physicsdolphin/nv-uefi-unlocker v2.1.6

v2.1.6 — GOP 挂死修复（非递归重连逃生门）+ tu10x heap 档位 + SEC2 marker matrix + PR#26

on GitHub

v2.1.6 头条：GOP 挂死修复——定位第二类"递归重连死锁"板形态（detach 后 GOP 句柄清零，固件在 ConnectController 内部死锁，日志逐行止于 RECONNECT: ConnectController (recursive=true) begin；#52 X99 实锤，#35/#61 同签名），新增 \tx-reconnect-nonrecursive.txt 逃生门（默认 OFF）。实证：#52（X99 + RTX 3080 Ti 魔改卡，GA103 10de:2420，v2.1.5 默认流必挂）换本链路后进系统、全链解锁——据我们所知这是 GA103/2420 的首个公开 Windows 解锁；首发挂死板 ASUS Z790（#13）复测 healthy control 通过（0.93 full rate）。同版收入 tu10x heap 档位修复线（#17/#57）、SEC2 marker matrix + \v67-direct-ss.bin 消融开关（#17/#62，默认 OFF）、以及 PR #26 工艺修复线首次进入 release 二进制。TU106（1f07）全链回归通过。

Headline of v2.1.6: the GOP-hang fix — a second class of boards deadlocks the recursive reconnect inside the firmware (zero GOP handles left after the detach; the per-line log ends at RECONNECT: ConnectController (recursive=true) begin; proven on the #52 X99 board, same signature on #35/#61). New \tx-reconnect-nonrecursive.txt escape hatch (default OFF). Proven: #52 (X99 + modded RTX 3080 Ti, GA103 10de:2420, always hung on v2.1.5) boots into Windows and fully unlocks with this chain — to our knowledge the first public Windows unlock of a GA103/2420; the original hang board ASUS Z790 (#13) re-tested as a healthy control (0.93 of full rate). Also in: the tu10x heap-tier fix line (#17/#57), the SEC2 marker matrix + \v67-direct-ss.bin ablation switches (#17/#62, default OFF), and PR #26's craft fixes enter a release binary for the first time. TU106 (1f07) full-chain regression passed.

中文

加载器（BOOTX64.EFI）

• \tx-reconnect-nonrecursive.txt（默认 OFF）：存在时强制非递归 reconnect——只把 vendor GOP 绑回设备，console 栈留给 bootmgfw 自建（PR #13 在 Z790 形态验证过、至今零挂死的路径）。背景：v2.1.5 的 stale_pathless_gop() 只覆盖"无路径 GOP 幸存 detach"形态；另一类板子 detach 后 GOP handles 清零，判定仍走 recursive=true 并在固件内死锁（#52 X99、#35 B460M/X570-P、#61 X570 GAMING X 同签名）。挂死时恢复手段不变 = 断电；\no-reconnect.txt 语义不变且优先级更高（两个标记并存时整体跳过重连——注意这会落入 #35/#61 的 Code 12 形态，见"已知开放"）
• HANDOFF-PCI 只读快照（#61 求助点 2）：FLR/verify 之后、reconnect 之前，打印 GPU 配置头 0x00–0x3F、能力表遍历（PCIe DevCtl/LnkCtl、MSI 使能）、每座桥的 Command 与 Bridge Control（VGA 路由位）——与 Windows 侧 pnputil /resources 同轮配对，配置空间在哪一侧被动过一处差异即可定位
• tu10x PLM relock 读回注解：0xffffffef = 已知好形态（bits 5:6 sticky-open，TU106/TU104 一致；E-C 对照轮实证），0xffffff8f = 全关；其余值显式标 UNEXPECTED

tu10x heap 修复线（v2.1.6-pre 首发内容，首次收入 stable）

• 22 GiB / 24 GiB heap 档位（#17 TITAN 22G / #57 TITAN 24G）：此前 8 GiB 常数导致大显存改装卡 WprMeta 布局越界报 0x91
• RM 驱动公式替代尺寸表：heap offset/size 按驱动同款公式从 gspFwOffset 推导，逐位复现 40HX 一手 dump（#57）
• LOCAL_MEMORY_RANGE 解码：usable FB 从驱动源解码，替代 PLM 锁死的 FB_SIZE_MIB 直读

