From 692a7eb0c5d13a2f4b22c5bdad80b3749c6cf7ef Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Sun, 15 Nov 2026 13:14:57 -0500 Subject: vgsp: eng56 - rewrite the window's own slot-1 SPH bind to the authored VTG image, and harden the author window-head decode - gsp_phys_booter.c: after authoring the VTG SPH at family+0x900, scan the patched 3D window for its own 0x2054 slot-1 pair and rewrite an operand whose low 12 bits are 0x600/0x300 (client family VA or pair-cache shadow line) to |0x900. The window's own later pair otherwise overwrites the synthesized prelude j1 and the DS validates the client's SASS page (c743: DS-IMAGE st1=0b0b7208). New SPH-SLOT1-REWRITE / SPH-SLOT1 receipts. - gsp_phys_booter.c: reject an inline VTG candidate whose IMAP word (w6, offset 24) is zero; fall back to the builtin image. A 640 B w6=0 record authored a zero-map SPH and the DS went to the FECS/PRI sentinel (c749 fam 0x4350000: ds 80000000->badf1201). - gsp_sema_service.c: the DDX ring-head decode scans past zero-payload and unreadable entries within the 8-entry bound instead of stopping (c746: the ring head is a zero dummy and the C36F release sits later); it still never fabricates a payload. Validation: c749 is the first boot with DS-IMAGE st0=st1=020a0481 (code ff007321, the authored VSA/VSB image), a clean slot-1 rewrite (old=0x01e00300 new=0x01e00900), beef MME-PACK-REARM, and the DS latch reduced from 86040626 to 84000420; stores are still 0 and the DRAW_IAB macro is the next gap. --- kernel/gsp_sema_service.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) (limited to 'kernel/gsp_sema_service.c') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 4655e77..6cb7034 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -27987,7 +27987,7 @@ static void svc_ddx_head_decode(struct nv_vgpu_device *vgpu, ring_ap, ent, sizeof(ent))) { reason = "unreadable"; head_unreadable = true; - break; + continue; } memcpy(&e0, ent, 4); memcpy(&e1, ent + 4, 4); @@ -28017,17 +28017,20 @@ static void svc_ddx_head_decode(struct nv_vgpu_device *vgpu, if (svc_read_va_push(vgpu, ch, va, buf, len)) { reason = "unreadable"; head_unreadable = true; - break; + continue; } if (!memchr_inv(buf, 0, len)) { /* * The push read succeeded but answered an all-zero * page (a stale/zero translation): there is no - * release to decode and no value to apply. + * release to decode and no value to apply. c746: + * the ring head is a zero dummy entry and the real + * C36F release sits at a later slot, so scan past + * it (bounded) instead of stopping the pass. */ reason = "zero-payload"; head_unreadable = true; - break; + continue; } mark = svc_rel_count; /* -- cgit v1.2.3