vgsp-gl: receipt the draw's clip coverage and refuse non-MVP fixed-CB pages

r1512 adds one bounded GL-COVER receipt per replayed draw. It decodes the
window's index buffer (0x17c8/0x17d8 + size), the stream-0 stride (0x1c00)
and position offset (0x1160), resolves the CALL_MME_DATA (0x3810) stream
base, reads the referenced vertices and evaluates the clip-space position
in Q16.16 integer math with the exact c[0x0][0x80..0xbc] block the replay
delivers, printing per-vertex clip codes plus clip/NDC/screen bboxes and
the injected viewport scale/offset/clip. It also prints the fixed-CB
copy provenance and tries the client's own scratch18 page read-only.

Measured (r1512): real gear vertices (stride 24, position offset 0,
3.549 0.852 -0.5) but the delivered "matrix" was a rotation block
(row3 = 0.1268 0.9922 0 1), giving clip w ~= 1.1 instead of the camera
distance (~40) and 57/64 sampled vertices outside clip. The draw was
clipped by a non-projection constant block, not by zero/garbage VS output.

r1513/r1514 fix the source: the fixed-CB copy now prefers the client's
SET_MME_SHADOW_SCRATCH(0x18) page and the client-CB VAs its own writes
published (0x43e0000/0x4450000), requires a strict projection shape
(|row3.x|,|row3.y| < 0.02 and row3.z/w not both zero), and the resolver
no longer accepts an unresolved PA 0 page. Non-MVP pages (including the
old forced 0x0cd70000 page) can no longer become the seed; when no real
page is found the r1476 identity positive control is used.

r1513/r1514 receipts: the strict gate finds no readable client MVP page
on these boots (the client's fixed-CB content is not materialised in the
emulated memory), so the seed is the controlled identity and the identity
still clips gear radii > 1 (12 launches r1514, 20 poison, no fragments;
root xwd 2 nonblack pixels at (216,0)-(409,2) 0x77edc). Next wall: get
the client's fixed-CB contents into its own page (emulate the VPC/
LOAD_CONSTANT_BUFFER writes from the init push) so the VS receives a real
MVP.

Build: make -C kernel (green). Evidence: backups/evidence-20261002-victory/r1512..r1514.

1 files changed, 7 insertions, 0 deletions

diff --git a/kernel/gsp_phys_gpu.h b/kernel/gsp_phys_gpu.h
index b8d92cd..6e16062 100644
--- a/kernel/gsp_phys_gpu.h
+++ b/kernel/gsp_phys_gpu.h
@@ -348,6 +348,13 @@ int gsp_phys_rmcall_gr_shadow_win0_value(void);
  */
 bool gsp_phys_rmcall_gr_sph_bind_value(void);
 
+/*
+ * r1512: the viewport state the 3D replay injects for the current launch
+ * (sema_gl_vp_prelude mode + its literal words). Read-only; used by the
+ * sema service's draw-coverage receipt.
+ */
+void gsp_phys_gr_vp_state_get(int *mode, u32 *words, u32 *n);
+
 /* m91: keep the forwarded QMD pointer pairs at the guest VAs (default 0). */
 int gsp_phys_rmcall_gr_ptr_guest_value(void);