vgsp-gr: deliver the real GL shader images and the client fixed constant buffer to the engine-visible pages

- inline-apply writes the image into the guest HPA whenever the page is kept
  at the guest VA (code_keep_guest), not only for stream3d windows; a shadow
  copy is useless when the engine fetches the guest page (r1470: guest=0 VS
  then lost to the window-0 shadow copy).
- the standalone 0x180/0x1b0 context-init upload pair (outside any C597
  section) is also recorded in the GRCE destination ring, so a later draw
  window can find the client's real VTG image at its bind VA.
- sema_gl_cb_copy_to / sema_gl_cb_src_va: copy the client fixed-CB page into
  the forced, mapped MME seed page before the launch, so the vertex shader
  reads the client's transform constants instead of screen/stale data. Falls
  back to a synthetic identity MVP when the client VA cannot be walked.
- cache any push chunk whose first word is a real SPH (020a0481 VTG /
  000a1482 PS) and use it as the program-record fallback when the window's
  own bind-VA upload was never captured (the init push's continuation chunks
  are otherwise judged implausible and never reach the ring).
- r1481/r1482: the real VS SPH+code and PS are applied guest=1 at the bind
  VA, the client CB page resolves and is copied, poison=0 over 9-10 launches;
  render-target writes still zero - the remaining wall is the draw's
  render-target/colour-target binding (the beef window's output retirement
  set is 10 pages of shader-like data, not the 900-page screen surface).

1 files changed, 18 insertions, 4 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 62ab6eb..33e1b35 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -27933,7 +27933,21 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 				 * into the guest page too, emulating the
 				 * upload that never executed.
 				 */
-				if (stream3d && pg->hpa)
+				/*
+				 * SESSION 154: a program page whose CODESRC
+				 * verdict keeps it at the guest VA is read by
+				 * the engine directly (code_keep_guest sets
+				 * mapped without a QMD rewrite). The inline
+				 * image MUST land in the guest HPA there even
+				 * when the window was not classified
+				 * stream3d: the shadow copy is then unused and
+				 * the engine fetches the empty guest page.
+				 * r1470: the complete 0x41c0000 window's VS
+				 * applied guest=0 into the shadow while the
+				 * guest page stayed zero (the win0 shadow copy
+				 * then restored the zero page as well).
+				 */
+				if ((stream3d || code_keep_guest) && pg->hpa)
 					memcpy((u8 *)__va(pg->hpa) +
 						       (inl->dst_va &
 							(GSP_PHYS_PAGE_SIZE - 1)),
@@ -27951,8 +27965,8 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 						inl_apply_log++;
 						pr_info("vgsp-gr: INLINE-APPLY dst=0x%llx len=%u pg_va=0x%llx guest=%u first=%08x %08x\n",
 							inl->dst_va, len, pg_va,
-							stream3d && pg->hpa ?
-								1u : 0u,
+							(stream3d || code_keep_guest) &&
+								pg->hpa ? 1u : 0u,
 							len >= 4 ? get_unaligned_le32(inl->data) : 0u,
 							len >= 8 ? get_unaligned_le32(inl->data + 4) : 0u);
 					}
@@ -27967,7 +27981,7 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 				 * still rejects the header, the bytes are known
 				 * present at the VA it fetched.
 				 */
-				if (stream3d && pg->hpa) {
+				if ((stream3d || code_keep_guest) && pg->hpa) {
 					static u32 inl_rb_log;
 					const u32 *gw = (const u32 *)
 						((u8 *)__va(pg->hpa) +