vgsp: aperture-aware foreign USERD guard and wire fallback

c24 (V30) skipped the X/GLX channel's own sysmem USERD block because the
same numeric PA 0x8f0000 is owned by the RC watchdog channel in vidmem;
the X server then failed with 'Failed to initialize DMA' and 'Failed to
allocate push buffer'.  Compare the aperture as well as the page, and keep
base 0 + userdOffset as a fallback when the client memory-object table
cannot name the USERD (the resolver still wins when it has a verified
object).  This restores the c23 X bring-up while keeping the fail-closed
table path.

Validation pending a fresh V31 cycle: X starts, glxinfo/glxgears, chan_dump
userd page/aper, and the USERD resolution/fallback witness lines.

1 files changed, 20 insertions, 0 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index 9ba17c8..4420810 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -3793,6 +3793,8 @@ static void gsp_rm_register_channel(struct gsp_emu_context *ctx, u32 h_client,
 		 * USERD zero (the service must never write a guessed block).
 		 */
 		if (userd_wire_base == 0) {
+			u64 wire_pa = desc.userd_pa;
+			u32 wire_as = desc.userd_as;
 			u32 h_userd = 0;
 
 			desc.userd_pa = 0;
@@ -3813,6 +3815,24 @@ static void gsp_rm_register_channel(struct gsp_emu_context *ctx, u32 h_client,
 								     h_userd,
 								     uo);
 			}
+			/*
+			 * CONT.438b: the X/GLX kernel channel needs its
+			 * wire-derived block until the client memory-object
+			 * table can name the real USERD.  c24 (V30) cleared
+			 * it and X failed "Failed to initialize DMA"/
+			 * "Failed to allocate push buffer"; c23 (V28) used
+			 * base 0 + userdOffset and X started.  Keep the old
+			 * value as a fallback, but only when it is a real
+			 * 4K-backed offset (the resolver still wins when it
+			 * has a verified memory object).
+			 */
+			if (!desc.userd_pa && wire_pa) {
+				desc.userd_pa = wire_pa;
+				desc.userd_as = wire_as;
+				pr_info_ratelimited("vgsp-rm: chan USERD hObject=0x%x hUserd=0x%x unresolved; fallback to wire base+offset=0x%llx as=%u (no guessed table PA)\n",
+						    h_object, h_userd,
+						    wire_pa, wire_as);
+			}
 		}
 	}
 	memcpy(&desc.notifier_pa, params + GSPRM_CHAN_NOTIFIER_MEM, 8);