summaryrefslogtreecommitdiffstats
path: root/kernel
Commit message (Collapse)AuthorAge
* vgsp-gl: GS-mode/FASTGS variants for the synth GS SPHArthur Hanson Rasmusson45 hours
|
* vgsp-gl: synthesized GS SPH image + map variants for the SPH18 gateArthur Hanson Rasmusson46 hours
|
* vgsp-gl: per-stage synth SPH disable mask (r1562: DS wall reduced to SPH18)Arthur Hanson Rasmusson47 hours
|
* vgsp-gl: pair-safe synth SPH binds + per-stage bind disableArthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | sema_gl_sph_bind_pair_safe (default 0) emits the synth SPH-BIND block only after closing a carried-open BEGIN/END pair, removing the r1558 EC 0x0d at 0x2018/0x1614. sema_gl_sph_stage_disable (default 0, bit j = suppress synth slot j) enables per-stage A/Bs. r1560 (mask 0x35, pair-safe on): 13 beef launches, 0 Class Error, DS 900400a0 (SPH5/7/18) - the synth-block fault is gone. r1561 (stage-disable TCS): VSB 5/7 cleared but VSA/TCS validation bits returned and GS 18 persisted; the remaining bits are stage/family state, not a universal missing bind. Changed pages max 2; frame black. Evidence and ranked next step: Handoff-vGPU-IO.md SESSION 155 cont 9.
* vgsp-gl: bounded setup-push hold for maturity debuggingArthur Hanson Rasmusson2 days
| | | | | | | | | | sema_gr_setup_hold_ms (default 0, clamp 2000 ms) holds/defer the draw window while the 60216-byte setup push pin is landing, replacing the ~50% IMMATURE-SKIP lottery. Measured: 2000 ms stalls the ring behind the unreadable 0x4021004 entry (8 launches then silence), so the default stays 0; the param is a debug gate only. r1557 with hold=0 produced 64 beef launches and the DS A/B baseline 80000000->a0040a06. Evidence: Handoff cont 8.
* vgsp-gl: engine-visible MME selector seed + RT0 third-dimension seedArthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | sema_gl_mme_selector_seed (default 0) emits engine-visible 0x2380/0x2384/ 0x2388/0x238c (fixed-CB selector base>>8, d29) before the draw window; the old state seed only wrote MME shadow scratch, so with the selector programmer elided LOAD_CONSTANT_BUFFER (0x2390 <- 0xbf800000) failed with EC 0x03. r1545: 27 beef launches, 0 errors at 0x2390. sema_gl_rt0_third_dim (default 0) writes RT0 0x818 THIRD_DIMENSION=1 so the layered-RT validation matches the driver's layer-mode ONE; r1548: the 0x17e0/EC 0xd2 illegal color-target layer-vs-third-dimension error is gone and the DS reached validation with stage5 bound (0x19a0000). Both default-off; legacy bytes unchanged. Evidence: Handoff cont 5/6.
* vgsp-gl: add sema_sph_bind_mask for slot-selective synth SPH bindsArthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | With sema_gl_sph_bind=0 the r1538 window carries only the client's two slot-1 (VERTEX_B) binds; the DS then faults a0040800 (PS stage SPH11|SPH18, stage5=0) because the PS program start is missing. Add sema_sph_bind_mask (bit j = synth slot j) so the PS bind can be re-enabled alone (0x20) while the vertex synth binds stay off; the legacy sph_bind=1 behavior is byte-identical (j2/j5 both emitted). r1541 (mask=0x20): the receipt fires (j5=1 x8) but stage5 stays zero and the launch poisons at LOAD_CONSTANT_BUFFER (0x2390 <- 0xbf800000, EC 0x03), so the j5 synth emission needs the r1456 selector/state fix before this axis can be evaluated. Parameter default 0; evidence in Handoff-vGPU-IO.md.
* vgsp-gl: close a BEGIN/END pair carried into the draw windowArthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | r1526's first calls-kept draw window faulted with a GR class error at SET_FRONT_FACE (0x191c <- 0x901) EC 0x0d ILLEGAL_METHOD_IN_BEGIN_END: the window entered with a BEGIN..END pair still open from the previous emitted window, so the first client state method ran inside it. With the prelude CALL runs kept (iram_gate=0, hold_settle=0), r1529 then executed the draw macro (mac=0x22) with zero class errors and engine-side page writes. Add sema_gl_pair_close_entry (default 0, A/B): when the pair tracker carries an open pair into the window, emit the driver's own END form (0x1614 + event word, event 1 for split chains 1/2) before the first window run, then let the normal walk rebase the model. Receipt: PAIR-CLOSE-ENTRY split/ev/window. r1532 showed the close can misfire after refused launches (the injected END itself faulted at 0x1614), so the parameter stays off by default until the model is committed only on retire.
* vgsp-gl: spend the draw-coverage receipts on real-CB drawsArthur Hanson Rasmusson2 days
| | | | | | | | | The GL-COVER 12/boot budget was consumed by the pre-CB (synthetic identity) draws, so no clip-coverage receipt ever described a draw that used the client's real fixed CB. Emit the receipts only while svc_gl_cb_img_valid and re-arm the counter whenever a new CB image passes the strict projection gate, so the first draws after the real matrix lands carry the cover receipt.
