From 22f77ffbf5ea2a3f6f678b825c7d296c16471175 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Thu, 5 Nov 2026 13:22:14 -0500 Subject: vgsp-gr: read the fixed CB from the engine-visible page and never deliver a header-only VS image The GL draw's VS was reading two wrong inputs. First, the fixed-CB copy resolved the client VA through a learned/FB layer first, so it read the emulated BAR1 vidmem shadow - a buffer the engine never writes - and delivered unrelated vidmem (r1490 first=09037223 00000004; r1482 oscillated between a float row, method words and zeros). Resolve the CB the way the engine does: channel VAS, every registered VAS page-table walk, then the GR relocation resolver; only a SYS answer is content-valid and an FB answer is flagged. The matrix gate now requires four normal-magnitude floats in c[0x0][0x80..0xbc] (r1492 accepted a method page as a matrix); a rejected read authors the identity MVP. Second, the captured 1536 B VTG upload is spliced at a page boundary: the delivered image was the SPH header plus ZERO SASS, so the VS executed no code. Reject captured program images whose SASS body [0x80,min(len,0x200)) is zero (the real-upload ring record, the 020a0481 cache and the window's own upload all pass the gate) and deliver the built-in known-good VTG image (the client's own SPH V4T1 020a0481 + SASS) at the bind VA instead; sema_gl_vs_img=0 restores the old behaviour. Diagnostics: cb-matrix/cb-const dumps of every VS-read constant block, SPH-ALIAS code4 words at the bind, and MME-VSTREAM post-relocation stream/limit/address payloads. r1491-r1493 (VP_MODE=6, RT0=1): the bind page now shows the real SASS (code4=ff047321 0000a0ff ...) and the CB/identity delivery is logged, but the draw still produces no fragments (retirement 0-3/900 = the forced MME seed pages only; xwd decoration rows only). Next wall: the vertex attribute/staging fetch (slot-57 0x39c8 data and the staging scratch 0x36/0x37), not the shader image or the fixed CB. --- kernel/gsp_phys_booter.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) (limited to 'kernel/gsp_phys_booter.c') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index d6ce2c2..494cb25 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -25510,7 +25510,9 @@ static void gsp_phys_gr_sph_alias_receipt(u64 page, u64 va, u64 sh, u64 hpa, { static u32 sph_alias_n; u32 w[8] = { 0 }; + u32 c[4] = { 0 }; u32 off = (u32)(va & (GSP_PHYS_PAGE_SIZE - 1u)); + u32 coff = off + 0x80u; /* SPH code starts 0x80 B into the image */ bool rd = false; if (sph_alias_n >= 48u) @@ -25522,11 +25524,18 @@ static void gsp_phys_gr_sph_alias_receipt(u64 page, u64 va, u64 sh, u64 hpa, for (i = 0; i < 8u; i++) w[i] = get_unaligned_le32(p + (size_t)i * 4u); + if (coff + sizeof(c) <= GSP_PHYS_PAGE_SIZE) { + const u8 *cp = (const u8 *)__va(hpa + coff); + + for (i = 0; i < 4u; i++) + c[i] = get_unaligned_le32(cp + (size_t)i * 4u); + } rd = true; } - pr_info("vgsp-gr: SPH-ALIAS-%s page=0x%llx va=0x%llx off=0x%x shadow=0x%llx hpa=0x%llx rd=%u w8=%08x %08x %08x %08x %08x %08x %08x %08x\n", + pr_info("vgsp-gr: SPH-ALIAS-%s page=0x%llx va=0x%llx off=0x%x shadow=0x%llx hpa=0x%llx rd=%u w8=%08x %08x %08x %08x %08x %08x %08x %08x code4=%08x %08x %08x %08x\n", via, page, va, off, sh, hpa, rd ? 1u : 0u, - w[0], w[1], w[2], w[3], w[4], w[5], w[6], w[7]); + w[0], w[1], w[2], w[3], w[4], w[5], w[6], w[7], + c[0], c[1], c[2], c[3]); } /* @@ -26877,6 +26886,25 @@ static u32 gsp_phys_rmcall_gr_3d_patch_window(const u32 *in, u32 n, u32 *out, addr, wi, wv, lo); } } + /* + * r1491: the VERTEX_STREAM macro + * (CALL_MME_MACRO(2)=0x3810) carries + * [stream, limit_hi, limit_lo, addr_hi, + * addr_lo]; log the post-relocation words so + * the VTG stream base the engine will program + * is provable from the log. Bounded. + */ + if (addr == 0x3810u && cnt >= 5u) { + static u32 vstream_log; + + if (vstream_log < 8u) { + vstream_log++; + pr_info("vgsp-gr: MME-VSTREAM h=0x%x stream=%u limit=%08x:%08x addr=%08x:%08x (post-reloc)\n", + req ? req->h_object : 0u, + d[0], d[1], d[2], + d[3], d[4]); + } + } } wout += span; off += 1u + cnt; -- cgit v1.2.3