From a3d801e394a1c57833c816edc3d3cee22dc4a78a Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Thu, 5 Nov 2026 11:24:16 -0500 Subject: vgsp-gr: hold calls on a stream-damaged push so a dropped chunk cannot run LOAD_CONSTANT_BUFFER without its selector state A chunked GL draw whose earlier chunk was dropped (prelude LOAD-ONLY or the r1447 arming window hold) replayed the remaining chunks' calls alone; the constant-buffer selector (0x2380) lived in the dropped chunk, so the bug2548370 macro's LOAD_CONSTANT_BUFFER(0x2390) class-errored (ErrorCode 3) and the engine poisoned (badf1201 sentinel: pc=513/mac=0xf1 are its artifact, not a macro). Propagate the stream-relative chunk offset through the candidate and submit path, keep a per-push STREAM-DAMAGE record of the lowest dropped chunk, emit later chunks calls-held (the proven-safe shape), never arm the arming window-hold on a damaged stream, and start a fresh section at stream_rel==0. r1487: the exact r1485 damaging shape now retires clean (events=5, no poison) and the next chunk is captured; r1486 (holds off) still poisons because the first launch runs against a partially packed prelude, confirming the dropped chunk is the cause, not the hold release. --- kernel/gsp_phys_booter.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'kernel/gsp_phys_booter.h') diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h index 6689771..f821a85 100644 --- a/kernel/gsp_phys_booter.h +++ b/kernel/gsp_phys_booter.h @@ -495,6 +495,15 @@ struct gsp_phys_gr_submit { */ const u32 *stream; u32 stream_n; /* dwords */ + /* Stream-relative dword offset of this window inside the client's + * 3D section (0 = the section's first chunk). Used to detect that an + * earlier chunk of the same push was dropped by a LOAD-ONLY carrier + * or the r1447 window hold: the remaining chunks must then elide + * their CALL runs (the lost chunk's state - e.g. the constant-buffer + * selector - is no longer on the channel, so a macro that emits + * LOAD_CONSTANT_BUFFER would class-error -> FECS priv-error poison). + */ + u32 stream_rel; /* * SESSION 153-CONTINUED-87: the first program VA the captured * window binds (SET_PIPELINE_PROGRAM_ADDRESS pair; 0 when none). -- cgit v1.2.3