* vgsp-gl: deliver the fixed CB to the engine-visible seed page directlyArthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | The r1515/r1520 decode assembles the client's real fixed-CB image, but svc_gl_cb_copy()'s write to the forced seed VA (0x120700000) is refused by the r1506 authoring-VAS rule: the seed page belongs to the X server's VAS, so the beef channel write only updated the VA shadow while the engine kept reading the black screen page at pa 0x500000 (r1521 seed dump: the image never arrived; the engine fetched the RT clear). The seed is a service-forced engine input, not a client write, so resolve its VA through the VAS/walk/trusted chain and write the backing shadow/FB page directly with svc_write_ap(), bypassing the ownership rule. A bounded CB-SEED receipt reports the destination PA, aperture and the m80 words. Validated in r1522: the seed backing store at dpa 0x500000 holds the assembled image (m80 = the client's projection, e.g. 40a00000/40d55555/ bf9745d1/4211745c/bf800000/42200000) and cb-copy uses src=const-upload (ssrc=15).
* vgsp-gl: decode the 570.144 MME-wrapper fixed-CB upload formArthur Hanson Rasmusson2 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | The guest GL driver streams the fixed constant buffer through the C597 MME macros, not the native SET_CONSTANT_BUFFER_SELECTOR/LOAD_CONSTANT_BUFFER methods the r1515 scanner decodes: - CALL_MME_MACRO(0) = SETUP_FIXED_CONST arrives as an IMMD run at method 0x3800 carrying the VPC dword offset (the macro converts it to a byte address, so the fixed-CB offset is imm << 2). - CALL_MME_MACRO(57) = LOAD_CONSTANT_BUFFER_BUG2548370 arrives as a run at 0x39c8 whose payload is [count][count dwords]; the macro writes the data at the current fixed-CB offset and auto-increments it. - CALL_MME_MACRO(58) = LOAD_CONSTANT_BUFFER_OFFSET arrives at 0x39d0 with [offsetBytes]. r1517's own CHUNK1 dump of the 7144-byte draw window carries the real glxgears MVP this way (pixel-space 5.0/6.667 scales, -1.1818/36.3636 near/far row and the -1/40 w row = glFrustum(-1,1,-0.75,0.75,5,60) x translate(0,0,-40)); the old scanner ignored those runs, assembled only the 10 state-patch words, and the strict gate never passed, so every launch ran with the synthetic identity and the geometry clipped. With the wrapper form decoded the assembled 4 KB image carries the client's real MVP at c[0x0][0x80..0xbc], passes svc_gl_cb_mvp_ok(), and svc_gl_cb_copy() delivers it to the forced MME seed page as src=const-upload (src_ssrc=15) instead of synthetic-id.
* vgsp-gl: decode the client fixed-CB upload runs and gate the assembled imageArthur Hanson Rasmusson3 days
|
* vgsp-gl: receipt the draw's clip coverage and refuse non-MVP fixed-CB pagesArthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | r1512 adds one bounded GL-COVER receipt per replayed draw. It decodes the window's index buffer (0x17c8/0x17d8 + size), the stream-0 stride (0x1c00) and position offset (0x1160), resolves the CALL_MME_DATA (0x3810) stream base, reads the referenced vertices and evaluates the clip-space position in Q16.16 integer math with the exact c[0x0][0x80..0xbc] block the replay delivers, printing per-vertex clip codes plus clip/NDC/screen bboxes and the injected viewport scale/offset/clip. It also prints the fixed-CB copy provenance and tries the client's own scratch18 page read-only. Measured (r1512): real gear vertices (stride 24, position offset 0, 3.549 0.852 -0.5) but the delivered "matrix" was a rotation block (row3 = 0.1268 0.9922 0 1), giving clip w ~= 1.1 instead of the camera distance (~40) and 57/64 sampled vertices outside clip. The draw was clipped by a non-projection constant block, not by zero/garbage VS output. r1513/r1514 fix the source: the fixed-CB copy now prefers the client's SET_MME_SHADOW_SCRATCH(0x18) page and the client-CB VAs its own writes published (0x43e0000/0x4450000), requires a strict projection shape (|row3.x|,|row3.y| < 0.02 and row3.z/w not both zero), and the resolver no longer accepts an unresolved PA 0 page. Non-MVP pages (including the old forced 0x0cd70000 page) can no longer become the seed; when no real page is found the r1476 identity positive control is used. r1513/r1514 receipts: the strict gate finds no readable client MVP page on these boots (the client's fixed-CB content is not materialised in the emulated memory), so the seed is the controlled identity and the identity still clips gear radii > 1 (12 launches r1514, 20 poison, no fragments; root xwd 2 nonblack pixels at (216,0)-(409,2) 0x77edc). Next wall: get the client's fixed-CB contents into its own page (emulate the VPC/ LOAD_CONSTANT_BUFFER writes from the init push) so the VS receives a real MVP. Build: make -C kernel (green). Evidence: backups/evidence-20261002-victory/r1512..r1514.
* vgsp-gl: sweep the beef ring head for the client's init uploads and ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | | quarantine the screen/code-heap overlap The GL client's one-shot LOAD_INLINE_DATA uploads (code images, vertex and index buffers) sit at the head of its GPFIFO ring, but the first observed GP_PUT can already be far past them (r1508: put=8982), so the continuation sweep never decoded them and the FB fetch pages stayed zero. Sweep the head once per beef channel in inline-only mode with the read-arbitrated, tail-aware decoder: r1509 receipts show 'sema-utilsweep swept=64 writes=16' and 'inline write dst=0x44ff000 -> pa=0xb9f000 bytes=1550 data8=9a996940...', after which sema_probe reads the client's real vertex floats and the u16 index stream at 0xb9d410/0xb9fcc8. The guest's shader/code-heap BAR1 upload can also land on the captured X screen's pages (r1508/r1510: vidmem 0x200000 held a program image while the X screen VA 0x120400000 maps there). Snapshot the captured surface at bind time; before a launch whose surface page 0 carries the code-heap/SPH signature, restore the surface from that snapshot (a black X-clear baseline when the bind happened after the upload). The quarantine is content-gated, preserves raster stores that follow, and r1509/r1511 show the clean page 0 (0xff000000) with no code bytes.
