Phase-3 Deep-Dive Backlog
Binaries pinned on this page —
libnrt.so→libnrt.so.2.31.24.0(aws-neuronx-runtime-lib 2.31.24.0-0b044f4ce, BuildID[sha1]8bb57aba0fb2e0035f1d88e9fc4fb3e7387c102e, ELF64 DYN x86-64, not stripped, full DWARF v4) ·libnccom.so.2.31.24(aws-neuronx-collectives 2.31.24.0-1a31ba186, BuildID9c00176c081788c9435d27d11bb40e92495463f0, not stripped,.debug_info) ·neuron.ko(aws-neuronx-dkms 2.27.4.0, GPL-2.0 C source authoritative, binary stripped) ·libncfw.so(SONAMElibncfw.so.2.31.1.0.cf13a49f, BuildIDa98f8e1ca2294582835310c3a1092e0a5e500db5, no DWARF) ·libnrtucode_extisa.so(BuildID7bb03bc42ce1530924a1797ec9d5e518a7ae5e44, stripped, no DWARF, no symbol table).Part XVI — Appendices / REFERENCE · Evidence grade: every row is a real gap whose boundary is already byte-anchored on its owning page; this page adds the recovery method and a priority, not new derivation. Addresses cited are those of the boundary the next pass starts from. · back to appendix index
Abstract
This is the prioritized frontier — the work-list a next pass picks up. The Extraction Status coverage map grades what exists: it assigns every shipped page one of three evidence grades and names the principal gap that holds each cell below byte-level. This page is the inverse of that map. It takes the genuinely-opaque and surface-mapped items that map routes here — the sequencer-internal microcode ops, the per-arch leaf bodies left at a name, the config TUs with no recovered caller, the template-inlined composer TUs folded into enc.cc by address — and turns each into an actionable deep-dive: what is known, what is missing, the concrete recovery method, and a priority. It is a register of work, not a catalogue of findings.
Every entry is a real gap, not an invented one. The honesty discipline of the methodology page's confidence discipline cuts both ways: just as a page must not claim coverage it does not have, this backlog must not manufacture work to look thorough. Each row below corresponds to a not-traced or surface-mapped cell that already names its own boundary on its owning page; nothing here is a hole the book pretends is filled, and nothing is padding. The two hard ceilings from the coverage map — libncfw.so and libnrtucode_extisa.so carry no DWARF, and the latter no symbols at all — set the difficulty of several entries: their recovery methods are raw-disassembly-against-carved-blobs, not symbol-driven, and that is stated per row. The page closes with a short prioritization note on what a next pass should tackle first and why.
NOTE — "backlog" does not mean "broken." Most of these regions are correctly surface-mapped today — a reimplementer treats the named boundary as a contract and builds the interior against the binary. This page exists so that the book's own completeness can advance: it is the queue that, drained, lifts pages from
surface-mapped/not-tracedtoward byte-level. A row leaving this list is a page gaining a grade on the coverage map.
1. The backlog
One row per open deep-dive. What is known is the byte-anchored boundary the owning page already pins; The gap is the interior a reimplementer still cannot rebuild; Method is the concrete recovery approach; Pri is P1 (blocks a reimplementer on a hot path) / P2 (interior of a mapped subsystem) / P3 (cosmetic or doc reconciliation); Conf grades this assessment of the gap, not the eventual finding.
