vgsp-gl: deliver the fixed CB to the engine-visible seed page directly

The r1515/r1520 decode assembles the client's real fixed-CB image, but
svc_gl_cb_copy()'s write to the forced seed VA (0x120700000) is refused by
the r1506 authoring-VAS rule: the seed page belongs to the X server's VAS,
so the beef channel write only updated the VA shadow while the engine kept
reading the black screen page at pa 0x500000 (r1521 seed dump: the image
never arrived; the engine fetched the RT clear).

The seed is a service-forced engine input, not a client write, so resolve
its VA through the VAS/walk/trusted chain and write the backing shadow/FB
page directly with svc_write_ap(), bypassing the ownership rule. A bounded
CB-SEED receipt reports the destination PA, aperture and the m80 words.

Validated in r1522: the seed backing store at dpa 0x500000 holds the
assembled image (m80 = the client's projection, e.g. 40a00000/40d55555/
bf9745d1/4211745c/bf800000/42200000) and cb-copy uses
src=const-upload (ssrc=15).

0 files changed, 0 insertions, 0 deletions