* vgsp-gl: scope client inline writes to the authoring VAS and receipt surface ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | | | ownership The captured 1280x720 colour-target bind is the X server's screen (VA 0x120400000, 900 contiguous FB pages from 0x200000 to 0x583000 in the emitting VAS 0x10005). The GL client uses the same 0x1200xxxxx VAs for its own allocations; its fixed-CB write (0x120700000) was resolved through the X VAS by the global cross-VAS walk and overwrote screen page 0x500000 with the CB matrix. Resolve client inline writes through the authoring channel's own VAS (GR handle 0xbeef0100 inherits its CE siblings' VAS 0xbeef0300) and refuse cross-VAS translation for a channel-owned page whose own VAS does not map it (VA shadow instead). Receipts: SURF-OWNER (emitting channel, VAS span coverage first/mid/last PA, retarget) and GRCE owner-vas. Add viewport mode 7 (the client's 800x600 window viewport) and a VP-METHOD census of viewport-family runs in trusted pushes; a bounded BAR1 screen-range write witness. r1506: the CB no longer touches the screen (vidmem 0x500000 reads the black clear), screen ownership proven. r1507/r1508: the active indexed draw's vertex/index pages are all-zero in its own FB shadow in those boots, so no fragments; the client never emits a real 0x0a00 viewport block (the 0xa00 hits are misaligned vertex floats), so the viewport stays synthesized.
* vgsp-gl: scope program pages to the emitting VAS, make the MME prelude ↵Arthur Hanson Rasmusson3 days
| | | | boot-independent, and discover the fixed CB by content
* vgsp-gl: deliver the real pixel-stage image and receipt the active draw's ↵Arthur Hanson Rasmusson3 days
| | | | topology/index args
* vgsp-gr: deliver empty FB fetch pages from real FBMEM, discover the CB per ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | | | | boot, clear the DS latch after each window The active indexed draw's vertex/index buffers resolve through the client's page tables to vidmem pages whose emulated BAR1 shadow is empty (no emulated upload path ever populated it), so the engine fetched zeros and the draw stored nothing. Three delivery paths now cover the page: a real-FB VID leaf for launch fetch pages (QMD pointers, never the data-fill surface) and for vertex streams when every shadow byte is zero; a sysmem-backing copy when the same VA also has a nonzero SYS mapping; otherwise the existing shadow page is used untouched. Render-target pages keep their shadow identity so the copy-out can still ship stores back to the guest. The fixed constant buffer is discovered per boot: the captured SET_MME_SHADOW_SCRATCH(0x18) value is authoritative, the historically observed base is a gated fallback, and a resolved real page is remembered for later misses. The DS HWW ESR latch is now also cleared (W1C) after each replayed window, so a failed window cannot poison the next window's entry state. Validated with three supervised cycles (r1497-r1499): the active streams read the client's real vertex floats, the real MVP resolves, poison stays at 0-1 per run, and the engine clears the render target to opaque black (dump_vidmem 0x200000 = ff000000) with the guest window still all black - the remaining wall is geometry coverage, not data delivery.
* vgsp-gr: keep the validated fixed CB across launches and map each VTG stream ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | contiguously - Remember the last fixed-CB page that resolved through a SYS source and passed the matrix gate; a later resolution miss (or a method-page answer) reuses it instead of zeroing the seed page with the synthetic identity. Only a boot with no validated read ever uses the identity fallback. Do not skip the write on an unchanged hash: the seed page lives in the client's screen allocation and the guest can rewrite it between launches. - Treat the CALL_MME_MACRO(2) vertex stream as one range: map [base,end) into a fresh contiguous fetch line and rewrite both ends from it, preserving the client's stream length across 4 KB boundaries. Unresolvable pages map the module zero page (a zero vertex, never a fault). The generic per-word pass remains the fallback. - Diagnostics: cb-copy logs the first 8 seed-page words and the cached flag; MME-VSTREAM-LINE dumps the resolved base page (client VA, HPA, page count, first 8 words). - Evidence: r1494 (poison 11/17 -> 1/16, real vertex floats at the stream bases, CB cache verified live with src=vaswalk -> src=cached-real) and r1495/r1496 (the active draw's vertex/index page is an all-zero vidmem shadow page while the data exists in guest sysmem - the new wall).
* vgsp-gr: read the fixed CB from the engine-visible page and never deliver a ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | header-only VS image The GL draw's VS was reading two wrong inputs. First, the fixed-CB copy resolved the client VA through a learned/FB layer first, so it read the emulated BAR1 vidmem shadow - a buffer the engine never writes - and delivered unrelated vidmem (r1490 first=09037223 00000004; r1482 oscillated between a float row, method words and zeros). Resolve the CB the way the engine does: channel VAS, every registered VAS page-table walk, then the GR relocation resolver; only a SYS answer is content-valid and an FB answer is flagged. The matrix gate now requires four normal-magnitude floats in c[0x0][0x80..0xbc] (r1492 accepted a method page as a matrix); a rejected read authors the identity MVP. Second, the captured 1536 B VTG upload is spliced at a page boundary: the delivered image was the SPH header plus ZERO SASS, so the VS executed no code. Reject captured program images whose SASS body [0x80,min(len,0x200)) is zero (the real-upload ring record, the 020a0481 cache and the window's own upload all pass the gate) and deliver the built-in known-good VTG image (the client's own SPH V4T1 020a0481 + SASS) at the bind VA instead; sema_gl_vs_img=0 restores the old behaviour. Diagnostics: cb-matrix/cb-const dumps of every VS-read constant block, SPH-ALIAS code4 words at the bind, and MME-VSTREAM post-relocation stream/limit/address payloads. r1491-r1493 (VP_MODE=6, RT0=1): the bind page now shows the real SASS (code4=ff047321 0000a0ff ...) and the CB/identity delivery is logged, but the draw still produces no fragments (retirement 0-3/900 = the forced MME seed pages only; xwd decoration rows only). Next wall: the vertex attribute/staging fetch (slot-57 0x39c8 data and the staging scratch 0x36/0x37), not the shader image or the fixed CB.