| Topic | Owning page | What is known | The gap | Suggested method | Pri | Conf |
|---|---|---|---|---|---|---|
| Q7 GPSIMD sequencer-internal TIE ops | gpsimd/q7-blobs.md | 13 Q7 microcode blobs carved + fingerprinted; the 1534-mnemonic IVP/scalar ISA catalogue sized against libisa-core.so operand tables; FLIX/RELA loader decoded | The custom Tensilica TIE ops the sequencer issues inside the microcode have no public iclass decode → the blob bytes past the standard Xtensa-LX core ISA are not disassembled to opcodes | xt-objdump against the carved blobs cross-referenced to a TIE-DB (the .tdk/config descriptor that names the custom iclass slots); attribute each unknown FLIX slot to its TIE iclass, then decode operands from the slot's TIE field table. libnrtucode_extisa.so is stripped → blob-relative addressing only, no symbol anchor | P2 | HIGH |
| NCFW Xtensa sequencer internals | firmware/ncfw-sequencer.md | Xtensa-LX disassembly of the carrier mapped; 8 embedded blobs carved; the v2 reset prologue byte-anchored; the SUNDA v2 boot scaffold shown byte-identical to the extisa carrier | libncfw.so has no DWARF → the per-handler sequencer ops below the disassembly surface are not walked to a control-flow model; handler names are unrecoverable | Byte-trace from the carrier entry (libncfw_get_image_func get-image boundary) forward through the dispatch table; cross-reference the per-arch reset prologues to separate the shared boot scaffold from arch-specific handler bodies, then label handlers by the CSR/queue addresses they touch rather than by name | P2 | MEDIUM |
Per-arch SBUF leaf bodies (sbuf_base_for_core) | runtime/arch-geometry.md | The SBUF window size is byte-pinned per generation; the per-arch geometry constants are decoded; the leaf is reached via the arch-ops vtable | The per-core SBUF base derivation inside each arch's sbuf_base_for_core leaf is graded MED — the address arithmetic that maps core_id → base is summarized, not walked | Decode the per-arch leaves at their addresses (each is a small leaf off tdrv_arch_ops); the bodies are short → a direct disassembly resolves the base formula (likely window_base + core_id * stride); confirm stride against the byte-pinned window size already on the page | P2 | HIGH |
encd interior math | isa/validators-per-arch.md, collectives/encd-overview.md | The encd emitter boundary + per-arch op dispatch decoded; the validator entry tree mapped; the heavy bodies sized (e.g. ib_create_one_block 11,535 B / 241 callees / 141 KB frame) | Some encd and per-arch validator interior math (operand-legality arithmetic, address-overlay computation) is sized but not line-walked — huge per-fn bodies left as a contract | Deeper body trace of enc.cc functions: slice each heavy validator from its is_valid_* root, isolate the per-opcode arithmetic blocks, and re-derive the legality predicate. Frame-hazard rows (see §2 NOTE) flag which bodies need heap-allocation in a port | P2 | HIGH |
| 13 switch-platform per-event composer TUs | collectives/switch-broadcast-barrier.md | The switch-platform event surface is pinned; the 13 per-event composers are fn-covered (every function present) but name-gapped | The 13 composer TUs are -O2 template/STL-inlined and folded into enc.cc by address — they are never name-cited, so the per-event composer→TU attribution is missing | Address-band attribution + signature matching: partition the enc.cc address range by the DWARF CU line-table gaps, then match each anonymous band's call-signature against the named composer family (enc_mesh_primitive::__compose_*) to recover which event each band implements | P2 | MEDIUM |
~17 of 24 al_hal_udma_config fns — no static caller | runtime/hal-udma-iofic.md | The HAL UDMA build + IOFIC path decoded; all 24 al_hal_udma_config functions present and individually sized; the role of each is known | 17 of the 24 have no recovered static caller in libnrt → their invocation context (which build phase, which arch, what register state) is unknown; they may be indirect-only or dead | Indirect-reachability / vtable scan: sweep the arch-ops and HAL dispatch vtables (tdrv_arch_ops, the KaenaHal shim tables) for function-pointer slots holding these 17 addresses; cross-check the IOFIC config descriptor tables. A slot hit promotes a fn from "no caller" to "indirect-called from band X" | P2 | HIGH |
| Firmware upload-path DMA-descriptor algebra | firmware/upload-path.md | The DKMS→DRAM upload path is mapped end-to-end; the carrier get-image boundary and the v2 reset prologue are byte-anchored | The DMA-descriptor algebra that stages the firmware image into device DRAM is summarized, not re-derived — the descriptor count/stride/chunking math is a black box at the boundary | Re-derive the descriptor algebra from the upload driver: trace the H2T ring build in the kernel DMA layer (GPL source, line-anchored) against the carrier's expected image layout; confirm the chunk size against the embedded blob sizes already carved in firmware/embedded-payloads.md | P2 | HIGH |
