summaryrefslogtreecommitdiffstats
path: root/kernel/gsp_phys_booter.c
Commit message (Collapse)AuthorAge
* vgsp: eng65 - allow per-stage SPH disable on the all-slots bind boot ↵Arthur Hanson Rasmusson72 min.
| | | | | | | | | | | | | | | | | (TCS-off DS A/B) c788 achieved DRAW_IAB (MME-FAST macro-status=00122266 mpc=614 mac=0x22 run=1 via MME-DRAW-MOVE) but the draw latched DS 0x84000420 (SPH5 VSB c1, SPH10 TCS c2, M_PIPE_STAGE TI) and stores stayed 0 (NOWRITE-CONFIRMED wrote=0). The DS-ESR post-clear=84000420 then the retire reads ds=80000000, so the pending validation error is the draw's. The per-stage disable mask was only honoured with sema_gl_sph_bind=0, so the all-slots boot could not disable TCS while keeping the window's own VSB bind and the other synth slots. Read the mask unconditionally; default 0 keeps the emitted bytes identical. params-r1624 sets sema_gl_sph_stage_disable=0x04 (TCS disable record 0x2080<-0x20, synth j2 bind skipped) for the next A/B.
* vgsp: eng64 - chain the release behind the pack carrier and name a stalled ↵Arthur Hanson Rasmusson84 min.
| | | | | | | | | | | | | | | | | | | | | | carrier's gate c779: the pack-continuation carrier completed the pack (MME-CARRY-COMPLETE gen=4 off=2799/2799) and armed the release (MME-CARRY-ARM mode=release), but its launch poll held the single forwarding slot for 2801 ms; the armed release then deferred request-inflight until the beef channel unregistered at +2.2 s, so the release ended in MME-CARRY-HOLD reason=no-channel. - svc_fwd_gr_work: after a successful synthetic pack carrier, wait out the release grace in the same slot, claim it and run the release work directly (chained MME-CARRY-FIRE mode=release ... receipt). Gate: sema_gl_mme_release_chain (default 1; release carrier still default 0). - pump pack-carry block: an armed due carrier that cannot go out now names its blocker (MME-CARRY-WAIT reason=no-channel/client-candidate/ request-inflight/fe-defer), so the c781-class silent stall is visible. - booter: gsp_phys_gr_mme_release_waiting()/chain_enabled() helpers. c783-c785 (a03a68ea build) were all shallow (author=0, no MME window).
* vgsp: eng63b - reorder the release window's slot-34 DRAW_IAB call ahead of ↵Arthur Hanson Rasmusson101 min.
| | | | | | | | | | | | | | | | | the setup calls c780 (9a087063): the release launch ran and MME-SA-REARM re-pointed 7 slots (slot 34 client=0x265 golden=0x265), but the replay executed mac=0x33/0x0/0x39 only. The 728 B state window carries the slot-34 CALL at off=0x340 AFTER its 0x33/0x39 setup calls; the earlier 0x39 macro latches DS 0x84000420 and the MFE never reaches CALL(34) (mme mac stays 0x39, then idle). c716's 324 B DRAW window puts CALL(34) first and ran mac=0x22. Release launches only (release_sa_arm): locate the window's first CALL run and the slot-34 run (+ its immediately preceding 0x1644 pair), and emit the window with that run moved ahead of the first CALL run. MME-DRAW-PLAN/MOVE receipts; default off path unchanged.
* vgsp: eng63 - held-CALL target census, DRAW-window preference, and ↵Arthur Hanson Rasmusson116 min.
| | | | | | | | | | | | | | | | | | | | | | | | release-launch SA re-arm c776 proved the saved-window release replay carries the slot-34 CALL_MME_MACRO run (MME-WINRUN off=340 op=5 cnt=10 mthd=3910) but the macros ran 0x33/0x0/0x39: the release launch sets emit_prelude=0, and the client capture had no slot 34 (c774 fill published golden entry 0x265 host-side only), so the stale engine SA[34] resolved the call to IR 0 (mac=0x0). - MME-CALL-CENSUS/MME-CALL-TARGET: decode the held window's CALL runs with the hold/drop run grammar (op 1/3 walk method+4k, op 5 only the header method, op 4 one method) and print targets + slot34 with the client/golden/used entry. - release_save: among DRAW_IAB-bearing windows prefer the smaller raw DRAW stream (324 B/81 words, the c716 mac=0x22 shape) over the 728 B state window; keep=draw-win receipt. - sema_gl_mme_release_sa_arm (default 0; params-r1624 enables it): run the SA re-arm + golden fill on the release launch so CALL_MME_MACRO(34) points at the golden DRAW_IAB body (IR 0x265). Pack-carry/release receipts unchanged; release carrier still default 0.
* vgsp: eng62 - fill missing golden SA entries (slot 34 DRAW_IAB = IR 0x265), ↵Arthur Hanson Rasmusson2 hours
| | | | | | | | | | | | | | | | | | | | default off The golden overlay writes all 55 slot bodies, but the CALL_MME_MACRO(34) DRAW_IAB run targets SA[34]; the client's captured SA table only covered slots 0-11 (c772), so slot 34 resolved to IR 0 (the slot-0 body) and the macro never produced mac=0x22. Add sema_gl_mme_sa_golden_fill (bool, 0): for every slot whose client SA entry is missing/zero and whose golden body exists (kernel/golden-mme-tu104.h golden_mme_tu104_sa[64]), set the SA entry to the golden body's IR entry (slot 34 = 0x265, 75 words) and mark it present. Nonzero client entries are never overwritten. Fill runs in the golden overlay, in the submit path before the stub/call-drop walk, and in the SA re-arm (the release-carrier path); the release path re-fetches and emits the filled 0x11c pairs. New MME-GOLDEN sa-fill/sa-census receipts. c774 proves the fill: `MME-GOLDEN sa-fill slot=34 entry=0x265 (client=missing)`. Enable in params-r1624. Build rc 0; the mac=0x22 validation needs a c772-class release boot.
* vgsp: eng61 - prefer a DRAW_IAB-bearing window in the release save ↵Arthur Hanson Rasmusson2 hours
| | | | | | | | | | | | | | | | | | (diagnostic + robustness) The saved-window release carrier replays the client's held window with the CALL runs kept. Save the raw window after scanning it for the CALL_MME_MACRO(34) DRAW_IAB run (method 0x3910, the 0xA00A0E44 ten-data run); if the saved record already carries it and a later held window does not, keep the saved one (bounded MME-CARRY-SAVE-PREFER receipts). Caveat established from c772: its 728 B window also carries the 0xA00A0E44 slot-34 run at raw[113], so the DRAW_IAB window bytes are not the discriminator; the c772 replay ran 0x33/0x0/0x39 because SA[34]/the golden IR entry was stubbed, not because the window lacked the call. The next lever is the SA[34]/golden-body residency census, not the window choice. Build rc 0; validation pending.