* vgsp-gr: re-target the captured render surface per launch so a partial ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | VA-colliding allocation cannot receive the draw The SURF-PRELUDE target pair was patched once per capture generation and then reused; the re-patch test was dead because gsp_sema_gr_surf_recs() only fills in the VA when it returns true and the code negated the call, so 'want' could never be computed. A later draw whose ~10-page SYS allocation sits at the same 0x1204xxxxx VA as the X server's 1280x720 screen inherited the X server's 900-page target; the engine's RT pair then named the client's command/operand buffer, which is why the 'surface' held method words and copy-out saw no engine pixels. Add gsp_phys_gr_surf_launch_target(): only a complete contiguous rec run for the captured surface may use its data-rec bounce lane; a partial run falls back to the boot-time contiguous alias built from the captured bind's VAS pages (the real screen HPAs). Re-patch whenever the cached pair differs from that effective target (SURF-PRELUDE retarget); RT0 copies the same words, so the RT0==RT1 design is unchanged. r1490 (VP_MODE=6 RT0=1, r1476-args): 15 launches, poison=0, retarget have=0xa000000 want=0x15e0000 for the partial lane then 900-page targets, output retirement up to 3/900 with 2 copy-out pages changed by engine, and a non-empty 3.69 MB xwd. New wall: the draw still produces no raster fragments - the only changed pages are the forced MME constant-buffer pages inside the screen (offset pages 768/772/773, 0xff000000 fills). Also harden tools/guest-diag/qga_fetch.py (retry open, long timeout, atomic .part write, clear error exit) for evidence capture.
* vgsp-gr: hold calls on a stream-damaged push so a dropped chunk cannot run ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | LOAD_CONSTANT_BUFFER without its selector state A chunked GL draw whose earlier chunk was dropped (prelude LOAD-ONLY or the r1447 arming window hold) replayed the remaining chunks' calls alone; the constant-buffer selector (0x2380) lived in the dropped chunk, so the bug2548370 macro's LOAD_CONSTANT_BUFFER(0x2390) class-errored (ErrorCode 3) and the engine poisoned (badf1201 sentinel: pc=513/mac=0xf1 are its artifact, not a macro). Propagate the stream-relative chunk offset through the candidate and submit path, keep a per-push STREAM-DAMAGE record of the lowest dropped chunk, emit later chunks calls-held (the proven-safe shape), never arm the arming window-hold on a damaged stream, and start a fresh section at stream_rel==0. r1487: the exact r1485 damaging shape now retires clean (events=5, no poison) and the next chunk is captured; r1486 (holds off) still poisons because the first launch runs against a partially packed prelude, confirming the dropped chunk is the cause, not the hold release.
* vgsp-gr: capture the full 4K-word GL draw window, emit SET_SHADER_EXCEPTIONS ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | as immd13, and base the SPH region on the bound program's shadow page - SVC_GR_PUSH_WORDS / GSP_PHYS_GR_RAW_WORDS raised 2048 -> 4096: the beef full-frame push is 12288 B / 3072 words, so the 2048-word capture tail failed the 3D mark (raw_ok=0 fit_ok=0) and the launch fell back to a 239-word stub, losing the real 2115-word draw. Now '3D stream chunked window=1429 words -> 4 chunk(s)'. - SET_SHADER_EXCEPTIONS (0x1528) is emitted as the client's immd13 (0x8000054a) and skipped when the window already carries it; the remaining 0x1528 in the log is the client's own benign write. - sema_gl_sph_region_bind (default 1): the SPH region base is the first bound program's relocated shadow page, not the forced 0x1500000 pool base; r1484 latched the fetched SPHs (0,019a0f00,019a0200,0,0,019a0000) with ds=86040646 (region mismatch), r1485 uses base 0x19b0000 bind 0x19b0900 and the DS accepts (ds=80000000). - r1484/r1485: the screen now shows gear-class pixels (xwd bbox spanning the 800x600 window, multicolor); GUEST-WIT shows RT0 page 0 written. The remaining wall is the MME draw macro 0xf1 / pc 513 poison on the first calls+window launch after the arming hold is released.
* vgsp-gr: bind the beef GL draw to the captured 900-page screen surface, not ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | a cross-VAS 10-page operand buffer The PS SPH has MRT_ENABLE=0 (writes RT0); the beef window binds no colour target of its own, so the last trusted 0x800..0xbff run (the X screen surface 0x120400000, 1280x720, 900 pages) is the render target. Its pages were resolved through the global VA-keyed pin/ledger, which conflated clients: the beef client's own injected pin for VA 0x120400000 (a SYS staging/operand buffer holding SASS/method words) shadowed the X server's surface VAS and cut the set at 10 pages. Capture the surface's source VAS and resolve its pages through that VAS in the fill, bypassing the pin override for this page set. Re-patch the SURF prelude when the launch's rec base differs from the cached one, and copy the emitted SURF run's target/geometry into the RT0 run so RT0 == RT1 every launch (was hardcoded to the 0xa relocation half). r1483: the beef retirement is now 0/900 pages of the visible surface (was 0/10), RT0-BIND target=0xa000000, data[0] va=0x120400000 pa=0x100000, n_data =900, 6 launches, poison=0. The engine still stores nothing: GR-STATE sph is zero at retire and the launch traps at method 0x1528, so the next wall is making the pipeline program bind visible to the DS, not the RT VA.