SEC2 marker matrix + \v67-direct-ss.bin（#17/#62 消融线，默认 OFF）

• SEC2 点火环境三 marker（\tx-sec2-c-load.txt / \tx-ptimer-seed.txt / \tx-host-probe.txt）+ 载荷覆盖 marker \v67-direct-ss.bin（CMP 谱系 direct-SS 词表，xrip cmp50hx-unlock 钉定 blob，本仓库不打包）。默认行为与 v2.1.5 完全一致；消融实验继续在 v2.1.7-tu102-diag（原 v2.1.6 pre-release 二进制，sha 不变）上进行
• 注意：\v67-direct-ss.bin 在本版合并中按 PR #26 的严格资产语义移植——文件存在但不可读 = abort，绝不静默降级到 four-plm 载荷

PR #26 工艺修复线（首次进入 release 二进制）

• 严格资产语义（must_asset!）：资产"存在但不可读"（空文件/超尺寸/短读/介质拔出）在任何 GPU 交互前 abort，不再与"U 盘没放该文件"混为一谈
• FLR 路径按能力表定位 PCIe cap（不再硬编码 0x78；DEVCAP.FLR=bit28 在 TU106 真机实证）
• 扩展能力链遍历修复、三处打印错字节的诊断修正、EBUSY 语义修正（拒绝 claim 时不再声称"什么都没碰"）、sim 特权模型覆盖整个 PLM 保护块
• TU106 1f07 全链回归通过（evidence commit 56e200d）

证据

• #52（X99 + GA103 2420 魔改 3080 Ti）：v2.1.5 挂死 → 本链路全链解锁，GPU-Z 截图 + 吞吐 CSV 在档（issue #52）
• #13（ASUS Z790 + 4060 Ti 2803）：无标记自然路径 ConnectController ok、交棒 Windows 无 Code 12、ada-unlock-kit verify 0.93 full rate（issue #61 评论）
• TU106（1f07）PR#26 head 全链回归：解锁闭环 + DEVCAP bit28 实证（docs/evidence/）

已知开放

• #35/#61 Code 12 线：跳过重连（\no-reconnect.txt）交棒后 Windows 传统 VGA 资源未分配的形态未在本版解决，诊断继续（交棒 console 归属链失序为当前主线假设）；受影响机器请在 issue 内按协议反馈
• 新 marker 的 README 文档随后续版本补充（本版以 release note 为准）

资产纪律

发布 zip（nv-uefi-unlocker-v2.1.6.zip，与 v2.1.5 同布局）：BOOTX64.EFI、LICENSE、README.md、make-usbroot.ps1 / make-usbroot.sh、enable-turing-unlock.ps1、assets-x86_64-windows.exe / assets-x86_64-linux、ssdiag-x86_64-windows.exe。不含任何 NVIDIA 固件（逐文件名扫描核验：无 gsp_/fwimage_/fwsignature_/booter_/sec2_bl_/scrubber_/v67-/.rom；pmxdrv.sys 为 Intel 签名的 Windows 内核驱动，内嵌于 ssdiag.exe，非 NVIDIA IP 亦非散装文件）。全部固件件由 make-usbroot.ps1 / make-usbroot.sh 在构建机上从钉 SHA-256 的 610.43.03 公开输入现场再生；Turing proven BL（0x6000 字节，de676bae…）由脚本从钉 hash 的 cmp50hx 仓库自动获取。

• make-usbroot.sh 较 v2.1.5 更新：Turing GSP 门 fail-closed（聚合判定无法区分适配器——单个 N/A 即拒绝构建，防 4090+20 系混插机器在 4090 的 GSP 状态下放行）+ Linux 侧 Turing 设备段扩到 0x2182..0x21D1（与白名单一致）
• ssdiag-x86_64-windows.exe 与 v2.1.5 逐字节相同（9283eaa4…，v0.4.8 无改动）

产物校验（SHA-256）

aa0c11485c152a6dc7b76a0f300e51e19e2942d22e5716ae6a79d0fe0a3612d7  BOOTX64.EFI
8ab415b4bd1eedaf96cebeabe9f3c0895b290d02cac0af40fe9c99d1bb00169b  assets-x86_64-windows.exe
3b907b503b0a00e8eab64cfdec7d40746ebe65d28ec2926d2b11f636d02e213a  assets-x86_64-linux
9283eaa42b81d66680880fd3264c42117fd77691bfd66c40946540e51f9d2c27  ssdiag-x86_64-windows.exe
ffc5b8eada75c5563390ba5bb7fa06de70a3222f46a33467a268dcc33b669e46  nv-uefi-unlocker-v2.1.6.zip

