fix(smu): derive the physical CO slot from Linux topology, not an SMU probe

The per-core Curve Optimizer slot was discovered with an SMU "echo probe" (GET
each slot, treat an argument-echo as a harvested/disabled slot). That heuristic
rests on undocumented GET-on-disabled-slot firmware behavior, and a closed-loop
simulation showed it can build a self-consistent WRONG map under plausible
response models -- a silent wrong-core CO write that read-back cannot catch,
because read-back re-derives the same wrong slot.

It is also unnecessary on Linux. The kernel decodes each core's APIC ID (CPUID
Fn8000_001E) with the hardware's own field widths and exposes the result as the
physical, gap-preserving /proc/cpuinfo "core id" -- so core_id % 8 already IS the
physical SMU slot on harvested / multi-CCD parts (5900X, 7900X, 9900X, 5600X,
...), and core_id // 8 the CCD. (Linux-vs-Windows: Windows enumerates cores
contiguously, which is why ZenStates/ryzen_monitor read the SMN core-disable fuse
to rebuild the slot; Linux hands it to us.)

Remove probe_slot_map and the slot-map state; set_topology now only supplies the
L3-detected CCD. encode_co_arg already derived slot = core_id % 8; its docstring's
"kernel renumbers cores contiguously" rationale (a Windows-ism) is corrected. New
tests drive the real encode+write+read-back on harvested 1-CCD and 2-CCD layouts
and assert each CO lands on the true physical slot (ablation-verified); the
obsolete echo-probe simulation is removed.

Residual (inherent to any approach, unchanged): the APIC-core-field == SMU-CO-slot
identity is a strong two-source inference (gap positions match on measured
3600X/5900X parts), not a single measured write-test on harvested silicon.

Eval: gate-green

Author: Daaboulex

CHANGELOG.md

@@ -40,8 +40,11 @@ Optimizer tuner for Linux, packaged as a NixOS module with an overlay.
   a hard crash there was previously invisible to both crash detectors, so a profile
   that crashes only under combined load could be re-applied into the same crash on
   every resume.
-- Zen 3 Curve Optimizer writes now honor the topology-probed physical core slot, so
-  a harvested or 2-CCD Zen 3 part (5900X, 5600X) no longer writes the wrong core.
+- Per-core Curve Optimizer writes address the correct physical core on harvested and
+  multi-CCD parts (5900X, 7900X, 9900X, 5600X, ...) by using the physical,
+  gap-preserving core id Linux exposes (the kernel's own APIC-ID decode); the earlier
+  SMU slot-probe heuristic was removed as unnecessary on Linux and unreliable
+  (it depended on undocumented GET-on-disabled-slot firmware behavior).
 - Backend pass/fail parsing treats a crash signal (including SIGILL and SIGFPE) as
   instability even after an earlier "passed" line, so an unstable offset is never
   reported as stable.

docs/hardware.md

@@ -29,10 +29,13 @@ AMD-specific.
 | Zen 5 (Strix Halo) | Ryzen AI Max | -60 to +10 | RSMU | PPT/TDC/EDC | -- | APU, uses Strix Point commands |
 | Zen 5 (Shimada Peak) | Zen 5 Threadripper | -60 to +10 | RSMU | PPT/TDC/EDC | Read/Write | Different SMU addresses (`get_co=0xA3`) |
 
-On harvested or multi-CCD parts (5900X 6+6, 5600X 6-of-8, 9900X, ...) the kernel
-renumbers cores contiguously while the SMU addresses physical slots; the driver probes
-the SMU to build the correct kernel-core to physical-slot mapping so a CO write always
-lands on the intended core.
+On harvested or multi-CCD parts (5900X 6+6, 5600X 6-of-8, 9900X, ...) the SMU
+addresses physical core slots, with gaps where cores are fused off. On Linux the
+kernel exposes each core's physical, gap-preserving `core id` (decoded from the APIC
+ID via CPUID `Fn8000_001E`), so the driver derives the physical slot directly as
+`core id % 8` and the CCD from L3 topology -- a CO write always lands on the intended
+core, with no SMU slot-probing. (Windows tools read the SMN core-disable fuse for the
+same result because Windows enumerates cores contiguously; Linux gives it to us.)
 
