From b7f09612e48484df9e93ff5213a44ecaa572714e Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 13 Nov 2026 15:38:29 -0500 Subject: vgsp: rescue the direct-GL draw-state pushes from the LOW fb band, admit them to the 3D replay lane, and let the forced golden MME overlay satisfy the prelude maturity gate (eng28) The direct-GL client's draw-state pushes (476/624/728/324 B; invariant lead 90110087 = IMMD NVC597_INVALIDATE_SHADER_CACHES 0x21C<-0x1011) are intermittently unreadable while byte-identical copies park in the LOW framebuffer; the copies do not share the VA's in-page offset, so the page-stepped rescue scan could never land on them. Add a word-granular LOW-band sweep gated on the two recognisable push images (state lead via the method-stream window gate; 256-B VTG SPH upload by exact signature) and pin hits exactly like the existing rescue. The same pushes carry the frame's real state (SET_COLOR_CLEAR_VALUE 0xD80, NVC597_CLEAR_SURFACE 0x19D0, MME macro calls, vertex state) but no BEGIN/RT opener, so they never opened a C597 section and the state stream never reached the replay lane; admit the 0x21C lead as an opener on beef channels and exempt state-led windows from the eng25 colour-target guard (the guard's data-blob rejects continue unchanged - only the invariant state lead passes). Where the client's 0x114 IRAM upload is not captured (code words stay <= 4 on every boot observed), the forced golden overlay (sema_gl_mme_golden + _force; golden-only, fail-closed) can serve every called macro slot; add gsp_phys_gr_golden_ready() and skip the IMMATURE-SKIP software completion while it holds (see the golden-slot/pack machinery). Live (c348/c350/c351, r1624 params): the LOW-band rescue fired (VTG SPH 256-B push -> fb 0x2010200, pinned); the 324-B state push opened a section, captured (recs=4 nprog=1) and was marked for the verbatim 3D lane; with the bypass the lane submitted it to the engine for the first time (GR LAUNCH submitted + GUEST GR LAUNCH OK, MME-PRELUDE pack 1701 IR words, MME-GOLDEN slot 0 accepted). The emitted 51-word window still omits the 0xD80/0x19D0 clear runs (marked window 81), so pixel stores remain 0 and frames black; receipts under /tmp/opencode/eng28-*. Refs: CONT.490. --- kernel/gsp_phys_gpu.h | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'kernel/gsp_phys_gpu.h') diff --git a/kernel/gsp_phys_gpu.h b/kernel/gsp_phys_gpu.h index d84b080..d2faa1e 100644 --- a/kernel/gsp_phys_gpu.h +++ b/kernel/gsp_phys_gpu.h @@ -349,6 +349,16 @@ int gsp_phys_rmcall_gr_shadow_win0_value(void); bool gsp_phys_rmcall_gr_sph_bind_value(void); u32 gsp_phys_rmcall_gr_sph_bind_mask_value(void); +/* + * eng28 (CONT.490): the golden MME overlay is forced (sema_gl_mme_golden + + * sema_gl_mme_golden_force), so every called macro slot is served from the + * driver-emitted golden program (golden-only, fail-closed) and the client's + * captured 0x114 upload is not a prerequisite for a safe launch. The + * service's immature-skip gate consults this so beef draw-state windows are + * not software-completed while the golden program can serve them. + */ +bool gsp_phys_gr_golden_ready(void); + /* * SESSION 155 CONT 11: bind a synthesized header-only GEOMETRY SPH to * stage 4 with ENABLE=0 (sema_gl_sph_gs_img, default 0). The sema service -- cgit v1.2.3