diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-11-05 19:47:44 -0500 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-11-05 19:47:44 -0500 |
| commit | decf1b2e57454c5d05eb66c4b7906bcf51238ede (patch) | |
| tree | 957ff417a5d4751a54d5cc767082d7caacf6d4fc /kernel/include/gsp_rpc_integration.h | |
| parent | be25496cdc7d08226daa26f0707997dee12612dd (diff) | |
| download | open-iov-decf1b2e57454c5d05eb66c4b7906bcf51238ede.tar.gz open-iov-decf1b2e57454c5d05eb66c4b7906bcf51238ede.zip | |
vgsp-gl: receipt the draw's clip coverage and refuse non-MVP fixed-CB pages
r1512 adds one bounded GL-COVER receipt per replayed draw. It decodes the
window's index buffer (0x17c8/0x17d8 + size), the stream-0 stride (0x1c00)
and position offset (0x1160), resolves the CALL_MME_DATA (0x3810) stream
base, reads the referenced vertices and evaluates the clip-space position
in Q16.16 integer math with the exact c[0x0][0x80..0xbc] block the replay
delivers, printing per-vertex clip codes plus clip/NDC/screen bboxes and
the injected viewport scale/offset/clip. It also prints the fixed-CB
copy provenance and tries the client's own scratch18 page read-only.
Measured (r1512): real gear vertices (stride 24, position offset 0,
3.549 0.852 -0.5) but the delivered "matrix" was a rotation block
(row3 = 0.1268 0.9922 0 1), giving clip w ~= 1.1 instead of the camera
distance (~40) and 57/64 sampled vertices outside clip. The draw was
clipped by a non-projection constant block, not by zero/garbage VS output.
r1513/r1514 fix the source: the fixed-CB copy now prefers the client's
SET_MME_SHADOW_SCRATCH(0x18) page and the client-CB VAs its own writes
published (0x43e0000/0x4450000), requires a strict projection shape
(|row3.x|,|row3.y| < 0.02 and row3.z/w not both zero), and the resolver
no longer accepts an unresolved PA 0 page. Non-MVP pages (including the
old forced 0x0cd70000 page) can no longer become the seed; when no real
page is found the r1476 identity positive control is used.
r1513/r1514 receipts: the strict gate finds no readable client MVP page
on these boots (the client's fixed-CB content is not materialised in the
emulated memory), so the seed is the controlled identity and the identity
still clips gear radii > 1 (12 launches r1514, 20 poison, no fragments;
root xwd 2 nonblack pixels at (216,0)-(409,2) 0x77edc). Next wall: get
the client's fixed-CB contents into its own page (emulate the VPC/
LOAD_CONSTANT_BUFFER writes from the init push) so the VS receives a real
MVP.
Build: make -C kernel (green). Evidence: backups/evidence-20261002-victory/r1512..r1514.
Diffstat (limited to 'kernel/include/gsp_rpc_integration.h')
0 files changed, 0 insertions, 0 deletions