* vgsp: eng59c - preserve the saved release window across the beef channel ↵Arthur Hanson Rasmusson3 hours
| | | | | | | | | | | | | | | | | | | | | recycle; defer non-ready takes c765/c766: the release carrier saved the held 324/728 B window, then the client re-registered the beef channel before the pack completed. The follow-up's chan_ctx_reset cancelled the saved record unconditionally (consumed=true, valid=false) even though keep_done_across_recycle=1 means the engine context and packed program survive; the pack-completion arm then early-returned and the release never fired. With keep_done_across_recycle=1 the re-register is a client-handle recycle, not a context loss: keep the release record. Cancel it only in the genuine !keep_done wipe path. Also make release_take defer (not consume) on not-armed/grace/pack-not-resident with bounded MME-CARRY-HOLD receipts; only terminal conditions or a failed fire consume. release_rearm now runs unconditionally with the knob on and release_arm gates on pack_done, so the record survives the save->completion gap. Build rc 0; validation pending.
* vgsp: eng59b - do not let the arming launch consume the release carrier; ↵Arthur Hanson Rasmusson3 hours
| | | | | | | | | | | | | | | | | | | | re-arm in the pump The saved-window release carrier was armed inside the pack-completing launch's own build, and the client-first cancel treated that same launch (and its retries) as the next client launch, silently dropping the claim. c762: MME-CARRY-SAVE (win=240 held=68) -> MME-CARRY-ARM mode=release -> the arming launch ran mac=0 (LOAD-ONLY, window dropped, held CALLs still owed) -> no FIRE, no synthetic push, no mac=0x22. Track the arming launch identity (h + push) and keep the claim armed across it; only the MME-PACK-REARM edge (calls actually released), a real consumer, context/handle changes, or a launch error cancels/consumes. Add a pump-side re-arm once pack_done_gen is set, and bounded MME-CARRY-HOLD receipts for every skip. One fire per pack completion, no retries. Build rc 0; validation pending (c762-class boot with sema_gl_mme_pack_release=1).
* vgsp: eng59 - saved-window release carrier for the held MME CALL runs ↵Arthur Hanson Rasmusson3 hours
| | | | | | | | | | | | | | | | | | | | | | | | (default off) When a 324 B draw window holds its CALL runs while the 2799-word pack is incomplete, the pack can complete later (X lane or a 728 B window) but the next client launch that would release the held calls is a per-frame lottery (c756: MME-CALL-HOLD 18, pack complete, no next launch -> no REARM/mac=0x22). Save the held window at MME-CALL-HOLD (raw pre-relocation stream + the launch capture fields) into module memory. When the pack is complete and resident and no client launch consumes the release within sema_gl_mme_pack_release_ms, re-submit the saved capture through the normal fill/build path with the held CALL runs KEPT (mme_hold_calls=false), no prelude emission, and gr_synthetic/no guest release. The released CALL(34) runs DRAW_IAB against the resident pack, the shape c716 proved. New: sema_gl_mme_pack_release (bool, 0) / _ms (uint, 100); MME-CARRY-SAVE / ARM/FIRE/COMPLETE/CANCEL/ABORT mode=release receipts. Beef-only, one fire per pack completion, fail-closed on context/handle changes or launch errors. The existing pack-continuation carrier is unchanged with its knob off. Build rc 0; validation pending.
* vgsp: eng56 - rewrite the window's own slot-1 SPH bind to the authored VTG ↵Arthur Hanson Rasmusson5 hours
| | | | | | | | | | | | | | | | | | | | | | | | | image, and harden the author window-head decode - gsp_phys_booter.c: after authoring the VTG SPH at family+0x900, scan the patched 3D window for its own 0x2054 slot-1 pair and rewrite an operand whose low 12 bits are 0x600/0x300 (client family VA or pair-cache shadow line) to <page>|0x900. The window's own later pair otherwise overwrites the synthesized prelude j1 and the DS validates the client's SASS page (c743: DS-IMAGE st1=0b0b7208). New SPH-SLOT1-REWRITE / SPH-SLOT1 receipts. - gsp_phys_booter.c: reject an inline VTG candidate whose IMAP word (w6, offset 24) is zero; fall back to the builtin image. A 640 B w6=0 record authored a zero-map SPH and the DS went to the FECS/PRI sentinel (c749 fam 0x4350000: ds 80000000->badf1201). - gsp_sema_service.c: the DDX ring-head decode scans past zero-payload and unreadable entries within the 8-entry bound instead of stopping (c746: the ring head is a zero dummy and the C36F release sits later); it still never fabricates a payload. Validation: c749 is the first boot with DS-IMAGE st0=st1=020a0481 (code ff007321, the authored VSA/VSB image), a clean slot-1 rewrite (old=0x01e00300 new=0x01e00900), beef MME-PACK-REARM, and the DS latch reduced from 86040626 to 84000420; stores are still 0 and the DRAW_IAB macro is the next gap.
* vgsp: eng55 - VTG SPH authoring at family+0x900, DDX ring-head tracker ↵Arthur Hanson Rasmusson5 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | decode, MME pack carrier, and the pump atomic-sleep hoist - gsp_phys_booter.c: sema_gl_sph_vtg_auth (default 1) authors the client's live VTG SPH image at family+0x900 and binds VSA/VSB there; new SPH-AUTHOR / SPH-ALIAS-auth receipts and a DS-IMAGE stage census at the DS latch (stage-start w0 + code word through the pair cache). - gsp_phys_booter.c: sema_gl_mme_pack_carry (default 0) + _ms (default 100) host-initiated windowless continuation carrier for a split MME pack; MME-CARRY-ARM/FIRE/COMPLETE/CANCEL/ABORT receipts, beef-only, bounded. - gsp_sema_service.c: sema_ddx_tracker_auth (default 0) ring-head decode for the DDX channel when the USERD is missing/reset (guest-authored C36F release applied verbatim); sema_gr_scan_top default raised to 0x300000000 for the 12 GiB campaign guest. - gsp_sema_service.c: hoist the r707e VAS candidate verify out of svc.chan_lock (its vfio_dma_rw path can sleep) and add in_atomic guards to svc_read/svc_write; fixes the gsp-sema-svc "scheduling while atomic" pump stall that lost the marked draw-window launch. - tools: enable sema_ddx_tracker_auth=1 in params-r1624; use timeout -k in the guest GL/GZDoom wrappers so a wedged GPU wait cannot hang a cycle. Validation: c741/c743 boots (VTG author byte readback, cross-lane and beef pack completion + REARM, DS-IMAGE census) and the c743 DS-FAST chain; A/B for the carrier and the tracker decode is still open.