| V2 BUG-A retry-loop livelock bound | appendix/known-bugs.md | The retry loop in _ndma_memcpy_wait_for_completion (neuron_dma.c:378-429) is byte-anchored; it is armed by ndma_retry_memcpy=true and bounded only by the reset window ending | The loop has no explicit iteration cap → whether a stuck reset window can livelock the DMA wait is a flagged-but-not-bounded hazard | Worst-case bound analysis: model the reset-window predicate (nr_op_in_reset_wnd, neuron_reset.c:366-379) against the reset state machine's max dwell; determine whether the window is guaranteed to close, or add a cap as a hardening recommendation | P3 | MEDIUM |
| NDS kernel refcount doc-vs-code mismatch | appendix/known-bugs.md (NDS-REF) | The NDS counter plane + wire format are byte-level; the kernel-side datastore is mapped | The doc describes a refcount the kernel code does not maintain symmetrically → flagged for reconciliation; no functional bug confirmed | Reconcile the refcount lifecycle: trace every increment/decrement of the NDS kernel refcount against the documented model; either confirm the asymmetry is benign (the dominant likelihood) or escalate to a SW-defect row | P3 | LOW |
kmgr_unload_nn erase-then-drain ordering | appendix/known-bugs.md (KMGR-ORD) | The unload path is mapped; NN state is erased before outstanding work is drained | Whether the ordering is an exploitable hazard or a benign sequence is not root-caused to a failure | Failure-mode analysis: construct the concurrent-unload-vs-in-flight-DMA interleaving and determine whether the erase-before-drain can free state a live descriptor still references | P3 | MEDIUM |
GOTCHA — a row's Conf grades the gap assessment, not the difficulty or the eventual answer.
HIGHmeans "this boundary is firmly pinned and the named method will close it" — e.g. the SBUF leaves are short and their formula is mechanically recoverable.MEDIUM/LOWmeans the boundary itself is softer: the NCFW sequencer internals (no DWARF) and the NDS refcount (doc-vs-code only) carry more uncertainty about what the method will find, not whether the gap is real.
2. Prioritization note
A next pass should drain by leverage, not by ease. Two clusters carry the most weight:
- The
encd/ collectives-composer interiors (P2) are the densest first-party reimplementation mass on the binary — the heavy-frame census puts ISA-validation at ~1.42 MB / 369 fns and collectives/encoder at ~1.06 MB / 1129 fns, with the composer/scheduler family owning 28 of the 50 largest functions. Closing theencdinterior-math row and the 13 switch-platform TU attribution lifts the single biggest set ofsurface-mapped/MEDIUMcells at once. These bodies are also stack-frame hazards for a clean-room port:enc_find_cc_context_by_signaturereserves a 6.75 MB single-struct stack frame andact_local_storage_tbls_setup685 KB — a reimplementation must heap-allocate, so the interior trace and the port-hazard warning land together. - The two no-DWARF carriers (P2, harder) — the Q7 TIE ops and the NCFW sequencer internals — are lower-leverage per byte but they are the only fully-opaque regions left, so they bound the book's worst grade. They need the heaviest method (raw disassembly + TIE-DB / address-band attribution), so they are second in line: high effort, narrow but irreducible coverage.
The P3 reconciliations (livelock bound, NDS refcount, kmgr ordering) are cheap and should be folded into whatever pass touches their owning subsystem — they do not justify a dedicated pass, but each is a one-function analysis that converts a "flagged" row into a confirmed status.
NOTE — this page is the inverse of the coverage map. Extraction Status grades what exists — it is the ledger of confidence over the shipped pages. This page lists what to do — it is the queue of work that, drained, advances those grades. The two are kept separate on purpose: a reader auditing coverage reads the coverage map; a reader planning the next pass reads this backlog. Neither restates the other — the coverage map does not carry recovery methods, and this page does not carry the per-page coverage table.
Cross-References
- Extraction Status — the coverage map this page inverts; its §4 "what remains opaque" routes every
not-traceditem here - Subsystem ↔ Binary ↔ Source-TU Matrix — the ownership view: which TU in which binary implements each subsystem a backlog row touches
- Known-Bugs and Anomalies Catalog — owns the three P3 reconciliation rows (V2 BUG-A livelock, NDS-REF, KMGR-ORD) as flagged defects awaiting root-cause
- Methodology — the static-analysis method every recovery row above applies (disassembly, DWARF-CU partition, vtable scan, address-band attribution)