=0; r1113 torn 0x81a4 fixed), MME-miss census into MISS-ABORT+demand, MME-IMMATURE-SKIP; r1116: draw reaches engine, trap moved to 0x238c LOAD_CONSTANT_BUFFER_OFFSET Data=0x20020 then PBENTRY; GATE 1 static nz=2551 mean=0.083 DIFF 0 - SESSION 153 r1112-r1116
* vgsp: re-arm on MISS-ABORT (candidate re-offered unwon, releases re-parked, ↵Arthur Hanson Rasmusson37 hours
| | | | 1500ms tick, 55s/64-try episode bound; GSP_PHYS_GR_RC_MISSABORT -ENOMSG), junk-operand filter (0x10000000..0x100000000 reloc misses not demanded - float constants), MME prelude latch cleared on WEDGE-RECOVER - **FIRST-EVER nonzero beef submit+retire** (GR LAUNCH submitted push=0xcf3d724 len=5016 pages=9 words=389, poll break ch=0xc0ffee02 after 64us, 12 poll breaks, 0 poisons; client 0.077->287-436 FPS); still NO-STORES (bounce 0 pages changed by engine); next: SKED CTA counters for prove dispatch-vs-degenerate + fix vertex/index operand state - SESSION 153 r1109-r1111
* vgsp: demand set 64->512 + ring-overwrite (no silent drop; ↵Arthur Hanson Rasmusson38 hours
| | | | head/total/evicted in debugfs sema_setup_demand), EBADMSG return authors software release (suppresses synth), ZEROWIN-SKIP (all-zero 3D window software-released, no engine submit) - verified: demand 197 VAs past cap, MISS-ABORT convergence (submit only at miss=0), ZEROWIN-SKIP no-poison; store-bearing window still not achieved (r1106 retire root-caused zero window); r1108 slow-death (Wait for channel idle timed out + red screen on SKIP edge); next: re-arm candidate on MISS-ABORT (not consume) - SESSION 153 r1107-r1108
* vgsp: PBENTRY first-sighting watch (all 12 PBDMA intr0 bit18, ↵Arthur Hanson Rasmusson39 hours
| | | | PB_HEADER/COUNT/DATA0/HDR_SHADOW dump pre-rearm, 8/boot) + PB-FAULT-DUMP voff/tail/past-end; sema_gl_sdm_drop (op-0/2/6 single-word SDM entries from preludes+window); reloc level-2 fallback; sema_gl_miss_abort (pre-doorbell abort on residual MISS, feeds pin demand); gsp_sema_demand_note + attr-prelude ptr pages demand-recorded + sema_attr_settle_ms=8000 - **FIRST BEEF WINDOW RETIRES ON REAL HW** (poll break ch=0xc0ffee02 after 68us, 737-word block) but no-store retire (0/4 pages changed, NO-STORES); residual MISS flood (miss=11..17) blocked by FULL demand set (64/64 MAX) - SESSION 153 r1103-r1106
* vgsp: sema_gl_attr_zero_fix (default 1) - torn-read zero guard drops ↵Arthur Hanson Rasmusson39 hours
| | | | exactly-zero data words in SET_VERTEX_ATTRIBUTE_A/B INC runs (span=(wr-wout)+1), FE-decode trap regs (0x40a630..c MME_PC/MACRO/GENERATED) in sked sampler - 0x1168 fault root-caused to client's own 20030458 38400000 38200040 00000000 run (A(2)=0 ErrorCode 0x5); r1102: ZERO Class Errors (fault class cleared); next wall: PBENTRY fault intr0 bit18 (exceptType=0x20, pbfetch=0x101ebc block end, gp_put=5) - SESSION 153 r1101-r1102
* vgsp+diag: attr/pipeline prelude (families 0x1100-0x1200/0x2000-0x2060, ↵Arthur Hanson Rasmusson40 hours
| | | | dedup, 512w, program-pair VA record; emitted via patch_window relocation, run-aligned after MME prelude), mature-prelude gate (>=64 0x114 code words, sema_gr_prelude_gate_ms=60000 busy-defer), pin_gr_stream 0.75s pass, trap regs in sked sampler - first clean DS+MME (ds_esr=80000000 mme_esr=80000000, a2040a00 gone); 0x1168 CLASS ERROR persists as MME-MACRO-GENERATED WRITE (no 0x1168 header in emitted stream; macro(2) args [0,0,600000,0,610800]); next: disassemble macro (2) at pc 0xa + trapped-addr read pre-latch - SESSION 153 r1095-r1100
* vgsp+diag: debugfs sema_setup_demand (armed setup-hold VA set, 0444 ↵Arthur Hanson Rasmusson41 hours
