diff options
Diffstat (limited to 'docs/04-implementation/04-real-render-walls.md')
| -rw-r--r-- | docs/04-implementation/04-real-render-walls.md | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/docs/04-implementation/04-real-render-walls.md b/docs/04-implementation/04-real-render-walls.md index 3119b75..ec1b75f 100644 --- a/docs/04-implementation/04-real-render-walls.md +++ b/docs/04-implementation/04-real-render-walls.md @@ -1154,3 +1154,30 @@ index-buffer bind, the vertex-shader position output and the viewport/clip transform must be checked against the client's own draw arguments (the active index page currently reads as vertex floats at its bound VA, so the index/vertex role or the index count is also a candidate). + +## Session 154 (r1515-r1517): the fixed-CB upload is decoded but its bulk is not in the method stream + +The client publishes the fixed-CB base once per context +(`SET_MME_SHADOW_SCRATCH(0x18)`, method `0x3460`, value = VA >> 8) and then +writes the constant store through the C597 methods +`SET_CONSTANT_BUFFER_SELECTOR_A/B/C` (`0x2380/0x2384/0x2388`), +`LOAD_CONSTANT_BUFFER_OFFSET` (`0x238c`) and `LOAD_CONSTANT_BUFFER(i)` +(`0x2390`). The emulator now scans every decoded push of the client's GL +channel for those runs, assembles the first 4 KB of the constant buffer, +validates it with the strict projection gate, and delivers a passing image +to the forced MME seed page; a receipt reports the push, base, selector, +run/word counts, the `c[0x0][0x80..0xbc]` block and whether the projection +shape passed (`CB-UPLOAD`, `CB-UPLOAD-SCAN`, `cb-copy src=const-upload`). + +Measured on a validated boot (r1517, glxgears formed, draws submitted): the +60216-byte setup push is read and the scratch-18 base is captured +(VA `0x4460000`), but its `0x2390` content is only 10 state-patch words +(selector/offset pairs, no matrix rows). The base page resolves to the +emulated vidmem offset `0xb10000` and reads zero; the neighbouring +`0x43e0000` page is client vertex data, and the guest-RAM projection-shape +scanner finds only transient copies. The draw therefore still runs with the +synthetic identity (r1517 `GL-COVER` clip space inside 50/64 sampled +vertices) and the window capture is black (`xwd -id`, non-black 0). The +remaining work is to capture the constant-buffer *bulk* transfer itself +(the staging buffer to the vidmem CB page), not the method-stream patches. + |