* vgsp: eng51 - emit the SPH-BIND stage block (budget fix), admit RT0-bearing ↵Arthur Hanson Rasmusson7 hours
| | | | | | | | | | | | | | | | | | | | | | | draw-synth windows, preserve the last beef push, and default the DS stage-image A/B safe - gsp_phys_booter.c: the synthesized SPH-BIND stage-block guard double-counted the already-emitted raster words (101 > 96), silently skipping j0/j2/j4/j5; pre=29 -> pre=84 and the DS stage VAs populate. Add the SPH-BIND-STAGE-SKIP receipt. - gsp_sema_service.c: sema_gl_win_rt0_admit (default 1) admits a beef draw-synth window whose FIRST colour-target write is a usable surface-class bind (RT0-FIRST-MISS witness); preserve the most recent beef push (>=256 B) for the gsp-phys-last-push debugfs dump; skip the non-RAM windows in the linear ring scan; fix the MME shadow-RAM index shift to (mthd >> 2) & 0xfff. - gsp_phys_booter.c: sema_gl_sph_vtg600 (default 0) and sema_gl_sph_vtg_j1 (default 0) are the stage-image A/B: binding family+0x600 poisons the DS (the engine-visible alias shadow there is the client's SASS upload), so keep the historical +0x900 zero page until a real VTG SPH is authored at an engine-visible VA. - tools/guest-diag/params-r1624.txt: enable sema_gl_win_rt0_admit. - wiki/Project-Status.md: 2026-11-15 status (MME chain completes and executes DRAW_IAB; DS stage image is the named gate).
* vgsp: keep the synthesized SPH-BIND prelude intact by omitting the ↵Arthur Hanson Rasmusson12 hours
| | | | | | | | | | | | | | auto-dropped 0x22c run (eng50) The SPH-BIND prelude emitted '0x22c <- 0x800', which is on win_drop_auto_match's drop list: the patch pass removed exactly 2 words, so kept=29/31, on==nfin failed and the WHOLE prelude was discarded on every beef window -> VSA/TCS/GS unbound -> DS latch a2040a04 (stage[1] fetch VA 0x01df0300) -> DRAW_IAB (mac=0x22) never rasterized. Fix: omit the auto-dropped run from the synthesized prelude (knob-consistent) + a WIN-DROP diagnostic. Built (srcversion 2D8F375AB343FC73EA26286); end-to-end validation blocked in-window (c704-6: draw-synth RT-guard refusal + WEDGE-REARM rc=-110 before SPH-BIND was reached).
* vgsp: alias a contiguous 7-page fixed-CB region in the scratch PT pool ↵Arthur Hanson Rasmusson23 hours
| | | | | | | | | | | | | | (sema_gl_mme_cb_alias, default 0) (eng45) Macro 57 (LOAD_CONSTANT_BUFFER) reads the 0x7000-byte fixed CB at seed-shadow +0x5000, but only the single seed page was mapped (the pre-existing fixed-CB+0x4000 class), producing FAULT_PTE VIRT_READ at 0x0_015a5000 11 ms after the released calls (post-REARM). The alias maps a contiguous 7-page region in the scratch PT pool (page 0 = CB image/MVP; unservable tail = dummy zero page), wired into the scratch-0x18 and d19 seed paths, logged MME-CB-ALIAS. Safety-validated c654 (alias exercised, 0 MMU faults, 0 badf1201, 0 poison all boot); the beef macro chain was not reproduced in-window, so end-to-end validation is pending.
* vgsp: eng43 - keep the MME pack completion record and packed cursor across ↵Arthur Hanson Rasmusson24 hours
| | | | | | | | | | | | | | | | | | | an owner channel re-register (sema_gl_mme_keep_done_across_recycle, default 0) c579: the first eng42-module completion (2799/2799) was followed 1.09 s later by the beef owner re-register; the eng40 chan_ctx_reset treated the recycle as a context loss, rewound the pack cursor and wiped pack_done_gen/ch, so every later prelude launch re-emitted (pre_words_out > 0 -> the r1222 clause correctly withheld the release) and MME-PACK-REARM could never fire. The knob keeps pack_done_h/gen/ch and the cursor (pack_off/pack_sa/load accounting) across the re-register so the first prelude launch on the re-incarnated channel is non-emitting and the REARM clause releases the held calls against the engine-resident program. The per-incarnation latch/live/release state is still cleared, and every genuine context wipe (WEDGE-RECOVER/CWD-CLEAR, park recovery, iram-gate failure, non-keep_gen generation rewind, FLR via reload) clears the record on its own path. Default 0 = legacy invalidate (validation pending).
* vgsp: eng42 - engine-global MME pack completion: record the pack completion ↵Arthur Hanson Rasmusson26 hours
| | | | globally (pack_done_gen/ch) so the post-completion call release fires for cross-lane completions (c552: part 1 on X, completion on beef -> pack_done_h withheld, REARM unreachable); restart the owner-less wedged cursor (poff==maxa && done_h==0) so a later window can re-emit the deterministic golden image (validation pending)
* vgsp: per-channel MME pack completion accounting + rearm release + ↵Arthur Hanson Rasmusson28 hours
| | | | | | | | | | | | | | | context-reset invalidation (eng40, validation pending) After the multi-part beef pack completes (2799/2799; keep_gen=1 works), the prelude generation drifts and the pack branch refuses re-emission (poff==maxa), so calls stay held forever (pcv=0, shadow draws 0, wrote=0). This adds: (1) per-channel contiguous-load accounting + pack_done_h so the completion is remembered for the loaded channel; (2) an MME-PACK-REARM call release when a completed pack's channel launches again; (3) gsp_phys_gr_mme_chan_ctx_reset(h) invalidation on context wipes/channel re-registers (the client recycles the beef channel between pushes, c496), shown firing safely. Validation: the fix was not yet observed completing on a green window with a same-incarnation draw; committed for reproducibility per house style.
