From 54a1711284abe23582eb0cd16dc9e53069c408e6 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Sun, 1 Nov 2026 08:34:51 -0500 Subject: vgsp: CONT-88 - real program payload delivery engine-visible: GSP_BRIDGE_INLINE_BYTES/SVC_GR_INLINE_BYTES/GSP_PHYS_GR_INLINE_BYTES 256->2048 (+static_asserts; svc_gl_flush prs[] static); svc_grce_dst_newest harvests window's REAL captured upload from svc_grce_dst_ring, svc_gl_flush attaches real 1536B@0x4350900 + 1408B@0x4350f00 (w0=0x020a0481) as inline records at own dst VAs (page-crossing split, tail page candidate); svc_grce_inline_write dual-writes engine-visible injected-pin page (svc_grce_land_write page-clamped); SPH-BIND also emits SET_PIPELINE_SHADER(2)<-0x21/(5)<-0x51 - delivery WORKS: real-upload record va=0x4350900 len=1536 first=020a0481 (engine-visible delivery), INLINE-APPLY guest=1, INLINE-RB rb=020a0481 pa=0x64cfd6000, page[7] va=0x4350000 hpa=0x64cfd6000 (r1283); wall survives real image (9/11 + ESR 0xa0000a00 +14ms; V4 window still 9/11); bind+type+real-image combo never seen on executing launch (lane wedges 1-3 launches); stores 0/900-901; next: healthy boot >=3 bind-carrying launches then harvest client init-push pipeline state (20010810 00000011 SET_PIPELINE_SHADER(1)<-0x11 + 0x204c pair) into SPH-BIND prelude - SESSION 153 r1282-r1286 --- kernel/gsp_phys_booter.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) (limited to 'kernel/gsp_phys_booter.c') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index 5c1941a..a28aec0 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -24485,7 +24485,7 @@ gr_page_unmapped: * from guest RAM (`20020825 [0,04400200]`, * `20020855 [0,04400000]`). */ - if (nfin + 6u <= 40u) { + if (nfin + 10u <= 40u) { in[nfin++] = 0x20000000u | (2u << 16) | (0x2094u >> 2); in[nfin++] = (u32)((fam + 0x200u) >> 32) & 0xffu; @@ -24494,6 +24494,33 @@ gr_page_unmapped: (0x2154u >> 2); in[nfin++] = (u32)(fam >> 32) & 0xffu; in[nfin++] = (u32)fam & 0xfffffffcu; + /* + * SESSION 153-CONTINUED-88: the per-slot + * SET_PIPELINE_SHADER(j) TYPE state. The + * client's init push writes it once per + * channel (init-push image: `20010810 + * 00000011` = SET_PIPELINE_SHADER(1) <- + * ENABLE|TYPE=VTG); the captured per-frame + * windows carry only the program-address + * pairs, so the replay context's stage + * registers for the synthesized binds would + * stay unset. Emit them for the two + * synthesized slots with the known types + * (j=2 TESS_CONTROL -> 2, j=5 PIXEL -> 5). + */ + in[nfin++] = 0x20000000u | (1u << 16) | + (0x2080u >> 2); + in[nfin++] = 1u | (2u << 4); + in[nfin++] = 0x20000000u | (1u << 16) | + (0x2140u >> 2); + in[nfin++] = 1u | (5u << 4); + /* + * nrun counts only the two ADDRESS-bearing + * binds above: the guard below matches it + * against the relocation pass's + * relocated-pair count, and the constant + * type runs can never be relocated. + */ nrun += 2; } orel = gsp_phys_rmcall_gr_3d_patch_window( -- cgit v1.2.3