vgsp-gr: capture the full 4K-word GL draw window, emit SET_SHADER_EXCEPTIONS as immd13, and base the SPH region on the bound program's shadow page

- SVC_GR_PUSH_WORDS / GSP_PHYS_GR_RAW_WORDS raised 2048 -> 4096: the beef
  full-frame push is 12288 B / 3072 words, so the 2048-word capture tail
  failed the 3D mark (raw_ok=0 fit_ok=0) and the launch fell back to a
  239-word stub, losing the real 2115-word draw. Now '3D stream chunked
  window=1429 words -> 4 chunk(s)'.
- SET_SHADER_EXCEPTIONS (0x1528) is emitted as the client's immd13
  (0x8000054a) and skipped when the window already carries it; the
  remaining 0x1528 in the log is the client's own benign write.
- sema_gl_sph_region_bind (default 1): the SPH region base is the first
  bound program's relocated shadow page, not the forced 0x1500000 pool
  base; r1484 latched the fetched SPHs (0,019a0f00,019a0200,0,0,019a0000)
  with ds=86040646 (region mismatch), r1485 uses base 0x19b0000 bind
  0x19b0900 and the DS accepts (ds=80000000).
- r1484/r1485: the screen now shows gear-class pixels (xwd bbox spanning
  the 800x600 window, multicolor); GUEST-WIT shows RT0 page 0 written. The
  remaining wall is the MME draw macro 0xf1 / pc 513 poison on the first
  calls+window launch after the arming hold is released.

1 files changed, 14 insertions, 2 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 18d5e78..327a932 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -7420,8 +7420,20 @@ static struct svc_fwd_cand svc_fwd_cand;
  * (CONT-44: zero src=stream captures on the client channel). The window
  * slice still has to fit the backend's method block; only the raw[]
  * retention is widened here.
- */
-#define SVC_GR_PUSH_WORDS	2048
+ *
+ * SESSION 154-1: 2048 -> 4096 dwords (16 KB). The direct client's
+ * occasional full-frame push is 12288 B (3072 dwords; r1483
+ * `section open (draw) push=0x4310110 len=12288`, window 2115 words at
+ * off 0xef4). With the 2048-word tail the window start fell before the
+ * retained tail, `len == push_n*4` failed and the whole capture was
+ * dropped: `3D mark failed ... raw_ok=0 fit_ok=0 (rawlen=3072
+ * pushn=2048 len=12288)`. The launch then replayed the previous
+ * window's fallback words and the client's real draw never reached the
+ * engine. 4096 words carries the whole 12288-B push so the existing
+ * method-aligned svc_gl_stream_chunks() split (<=448-word chunks, six
+ * per frame) can run. Must stay equal to GSP_PHYS_GR_RAW_WORDS.
+ */
+#define SVC_GR_PUSH_WORDS	4096
 #define SVC_GR_QMD_WORD_NONE	0xffffffffu
 /* svc_gr_cand.rel_flags bits (decoded from qmd[24] and qmd[4]). */
 #define SVC_GR_REL_REDUCTION	0x1u