vgsp-gl: deliver the real pixel-stage image and receipt the active draw's topology/index args

2 files changed, 120 insertions, 2 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index b20e43e..7b99fc4 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -20767,12 +20767,17 @@ if (gsp_phys_gr_slot_kept(j, sa_mask,
 						 win3d[wo + 1u] : 0u;
 					u32 d1 = (wo + 2u < win3d_n) ?
 						 win3d[wo + 2u] : 0u;
+					u32 d2 = (wo + 3u < win3d_n) ?
+						 win3d[wo + 3u] : 0u;
+					u32 d3 = (wo + 4u < win3d_n) ?
+						 win3d[wo + 4u] : 0u;
 
 					if ((op == 1u || op == 3u || op == 5u) &&
 					    cnt && wo + 1u + cnt <= win3d_n)
 						span = 1u + cnt;
-					pr_info("vgsp-gr: MME-WINRUN off=%x op=%u cnt=%u mthd=%x d0=%x d1=%x\n",
-						wo * 4u, op, cnt, addr, d0, d1);
+					pr_info("vgsp-gr: MME-WINRUN off=%x op=%u cnt=%u mthd=%x d0=%x d1=%x d2=%x d3=%x\n",
+						wo * 4u, op, cnt, addr, d0, d1,
+						d2, d3);
 					wo += span;
 					wr++;
 				}
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 8668b6f..fc43b60 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -8385,6 +8385,20 @@ static bool sema_gl_vs_img = true;
 module_param_named(sema_gl_vs_img, sema_gl_vs_img, bool, 0644);
 MODULE_PARM_DESC(sema_gl_vs_img,
 	"Deliver the built-in known-good VTG image (SPH+SASS) when the captured VS upload has no SASS body (default 1)");
+/*
+ * r1500: deliver the known-good pixel image. The active indexed draw
+ * binds a PIXEL stage (j=5) but no per-window upload of that program was
+ * ever captured (the 0x2154 pair is absent from the sliced window), so
+ * the PS slot page stayed empty and the fragment stage had no code. The
+ * client's real 384 B PS image (SPH V4 000a1482 + SASS) was recovered
+ * from its init-push page; deliver it at the PS bind VA exactly like the
+ * VTG image. Default 1; A/B via sema_gl_ps_img=0, overridden by
+ * sema_gl_ps_hex.
+ */
+static bool sema_gl_ps_img = true;
+module_param_named(sema_gl_ps_img, sema_gl_ps_img, bool, 0644);
+MODULE_PARM_DESC(sema_gl_ps_img,
+	"Deliver the built-in known-good PS image (SPH+SASS) when no captured PS upload/program exists (default 1)");
 static u8 svc_gl_prog[GSP_BRIDGE_INLINE_BYTES];
 static u32 svc_gl_prog_len;
 static u8 svc_gl_vs[GSP_BRIDGE_INLINE_BYTES];
@@ -8492,6 +8506,44 @@ static const u8 svc_gl_vs_img[1408] = {
 };
 
 /*
+ * r1500: known-good pixel program image (SPH V4 000a1482 + SASS), the
+ * client's own compiled fragment shader recovered from its init-push
+ * page. The active indexed draw binds type-5 (PIXEL) at the program
+ * family base (j=5) but the sliced window carries no 0x2154 pair and no
+ * PS upload, so that page stayed empty and the fragment stage had no
+ * code. Delivered at the PS bind VA when no captured PS exists, analogous
+ * to svc_gl_vs_img for VTG. A/B via sema_gl_ps_img=0, overridden by
+ * sema_gl_ps_hex. The bytes are the client's compiled program.
+ */
+static const u8 svc_gl_ps_img[384] = {
+
+	0x82, 0x14, 0x0a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xaa, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x26, 0x73, 0x04, 0x00, 0xff, 0x00, 0x00, 0x00, 0x1f, 0x00, 0x0e, 0x00, 0x00, 0x02, 0x0e, 0x04,
+	0x26, 0x73, 0x00, 0x00, 0xff, 0x00, 0x00, 0x00, 0xa0, 0x80, 0x00, 0x00, 0x00, 0x62, 0x0e, 0x00,
+	0x26, 0x73, 0x01, 0x00, 0xff, 0x00, 0x00, 0x00, 0xa1, 0x80, 0x02, 0x00, 0x00, 0xa2, 0x0e, 0x00,
+	0x26, 0x73, 0x02, 0x00, 0xff, 0x00, 0x00, 0x00, 0xa2, 0x80, 0x04, 0x00, 0x00, 0xe2, 0x0e, 0x00,
+	0x26, 0x73, 0x03, 0x00, 0xff, 0x00, 0x00, 0x00, 0xa3, 0x80, 0x06, 0x00, 0x00, 0x22, 0x0f, 0x00,
+	0x08, 0x73, 0x04, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x64, 0x1e, 0x00,
+	0x20, 0x82, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x41, 0x00, 0x00, 0xe4, 0x2f, 0x08,
+	0x20, 0x92, 0x01, 0x01, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x41, 0x00, 0x00, 0xe4, 0x4f, 0x08,
+	0x20, 0xa2, 0x02, 0x02, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x41, 0x00, 0x00, 0xc4, 0x8f, 0x00,
+	0x20, 0xb2, 0x03, 0x03, 0x04, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x41, 0x00, 0x00, 0xe2, 0x0f, 0x01,
+	0x4d, 0x79, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x03, 0x00, 0xee, 0x0f, 0x00,
+	0x47, 0x79, 0x00, 0x00, 0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0x83, 0x03, 0x00, 0xc0, 0x0f, 0x00,
+	0x18, 0x79, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x0f, 0x00,
+	0x18, 0x79, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x0f, 0x00,
+	0x18, 0x79, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x0f, 0x00,
+	0x18, 0x79, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x0f, 0x00,
+};
+
+/*
  * r1481: shader-image cache filled from any push chunk that starts with a
  * real SPH magic. The client's init push carries its VS/PS images as raw
  * continuation chunks (first word 020a0481 / 000a1482) whose method
@@ -8551,6 +8603,10 @@ static void svc_gl_prog_apply_param(void)
 		memcpy(svc_gl_vs, svc_gl_vs_img, sizeof(svc_gl_vs_img));
 		svc_gl_vs_len = (u32)sizeof(svc_gl_vs_img);
 	}
+	if (READ_ONCE(sema_gl_ps_img) && !svc_gl_ps_len) {
+		memcpy(svc_gl_ps, svc_gl_ps_img, sizeof(svc_gl_ps_img));
+		svc_gl_ps_len = (u32)sizeof(svc_gl_ps_img);
+	}
 }
 