* vgsp-gr: deliver the real GL shader images and the client fixed constant ↵Arthur Hanson Rasmusson3 days
| | | | | | | | | | | | | | | | | | | | | | | | | buffer to the engine-visible pages - inline-apply writes the image into the guest HPA whenever the page is kept at the guest VA (code_keep_guest), not only for stream3d windows; a shadow copy is useless when the engine fetches the guest page (r1470: guest=0 VS then lost to the window-0 shadow copy). - the standalone 0x180/0x1b0 context-init upload pair (outside any C597 section) is also recorded in the GRCE destination ring, so a later draw window can find the client's real VTG image at its bind VA. - sema_gl_cb_copy_to / sema_gl_cb_src_va: copy the client fixed-CB page into the forced, mapped MME seed page before the launch, so the vertex shader reads the client's transform constants instead of screen/stale data. Falls back to a synthetic identity MVP when the client VA cannot be walked. - cache any push chunk whose first word is a real SPH (020a0481 VTG / 000a1482 PS) and use it as the program-record fallback when the window's own bind-VA upload was never captured (the init push's continuation chunks are otherwise judged implausible and never reach the ring). - r1481/r1482: the real VS SPH+code and PS are applied guest=1 at the bind VA, the client CB page resolves and is copied, poison=0 over 9-10 launches; render-target writes still zero - the remaining wall is the draw's render-target/colour-target binding (the beef window's output retirement set is 10 pages of shader-like data, not the 900-page screen surface).
* vgsp-gr: sema_gl_pair_orphan_drop (default 1) - drop orphan END runs (method ↵Arthur Hanson Rasmusson4 days
| | | | 0x1614) when the pair model is closed and restore pair_open/open_split from the launch-entry snapshot when a window is dropped/held, so dropped windows are pair-state no-ops; fixes the EC0x0d 0x1614/0x2098 poison that follows a held/dropped BEGIN
* vgsp-gr: authoritative viewport/RT closure - sema_gl_vp_prelude modes 5/6 ↵Arthur Hanson Rasmusson4 days
| | | | use live slot 33 (CALL 0x3908) / raw driver words with scaleY=+360, clip 0x0c00/0x0c04 and 0x193c=0x21800 (ZERO_ONE|FRUSTUM_XYZ); sema_gl_rt0_bind binds SET_COLOR_TARGET(0)=0x800 plus SET_CT_SELECT count=2 (the PS has MRT_ENABLE=0 and writes RT0 while the client binds only RT1); both preludes gated to windows with a CALL run so Xorg 2D windows are untouched; r1465: CALL(33) executes (mac=0x21) on the beef window, RT0 bound, DRAW blocked by the 0x1614 pair poison
* vgsp-gr: sema_gl_vp_prelude_pos - insert the synthesized viewport before the ↵Arthur Hanson Rasmusson4 days
| | | | first CALL run (default 1) so the 0x2080 SET_PIPELINE bind lands first, or before the first 0x3910 (pos 2); mode 4 = clip rect with the verified (size<<16)|origin pixel encoding; r1462: 3 DRAWs executed with pos=1 VP and still zero RT stores
* vgsp-gr: sema_gl_vp_prelude - synthesize the missing Turing viewport ↵Arthur Hanson Rasmusson4 days
| | | | scale/offset (mode 1) plus optional pixel-centre/clip-control (2) and clip-rect (3) at the head of replayed 3D windows; the client push never writes the viewport family; default 0 = legacy bytes; r1459: FE accepts the words, draws still store nothing -> insertion position vs pipeline-group binding is the next variable
* vgsp-diag: whole-vidmem page-hash bracket - sema_gl_vidmem_bracket hashes ↵Arthur Hanson Rasmusson4 days
| | | | every 4KB page of the BAR1 shadow before the GR publish and diffs after the output-retirement wait, reporting any changed page outside the sampled output set; vidmem_hash_snap/vidmem_hash_diff manual module params; default 0 is a strict no-op
* vgsp-mme: pair_chain cross-launch state - persist pair_open/open_split ↵Arthur Hanson Rasmusson4 days
| | | | across windows + entry snapshot; PAIR-CHAIN-ENTRY-ELIDE post-branch compaction (drop [0x2054,0x2158] runs on windows that enter with a pair already open, gated pair_chain && entry_open && pairs_gen!=0) fixing the r1453b #11 0x2058/BEGIN_END_ACTIVE leak; resets at both wipe sites; 0=legacy
* vgsp-mme: sema_gl_pair_chain (default 1) - EC0x0d = BEGIN_END_ACTIVE decode: ↵Arthur Hanson Rasmusson4 days
| | | | drain (WAIT_FOR_IDLE<-0) before each following normal/normal BEGIN so each END closes exactly one pair; held-call branch pair elision gated on pairs_gen==pl_gen; per-launch/context-wipe resets; guest BEGIN data carried verbatim (no normalisation site exists); 0=legacy bytes
* vgsp-mme: log-only non-blind d24/d25 capture - print shadow[c597] ↵Arthur Hanson Rasmusson4 days
| | | | 0x3490/0x3494/0xd24/0xd25 via gsp_phys_mme_shadow_read (8/boot cap, zero behavior change) so sema_mme_state_d24/d25 can be seeded from the engine's own state instead of blind values
* vgsp-gr: sema_gl_attr_sph_drop (default 1) - drop the attr-prelude ↵Arthur Hanson Rasmusson4 days
| | | | SET_PIPELINE(2) runs (method 0x2080; the guest's cold 0x20 word is refused EC4 by the FE on a windowless LOAD-ONLY carrier); exact mask (op in {1,3,5}, cnt!=0, (hdr&0xfff)<<2==0x2080), once-per-gen log + counter, 0=legacy; SPH-BIND log caps 16->64
