vgsp: keep the synthesized SPH-BIND prelude intact by omitting the auto-dropped 0x22c run (eng50)

The SPH-BIND prelude emitted '0x22c <- 0x800', which is on
win_drop_auto_match's drop list: the patch pass removed exactly 2 words, so
kept=29/31, on==nfin failed and the WHOLE prelude was discarded on every beef
window -> VSA/TCS/GS unbound -> DS latch a2040a04 (stage[1] fetch VA
0x01df0300) -> DRAW_IAB (mac=0x22) never rasterized. Fix: omit the
auto-dropped run from the synthesized prelude (knob-consistent) + a WIN-DROP
diagnostic. Built (srcversion 2D8F375AB343FC73EA26286); end-to-end validation
blocked in-window (c704-6: draw-synth RT-guard refusal + WEDGE-REARM rc=-110
before SPH-BIND was reached).

1 files changed, 42 insertions, 3 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index bdcf25e..cf3107f 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -27891,6 +27891,24 @@ static u32 gsp_phys_rmcall_gr_3d_patch_window(const u32 *in, u32 n, u32 *out,
 		}
 		if (gsp_phys_rmcall_gr_win_drop_match(addr) ||
 		    gsp_phys_rmcall_gr_win_drop_auto_match(addr)) {
+			/*
+			 * eng50: this drop used to be silent, which made the
+			 * SPH-BIND guard failure (on != nfin) unattributable
+			 * - the synthesized prelude's own 0x22c run was
+			 * auto-dropped here and the whole prelude then
+			 * skipped (`SPH-BIND skipped (reloc=1/1 kept=29/31)`,
+			 * eng46). Name the dropped word so the next guard
+			 * failure is one grep away.
+			 */
+			static u32 wd_log;
+
+			if (wd_log < 24u) {
+				wd_log++;
+				pr_info("vgsp-gr: WIN-DROP in[%u]=%08x op=%u addr=%#x sub=%u cnt/val=%#x span=%u (win_drop/auto) h=0x%x\n",
+					off, hdr, op, addr, sub,
+					(cnt ? cnt : ((hdr >> 16) & 0x1fffu)),
+					span, req->h_object);
+			}
 			dropped++;
 			off += span;
 			continue;
@@ -30829,9 +30847,30 @@ gr_page_unmapped:
 			in[nfin++] = 0x20000000u | (1u << 16) |
 				     (0x310u >> 2);
 			in[nfin++] = 0x705u;
-			in[nfin++] = 0x20000000u | (1u << 16) |
-				     (0x22cu >> 2);
-			in[nfin++] = 0x800u;
+			/*
+			 * eng50: SET_GO_IDLE_TIMEOUT (0x22c) is on the
+			 * window patch pass's auto-drop list
+			 * (gsp_phys_rmcall_gr_win_drop_auto_match: 0x10c/
+			 * 0x1b0/0x5e0/0x1b00/0x22c). Emitting it here made
+			 * the prelude lose exactly those 2 words inside
+			 * gsp_phys_rmcall_gr_3d_patch_window, so
+			 * `on == nfin` failed and the WHOLE synthesized
+			 * SPH-BIND prelude was skipped (eng46 receipt:
+			 * `SPH-BIND skipped (reloc=1/1 kept=29/31)` on
+			 * every beef window). The stages then stayed
+			 * unbound and the DS latched the a2040a04 class
+			 * (VSA check2 | TCS 1/3 | GS check2) on the first
+			 * post-REARM draw, so the draw macro's emission
+			 * never rasterized (wrote=0, px0=0). Emit the
+			 * write only when the auto-drop is off (it is the
+			 * same init-only GO_IDLE config the drop comment
+			 * says the replay channel does not need).
+			 */
+			if (!READ_ONCE(gsp_phys_gr_win_drop_auto)) {
+				in[nfin++] = 0x20000000u | (1u << 16) |
+					     (0x22cu >> 2);
+				in[nfin++] = 0x800u;
+			}
 			in[nfin++] = 0x20000000u | (2u << 16) |
 				     (0x1128u >> 2);
 			in[nfin++] = 0xffffffffu;