tenstorrent/tt-metal

Split out of #51221 (item 3 of 3) so it can be fixed and closed independently of the two Quasar-header items. Verified still present at tt_metal/hw/firmware/src/tt-1xx/active_erisc.cc:115 on current main. initialize_local_memory() passes the .data section size in BYTES to l1_to_local_mem_copy(), whose len parameter is in 32-bit WORDS, so it copies 4× too much data into local memory (overrunning .data into .bss/stack) and reads 4× past the L1 init image. How it fails Blackhole active-ethernet firmware boot — active_erisc.cc is the BH ACTIVE_ETH firmware source (tt_metal/llrt/hal/tt-1xx/blackhole/bh_hal.cpp:189). With a non-empty .data/.rodata section of N bytes, the copy writes 4*N bytes starting at __ldm_data_start. The AERISC local-memory window is only MEM_AERISC_LOCAL_SIZE = MEM_ERISC_LOCAL_SIZE(8192) - MEM_ERISC_BASE_FW_LOCAL_SIZE(0x700) = 6400 bytes (dev_mem_map.h:368), and main.ld places .bss immediately after .data (__ldm_data_end at main.ld:227, __ldm_bss_start at :245), so

Split out of #51225, combining items 6 and 7 — they are the same copy-paste slip in two architectures and the parent asks for them to be fixed as one change. Verified still present on current main: bh_hal_idle_eth.cpp:56-58 and qa_hal_idle_eth.cpp:56-58 are byte-identical in the relevant expression. On Blackhole and Quasar, the IDLE_ETH UNRESERVED base is derived from MEM_AERISC_MAP_END (the active-eth map end) while the IDLE_ETH KERNEL_CONFIG base is MEM_IERISC_MAP_END, so the idle-eth kernel-config ring buffer overlaps the start of the unreserved/allocatable L1 region by 2544 bytes on both arches. The code Both files, lines 56-58 — the base uses IERISC but the unreserved start uses AERISC: mem_map_bases[static_cast<std::size_t>(HalL1MemAddrType::KERNEL_CONFIG)] = MEM_IERISC_MAP_END; mem_map_bases[static_cast<std::size_t>(HalL1MemAddrType::UNRESERVED)] = tt::align(MEM_AERISC_MAP_END + MEM_ERISC_KERNEL_CONFIG_SIZE, max_alignment); The sibling that does it correctly is the Wormh

Split out of #51225 (item 4 of 7) so it can be fixed and closed independently. Verified still present at tt_metal/distributed/mesh_device.cpp:1726 on current main. MeshDevice::~MeshDevice() unconditionally dereferences pimpl_, which is still null whenever construction of the MeshDeviceImpl (or of the MeshDeviceView passed to it) throws, turning a clean TT_FATAL into a segfault during exception unwinding. How it fails MeshDevice::create(MeshDeviceConfig(/*mesh_shape=*/MeshShape(2, 2), /*offset=*/std::nullopt, /*physical_device_ids=*/{0})); MeshDeviceConfig performs no cross-validation of mesh_shape vs physical_device_ids (tt_metal/api/tt-metalium/mesh_config.hpp has no checks), so create() reaches line 407-412 with root_devices.size() == 1 and mesh_shape.mesh_size() == 4. std::make_unique<MeshDeviceView>(mesh_shape, root_devices, fabric_node_ids) → MeshDeviceViewImpl → MeshContainer<T>::MeshContainer(shape, valu

Split out of #51127 (defect 2 of 10) so it can be fixed and closed independently of the other subsystems. Parent anchors this at cq_dispatch.cpp:1159 against 02246470f99; verified still present at line 1157 on current main. Line numbers below are against current main. process_go_signal_mcast_cmd re-reads cmd->mcast.num_unicast_txns after the kernel has intentionally overwritten that word of the command with the go-signal value, so the virtualize_unicast_cores check compares against a garbage byte. How it fails Chip built with VIRTUALIZE_UNICAST_CORES=1 (mesh chip whose virtual active-eth-core count exceeds the physical count) and dispatch_s disabled (2 CQs on ETH dispatch cores), launching a program on sub-device index 1 (multicast_go_offset == 1, so storage_offset == 1). Line 1132 writes go_signal_value into word 1 of the command, i.e. bytes 4..7, which is exactly where mcast.multicast_go_offset (byte 5), mcast.num_unicast_txns (byte 6) and mcast.noc_data_start_index (byte 7) live (ba

File: tt_metal/tt-llk/tt_llk_quasar/common/inc/ckernel_dest.h The file should be refactored to have a cleaner API. See the equivalent file for blackhole. Should be as simple as copy pasting the file over, and changing to use cfg_rmw. Unless there are other architectural changes in this debug dest pathway. However, make sure there is no race on register write. (See tenstorrent/tt-llk#1671)