vgsp-gr: deliver empty FB fetch pages from real FBMEM, discover the CB per boot, clear the DS latch after each window

The active indexed draw's vertex/index buffers resolve through the client's
page tables to vidmem pages whose emulated BAR1 shadow is empty (no emulated
upload path ever populated it), so the engine fetched zeros and the draw
stored nothing. Three delivery paths now cover the page: a real-FB VID leaf
for launch fetch pages (QMD pointers, never the data-fill surface) and for
vertex streams when every shadow byte is zero; a sysmem-backing copy when the
same VA also has a nonzero SYS mapping; otherwise the existing shadow page is
used untouched. Render-target pages keep their shadow identity so the copy-out
can still ship stores back to the guest.

The fixed constant buffer is discovered per boot: the captured
SET_MME_SHADOW_SCRATCH(0x18) value is authoritative, the historically observed
base is a gated fallback, and a resolved real page is remembered for later
misses. The DS HWW ESR latch is now also cleared (W1C) after each replayed
window, so a failed window cannot poison the next window's entry state.

Validated with three supervised cycles (r1497-r1499): the active streams read
the client's real vertex floats, the real MVP resolves, poison stays at 0-1
per run, and the engine clears the render target to opaque black
(dump_vidmem 0x200000 = ff000000) with the guest window still all black -
the remaining wall is geometry coverage, not data delivery.

1 files changed, 10 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index f63b9fa..ff3d088 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -474,6 +474,16 @@ struct gsp_sema_gr_reloc {
 };
 
 int gsp_sema_gr_reloc_resolve(u64 va, struct gsp_sema_gr_reloc *out);
+/*
+ * r1497: when a fetch VA resolves to an FB page whose emulated shadow is
+ * empty, copy the same VA's sysmem backing (found by walking every
+ * registered VAS) into that page. gsp_sema_gr_fetch_sys_into() takes the
+ * already-resolved FB PA; gsp_sema_gr_fetch_backing() resolves the VA the
+ * way the relocation chain does and is the booter's entry point. Both
+ * return true only when bytes were delivered.
+ */
+bool gsp_sema_gr_fetch_sys_into(u64 va, u64 fb_pa, u64 *gpa_out);
+bool gsp_sema_gr_fetch_backing(u64 va);
 
 /*
  * SESSION 153-CONTINUED-59: record one VA (page-aligned internally) in the