* vgsp-mme: sema_gl_mme_sph_bind_binding (default 0) - drop the synthesized ↵Arthur Hanson Rasmusson4 days
| | | | BINDING(2)/(5)=0 data writes from the SPH-BIND emission (the FE rejects the 0x2090 word with Class Error EC4 when walking the window; the real client never emits 0x2090), keep the REG_COUNT(2)/(5)=0x1a runs; size guard 19->17 when dropped; 1 = legacy bytes
* vgsp-mme: golden-only completion + mme-audit tool - accept golden slot 0 ↵Arthur Hanson Rasmusson4 days
| | | | (entry=0 valid) + sema_gl_mme_golden_only=1 force-blanks non-golden called slots (stub/drop their CALL runs), overlay logs inspected/blank/maxa; tools/mme-audit: stdlib overlay-sim + booter-grammar walk + operand map + cross-boot table (decodes the r1448 slot-57 stall: IR 899-900 emits PIPELINE_BINDING(2) @0x2090 rejected only when the program-address pairs are carried)
* vgsp-mme: CONT-118 hold_window + strict_grace - sema_gl_mme_hold_window=1 ↵Arthur Hanson Rasmusson4 days
| | | | moves the window drop to the one arming launch/gen (MME-WINDOW-HOLD) so the release launch carries calls+window together (the only 22x-clean r1443b shape; poison fires while the MME validates the loaded program on the first post-pack window launch); sema_gl_mme_strict_grace=8 fails the strict release's FE-idle term open (gsp_phys_gr_fe_idle is inert: ==1 exact vs real 0x0e0e0001-class); resets mirror CONT-118; 0=legacy
* vgsp-mme: CONT-118 strict release + FE-busy deferral - ↵Arthur Hanson Rasmusson4 days
| | | | sema_gl_mme_hold_strict (calls release only when pre_words_out==0 && fe_idle() && live_gen==pl_gen) and sema_gl_mme_fe_defer (busy-defer the load-only carrier at svc_gr_request before fill/consume, bounded 4 consecutive defers/gen with GIVEUP log) - both default 1, independent live A/B, 0 = legacy-equivalent
* vgsp-mme: CONT-118 one-launch-delay settle hold (sema_gl_mme_hold_settle, ↵Arthur Hanson Rasmusson5 days
| | | | default 1) - calls run only after the carrier executed AND settled, fixing the first-carrier pc=513/word-1539 part-2 pre-residency poison; resets in iram_gate_fail/WEDGE/PARK-RECOVER; seed-log caps 16->64; +60 net
* vgsp-sph: d24/d25 seed extension - capture 0x3490/0x3494 (scratch24/25) + ↵Arthur Hanson Rasmusson5 days
| | | | params sema_mme_state_d24/d25 + fail-closed seed emissions after d19 (param>captured>skip, 3d-reloc) - the d28-forced slow path reads the 0x349x states after d19; +235/-1
* vgsp-sph: C4 - capture scratch 0x19 (CB selector, mthd 0x3464) + seed STATE ↵Arthur Hanson Rasmusson5 days
| | | | 0xD19 emission (param sema_mme_state_d19 > captured, 3d-reloc, fail-closed) - the d28-forced slow path reads an unseeded d19 and faults the consumer at VA 0 (HUBCLIENT_PD); +129/-1
* vgsp-sph: emit j=2/j=5 REGISTER_COUNT/BINDING records in the SPH-bind ↵Arthur Hanson Rasmusson5 days
| | | | prelude (guard 13u->19u, headers 0x20020823/0x20020853, values 0x1a/0x0) - supplies the per-stage validation input the DS checks on the synthesized stage slots (a2040x00/SPH9 wall); constants shaped from the captured j=1 record, fail-closed (no relocation)
* vgsp-gr: CONT-114 golden MME slot overlay (sema_gl_mme_golden) - the capture ↵Arthur Hanson Rasmusson6 days
| | | | lottery loses on partial boots (13/55 slots; r1405/6/10/11/12) and the called DRAW_IAB slot 34 gets keep-clamped+call-dropped, so no draw ever executes; this overlay serves called-but-uncaptured SA slots from the driver's own generated macro code (word-exact vs a live full capture: 34=0x265/75w, 39=0x29f/69w, 40=0x2b6/69w, 48=0x337/21w, 51=0x350/12w, 57=0x364/189w) via an untracked .gitignore'd build input kernel/golden-mme-tu104.h: slot_kept/slot_stubbed consult it, the window scan counts golden slots as covered (no stub pair, calls survive), and the pack builder overlays the golden words+SA pairs into ir_pack after the capture fill (mode 1 = uncovered only, force=2 = overwrite all); golden-filled slots are byte-shape-identical to captured ones (0x11c pairs + one 0x114 ONEINC chunk) so the IRAM gate and downstream consumers are unchanged
* vgsp: CONT-113 - clamp keep_mask to capture-covered slots (r1405 poison root ↵Arthur Hanson Rasmusson6 days
| | | | | | | | | | | | | | | | | | | | | cause) The r1405 priv-error wedge traced live: the draw window calls CALL_MME_MACRO(34)/(57) while the MME capture holds 13 SA slots (0..12, IR <= 0xe9); keep_mask=~0 exempted every slot from stubbing, so those calls ran, the MME fetched an instruction the packed program does not hold (info=badf1201 pc_valid=1 pc=513 mac=0x1f1 miss=1 ir=badf1201) and poisoned the lane; the second recovery's hard re-arm left the engine unresponsive (probe rc=-110, GP_GET frozen). Fix (one variable): gsp_phys_gr_slot_kept() - a keep_mask slot is only honored when the capture covers it (SA entry present AND its IR instruction entered the replay); otherwise the proven r1186 safe combination applies: SA stub + CALL-run drop, never a fetch of non-resident code. The decision reads the live SA table per window, so a later capture generation that covers the slot releases it automatically. Bounded MME-KEEP-CLAMP witness. Knob sema_gl_mme_keep_clamp (default 1; 0 = r1405 all-real A/B).