* vgsp: eliminate the part-launch FE poison - redirect replayed client ↵Arthur Hanson Rasmusson29 hours
| | | | SET_REPORT_SEMAPHORE/SET_NOTIFY targets to the mapped module scratch slot (sema_gl_report_sem_scratch, default 1); add sema_gl_mme_pack_keep_gen (default 0) to keep the packed-part cursor across deterministic-image generation changes (eng39)
* vgsp: keep partial-part MME pack launches' windows via ↵Arthur Hanson Rasmusson33 hours
| | | | | | | | | | | | | | | | | sema_gl_mme_partial_keep_window (default 0 = legacy) (eng36/eng37) The load-only carrier gate turns every 3D window launch windowless while the packed MME program generation is not latched+live. A launch that emits only a PART of the packed program (block room exhausted) cannot make the program resident, so dropping its window also discards the draw's state and defers the completion to an unrelated later push, where it dies (GP_GET-frozen / MISSING_MACRO_DATA) and the generation never promotes. New knob sema_gl_mme_partial_keep_window (default 0 = legacy drop-everything): when set, only a launch that emits the FINAL part of the pack stays a windowless carrier; partial-part launches keep their window in the calls-held shape so client state accumulates and the completing carrier can promote the generation and let the next window run real calls.
* vgsp: relocate a CODESRC-SUSPECT GR program page to the engine-mapped ↵Arthur Hanson Rasmusson34 hours
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | window-0 shadow instead of leaving the QMD pointer at an unmapped guest VA (eng33) The client's MME-expanded draw builds a QMD whose program page (qmd[48]) classifies CODESRC-SUSPECT (empty-page): the engine's GPCCLIENT_GCC I-fetch then read the guest VA above every engine-PDB window, raised FAULT_PDE and the FIFO parked for the rest of the boot (the TSG re-arm cannot revive a parked PBDMA). c361-c368 receipts. With gsp_phys_gr_codesrc_reloc=1 (default) the builder copies the page into the window-0 shadow (empty sources only; PTE/module pages are never republished), overlays the client's own known-good SPH+SASS stage image at the original QMD program offset (gsp_sema_gl_prog_img, stage-typed from the section bind; truncated at a 128-bit boundary with a terminal EXIT when the image is larger than the remaining page), and the existing QMD w48/49 + prefetch rewrite publishes the shadow VA. If the shadow mapping cannot be installed the page stays unmapped and the existing refusal drops the launch, so an unmapped QMD program pointer is never published. 0 restores the old guest-VA behaviour for a one-flip A/B. Validation (c373, params-r1624): 31 CODESRC-RELOC events (img_len=384, off=0xb00, 0 truncations), 51 GR LAUNCH submitted, 11 MME-FAST end events=3, 79 FETCH-WIT with GP_GET advancing engine-fetched, 0 FAULT_PDE, 0 vgsp-fault, 0 WEDGE-REARM/PARK-RECOVER; work_gr backend_ok=35 fault=0. The draws still write nothing (NOWRITE, no clear run in the emitted window), so px0 stays 0 - the store wall is unchanged and is the next target.
* vgsp: rescue the direct-GL draw-state pushes from the LOW fb band, admit ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | them to the 3D replay lane, and let the forced golden MME overlay satisfy the prelude maturity gate (eng28) The direct-GL client's draw-state pushes (476/624/728/324 B; invariant lead 90110087 = IMMD NVC597_INVALIDATE_SHADER_CACHES 0x21C<-0x1011) are intermittently unreadable while byte-identical copies park in the LOW framebuffer; the copies do not share the VA's in-page offset, so the page-stepped rescue scan could never land on them. Add a word-granular LOW-band sweep gated on the two recognisable push images (state lead via the method-stream window gate; 256-B VTG SPH upload by exact signature) and pin hits exactly like the existing rescue. The same pushes carry the frame's real state (SET_COLOR_CLEAR_VALUE 0xD80, NVC597_CLEAR_SURFACE 0x19D0, MME macro calls, vertex state) but no BEGIN/RT opener, so they never opened a C597 section and the state stream never reached the replay lane; admit the 0x21C lead as an opener on beef channels and exempt state-led windows from the eng25 colour-target guard (the guard's data-blob rejects continue unchanged - only the invariant state lead passes). Where the client's 0x114 IRAM upload is not captured (code words stay <= 4 on every boot observed), the forced golden overlay (sema_gl_mme_golden + _force; golden-only, fail-closed) can serve every called macro slot; add gsp_phys_gr_golden_ready() and skip the IMMATURE-SKIP software completion while it holds (see the golden-slot/pack machinery). Live (c348/c350/c351, r1624 params): the LOW-band rescue fired (VTG SPH 256-B push -> fb 0x2010200, pinned); the 324-B state push opened a section, captured (recs=4 nprog=1) and was marked for the verbatim 3D lane; with the bypass the lane submitted it to the engine for the first time (GR LAUNCH submitted + GUEST GR LAUNCH OK, MME-PRELUDE pack 1701 IR words, MME-GOLDEN slot 0 accepted). The emitted 51-word window still omits the 0xD80/0x19D0 clear runs (marked window 81), so pixel stores remain 0 and frames black; receipts under /tmp/opencode/eng28-*. Refs: CONT.490.
* vgsp: route direct-GL draw-synth captures through the verbatim 3D replay ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | lane; beef rel_mod launches may take the ch_rel release branch (eng24) Clause 1 (gsp_sema_service.c, svc_gl_flush): the direct-GL (beef-family) section captures opened by the eng23 inside-run openers carry synthesized PROG/PARAM/REL (src=draw-synth) but a REAL method window; include 'd' in the stream-3d marking (single 448-word block and the method-aligned chunk split) so the window replays verbatim on the engine like the X/stream/hold lanes, instead of waiting on a synthesized compute-QMD release the engine never writes. Verified live: '3D stream chunked h=0xbeef0100 push=0x4250110 window=779 words -> 3 chunk(s)' and 'GR LAUNCH submitted h=0xbeef0100 ... polling qmd_rel=0'. Clause 2 (gsp_phys_booter.c, gsp_phys_backend_guest_gr_submit): a beef-family launch whose QMD release0 was redirected to the module semaphore with the rel_mod sentinel (0x600df00d) may break its poll on the channel release alone (the X lane's proven branch) once the engine has retired the method block; witnessed by 'GR LAUNCH OK ch_rel branch (beef rel_mod; ...)'. Verified live: 4+ beef launches now complete (engine fetch OK, GUEST GR LAUNCH OK ok=22..25) where the c338 shape timed out (qmd_rel=0xc0ffee01 want=0x600df00d). Known residual (unchanged by this commit): the replayed beef windows retire without stores (NOWRITE-CONFIRMED/AMBIGUOUS, wrote=0 -> px0=0), the same engine-store wall the X lane shows; and with the default sema_mme_immature_skip=1 the service soft-completes replayed beef windows before any engine contact (A/B with the knob at 0 was used to put the real window on the engine).
