vgsp: CONT-100 - mme_ir_pack UNITS FIX: ptr is an MME instruction address (driver codeOffset += codeSize/3, mmeDownload.cpp:5775), each instruction = 3 IR words; old gsp_phys_gr_mme_ir_pack[ptr+k] emitted a pointer-0 image covering only ~312 of 933 instructions, now [ptr*3+k] with next-SA clamp in instructions + maxa in words; correct units need 2960 words > working block ceiling so pack falls back to drain (do not re-enable pack=1 without A/B) - BISECT DONE: culprit macro = slot 0 SETUP_FIXED_CONST (r1345 nop_drop=0x5 slots{0,2}: MME-CALL-DROP 36 word(s) dropped_mask=0x5, 12 beef launches poisons=0; r1347 nop_drop=0x1 slot0 only: MME-CALL-DROP 11 word(s) dropped_mask=0x1, 11 beef launches poisons=0 WITH slot 2 executing); post-call wall both no-poison boots: trap=80002058 data=019a0900 grfifo 06061602->00000001 (method 0x2058=SET_PIPELINE_PROGRAM_ADDRESS_B(1) <- relocated 0x2054-pair operand, then park); offline engine-faithful sim: all executed macros ENDNEXT clean, slot 34 emits draw 0x1618<-0x61000008/0xd74/0xd78/0x1614, slot 0 emits 0x2380<-0x7000 + 0x2384/0x2388<-STATE 0xd18 parts (0 under replay) = incomplete CB selector; driver slot-0 calls carry VPC_CONSTANT_DWORD(VPC_VIEW_ID) gf100varray.c:56; 0xbadf1201 is fixed priv-error constant (pc=513 artifact) - GATE1 black 0/900 pages - next: seed golden STATE 0xd18 (SET_MME_SHADOW_SCRATCH(0x18) method 0x3460) before calls (SETUP_FIXED_CONST merges it into CB_SELECTOR_B/C); find real value in client setup pushes (scan 0x3460 write / fixed-constant base) or golden run; poison-free control nop_drop=1<<0 - SESSION 153 r1345-r1347

1 files changed, 23 insertions, 6 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 114751d..42fb8f2 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -19229,14 +19229,31 @@ static u32 gsp_phys_rmcall_build_gr_launch(u32 *pb,
 							    (!nxt ||
 							     sa_ent[kk] < nxt))
 								nxt = sa_ent[kk];
-						if (nxt && ptr + blen > nxt)
-							blen = nxt - ptr;
+						/*
+						 * CONT-100 units fix: `ptr` is an
+						 * MME INSTRUCTION address (the
+						 * driver advances codeOffset by
+						 * codeSize/3, mmeDownload.cpp),
+						 * and each instruction is 3 IR
+						 * words stored at 3*ptr..3*ptr+2.
+						 * Indexing the contiguous word
+						 * image at ptr+k (the pre-CONT-100
+						 * form) misplaced every macro and
+						 * left 2/3 of the program
+						 * unreachable (r1343/r1344 poison,
+						 * only ~312 of 933 instructions
+						 * covered). Clamp the tail at the
+						 * next SA entry in INSTRUCTIONS.
+						 */
+						if (nxt &&
+						    ptr + (blen + 2u) / 3u > nxt)
+							blen = 3u * (nxt - ptr);
 						for (k = 0; k < blen &&
-						     ptr + k < 4096u; k++)
-							gsp_phys_gr_mme_ir_pack[ptr + k] =
+						     ptr * 3u + k < 4096u; k++)
+							gsp_phys_gr_mme_ir_pack[ptr * 3u + k] =
 								pl[r + 2u + k];
-						if (ptr + blen > maxa)
-							maxa = ptr + blen;
+						if (ptr * 3u + blen > maxa)
+							maxa = ptr * 3u + blen;
 						nruns++;
 					}
 					r += span;