| | | | seq_file) + pin_gr_stream demand loop reads it (kills dmesg-ring race; 20s resend/300s expiry), bounded 3D raw dump of pre-drop window - MME-PRELUDE emitted gen=2 words=512 (context alive submissions=760); NEW WALL: first beef window loads context + clean MME (mme_esr=80000000) then Class Error ChId 0001 Class 0xc597 Offset 0x1168 (SET_VERTEX_ATTRIBUTE_A(2)) ErrorCode 0x5 + poison; emitted attr runs byte-faithful; next: attr/pipeline prelude (0x1100-0x1200/0x2000-0x2060) + gate first launch on mature prelude - SESSION 153 r1091-r1094
* vgsp+diag: resolver GL pushbuffer families (0x4000000/0x42000000 learn-once ↵Arthur Hanson Rasmusson41 hours
| | | | byte-exact, raw-tail newest-first scan), setup-hold demand cap 0x8000->0x10000 (60216B push=16 pages), pin_gr_stream harvest 2MB - r1089 target reached: setup push readable (unreadable=0), MME prelude captured words=511; beef context still tears down (submissions=0); demand races dmesg ring (manual demand fixed r1090); host / was 100%, freed ~6G - SESSION 153 r1088-r1090
* vgsp: sema_gr_setup_hold_ms param (default 0) - setup-push detect (>=12288B ↵Arthur Hanson Rasmusson42 hours
| | | | or MME-setup families in scan), hold arm on first unreadable read with 8x4K demand to stalled-VA channel, deadline consult at consume gate; r1079-readable setup captured words=511 (contrast r1083/85/87 zeros = setup-push read lottery root); hold fired but guest resolver covers only 0x120000000-0x121000000 - next: extend resolver to GL pushbuffer VA families - SESSION 153 r1083-r1087
* vgsp: MME setup prelude - capture client MME context-setup runs ↵Arthur Hanson Rasmusson42 hours
| | | | (0x114..0x124/0x234/0x550..0x568/0x3400..0x34fc) verbatim, exact-run dedup, 512-word buf + gen counter (sema_mme_prelude_cap); one-time-per-generation preplay in GR launch build (sema_gl_mme_prelude); capture verified - full macro program 11 SA/IR pairs ~206 code words, MME-PRELUDE emitted gen=5 words=444; no further mme_esr=80000004 after prelude (r1079); remaining: setup push unreadable=1 skip before pin demand; r1082-class content-independent dispatch stall - SESSION 153 r1078-r1082
* vgsp: in-flight MME/fault capture (ds_esr/mme_esr/mme_pc/mac/ir/mth regs at ↵Arthur Hanson Rasmusson43 hours
| | | | 5ms sked sampler), PB-FAULT-DUMP+WINPROBE+window-dump budgets raised, BLOCKVAL stream validator, subdrop (multi-word runs subchannel!=0 dropped), sema_mme_census - ROOT CAUSE: real MME ILLEGAL_OPCODE on CALL_MME_MACRO(2)=0x3810 with no macro program loaded (mme_esr=80000004 mme_pc=0 mme_ir=1); client's MME setup (0x120 LOAD_MME_START_ADDRESS_RAM, 0x124, 0x3400 scratch) never forwarded; 0x1c00+j*16=SET_VERTEX_STREAM_A_FORMAT(j); next: MME setup prelude injection - SESSION 153 r1073-r1077
* vgsp: svc_push_page_heal (beef push all-zero read re-resolves via ↵Arthur Hanson Rasmusson44 hours
| | | | launch-page chain, pin/cache, src=10; sema-pushzero len cap 1024), mme-reloc-rsv (MME-family payload miss resolves via RELOC-FIXED ledger/pin/walk shadow-map), pin_gr_stream pushzero 4K-page bulk demand (48/batch); HW retire only with A+0x34a8+C dropped - draw payloads live in exactly the refused families (0x1c00-0x1c20 MME macro-code uploads / 0x3810 CALL_MME_MACRO); Graphics Exception ChID 0001 Class 0x0000c597 Offset 0 - SESSION 153 r1070-r1072
* vgsp: sema_gl_mme_reloc (CALL_MME_MACRO/DATA payload relocation via launch ↵Arthur Hanson Rasmusson45 hours
| | | | pages, raw-operand fault fix), MME-page collection + 4KB ptr dedup, 0x1b00 pair-relocation, sema_gr_wedge_recover (TSG-preempt re-arm on 0xbadf, revived channel: REAL GR SEM OK 0xc0ffee01), win_drop_auto += 0x1b00 - BEEF LAUNCHES RETIRE (h=0xbeef0100 ch_rel=0xc0ffee02 elapsed_ms=0 ok=6, 3 consecutive); full-perimeter windows still wedge in [0x1200,0x7ffc); client registration 5/5 with keeper - SESSION 153 r1058-r1063
* vgsp: sema_gl_idx_reloc knob (idx-buffer/vertex-stream shadow-VA relocation, ↵Arthur Hanson Rasmusson46 hours