历史构建（仍在架）：v2.1.7-tu102-diag = 96e0133f…（V67 消融钉定件）、v2.1.6-diag.1 = dbc8c1d4…（reconnect 诊断首版）。

English

Loader (BOOTX64.EFI)

• \tx-reconnect-nonrecursive.txt (default OFF): when present, forces a non-recursive reconnect — the vendor GOP is bound back to the device and the console stack is left to bootmgfw (the PR #13-validated path, zero hangs to date). Background: v2.1.5's stale_pathless_gop() only covers the "pathless GOP survived the detach" shape; on another class of boards the detach leaves zero GOP handles, the heuristic still picks recursive=true, and the firmware deadlocks inside ConnectController (#52 X99, #35 B460M/X570-P, #61 X570 GAMING X share the signature). Hang recovery is unchanged = power cycle; \no-reconnect.txt semantics are unchanged and take priority (with both markers the reconnect is skipped entirely — which lands in the #35/#61 Code 12 shape, see "Known open")
• HANDOFF-PCI read-only snapshot (issue #61 ask #2): after FLR/verify, before the reconnect — GPU config header 0x00–0x3F, a capability walk (PCIe DevCtl/LnkCtl, MSI enable), and every bridge's Command / Bridge Control (VGA routing bits). Pairs with the Windows-side pnputil /resources dump of the same boot
• tu10x PLM relock readback annotation: 0xffffffef = known-good (bits 5:6 sticky-open, TU106/TU104 identical; proven in the E-C control run), 0xffffff8f = fully closed; anything else is flagged UNEXPECTED

tu10x heap fix line (first shipped in v2.1.6-pre; first stable to carry it)

• 22 GiB / 24 GiB heap tiers (#17 TITAN 22G / #57 TITAN 24G): the old 8 GiB constant broke the WprMeta layout on large-VRAM modded cards with exit 0x91
• RM driver formula replaces the size table: heap offset/size derived from gspFwOffset with the driver-exact formula, reproducing the 40HX first-hand dump bit-for-bit (#57)
• LOCAL_MEMORY_RANGE decode: usable FB decoded from the driver source instead of the PLM-locked FB_SIZE_MIB read

SEC2 marker matrix + \v67-direct-ss.bin (#17/#62 ablation, default OFF)

• Three SEC2-environment markers (\tx-sec2-c-load.txt / \tx-ptimer-seed.txt / \tx-host-probe.txt) plus the payload override \v67-direct-ss.bin (CMP-lineage direct-SS word table, pinned xrip cmp50hx-unlock blob, not redistributed here). Default behavior identical to v2.1.5; the ablation continues on v2.1.7-tu102-diag (the original v2.1.6 pre-release binary, sha unchanged)
• Note: in this merge the \v67-direct-ss.bin override was ported onto PR #26's strict asset semantics — a file that is present but unreadable aborts, it never silently degrades to the four-plm payload

PR #26 craft fixes (first time in a release binary)

• Strict asset semantics (must_asset!): an asset that is present but unusable (empty / over the size cap / short read / media pulled) aborts before any GPU interaction, no longer conflated with "the file is not on the stick"
• FLR paths locate the PCIe capability by walk (no hardcoded 0x78; DEVCAP.FLR = bit 28 field-proven on TU106)
• Extended-capability chain walk fixes, three diagnostics that printed the wrong bytes, the EBUSY semantics fix (a refused claim no longer claims nothing was touched), and the sim privilege model covering the whole PLM-protected block
• TU106 1f07 full-chain regression passed (evidence commit 56e200d)

Evidence

• #52 (X99 + GA103 2420 modded 3080 Ti): hung on v2.1.5 → full-chain unlock with this chain, GPU-Z screenshot + throughput CSVs on file (issue #52)
• #13 (ASUS Z790 + 4060 Ti 2803): marker-free natural path ConnectController ok, Windows handoff with no Code 12, ada-unlock-kit verify at 0.93 of full rate (issue #61 comment)
• TU106 (1f07) regression on the PR#26 head: unlock closed + DEVCAP bit28 field-proven (docs/evidence/)