 All generations support PBO scalar read/write (1.0x to 10.0x) and OC mode
 enable/disable. SMU features require the

src/smu/commands.py

@@ -496,10 +496,12 @@ def encode_co_arg(
         ccd: Topology-detected CCD index. If provided, used instead of
              deriving CCD from ``core_id // 8``. Always prefer passing the
              L3-detected CCD from topology when available.
-        slot: Physical slot index (0-7) within the CCD. On harvested chips
-              the kernel renumbers cores contiguously, so ``core_id % 8``
-              targets the wrong SMU slot. When provided, overrides the
-              ``core_id % 8`` fallback.
+        slot: Physical slot index (0-7) within the CCD, overriding the default
+              ``core_id % 8``. On Linux ``core_id`` is already the physical,
+              gap-preserving core index (the kernel's own APIC-ID decode), so the
+              default is exact even on harvested parts; this override exists only
+              for a caller with a different authoritative source (e.g. an SMN
+              core-disable fuse map, as the Windows tools use).
     """
     commands = get_commands(generation)
     if commands is None:
@@ -512,15 +514,14 @@ def encode_co_arg(
     margin = value & 0xFFFF
 
     if scheme in ("zen3", "zen4_5"):
-        # Zen 3/4/5 share the per-core layout: CCD in bits [31:28], core within
-        # CCD in bits [23:20]. Prefer the topology-detected CCD and the probed
-        # physical slot; harvested / multi-CCD parts (5900X, 5600X, 9900X, ...)
-        # renumber kernel core-ids contiguously, so deriving the slot from
-        # core_id alone targets the WRONG SMU slot — and that write is silent,
-        # because read-back hits the same wrong slot. Fall back to core_id only
-        # when topology did not supply the CCD/slot.
-        #   Zen 3 once used (((core_id&8)<<5 | core_id&7)<<20), which is bit-identical
-        #   to this for the core_id-derived case but discarded the ccd/slot args.
+        # Zen 3/4/5 per-core layout: CCD in bits [31:28], physical core-in-CCD in
+        # bits [23:20]. On Linux core_id is the kernel's APIC-ID-derived PHYSICAL
+        # core index and is gap-preserving on harvested parts (a fused-off core
+        # leaves a hole, not a renumber), so core_id % 8 IS the physical slot and
+        # core_id // 8 the CCD. The ccd/slot keyword overrides let a caller supply a
+        # more authoritative source: the L3-detected CCD (RyzenSMU.set_topology), or
+        # a slot from an SMN core-disable fuse map on a platform where core_id is not
+        # already physical.
         detected_ccd = ccd if ccd is not None else core_id // 8
         core_in_ccd = slot if slot is not None else core_id % 8
         return (detected_ccd << 28) | (core_in_ccd << 20) | margin

src/smu/driver.py

@@ -118,110 +118,34 @@ def __init__(
         self.dry_run = dry_run
         self._smu_lock = threading.Lock()
         self._backup: dict[int, int] | None = None
-        # Topology-detected CCD map: {physical_core_id: ccd_index}
-        # Set via set_topology() to use L3-detected CCD instead of core_id // 8
+        # Topology-detected CCD map: {physical_core_id: ccd_index}. Set via
+        # set_topology() to pin the SMU CCD field from L3 topology instead of
+        # core_id // 8. The physical SLOT is not stored: it is core_id % 8 (see
+        # set_topology / encode_co_arg for why that is exact on Linux).
         self._topology_ccd: dict[int, int] | None = None
-        # Harvested core slot map: {physical_core_id: physical_slot_in_ccd}
-        # Populated by probe_slot_map() for zen4_5 chips with harvested cores.
-        # When None, encode_co_arg falls back to core_id % 8.
-        self._slot_map: dict[int, int] | None = None
 
     def set_topology(self, topology) -> None:
-        """Load CCD mapping from CPU topology for accurate SMU encoding.
-
-        Without this, CCD is derived from ``core_id // 8`` which is correct
-        for standard AMD desktop layouts but may break on non-standard configs.
-
-        For Zen 3/4/5 chips, also probes the SMU to detect harvested core slots.
-        On harvested / multi-CCD chips (9900X, 9700X, 7900X, 5900X, 5600X, etc.)
-        the kernel renumbers cores contiguously but the SMU uses physical slot
-        indices — probing builds the correct mapping.
+        """Load the L3-detected CCD map so the SMU CCD field is exact.
+
+        The physical slot within a CCD is NOT probed. On Linux the kernel decodes
+        each core's APIC ID (CPUID Fn8000_001E) with the hardware's own field
+        widths and exposes the result as the physical, gap-preserving /proc/cpuinfo
+        "core id" -- so ``core_id % 8`` IS the physical SMU slot, including on
+        harvested / multi-CCD parts (5900X, 7900X, 9900X, 5600X, ...), where a
+        fused-off core leaves a hole in the numbering rather than renumbering the
+        rest. (This is the Linux-vs-Windows difference: Windows enumerates cores
+        contiguously, which is why the Windows tools read the SMN core-disable fuse
+        to rebuild the physical slot; Linux hands us the physical slot directly.)
+
+        encode_co_arg derives the slot from core_id; this method only supplies the
+        CCD index, which L3 topology pins more robustly than core_id // 8 on
+        non-standard layouts.
         """
         self._topology_ccd = {}
         for core_id, core_info in topology.cores.items():
             if core_info.ccd is not None:
                 self._topology_ccd[core_id] = core_info.ccd
 
