vgsp-gr: read the fixed CB from the engine-visible page and never deliver a header-only VS image

The GL draw's VS was reading two wrong inputs. First, the fixed-CB copy
resolved the client VA through a learned/FB layer first, so it read the
emulated BAR1 vidmem shadow - a buffer the engine never writes - and
delivered unrelated vidmem (r1490 first=09037223 00000004; r1482
oscillated between a float row, method words and zeros). Resolve the CB
the way the engine does: channel VAS, every registered VAS page-table
walk, then the GR relocation resolver; only a SYS answer is content-valid
and an FB answer is flagged. The matrix gate now requires four
normal-magnitude floats in c[0x0][0x80..0xbc] (r1492 accepted a method
page as a matrix); a rejected read authors the identity MVP.

Second, the captured 1536 B VTG upload is spliced at a page boundary: the
delivered image was the SPH header plus ZERO SASS, so the VS executed no
code. Reject captured program images whose SASS body [0x80,min(len,0x200))
is zero (the real-upload ring record, the 020a0481 cache and the window's
own upload all pass the gate) and deliver the built-in known-good VTG
image (the client's own SPH V4T1 020a0481 + SASS) at the bind VA instead;
sema_gl_vs_img=0 restores the old behaviour.

Diagnostics: cb-matrix/cb-const dumps of every VS-read constant block,
SPH-ALIAS code4 words at the bind, and MME-VSTREAM post-relocation
stream/limit/address payloads.

r1491-r1493 (VP_MODE=6, RT0=1): the bind page now shows the real SASS
(code4=ff047321 0000a0ff ...) and the CB/identity delivery is logged, but
the draw still produces no fragments (retirement 0-3/900 = the forced MME
seed pages only; xwd decoration rows only). Next wall: the vertex
attribute/staging fetch (slot-57 0x39c8 data and the staging scratch
0x36/0x37), not the shader image or the fixed CB.

1 files changed, 30 insertions, 2 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index d6ce2c2..494cb25 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -25510,7 +25510,9 @@ static void gsp_phys_gr_sph_alias_receipt(u64 page, u64 va, u64 sh, u64 hpa,
 {
 	static u32 sph_alias_n;
 	u32 w[8] = { 0 };
+	u32 c[4] = { 0 };
 	u32 off = (u32)(va & (GSP_PHYS_PAGE_SIZE - 1u));
+	u32 coff = off + 0x80u;	/* SPH code starts 0x80 B into the image */
 	bool rd = false;
 
 	if (sph_alias_n >= 48u)
@@ -25522,11 +25524,18 @@ static void gsp_phys_gr_sph_alias_receipt(u64 page, u64 va, u64 sh, u64 hpa,
 
 		for (i = 0; i < 8u; i++)
 			w[i] = get_unaligned_le32(p + (size_t)i * 4u);
+		if (coff + sizeof(c) <= GSP_PHYS_PAGE_SIZE) {
+			const u8 *cp = (const u8 *)__va(hpa + coff);
+
+			for (i = 0; i < 4u; i++)
+				c[i] = get_unaligned_le32(cp + (size_t)i * 4u);
+		}
 		rd = true;
 	}
-	pr_info("vgsp-gr: SPH-ALIAS-%s page=0x%llx va=0x%llx off=0x%x shadow=0x%llx hpa=0x%llx rd=%u w8=%08x %08x %08x %08x %08x %08x %08x %08x\n",
+	pr_info("vgsp-gr: SPH-ALIAS-%s page=0x%llx va=0x%llx off=0x%x shadow=0x%llx hpa=0x%llx rd=%u w8=%08x %08x %08x %08x %08x %08x %08x %08x code4=%08x %08x %08x %08x\n",
 		via, page, va, off, sh, hpa, rd ? 1u : 0u,
-		w[0], w[1], w[2], w[3], w[4], w[5], w[6], w[7]);
+		w[0], w[1], w[2], w[3], w[4], w[5], w[6], w[7],
+		c[0], c[1], c[2], c[3]);
 }
 
 /*
@@ -26877,6 +26886,25 @@ static u32 gsp_phys_rmcall_gr_3d_patch_window(const u32 *in, u32 n, u32 *out,
 							addr, wi, wv, lo);
 					}
 				}
+				/*
+				 * r1491: the VERTEX_STREAM macro
+				 * (CALL_MME_MACRO(2)=0x3810) carries
+				 * [stream, limit_hi, limit_lo, addr_hi,
+				 * addr_lo]; log the post-relocation words so
+				 * the VTG stream base the engine will program
+				 * is provable from the log. Bounded.
+				 */
+				if (addr == 0x3810u && cnt >= 5u) {
+					static u32 vstream_log;
+
+					if (vstream_log < 8u) {
+						vstream_log++;
+						pr_info("vgsp-gr: MME-VSTREAM h=0x%x stream=%u limit=%08x:%08x addr=%08x:%08x (post-reloc)\n",
+							req ? req->h_object : 0u,
+							d[0], d[1], d[2],
+							d[3], d[4]);
+					}
+				}
 			}
 			wout += span;
 			off += 1u + cnt;