vgsp: relocate a CODESRC-SUSPECT GR program page to the engine-mapped window-0 shadow instead of leaving the QMD pointer at an unmapped guest VA (eng33)

The client's MME-expanded draw builds a QMD whose program page (qmd[48])
classifies CODESRC-SUSPECT (empty-page): the engine's GPCCLIENT_GCC I-fetch
then read the guest VA above every engine-PDB window, raised FAULT_PDE and
the FIFO parked for the rest of the boot (the TSG re-arm cannot revive a
parked PBDMA). c361-c368 receipts.

With gsp_phys_gr_codesrc_reloc=1 (default) the builder copies the page into
the window-0 shadow (empty sources only; PTE/module pages are never
republished), overlays the client's own known-good SPH+SASS stage image at
the original QMD program offset (gsp_sema_gl_prog_img, stage-typed from the
section bind; truncated at a 128-bit boundary with a terminal EXIT when the
image is larger than the remaining page), and the existing QMD w48/49 +
prefetch rewrite publishes the shadow VA. If the shadow mapping cannot be
installed the page stays unmapped and the existing refusal drops the launch,
so an unmapped QMD program pointer is never published. 0 restores the old
guest-VA behaviour for a one-flip A/B.

Validation (c373, params-r1624): 31 CODESRC-RELOC events (img_len=384,
off=0xb00, 0 truncations), 51 GR LAUNCH submitted, 11 MME-FAST end
events=3, 79 FETCH-WIT with GP_GET advancing engine-fetched, 0 FAULT_PDE,
0 vgsp-fault, 0 WEDGE-REARM/PARK-RECOVER; work_gr backend_ok=35 fault=0.
The draws still write nothing (NOWRITE, no clear run in the emitted
window), so px0 stays 0 - the store wall is unchanged and is the next
target.

1 files changed, 8 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index 6f07209..b40dad2 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -676,6 +676,14 @@ bool gsp_sema_mme_scratch25_get(u32 *val);
 int gsp_sema_gl_sph_blob_version(void);
 
 /*
+ * r1625: the engine-visible known-good SPH+SASS image for a refused
+ * program page (GR CODESRC-SUSPECT relocation). Stage-typed from the
+ * section's own pipeline bind, falling back to the PIXEL image; NULL
+ * when no image is loaded. *len_out receives the byte count.
+ */
+const u8 *gsp_sema_gl_prog_img(u64 va, u32 *len_out);
+
+/*
  * SESSION 153-CONTINUED-68: furthest IR instruction covered by the CAPTURED
  * 0x114 uploads (pc + ceil(code words / 3)). The GR launch builder places
  * its end-noop macro stub at this address (aligned past the replayed