From d61bf4e99e5119f7a6b8ee43e745fbbf4fd5c4ef Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Sun, 1 Nov 2026 21:42:00 -0500 Subject: vgsp: CONT-101 - sema-scratch18 watch (scan every decoded push on every channel for 0x3460 SET_MME_SHADOW_SCRATCH(0x18), log up to 24 hits, publish first value via gsp_sema_mme_scratch18_get) + sema_gl_mme_seed/seed_val/seed_xlat (emit [op1 cnt1 m=0x3460][value] ahead of every replayed 3D window; xlat translates value page through launch shadow mapper before >>8) - DECISIVE: client NEVER writes 0x3460 (0 hits across r1348-52 all channels); seed works end-to-end (MME-SEED scratch 0x18 <- 0x000a0000 va=0xa000000 xlat=1) but wall not cleared: MME-FAST trap=80002058 data=019b0900 grfifo 04041602->00000001 park events=2 - trap is window's own relocated program pair (pair addr=0x2054 va=0x4350900 -> 0x19b0900) and fires BEFORE MME consumes seed; DESIGNED FIX WORKS LIVE: sema_gl_prog_guest_va=Y -> PROG-GUEST-VA keep addr=0x2054 va=0x4400900 (Tier-1 identity; operand verbatim) -> ZERO trap=80002058 thereafter; r1352 (keep from boot) got session's FIRST MME-generated evidence (gen0=1) then lottery outcome events=4 (poison) esr->0xbadf1201 WEDGE-REARM engine still wedged; GATE1 black 0/900 pages NO-STORES - next: boot r1347 richest config (nop_drop=1<<0 slot 0 dropped) PLUS sema_gl_prog_guest_va=1 from insmod (removes 0x2058 trap class the seed cannot touch); check stores before re-arming slot 0 with seed; 0xd18 golden value open but subordinate (vGPU client never emits it) - SESSION 153 r1348-r1352 --- kernel/gsp_sema_service.h | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'kernel/gsp_sema_service.h') diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h index f2a40ee..7efc2f3 100644 --- a/kernel/gsp_sema_service.h +++ b/kernel/gsp_sema_service.h @@ -557,6 +557,16 @@ bool gsp_sema_gr_surf_recs(u64 *va, u32 *n); */ u64 gsp_sema_mme_sa_get(u32 *entries, u32 n); +/* + * SESSION 153-CONTINUED-101: the client's own SET_MME_SHADOW_SCRATCH(0x18) + * write (method 0x3460) - mmeCodeOGL_C597_SETUP_FIXED_CONST (slot 0) reads + * shadow scratch 0x18/0xd18 via STATE and emits it as the fixed-function + * constant-buffer selector (SET_CONSTANT_BUFFER_SELECTOR_B/C). Returns + * true (and stores the value exactly as pushed: fixed-CB address >> 8) + * once any decoded client push carried the write. false until then. + */ +bool gsp_sema_mme_scratch18_get(u32 *val); + /* * SESSION 153-CONTINUED-87: the SPH VERSION of the live program images * (sema_gl_vs/ps_hex blobs), so the GR launch builder emits a -- cgit v1.2.3