* vgsp: exclude the 0x40706c read sentinel from the pre-replay CWD-clear ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | predicate; add sema_gl_cwd_clear (A/B knob) FALSIFIED NOTE (eng16, c271/c272): the eng15 lead that the always-fire CWD-clear rode on the 0x40706c sentinel and caused the zero-store wall is FALSIFIED. A/B on the same launch shapes (h=0x1000013 push=0x1200107e4 words=50 / push=0x1200106bc words=53): - c260 (old code, clear fires 7x/boot on the sentinel): wrote=0. - c272 (clear fully off, sema_gl_cwd_clear=0): wrote=0 both launches, pbfetch=block end, intr0=0 - identical to c260. - c271 (predicate fixed, knob on): 0 CWD-CLEAR all boot (the sentinel no longer arms it; esr=80000000 / grfifo pending counts are clean). The change still lands because the old predicate was a bug either way: 0x40706c reads 0xbadf5040 always (read-only hardware sentinel; eng15 write test 0x0 -> 0xbadf5040), so every stream3d launch ran a TSG preempt/resched + MME latch wipe before a noQMD replay that never re-loads context - an unjustified per-launch context reset. The zero-store wall is unchanged and now localized: the stream3d lane only replays X DDX setup-only windows (c272 decode: INC6@0x840 SET_COLOR_TARGET_A(1) VA=0x0c000000 1920x1080 X8R8G8B8, INVALIDATE_*, INC5@0x180 LINE_LENGTH_IN/OFFSET_OUT - no BEGIN 0x1618 / no draw 0xd74 / no CALL run), while the pbuffer client's own push entry (0xbeef0100 va=0x4000100 len=262144) is unreadable host-side (rc=-2, channel unregistered, submissions=0) - so no draw reaches any lane.
* vgsp: eng15 diagnostics - 3D window 48->256, WINPROBE 64->2048, ↵Arthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | NOWRITE-PBDMA dump Diag-only commit (eng15 receipts: /tmp/opencode/eng15-receipts-c260.txt). - gr3d_win_log 48 -> 256: keep the raw 3D window dump for the gl_frames-era replays (the 48/boot budget was consumed by earlier launches). - winprobe_log 64 -> 2048: keep WINPROBE samples for every stream3d launch. - NEW NOWRITE-PBDMA dump (stream3d-only, 256/boot): all 12 PBDMA instances' intr0/gp_put/pbfetch/off-in-block/hdr/pbcnt at the zero-write verdict. Produced the decisive c260 data: pbfetch == 0x101000+words*4 exactly (deposit fully fetched per launch), intr0=0. No behaviour change; logging only.
* vgsp: CB parser decode fix + pre-replay FE context clear attempt (cwd3 latch ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | | | survives; zero-store persists) (a) svc_gl_cb_upload_scan decode now follows the class definitions (cla16f.h: method 11:0, subchannel 15:13): addr=(hdr&0xfff)<<2, subch=(hdr>>13)&7; selector B/C swapped (0x2384=B=ADDRESS_UPPER high dword, 0x2388=C=lower, cla097.h); 0x238c runs apply [offset][constants...] inline data. CB-DIAG prints subch. Other classes untouched. (b) Pre-replay CWD poison clear for the stream3d lane: new gsp_phys_gr_cwd_clear_locked() (checks 0x404490/0x40706c/0x400504 for 0xbadf, runs the wedge recovery's bounded TSG preempt/resched re-arm + shared latch wipe) before build_gr_launch; once per launch, stream3d+sema_gr_wedge_recover gated (CUDA/CE unaffected). Validation (c250-c254, rich args, ladder armed): the re-arm probes green ('WEDGE-REARM probe rc=0 (engine ALIVE)') but the cwd3 latch does NOT move ('CWD-CLEAR after re-arm ... cwd3=badf5040') and wrote=0 persists (0/1024) with the 0x1528 trap gone under sema_gl_shader_exc=0 - clause (b) is falsified as sufficient: the poison is not the TSG/PBDMA context the re-arm touches. CB-DIAG on these draws shows n3800/n39c8/n2390=0 because bit 12 is 0 on that stream (old/new decodes identical there) - the parser fix stands on the class definition. X regressed to the DDX DMA wall on these cycles (DMA-init 0x51 + per-start SIGSEGVs), so clean gl_frames windows were rare.
* vgsp: admit short MME preludes and drop the 0x22c init method from replay ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | (stream3d zero-write fixes) NOWRITE decode (eng11): wrote=0/tracked=1024 is the retire scan; fe_esr= 0x80000000 is the CLEARED FE latch (not a live fault); trap=0x8000022c/... is PGRAPH_TRAPPED_ADDR naming method 0x22c (C597 SET_GO_IDLE_TIMEOUT, init-only, emitted once at channel init) - the FE traps on the replay of that init write and never reaches the draw. The c220 stack also showed a second defect: 'MME-PRELUDE deferred (window=20 prelude=13 sa=0 cap=2048)' -> MME-REGS esr=badf1201 miss=1 pc=513 -> grfifo poison -> warm sem rc=-110. Fixes (gsp_phys_booter.c): - A: admit a captured prelude shorter than 24 words (pl_room is clamped to pl_n, so pl_room >= 24u could never be true for preludes < 24 words and they were deferred forever). - B: add addr == 0x022c to gsp_phys_rmcall_gr_win_drop_auto_match() (knob sema_gl_win_drop_auto, default 1): drop the replay-hostile init write like the existing 0x10c/0x1b0/0x5e0/0x1b00 triggers. Validation pending (c221 no-capture lottery, c222 X death before the live A/B); receipts: eng11-*.