Known open

• #35/#61 Code 12 line: the shape where skipping the reconnect (\no-reconnect.txt) lands Windows with the legacy VGA ranges unassigned is not solved in this version; diagnosis continues (handoff console-ownership discontinuity is the leading hypothesis). Affected machines: please keep reporting per the issue protocols
• README documentation for the new marker follows in a later release; this release note is the source of truth

Asset discipline

The release zip (nv-uefi-unlocker-v2.1.6.zip, same layout as v2.1.5): BOOTX64.EFI, LICENSE, README.md, make-usbroot.ps1 / make-usbroot.sh, enable-turing-unlock.ps1, assets-x86_64-windows.exe / assets-x86_64-linux, ssdiag-x86_64-windows.exe. It contains no NVIDIA firmware (verified by a per-file name scan: no gsp_/fwimage_/fwsignature_/booter_/sec2_bl_/scrubber_/v67-/.rom; pmxdrv.sys is an Intel-signed Windows kernel driver, embedded in ssdiag.exe — not NVIDIA IP and not a loose file). Every firmware file is regenerated on the build machine by make-usbroot.ps1 / make-usbroot.sh from the SHA-256-pinned 610.43.03 public inputs; the Turing proven BL (0x6000 bytes, de676bae…) is fetched by the script from the pinned cmp50hx repository.

• make-usbroot.sh is updated over v2.1.5: the Turing GSP gate is now fail-closed (the aggregate check cannot tell which adapter a field belongs to, so a single N/A refuses the build — a 4090 + 20-series box can no longer pass on the 4090's GSP state) and the Linux-side Turing device range widens to 0x2182..0x21D1 (matching the whitelist)
• ssdiag-x86_64-windows.exe is byte-identical to v2.1.5's (9283eaa4…, v0.4.8 unchanged)

Artifact hashes (SHA-256)

aa0c11485c152a6dc7b76a0f300e51e19e2942d22e5716ae6a79d0fe0a3612d7  BOOTX64.EFI
8ab415b4bd1eedaf96cebeabe9f3c0895b290d02cac0af40fe9c99d1bb00169b  assets-x86_64-windows.exe
3b907b503b0a00e8eab64cfdec7d40746ebe65d28ec2926d2b11f636d02e213a  assets-x86_64-linux
9283eaa42b81d66680880fd3264c42117fd77691bfd66c40946540e51f9d2c27  ssdiag-x86_64-windows.exe
ffc5b8eada75c5563390ba5bb7fa06de70a3222f46a33467a268dcc33b669e46  nv-uefi-unlocker-v2.1.6.zip

Historical builds (still up): v2.1.7-tu102-diag = 96e0133f… (V67 ablation pin), v2.1.6-diag.1 = dbc8c1d4… (first reconnect diagnostic).

Attachment replaced in place (2026-11-08). The pinned CachyOS archive dropped nvidia-utils-610.43.03 from its rolling window (#212), which killed every make-usbroot script shipped in this release. The make-usbroot.ps1 / make-usbroot.sh inside the zip (and SHA256SUMS.txt) now carry the fix from main (e3fa6f4): the nvidia-utils input is a source group — Arch Linux Archive → first-party NVIDIA .run → CachyOS cache — with automatic fallback, -UtilsSource / --utils-source to pin one transport, and the same pinned GSP-firmware hashes (all three containers verified bit-identical). Everything else in the zip is byte-unchanged. If you downloaded this release before 2026-11-08, grab the zip again.

附件已原地替换（2026-11-08）：CachyOS 归档对每个包只保留约三个版本的滚动窗口，钉定的 nvidia-utils-610.43.03 已被挤出窗口（HTTP 404，#212），本 release 内置的制盘脚本随之失效。zip 内的 make-usbroot.ps1 / make-usbroot.sh 与 SHA256SUMS.txt 已替换为 main 上的修复版（e3fa6f4）：nvidia-utils 输入改为源组自动回退——Arch 官方归档（永久保留，版本不清除）→ 第一方 NVIDIA .run 安装器（XFree86 树只增不删）→ CachyOS 旧容器（仅作字节缓存还魂通道）——并可用 -UtilsSource / --utils-source 钉定单一传输。GSP 固件的钉定 SHA-256 不变：三个容器内含固件逐位一致，已交叉验证。zip 其余文件逐字节未动。2026-11-08 之前下载过本 release 的用户请重新下载 zip。