-        if self.commands.encoding_scheme in ("zen3", "zen4_5") and not self.dry_run:
-            try:
-                self._slot_map = self.probe_slot_map()
-            except Exception as e:
-                log.warning("Slot probing failed, using core_id %% 8 fallback: %s", e)
-                self._slot_map = None
-
-    def probe_slot_map(self) -> dict[int, int] | None:
-        """Probe SMU to discover the physical slot for each core within its CCD.
-
-        On harvested Zen 3/4/5 chips the kernel renumbers cores contiguously
-        but the SMU addresses physical slots (0-7) including gaps from
-        disabled cores. Probes all 8 slots per CCD using GET_CO: harvested
-        slots echo the argument, active slots return the actual CO value.
-
-        HARDWARE-UNVERIFIED: the echo-vs-value discrimination has not been
-        confirmed on real harvested silicon (9900X/9700X/5600X). If a chip
-        returns the CO value in a different field/format, the probe could map
-        to the wrong slot; the count-based fallback (active_slots !=
-        expected_count -> core_id %% 8) bounds the damage but does not prove it.
-
-        Returns the slot map {core_id: physical_slot}, or None if probing
-        is not needed or fails.
-        """
-        if self.commands.encoding_scheme not in ("zen3", "zen4_5"):
-            return None
-        if not self.commands.has_co or self.commands.get_co_cmd is None:
-            return None
-        if self._topology_ccd is None:
-            return None
-
-        ccd_cores: dict[int, list[int]] = {}
-        for core_id, ccd_idx in self._topology_ccd.items():
-            ccd_cores.setdefault(ccd_idx, []).append(core_id)
-
-        slot_map: dict[int, int] = {}
-
-        for ccd_idx, core_ids in sorted(ccd_cores.items()):
-            expected_count = len(core_ids)
-            active_slots: list[int] = []
-            ambiguous_slot: int | None = None
-
-            for phys_slot in range(8):
-                arg = (ccd_idx << 28) | (phys_slot << 20)
-                resp = self._send_command(self.commands.get_co_cmd, (arg,))
-                if not resp.success:
-                    log.warning(
-                        "Slot probe failed for CCD %d slot %d — SMU error",
-                        ccd_idx, phys_slot,
-                    )
-                    continue
-
-                if arg == 0:
-                    ambiguous_slot = phys_slot
-                    continue
-
-                if resp.args[0] != arg:
-                    active_slots.append(phys_slot)
-
-            if ambiguous_slot is not None and len(active_slots) < expected_count:
-                active_slots.insert(0, ambiguous_slot)
-
-            active_slots.sort()
-
-            if len(active_slots) != expected_count:
-                log.warning(
-                    "Slot probe mismatch on CCD %d: found %d active slots %s "
-                    "but topology has %d cores — falling back to core_id %% 8",
-                    ccd_idx, len(active_slots), active_slots, expected_count,
-                )
-                for core_id in sorted(core_ids):
-                    slot_map[core_id] = core_id % 8
-                continue
-
-            for core_id, phys_slot in zip(sorted(core_ids), active_slots, strict=True):
-                slot_map[core_id] = phys_slot
-
-        log.info("Slot map probed: %s", slot_map)
-        return slot_map
-
     @staticmethod
     def is_available(sysfs_path: Path = SYSFS_BASE) -> bool:
         """Check if ryzen_smu driver is loaded and accessible."""
@@ -367,8 +291,7 @@ def get_co_offset(self, core_id: int) -> int | None:
         if not self.commands.has_co:
             return None
         ccd = self._topology_ccd.get(core_id) if self._topology_ccd else None
-        slot = self._slot_map.get(core_id) if self._slot_map else None
-        arg = encode_co_arg(core_id, 0, self.commands.generation, ccd=ccd, slot=slot)
+        arg = encode_co_arg(core_id, 0, self.commands.generation, ccd=ccd)
         resp = self._send_command(self.commands.get_co_cmd, (arg,))
         if not resp.success:
             return None
@@ -412,8 +335,7 @@ def set_co_offset(self, core_id: int, value: int) -> bool:
             return False
 
         ccd = self._topology_ccd.get(core_id) if self._topology_ccd else None
-        slot = self._slot_map.get(core_id) if self._slot_map else None
-        arg = encode_co_arg(core_id, value, self.commands.generation, ccd=ccd, slot=slot)
+        arg = encode_co_arg(core_id, value, self.commands.generation, ccd=ccd)
         resp = self._send_command(self.commands.set_co_cmd, (arg,))
         if not resp.success:
             log.error("SMU rejected CO write for core %d value %d", core_id, value)