 /*
@@ -8653,6 +8709,7 @@ static u32 svc_gl_open_log;	/* bounded section-open witness */
 static u32 svc_gl_skip_log;	/* bounded flush-skip witness */
 static u32 svc_gl_np_log;	/* CONT.45 bounded no-param stream witness */
 static u32 svc_gl_mark_log;	/* CONT.45 bounded 3D-mark-failure witness */
+static u32 svc_gl_draw_args_log;	/* r1500 bounded draw-args witness */
 /*
  * SESSION 153-CONTINUED-18 (task 1): the kick NOTIFY executor.
  *
@@ -10691,6 +10748,62 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
 				len / 4u, svc_gr_cand.push_n, len);
 		}
 	}
+	/*
+	 * r1500: draw-args receipt. The remaining wall is "is the captured
+	 * window a real primitive with a real count?" Decode the window's
+	 * own BEGIN immediate (topology), SET_INDEX_BUFFER_A/B (0x17c8/cc)
+	 * and the E/F + DRAW_INDEX_BUFFER triple (0x17d8/dc/e0: index size,
+	 * first, count) with the same 1+cnt run grammar the replay uses.
+	 * This is read-only and names the exact values the ENGINE will see;
+	 * an index size of 1 means the buffer is read as 16-bit indices.
+	 */
+	if ((op_src[0] == 's' || op_src[0] == 'h') &&
+	    svc_gl_draw_args_log < 64 && svc_gl.start_off < at_off &&
+	    at_off <= len) {
+		u32 o = svc_gl.start_off;
+		u32 topo = 0xffffffffu, isz = 0xffffffffu;
+		u32 first = 0, count = 0;
+		u64 iva = 0;
+
+		while (o + 4 <= at_off) {
+			u32 h, op, cnt, ad, w0 = 0, w1 = 0, w2 = 0;
+			u32 span = 1;
+
+			memcpy(&h, buf + o, 4);
+			op = (h >> 29) & 7u;
+			cnt = (h >> 16) & 0xfffu;
+			ad = (h & 0x1fffu) << 2;
+			if ((op == 1u || op == 3u || op == 5u) && cnt &&
+			    o + 4u + cnt * 4u <= at_off)
+				span = 1u + cnt;
+			if (span > 1u) {
+				memcpy(&w0, buf + o + 4, 4);
+				if (span > 2u)
+					memcpy(&w1, buf + o + 8, 4);
+				if (span > 3u)
+					memcpy(&w2, buf + o + 12, 4);
+			}
+			if (op == 4u && ad == 0x1618u &&
+			    topo == 0xffffffffu)
+				topo = cnt;
+			if (op == 1u && ad == 0x17c8u && cnt >= 2u)
+				iva = ((u64)(w0 & 0xffu) << 32) |
+				      (u64)(w1 & 0xfffffffcu);
+			if ((op == 1u || op == 3u || op == 5u) &&
+			    ad == 0x17d8u && cnt >= 3u) {
+				isz = w0;
+				first = w1;
+				count = w2;
+			}
+			o += span * 4u;
+		}
+		if (topo != 0xffffffffu || iva || isz != 0xffffffffu) {
+			svc_gl_draw_args_log++;
+			pr_info("sema-gl: GL-DRAW h=0x%x push=0x%llx topo=%u isz=%u first=%u count=%u iva=0x%llx\n",
+				ch->h_object, push_va, topo, isz, first,
+				count, iva);
+		}
+	}
 out:
 	/*
 	 * SESSION 149 R15 (M1.1a): preserve the last valid release across