* vgsp: fix X DMA init + GR backend timeouts (CONT.399)Arthur Hanson Rasmusson6 days
| | | | | | | | | | | | | | | | | | | | | | | | | | X-DMA-FIX (gsp_sema_service.c): - svc_chan_userd: run the pristine-FB USERD scan when the r496b sweep ran on a resolved-but-unvalidated ring (ring_pa!=0 but no entry decoded), not only when the ring is untranslated. A stale pin/foreign VAS left the channel without a USERD and X's 10 s pushbuffer NOP test timed out ('Failed to initialize DMA'). - svc_fb_userd_pristine_scan: claim-check with (off,off) so a second GR channel is not considered foreign against the first adopter's ring_off=0. - svc_chan_vas_candidate_promote: register the channel's own parked COPY_SERVER_PDES candidate at the pump turn once its GPFIFO entry 0 content-validates, instead of waiting for the 1000 ms age-out. - pump: fall back to svc_channel_owner_vas when hVASpace==0 (driver 'attach to the TSG address space') so the GR client ring resolves. PAIR-SAFE (gsp_phys_booter.c): default sema_gl_pair_close_entry and sema_gl_sph_bind_pair_safe ON. An unclosed BEGIN/END pair made the replayed window raise ILLEGAL_METHOD_IN_BEGIN_END (Class Error 0x2018 EC 0x0d), the FE parked before the release semaphore, and draws timed out (backend_timeout). Diagnostics: CB-DIAG/CB-DIAG2 per-push fixed-CB capture summary. Verified: X direct-rendering green on attempt 1; work_gr backend_timeout=0 (was 6), backend_ok=5-7.
* vgsp-gl: author the PS/TCS stage images for the emitted mask slotsArthur Hanson Rasmusson9 days
|
* vgsp-gl: raster blend/alpha/cull/point/ZCULL neutral A/B stateArthur Hanson Rasmusson9 days
|
* vgsp-gl: follow migrated screen pages in the GR copy-outArthur Hanson Rasmusson9 days
|
* vgsp-gl: GS SPH placement/maps/context A/B knobsArthur Hanson Rasmusson9 days
|
* vgsp-gl: raster-enable prelude (CT_WRITE/depth/stencil/scissor) + DS reset fixArthur Hanson Rasmusson9 days
|
* vgsp-gl: GS-mode/FASTGS variants for the synth GS SPHArthur Hanson Rasmusson9 days
|
* vgsp-gl: synthesized GS SPH image + map variants for the SPH18 gateArthur Hanson Rasmusson9 days
|
* vgsp-gl: per-stage synth SPH disable mask (r1562: DS wall reduced to SPH18)Arthur Hanson Rasmusson9 days
|
* vgsp-gl: pair-safe synth SPH binds + per-stage bind disableArthur Hanson Rasmusson9 days
| | | | | | | | | | | | | | sema_gl_sph_bind_pair_safe (default 0) emits the synth SPH-BIND block only after closing a carried-open BEGIN/END pair, removing the r1558 EC 0x0d at 0x2018/0x1614. sema_gl_sph_stage_disable (default 0, bit j = suppress synth slot j) enables per-stage A/Bs. r1560 (mask 0x35, pair-safe on): 13 beef launches, 0 Class Error, DS 900400a0 (SPH5/7/18) - the synth-block fault is gone. r1561 (stage-disable TCS): VSB 5/7 cleared but VSA/TCS validation bits returned and GS 18 persisted; the remaining bits are stage/family state, not a universal missing bind. Changed pages max 2; frame black. Evidence and ranked next step: Handoff-vGPU-IO.md SESSION 155 cont 9.
* vgsp-gl: bounded setup-push hold for maturity debuggingArthur Hanson Rasmusson9 days
| | | | | | | | | | sema_gr_setup_hold_ms (default 0, clamp 2000 ms) holds/defer the draw window while the 60216-byte setup push pin is landing, replacing the ~50% IMMATURE-SKIP lottery. Measured: 2000 ms stalls the ring behind the unreadable 0x4021004 entry (8 launches then silence), so the default stays 0; the param is a debug gate only. r1557 with hold=0 produced 64 beef launches and the DS A/B baseline 80000000->a0040a06. Evidence: Handoff cont 8.
* vgsp-gl: engine-visible MME selector seed + RT0 third-dimension seedArthur Hanson Rasmusson9 days
| | | | | | | | | | | | | | | sema_gl_mme_selector_seed (default 0) emits engine-visible 0x2380/0x2384/ 0x2388/0x238c (fixed-CB selector base>>8, d29) before the draw window; the old state seed only wrote MME shadow scratch, so with the selector programmer elided LOAD_CONSTANT_BUFFER (0x2390 <- 0xbf800000) failed with EC 0x03. r1545: 27 beef launches, 0 errors at 0x2390. sema_gl_rt0_third_dim (default 0) writes RT0 0x818 THIRD_DIMENSION=1 so the layered-RT validation matches the driver's layer-mode ONE; r1548: the 0x17e0/EC 0xd2 illegal color-target layer-vs-third-dimension error is gone and the DS reached validation with stage5 bound (0x19a0000). Both default-off; legacy bytes unchanged. Evidence: Handoff cont 5/6.
* vgsp-gl: add sema_sph_bind_mask for slot-selective synth SPH bindsArthur Hanson Rasmusson9 days
| | | | | | | | | | | | | | | With sema_gl_sph_bind=0 the r1538 window carries only the client's two slot-1 (VERTEX_B) binds; the DS then faults a0040800 (PS stage SPH11|SPH18, stage5=0) because the PS program start is missing. Add sema_sph_bind_mask (bit j = synth slot j) so the PS bind can be re-enabled alone (0x20) while the vertex synth binds stay off; the legacy sph_bind=1 behavior is byte-identical (j2/j5 both emitted). r1541 (mask=0x20): the receipt fires (j5=1 x8) but stage5 stays zero and the launch poisons at LOAD_CONSTANT_BUFFER (0x2390 <- 0xbf800000, EC 0x03), so the j5 synth emission needs the r1456 selector/state fix before this axis can be evaluated. Parameter default 0; evidence in Handoff-vGPU-IO.md.
* vgsp-gl: close a BEGIN/END pair carried into the draw windowArthur Hanson Rasmusson9 days
| | | | | | | | | | | | | | | | | | | r1526's first calls-kept draw window faulted with a GR class error at SET_FRONT_FACE (0x191c <- 0x901) EC 0x0d ILLEGAL_METHOD_IN_BEGIN_END: the window entered with a BEGIN..END pair still open from the previous emitted window, so the first client state method ran inside it. With the prelude CALL runs kept (iram_gate=0, hold_settle=0), r1529 then executed the draw macro (mac=0x22) with zero class errors and engine-side page writes. Add sema_gl_pair_close_entry (default 0, A/B): when the pair tracker carries an open pair into the window, emit the driver's own END form (0x1614 + event word, event 1 for split chains 1/2) before the first window run, then let the normal walk rebase the model. Receipt: PAIR-CLOSE-ENTRY split/ev/window. r1532 showed the close can misfire after refused launches (the injected END itself faulted at 0x1614), so the parameter stays off by default until the model is committed only on retire.