| | | | default 0 = r1035-r1041 set), win_drop lo-hi ranges, engine-entry logging (e0/e1 in GR LAUNCH, ring[3] in poll break) - entry encoding IDENTICAL X vs beef (e0=0x00101000); discriminator = raw operand VA in window content faulting GR once and wedging ladder (cwd0=badf1201, fecsirq=0x10); next: relocate CALL_MME_DATA(j)=0x3804+j*8 operands + wedge recovery - SESSION 153 r1042-r1057
* vgsp: 3D flush gate fix (built-in chunk bound, not bisect knob), pushzero ↵Arthur Hanson Rasmusson2 days
| | | | zero-content rescue (probe PROMOTE_CTX, src=9), CHUNK1 dump, SET_INDEX_BUFFER+vertex-stream collection; publish GPFIFO entry at engine GP_GET (PUT-GET=1); win_drop 0x parser fix - beef chunks still PBDMA-stop at 0x1160 attr run (hdr=20030458 INC m=0x1160 cnt=3) while X retires ch_rel=0xc0ffee02 same boot - SESSION 153 r1034-r1041
* vgsp: 3D stream chunking for client pushes - GR push words 512->2048, ↵Arthur Hanson Rasmusson2 days
| | | | candidates 4->8, method-aligned <=384-word chunks in ring order with 8-pending backpressure (sema_gl_chunk_words knob), zero-head guard, PBDMA chunk-end fault fix, 3DSTREAM dump; first client src=stream capture (h=0xbeef0100 push=0x54eefd4 len=1580 nprog=2 recs=2), ch_rel=0xc0ffee02 submitted; beef windows still don't retire (scheduler stall vs X retiring same boot) - SESSION 153 r1028-r1033
* vgsp: zero-put-skip for GR chan userd (fixes r1025 poisoned latch; ↵Arthur Hanson Rasmusson2 days
| | | | submissions regression FIXED 32501/33646), revert op-translate walk-first (oops with flowing submissions; keep fill walk), NEW sema_screen_blit param - present blit PROVEN byte-exact (src=0x130e38000 spitch=1200 w=300 h=300 -> off=0x200000 rows_done=300 rc=0; window md5 b237eb04->4b751df8); remaining: client draws must execute (GR LAUNCH FAILED timeout ch_rel=0x00000000 want=0xc0ffee02, zero src=stream) - SESSION 153 r1026-r1027
* vgsp: op-translate + fill floor walk-first for below-floor (sub-1TiB) VAs ↵Arthur Hanson Rasmusson2 days
| | | | via guest page tables - kills LOWFILL-REFUSED va=0x120458c00 pa=0x120458c00 that froze DDX screen repaints (fresh boot: fills done=3686400 rc=0, LOWFILL-REFUSED=0); xwd path proven byte-exact vs vidmem 0x200000 fill artifact; window still black (client re-presents static frame; no client content in vidmem); r1025 beef0100 pump regression (GPFIFO va=0xa0d8f54 all-zero, submissions=0 vs 208) - SESSION 153 r1024-r1025
* vgsp: svc_client_slot_sweep - per-pass (~2ms) clear of armed 0xffff ↵Arthur Hanson Rasmusson2 days
| | | | completion slots for live beef channels; attempts now submit heavily (submissions 29->208, GP_PUT advancing put=14, sema-consume idx=94 put=95, ops_runs=2, copyent total=131068); client shim frames have content (mean_sum=60.8 nz_frac=0.2843); remaining wall = X presentation (DDX black fill va=0x120400000 vs client copy dst=0x4700000) - SESSION 153 r1024
* vgsp: sema_client_slot - clear armed 0xffff completion slots below ↵Arthur Hanson Rasmusson2 days
| | | | beef-family channel-notifier base in svc_notify_complete; first real client submissions (submissions=29, sema-pushall h=0xbeef0100 va=0x421f758 len=1720 allow=1 trusted=1); attempt still recycles ~12s - SESSION 153 r1023
* vgsp: apply userdOffset[subDeviceId] to channel USERD addr (real control ↵Arthur Hanson Rasmusson2 days
| | | | page fb 0x20fc00, not 0x18fe00); low-aperture 0x4000000-class entry window; GR-ring USERD probe accepts g>p/put-cap>1024; own-VAS-first counter derive - USERD wall broken (chan h=0xbeef0100 userd=0x20fc00 as=2 ring rc=0 pa=0x233603000); new wall: client never stores GP_PUT (put=0, FB 0x20fc00+0x8c frozen; last RM call ZCULL_BIND 0x20801208) - SESSION 153 r1016
* vgsp: FB USERD scan time-paced (1/25ms, cap 512) + pristine fallback for ↵Arthur Hanson Rasmusson2 days
| | | | ring_pa==0 - fixes fresh-boot Xorg 10s DMA-init wall (2/2 boots green, DDX channel sub=3402, TWOD fills execute) - SESSION 153 r1014-r1015
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-01 23:07:57 +0000