From 34eaeb5338af91235d9ee405366e7e8b7856ce7c Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Sun, 1 Nov 2026 14:56:45 -0500 Subject: vgsp: CONT-97 - gsp_phys_ds_spy re-clears DS_REPORT_MASK/_2 every sample + maskholds/last_mask logging (W1C confirmed: pgraph-rw 0x405840<-0x20 reads back 00000000, no synthetic calibration possible); slots NAMED: c597 SetPipeline[j] only j=0..5, window binds j=1/2/5 ProgramAddressA=0x19a0900/0x19a0200/0x19a0000 byte-equal SPH_INFO stage VAs; DS_HWW_ESR bits 0..23 = SPH0..23 checks (RM DS_SPH_ERR=0x6e+n) so j=9/10/11 binds cannot exist - {5,9,10,11} are per-SPH validation checks; pgraph-rw A/B: golden PATCH DS writes are TGA constraint logic ALREADY LIVE (0x700/0x800) not SPH-related; DS-spy captures: hits all badf1201 poison or zero (timing anomaly recorded); GATE1 black 3 boots ds=a4000e20 sph=0,019a0900,019a0200 0/900 pages; guest root capture 99.92% black; next: beef window's only call form is op=4 IMMD_DATA_METHOD on CallMme[0].Macro 0x3800 (MME-WINRUN off=a0 op=4 cnt=48 mthd=3800) never executed by MME (pcv=0; held windows retire, call-bearing park) while prelude resident - decode run vs MME call spec offline (mme_replay_slots81.txt) + re-emit client's own call shape (trigger 0x3800 + params 0x3804); if op=4 correct run pure-method window test keep_mask=0+hold=N to decide if replay needs MME at all - SESSION 153 r1326-r1327 --- kernel/gsp_phys_booter.c | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index 7c4a946..3d0aae2 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -31076,7 +31076,7 @@ static int gsp_phys_ds_spy_show(struct seq_file *m, void *unused) { void __iomem *bar0 = gsp_phys_gpu_bar0(); u64 t0; - u32 hits = 0, samples = 0; + u32 hits = 0, samples = 0, maskholds = 0, mask0_last = 0, mask2_last = 0; u32 ms = READ_ONCE(gsp_phys_ds_spy_ms); if (!bar0) @@ -31093,7 +31093,31 @@ static int gsp_phys_ds_spy_show(struct seq_file *m, void *unused) t0 = ktime_get_ns(); while (ktime_get_ns() - t0 < (u64)ms * 1000000ull) { u32 esr = readl(bar0 + GSP_PHYS_DS_ESR); + u32 m0 = readl(bar0 + GSP_PHYS_DS_REPORT_MASK); + u32 m2 = readl(bar0 + GSP_PHYS_DS_REPORT_MASK_2); + /* + * SESSION 153-CONTINUED-97: hold the HWW report masks + * cleared while sampling. A pending report POISONS the + * whole PRI block (every read returns 0xbadf1201), which + * hid the SPH stage snapshot at the validation instant + * (r1325 spy2: all 16+ hits badf1201, masks back at + * 00ffffff). The mask is (re)armed by the context load / + * the RM setup, not only by our replay path, so re-clear + * it every sample; the re-clear count is logged so the + * capture's provenance is visible. NOTE (r1326): poison + * still appeared on one pass despite 29 re-clears, so a + * clean latch is not guaranteed and the store-side read + * remains the authoritative fault-time datum. + * Development-only diagnostic tap. + */ + if (m0 || m2) { + iowrite32(0u, bar0 + GSP_PHYS_DS_REPORT_MASK); + iowrite32(0u, bar0 + GSP_PHYS_DS_REPORT_MASK_2); + maskholds++; + mask0_last = m0; + mask2_last = m2; + } samples++; if (esr & 0x7fffffffu) { u32 esr2 = readl(bar0 + GSP_PHYS_DS_ESR_2); @@ -31122,7 +31146,8 @@ static int gsp_phys_ds_spy_show(struct seq_file *m, void *unused) udelay(20); } } - seq_printf(m, "# DS-SPY end samples=%u hits=%u\n", samples, hits); + seq_printf(m, "# DS-SPY end samples=%u hits=%u maskholds=%u last_mask=%08x/%08x\n", + samples, hits, maskholds, mask0_last, mask2_last); return 0; } -- cgit v1.2.3