* vgsp-gl: receipt the draw's clip coverage and refuse non-MVP fixed-CB pagesArthur Hanson Rasmusson10 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r1512 adds one bounded GL-COVER receipt per replayed draw. It decodes the window's index buffer (0x17c8/0x17d8 + size), the stream-0 stride (0x1c00) and position offset (0x1160), resolves the CALL_MME_DATA (0x3810) stream base, reads the referenced vertices and evaluates the clip-space position in Q16.16 integer math with the exact c[0x0][0x80..0xbc] block the replay delivers, printing per-vertex clip codes plus clip/NDC/screen bboxes and the injected viewport scale/offset/clip. It also prints the fixed-CB copy provenance and tries the client's own scratch18 page read-only. Measured (r1512): real gear vertices (stride 24, position offset 0, 3.549 0.852 -0.5) but the delivered "matrix" was a rotation block (row3 = 0.1268 0.9922 0 1), giving clip w ~= 1.1 instead of the camera distance (~40) and 57/64 sampled vertices outside clip. The draw was clipped by a non-projection constant block, not by zero/garbage VS output. r1513/r1514 fix the source: the fixed-CB copy now prefers the client's SET_MME_SHADOW_SCRATCH(0x18) page and the client-CB VAs its own writes published (0x43e0000/0x4450000), requires a strict projection shape (|row3.x|,|row3.y| < 0.02 and row3.z/w not both zero), and the resolver no longer accepts an unresolved PA 0 page. Non-MVP pages (including the old forced 0x0cd70000 page) can no longer become the seed; when no real page is found the r1476 identity positive control is used. r1513/r1514 receipts: the strict gate finds no readable client MVP page on these boots (the client's fixed-CB content is not materialised in the emulated memory), so the seed is the controlled identity and the identity still clips gear radii > 1 (12 launches r1514, 20 poison, no fragments; root xwd 2 nonblack pixels at (216,0)-(409,2) 0x77edc). Next wall: get the client's fixed-CB contents into its own page (emulate the VPC/ LOAD_CONSTANT_BUFFER writes from the init push) so the VS receives a real MVP. Build: make -C kernel (green). Evidence: backups/evidence-20261002-victory/r1512..r1514.
* vgsp-gl: sweep the beef ring head for the client's init uploads and ↵Arthur Hanson Rasmusson10 days
| | | | | | | | | | | | | | | | | | | | | | | | quarantine the screen/code-heap overlap The GL client's one-shot LOAD_INLINE_DATA uploads (code images, vertex and index buffers) sit at the head of its GPFIFO ring, but the first observed GP_PUT can already be far past them (r1508: put=8982), so the continuation sweep never decoded them and the FB fetch pages stayed zero. Sweep the head once per beef channel in inline-only mode with the read-arbitrated, tail-aware decoder: r1509 receipts show 'sema-utilsweep swept=64 writes=16' and 'inline write dst=0x44ff000 -> pa=0xb9f000 bytes=1550 data8=9a996940...', after which sema_probe reads the client's real vertex floats and the u16 index stream at 0xb9d410/0xb9fcc8. The guest's shader/code-heap BAR1 upload can also land on the captured X screen's pages (r1508/r1510: vidmem 0x200000 held a program image while the X screen VA 0x120400000 maps there). Snapshot the captured surface at bind time; before a launch whose surface page 0 carries the code-heap/SPH signature, restore the surface from that snapshot (a black X-clear baseline when the bind happened after the upload). The quarantine is content-gated, preserves raster stores that follow, and r1509/r1511 show the clean page 0 (0xff000000) with no code bytes.
* vgsp-gl: scope client inline writes to the authoring VAS and receipt surface ↵Arthur Hanson Rasmusson10 days
| | | | | | | | | | | | | | | | | | | | | | | | | ownership The captured 1280x720 colour-target bind is the X server's screen (VA 0x120400000, 900 contiguous FB pages from 0x200000 to 0x583000 in the emitting VAS 0x10005). The GL client uses the same 0x1200xxxxx VAs for its own allocations; its fixed-CB write (0x120700000) was resolved through the X VAS by the global cross-VAS walk and overwrote screen page 0x500000 with the CB matrix. Resolve client inline writes through the authoring channel's own VAS (GR handle 0xbeef0100 inherits its CE siblings' VAS 0xbeef0300) and refuse cross-VAS translation for a channel-owned page whose own VAS does not map it (VA shadow instead). Receipts: SURF-OWNER (emitting channel, VAS span coverage first/mid/last PA, retarget) and GRCE owner-vas. Add viewport mode 7 (the client's 800x600 window viewport) and a VP-METHOD census of viewport-family runs in trusted pushes; a bounded BAR1 screen-range write witness. r1506: the CB no longer touches the screen (vidmem 0x500000 reads the black clear), screen ownership proven. r1507/r1508: the active indexed draw's vertex/index pages are all-zero in its own FB shadow in those boots, so no fragments; the client never emits a real 0x0a00 viewport block (the 0xa00 hits are misaligned vertex floats), so the viewport stays synthesized.
* vgsp-gl: scope program pages to the emitting VAS, make the MME prelude ↵Arthur Hanson Rasmusson10 days
| | | | boot-independent, and discover the fixed CB by content
* vgsp-gl: deliver the real pixel-stage image and receipt the active draw's ↵Arthur Hanson Rasmusson10 days
| | | | topology/index args
* vgsp-gr: deliver empty FB fetch pages from real FBMEM, discover the CB per ↵Arthur Hanson Rasmusson10 days
| | | | | | | | | | | | | | | | | | | | | | | | | | boot, clear the DS latch after each window The active indexed draw's vertex/index buffers resolve through the client's page tables to vidmem pages whose emulated BAR1 shadow is empty (no emulated upload path ever populated it), so the engine fetched zeros and the draw stored nothing. Three delivery paths now cover the page: a real-FB VID leaf for launch fetch pages (QMD pointers, never the data-fill surface) and for vertex streams when every shadow byte is zero; a sysmem-backing copy when the same VA also has a nonzero SYS mapping; otherwise the existing shadow page is used untouched. Render-target pages keep their shadow identity so the copy-out can still ship stores back to the guest. The fixed constant buffer is discovered per boot: the captured SET_MME_SHADOW_SCRATCH(0x18) value is authoritative, the historically observed base is a gated fallback, and a resolved real page is remembered for later misses. The DS HWW ESR latch is now also cleared (W1C) after each replayed window, so a failed window cannot poison the next window's entry state. Validated with three supervised cycles (r1497-r1499): the active streams read the client's real vertex floats, the real MVP resolves, poison stays at 0-1 per run, and the engine clears the render target to opaque black (dump_vidmem 0x200000 = ff000000) with the guest window still all black - the remaining wall is geometry coverage, not data delivery.
