From 4e65e2e28ee595e9210992752201a0c9c0143ba3 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Thu, 5 Nov 2026 09:36:43 -0500 Subject: vgsp-gr: deliver the real GL shader images and the client fixed constant buffer to the engine-visible pages - inline-apply writes the image into the guest HPA whenever the page is kept at the guest VA (code_keep_guest), not only for stream3d windows; a shadow copy is useless when the engine fetches the guest page (r1470: guest=0 VS then lost to the window-0 shadow copy). - the standalone 0x180/0x1b0 context-init upload pair (outside any C597 section) is also recorded in the GRCE destination ring, so a later draw window can find the client's real VTG image at its bind VA. - sema_gl_cb_copy_to / sema_gl_cb_src_va: copy the client fixed-CB page into the forced, mapped MME seed page before the launch, so the vertex shader reads the client's transform constants instead of screen/stale data. Falls back to a synthetic identity MVP when the client VA cannot be walked. - cache any push chunk whose first word is a real SPH (020a0481 VTG / 000a1482 PS) and use it as the program-record fallback when the window's own bind-VA upload was never captured (the init push's continuation chunks are otherwise judged implausible and never reach the ring). - r1481/r1482: the real VS SPH+code and PS are applied guest=1 at the bind VA, the client CB page resolves and is copied, poison=0 over 9-10 launches; render-target writes still zero - the remaining wall is the draw's render-target/colour-target binding (the beef window's output retirement set is 10 pages of shader-like data, not the 900-page screen surface). --- kernel/gsp_phys_booter.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) (limited to 'kernel/gsp_phys_booter.c') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index 62ab6eb..33e1b35 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -27933,7 +27933,21 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, * into the guest page too, emulating the * upload that never executed. */ - if (stream3d && pg->hpa) + /* + * SESSION 154: a program page whose CODESRC + * verdict keeps it at the guest VA is read by + * the engine directly (code_keep_guest sets + * mapped without a QMD rewrite). The inline + * image MUST land in the guest HPA there even + * when the window was not classified + * stream3d: the shadow copy is then unused and + * the engine fetches the empty guest page. + * r1470: the complete 0x41c0000 window's VS + * applied guest=0 into the shadow while the + * guest page stayed zero (the win0 shadow copy + * then restored the zero page as well). + */ + if ((stream3d || code_keep_guest) && pg->hpa) memcpy((u8 *)__va(pg->hpa) + (inl->dst_va & (GSP_PHYS_PAGE_SIZE - 1)), @@ -27951,8 +27965,8 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, inl_apply_log++; pr_info("vgsp-gr: INLINE-APPLY dst=0x%llx len=%u pg_va=0x%llx guest=%u first=%08x %08x\n", inl->dst_va, len, pg_va, - stream3d && pg->hpa ? - 1u : 0u, + (stream3d || code_keep_guest) && + pg->hpa ? 1u : 0u, len >= 4 ? get_unaligned_le32(inl->data) : 0u, len >= 8 ? get_unaligned_le32(inl->data + 4) : 0u); } @@ -27967,7 +27981,7 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req, * still rejects the header, the bytes are known * present at the VA it fetched. */ - if (stream3d && pg->hpa) { + if ((stream3d || code_keep_guest) && pg->hpa) { static u32 inl_rb_log; const u32 *gw = (const u32 *) ((u8 *)__va(pg->hpa) + -- cgit v1.2.3