From 17c7ed7cb1cbf2dad6f544b554808f188468980f Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Sat, 14 Nov 2026 07:31:03 -0500 Subject: vgsp: relocate a CODESRC-SUSPECT GR program page to the engine-mapped window-0 shadow instead of leaving the QMD pointer at an unmapped guest VA (eng33) The client's MME-expanded draw builds a QMD whose program page (qmd[48]) classifies CODESRC-SUSPECT (empty-page): the engine's GPCCLIENT_GCC I-fetch then read the guest VA above every engine-PDB window, raised FAULT_PDE and the FIFO parked for the rest of the boot (the TSG re-arm cannot revive a parked PBDMA). c361-c368 receipts. With gsp_phys_gr_codesrc_reloc=1 (default) the builder copies the page into the window-0 shadow (empty sources only; PTE/module pages are never republished), overlays the client's own known-good SPH+SASS stage image at the original QMD program offset (gsp_sema_gl_prog_img, stage-typed from the section bind; truncated at a 128-bit boundary with a terminal EXIT when the image is larger than the remaining page), and the existing QMD w48/49 + prefetch rewrite publishes the shadow VA. If the shadow mapping cannot be installed the page stays unmapped and the existing refusal drops the launch, so an unmapped QMD program pointer is never published. 0 restores the old guest-VA behaviour for a one-flip A/B. Validation (c373, params-r1624): 31 CODESRC-RELOC events (img_len=384, off=0xb00, 0 truncations), 51 GR LAUNCH submitted, 11 MME-FAST end events=3, 79 FETCH-WIT with GP_GET advancing engine-fetched, 0 FAULT_PDE, 0 vgsp-fault, 0 WEDGE-REARM/PARK-RECOVER; work_gr backend_ok=35 fault=0. The draws still write nothing (NOWRITE, no clear run in the emitted window), so px0 stays 0 - the store wall is unchanged and is the next target. --- kernel/gsp_sema_service.h | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'kernel/gsp_sema_service.h') diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h index 6f07209..b40dad2 100644 --- a/kernel/gsp_sema_service.h +++ b/kernel/gsp_sema_service.h @@ -675,6 +675,14 @@ bool gsp_sema_mme_scratch25_get(u32 *val); */ int gsp_sema_gl_sph_blob_version(void); +/* + * r1625: the engine-visible known-good SPH+SASS image for a refused + * program page (GR CODESRC-SUSPECT relocation). Stage-typed from the + * section's own pipeline bind, falling back to the PIXEL image; NULL + * when no image is loaded. *len_out receives the byte count. + */ +const u8 *gsp_sema_gl_prog_img(u64 va, u32 *len_out); + /* * SESSION 153-CONTINUED-68: furthest IR instruction covered by the CAPTURED * 0x114 uploads (pc + ceil(code words / 3)). The GR launch builder places -- cgit v1.2.3