* vgsp-gr: keep the validated fixed CB across launches and map each VTG stream ↵Arthur Hanson Rasmusson10 days
| | | | | | | | | | | | | | | | | | | | | | | contiguously - Remember the last fixed-CB page that resolved through a SYS source and passed the matrix gate; a later resolution miss (or a method-page answer) reuses it instead of zeroing the seed page with the synthetic identity. Only a boot with no validated read ever uses the identity fallback. Do not skip the write on an unchanged hash: the seed page lives in the client's screen allocation and the guest can rewrite it between launches. - Treat the CALL_MME_MACRO(2) vertex stream as one range: map [base,end) into a fresh contiguous fetch line and rewrite both ends from it, preserving the client's stream length across 4 KB boundaries. Unresolvable pages map the module zero page (a zero vertex, never a fault). The generic per-word pass remains the fallback. - Diagnostics: cb-copy logs the first 8 seed-page words and the cached flag; MME-VSTREAM-LINE dumps the resolved base page (client VA, HPA, page count, first 8 words). - Evidence: r1494 (poison 11/17 -> 1/16, real vertex floats at the stream bases, CB cache verified live with src=vaswalk -> src=cached-real) and r1495/r1496 (the active draw's vertex/index page is an all-zero vidmem shadow page while the data exists in guest sysmem - the new wall).
* vgsp-gr: read the fixed CB from the engine-visible page and never deliver a ↵Arthur Hanson Rasmusson10 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | header-only VS image The GL draw's VS was reading two wrong inputs. First, the fixed-CB copy resolved the client VA through a learned/FB layer first, so it read the emulated BAR1 vidmem shadow - a buffer the engine never writes - and delivered unrelated vidmem (r1490 first=09037223 00000004; r1482 oscillated between a float row, method words and zeros). Resolve the CB the way the engine does: channel VAS, every registered VAS page-table walk, then the GR relocation resolver; only a SYS answer is content-valid and an FB answer is flagged. The matrix gate now requires four normal-magnitude floats in c[0x0][0x80..0xbc] (r1492 accepted a method page as a matrix); a rejected read authors the identity MVP. Second, the captured 1536 B VTG upload is spliced at a page boundary: the delivered image was the SPH header plus ZERO SASS, so the VS executed no code. Reject captured program images whose SASS body [0x80,min(len,0x200)) is zero (the real-upload ring record, the 020a0481 cache and the window's own upload all pass the gate) and deliver the built-in known-good VTG image (the client's own SPH V4T1 020a0481 + SASS) at the bind VA instead; sema_gl_vs_img=0 restores the old behaviour. Diagnostics: cb-matrix/cb-const dumps of every VS-read constant block, SPH-ALIAS code4 words at the bind, and MME-VSTREAM post-relocation stream/limit/address payloads. r1491-r1493 (VP_MODE=6, RT0=1): the bind page now shows the real SASS (code4=ff047321 0000a0ff ...) and the CB/identity delivery is logged, but the draw still produces no fragments (retirement 0-3/900 = the forced MME seed pages only; xwd decoration rows only). Next wall: the vertex attribute/staging fetch (slot-57 0x39c8 data and the staging scratch 0x36/0x37), not the shader image or the fixed CB.
* vgsp-gr: re-target the captured render surface per launch so a partial ↵Arthur Hanson Rasmusson10 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | VA-colliding allocation cannot receive the draw The SURF-PRELUDE target pair was patched once per capture generation and then reused; the re-patch test was dead because gsp_sema_gr_surf_recs() only fills in the VA when it returns true and the code negated the call, so 'want' could never be computed. A later draw whose ~10-page SYS allocation sits at the same 0x1204xxxxx VA as the X server's 1280x720 screen inherited the X server's 900-page target; the engine's RT pair then named the client's command/operand buffer, which is why the 'surface' held method words and copy-out saw no engine pixels. Add gsp_phys_gr_surf_launch_target(): only a complete contiguous rec run for the captured surface may use its data-rec bounce lane; a partial run falls back to the boot-time contiguous alias built from the captured bind's VAS pages (the real screen HPAs). Re-patch whenever the cached pair differs from that effective target (SURF-PRELUDE retarget); RT0 copies the same words, so the RT0==RT1 design is unchanged. r1490 (VP_MODE=6 RT0=1, r1476-args): 15 launches, poison=0, retarget have=0xa000000 want=0x15e0000 for the partial lane then 900-page targets, output retirement up to 3/900 with 2 copy-out pages changed by engine, and a non-empty 3.69 MB xwd. New wall: the draw still produces no raster fragments - the only changed pages are the forced MME constant-buffer pages inside the screen (offset pages 768/772/773, 0xff000000 fills). Also harden tools/guest-diag/qga_fetch.py (retry open, long timeout, atomic .part write, clear error exit) for evidence capture.
* vgsp-gr: hold calls on a stream-damaged push so a dropped chunk cannot run ↵Arthur Hanson Rasmusson10 days
| | | | | | | | | | | | | | | | | | LOAD_CONSTANT_BUFFER without its selector state A chunked GL draw whose earlier chunk was dropped (prelude LOAD-ONLY or the r1447 arming window hold) replayed the remaining chunks' calls alone; the constant-buffer selector (0x2380) lived in the dropped chunk, so the bug2548370 macro's LOAD_CONSTANT_BUFFER(0x2390) class-errored (ErrorCode 3) and the engine poisoned (badf1201 sentinel: pc=513/mac=0xf1 are its artifact, not a macro). Propagate the stream-relative chunk offset through the candidate and submit path, keep a per-push STREAM-DAMAGE record of the lowest dropped chunk, emit later chunks calls-held (the proven-safe shape), never arm the arming window-hold on a damaged stream, and start a fresh section at stream_rel==0. r1487: the exact r1485 damaging shape now retires clean (events=5, no poison) and the next chunk is captured; r1486 (holds off) still poisons because the first launch runs against a partially packed prelude, confirming the dropped chunk is the cause, not the hold release.
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-15 22:57:13 +0000