* vgsp-sema: exempt injected pins from the push-read PA ceiling + ↵Arthur Hanson Rasmusson6 days
| | | | pinrej/pushfail visibility (carrier read >=6 GiB)
* vgsp: CONT-112 - changed-page copy-out witness budget + MME IR-word A/B ↵Arthur Hanson Rasmusson6 days
| | | | patch knob (sema_gl_mme_irpatch_off/_val)
* vgsp: CONT-111 - sema_gl_wit_shown (uint default 4) replaces hardcoded ↵Arthur Hanson Rasmusson7 days
| | | | 4-page GUEST-WIT shown budget ('if (shown < gsp_phys_gr_wit_shown)') so a store-rich launch dumps the full changed va/pa list; recipes carry 1024 - TASK 1 ANSWERED (surface): xwd/window path reads the RT va=0x120400000 pitch 5120 (proof via server GetImage ops sema-op2d h=0x1000013 dst=0x120350000 src=0x120658000 spitch=5120 so=1/480 => src base 0x120658000-480*5120=0x120400000); FIRST ENGINE-CHANGED RT PAGES of the campaign r1385: output retirement wait 2/900 pages changed (settled) + bounce copy-out 2 pages written back 2 changed by engine + OUT-ALIAS-WIT va=0x120705000 partner_va=0x120700000; but FB shadow at those pages reads same uniform weave invisible; GATE1 BLACK+STATIC: xwd root nz 0, shim frames=217 mean=0.0283 diff 0, FB shadow static while glxgears 445 FPS (8MB diff over 10s, md5 e85173d8 identical 5/5) - new /proc/kcore reader kcoredump.py/kscan*.py (region nv_vgpu_bar_init+0x15a SVC_VIDMEM base 0x120200000); HAZARD recorded: 64KB host probes into unverified regions panicked guest kernel (anon_vma), regions restored, SINGLE-PAGE PROBES ONLY - next: give changed pages priority in copy-out witness (OUT-PAGE-WIT with own budget; 12-line budget exhausted by OUT-UNCH flood so va->hpa of engine-changed pages never printed); then diff FB shadow via kcore reader across that copy-out to capture the engine's exact pixels; if weave then DRAW (0xd78) still isn't rasterizing and A/B moves to an IR-word patch knob on slot34's emitted BEGIN/SET_VERTEX_ARRAY_START/DRAW_VERTEX_ARRAY/END - SESSION 153 r1382-r1385
* vgsp: CONT-109 - FOUR FIXES: (1) WEDGE-RECOVER now rewinds pack_off/pack_sa ↵Arthur Hanson Rasmusson7 days
| | | | + invalidates live_gen (r1377 deadlock: recovery reset pre_emit_off=0 but left pack_off at end -> split emitter can=0->packed=1 zero words -> MME-PRELUDE part gen=3 off=0 words=0/3083 forever, latch never re-set, MME never started); (2) PARK-RECOVER same rewinds; (3) gsp_phys_gr_fetch_miss_log promotes live_gen on GP_GET advance (readback-free promotion on timeout path; r1377 lost it FETCH-WIT timeout engine-fetched then pending_gen cleared); (4) gsp_phys_mme_fast_sample latches poisoned when sample's FIRST read is poison (r1378 MME-FAST begin esr=badf1201 ds=badf1201 grfifo=badf1201 -> esr badf1201->80000000 was missed; stale latch+live then ran macro 57 on wiped context sked mme_esr=80000004 mme_mac=0x39, FE parked pc=513 mac=0xf1 mmegen=1) - PROGRESS (not gate claim): r1378 MME-FAST launch macro-status=000393a2(mpc=930 mac=0x39 run=0) MACRO 57 EXECUTED TO ITS LAST INSTRUCTION; STORES GREW 9/909 -> 238/906 -> 305/903 (r1378); r1379 clean boot (0x mme_esr=80000004, no WEDGE-RECOVER) float-vertex stores 4/906 50/970; guest 5447 frames in 12.1s = 448.994 FPS (fence-level only not pixels); GATE1 BLACK both boots: r1378/r1379 xwd 1280x720 nonblack 0 max 0; r1379 staging page-note va=0x4500000 pa=0x1035f1000 has 2517 nonzero bytes but content is a DESCRIPTOR TABLE (28cd1000 00000001 68cd1000 ffff8a74) not pixels; every retire 0/903 - A/B bisect inconclusive (flipped live but no new beef launches, client moved to software release; needs insmod arming) - next: arm wedge bisect at insmod on fresh boot (sema_gl_mme_keep_mask=0 sema_gl_mme_nop_drop=0xffffffffffffffff before client launches): clean => executed macros' emitted methods (0x2390/0x34a4 CB writes) park FE; still poisons => win_drop non-call families (SURF-PRELUDE/SHADER-EXC 0x1528/SPH-REGION/SA-REARM); then output retirement must move off 0/N before sema_screen_blit (src=drawable GPA dst_off=0x200000 pitch 5120) can present - SESSION 153 r1378-r1379
