MansfieldPlumbing
Table of contents

Physical HMX Accelerator Acquisition & Instruction Execution

Kokoro-Hexagon 0a03be39Updated 2026-09-23

Objective & Invariant

Verify whether physical HMX matrix coprocessor hardware is present and operational on the Snapdragon 8 Gen 2 (SM8550) CDSP under an unsigned User Process Domain:

  1. Verify QuRT syscalls for HMX acquisition (trap0(#0x1d)) and HVX mode control (trap0(#0x55)).
  2. Measure single-thread mode transition protocol: HVX unlock -> HMX try_lock -> mxclracc -> HMX unlock -> HVX relock.
  3. Verify that native HMX machine instructions (mxclracc, encoding 0xa6e0c011) execute on physical silicon without triggering illegal instruction exceptions or data aborts.

Verification Chain

  1. Independent Oracle Verification:

    • Instruction sequence emitted via pure PowerShell named encoders in src/emit/Hexagon.ps1.
    • Assembled independently via Qualcomm Hexagon SDK hexagon-llvm-mc -triple=hexagon -mcpu=hexagonv73 -mattr=+hvxv73,+hvx-length128b,+hvx-ieee-fp,+hmxv73.
    • Code bytes match: 100% bit-exact (272 bytes).
    • 13 invalid operands rejected. Zero relocations, zero imports.

  2. Physical Hardware Execution:

    • Device: Samsung Galaxy S23 (SM8550, Hexagon V73).
    • Execution log from tools/Invoke-HmxLockProbe.ps1:
Job=kokoro-hmx-lock-probe
LibrarySHA256=841306EB52EBCFE4AEAE7965BD18EDBEDFA6FBA52F53E29DB4DAA13062CA1F27
UnsignedPdRc=0
OpenRc=0
InvokeRc=0 InvokeMs=1.854
HvxUnlockRc=0
HmxTryLockRc=0
HmxUnlockRc=0
HvxRelockRc=0
CloseRc=104
Passed=True
StartupRestored=True

Physical Findings & Invariants

  1. HMX Hardware Silicon Confirmed Live:

    • HmxTryLockRc = 0 (QURT_EOK): QuRT successfully acquired the physical HMX coprocessor on the SM8550 CDSP.
    • mxclracc (0xa6e0c011) executed on the HMX execution unit without trapping or faulting.
    • HmxUnlockRc = 0 (QURT_EOK): QuRT successfully released the HMX unit and cleared accumulators.

  2. Single-Thread HVX/HMX Mutual Exclusion:

    • Confirmed QuRT constraint: A thread with active HVX context cannot lock HMX.
    • Explicitly executing qurt_hvx_unlock() (r0=3, r5=0, trap0(#85)) successfully releases the HVX context (HvxUnlockRc = 0), granting immediate admission to HMX.
    • Executing qurt_hvx_lock(1) (r0=1, r5=0, trap0(#85)) restores 128-byte HVX context (HvxRelockRc = 0).

  3. FastRPC Invocation Timing & Silicon Transition Observation:

    • Total wall-clock time for the entire FastRPC invocation (InvokeMs) containing the mode switch and instruction execution was 1.854 ms.
    • Boundary Condition: This 1.854 ms represents the entire FastRPC boundary traversal (host marshalling, RPC driver dispatch, stub execution, DSP-side QuRT traps, and return). It is not an isolated measurement of the raw silicon mode-switch latency.
    • Isolated silicon-side transition latency requires DSP-side cycle counter reads (pcycle / qurt_sysclock_get_hw_ticks()) or an identical baseline A/B delta probe.
    • Threading Model: A persistent 2-thread producer/consumer queue (Thread A dedicated to HVX pointwise; Thread B dedicated to HMX GEMM) or block-level epoch grouping is a strong candidate architecture to explore, pending isolated cycle counter measurements.

  4. Lifecycle Cleanup & Error Code 104 (CloseRc=104):

    • During the finally teardown, remote_handle64_close returned rc = 104.
    • Per Qualcomm Hexagon SDK specification incs/stddef/AEEStdErr.h: 
      #define AEE_ECONNRESET  (104)  ///< Connection reset by peer
    • This indicates the DSP process domain connection was reset or closed by the peer during the teardown sequence. While all QuRT syscalls and HMX arithmetic executed successfully with InvokeRc=0, CloseRc=104 is explicitly recorded as an unresolved lifecycle cleanup behavior to be characterized in subsequent driver probes.

  5. Epistemic Finding: Capability Query vs Physical Execution Discrepancy:

    • The FastRPC capability query (DSPRPC_GET_DSP_INFO) previously reported Cap_HMX_SUPPORT_DEPTH = 0 and Cap_HMX_SUPPORT_SPATIAL = 0.
    • Despite these capability attributes returning 0, direct execution of qurt_hmx_try_lock() and mxclracc succeeded without faulting on physical silicon.
    • Ground truth: FastRPC capability flags are not authoritative predicates for unsigned PD HMX availability on this platform; physical instruction execution on silicon is the primary source of truth.