* vgsp: CONT-108 - sema_gl_mme_iram_gate_break (default 0) + ↵Arthur Hanson Rasmusson7 days
| | | | sema_gl_mme_iram_gate_build (default 1) independently control the two gsp_phys_gr_mme_iram_gate() readback sites (poll-break ~28019, pre-doorbell builder ~20300; comment records r1374 healthy->FULL chronology + CONT-107 probe-park note) - TASK-1 SUPERSEDED: 'LOAD0 stall at slot 58' EXPLAINED+DISMISSED: no call to slot 58 exists (all 8 3D-raw windows CALL_MME_MACRO runs hit only lanes {0,2,34,39,40,48,51,57}; 0x39d0 CALL_MME_MACRO(58) ZERO times; SA complete MME-PRE-SA[57] entry=0x364 / [58] entry=0x3a3); word-exact: slot 57 = mmeCodeOGL_C597_LOAD_CONSTANT_BUFFER_BUG2548370 (63 instrs 0x364..0x3a2), slot 58 = mmeCodeOGL_C597_LOAD_CONSTANT_BUFFER_OFFSET (2 instrs 0x3a3..0x3a4); Mesa sim: slot-57 with real params ends after last instr 5/5 consumed -> next fetch 0x364+63=0x3a3 = observed pc = POST-COMPLETION FETCH POINTER not stalled LOAD0; INFO_EX=0x4 = DATA_FIFO_SIZE constant not exception; A/B VERDICT r1376 break=0 build=1 still wedges at first calls-bearing launch; r1377 BOTH SITES OFF still wedges but RECOVERS (WEDGE-RECOVER priv-error poison seen grfifo=0x1 self-cleared) -> debug-port readback NOT the wedge cause, wedge is IN THE FIRST WINDOW REPLAY ITSELF; FIRST NONZERO STORES r1377 output retirement wait 2/901 pages changed 214ms settled + GUEST-WIT retire 4/908 changed va=0x4500000 pa=0x5ac146000 pre=0x3fb2ca25c057d17b post=0x0 engine-authored writes; MME executed r1376 pc=931 ir=71cc0301,18c0034a,1c34238f; r1377 never started (pc_valid=0, gate off => no live promotion); GATE1 black - next: bisect wedge-causing window content at first window+live launch (r1377 config no readbacks): A/B keep_mask=0 nop_drop=all (ALL call runs dropped) vs default; wedge gone => executed macros' emitted methods (0x2390/0x34a4 CB writes) park FE; persists => non-call families (SURF-PRELUDE/SHADER-EXC 0x1528/SPH-REGION/SA-REARM) then bisect win_drop families; follow-up readback-free live-promotion trigger (MME pc!=0 witness) - SESSION 153 r1375-r1377
* vgsp: CONT-107 - IRAM READBACK GATE THAT FIXES THE ZERO-IR FETCH: ↵Arthur Hanson Rasmusson7 days
| | | | gsp_phys_mme_iram_read3() spec-correct MME debug read per NV_PGRAPH_PRI_MME_DEBUG (ENABLE bit1 -> PC|RD-trigger bit2 -> poll DONE -> data in HWW_ESR_INFO4/3/2); gsp_phys_gr_mme_iram_gate() reads every covered SA entry compares to packed image auto-calibrates port address unit (resolved INSTRUCTION not word); gate at poll-break (before live-gen promotion) + builder (before releasing calls); on fail: hold calls clear prelude latch rewind pack/drain cursors; MME-LOAD-ONLY carriers (window elided while unverified so 0x114/0x118 IRAM load cannot be interrupted by window's DS/SPH poison); knobs sema_gl_mme_iram_gate/_max/_probe sema_gl_mme_hold_fe_idle - MILESTONE r1374: MME-IRAM-BASE resolved=instruction (entry) at entry=0x5; MME-IRAM-GATE pass break h=0xbeef0100 gen=3 base=1 checked=54 + pass build run=1,2,3; MME-LOAD-ONLY carrier window dropped until gate verifies; ILLEGAL_OPCODE = 0 OCCURRENCES (was every prior boot); live readback 4044d0=0x01B20006 (IRAM_PC=0x364) -> 0x40449c=31c28300 0x4044a8=1a05834a 0x4044ac=00000003 EXACTLY THE GOLDEN MACRO-57 GROUP; MME fetch latch mme_esr_info=100003a3(pcv=1 pc=931) ir=71cc0301,18c0034a,1c34238f MATCHING reconstructed image at 931; new wall: calls released yet beef launches park grfifo=07071602 (FIFO not-empty+FULL count 22) MME at pc=931 (slot 58 entry ENDNEXT waiting on LOAD0 INFO_EX=4); GATE1 black 0/900 - next: explain LOAD0 stall at slot 58 entry 0x3a3 (decode full released window call runs win_dec.py on MME-WINRUN dump: is slot 58 genuinely called or macro 57 falls through predicated ENDNEXT 0x3a0/0x3a1 not taken); if fall-through snapshot/seed MME STATE predicate reads; if real call feed params or stub slot 58 to proven stub PC; r1374 first boot where full program runs this deep - SESSION 153 r1369-r1374
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-08 23:18:15 +0000