vgsp-gl: sweep the beef ring head for the client's init uploads and quarantine the screen/code-heap overlap

The GL client's one-shot LOAD_INLINE_DATA uploads (code images, vertex
and index buffers) sit at the head of its GPFIFO ring, but the first
observed GP_PUT can already be far past them (r1508: put=8982), so the
continuation sweep never decoded them and the FB fetch pages stayed
zero. Sweep the head once per beef channel in inline-only mode with the
read-arbitrated, tail-aware decoder: r1509 receipts show
'sema-utilsweep swept=64 writes=16' and
'inline write dst=0x44ff000 -> pa=0xb9f000 bytes=1550
data8=9a996940...', after which sema_probe reads the client's real
vertex floats and the u16 index stream at 0xb9d410/0xb9fcc8.

The guest's shader/code-heap BAR1 upload can also land on the captured
X screen's pages (r1508/r1510: vidmem 0x200000 held a program image
while the X screen VA 0x120400000 maps there). Snapshot the captured
surface at bind time; before a launch whose surface page 0 carries the
code-heap/SPH signature, restore the surface from that snapshot (a
black X-clear baseline when the bind happened after the upload). The
quarantine is content-gated, preserves raster stores that follow, and
r1509/r1511 show the clean page 0 (0xff000000) with no code bytes.

1 files changed, 11 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index ff3d088..8fec320 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -549,6 +549,17 @@ const u32 *gsp_sema_surf_prelude_get(u32 *n, u32 *gen);
 bool gsp_sema_surf_va_get(u64 *va, u32 *npages);
 
 /*
+ * SESSION 154 r1510: quarantine the guest code-heap/shader upload that can
+ * overlap the captured X screen (BAR1 mmap writes the emulator cannot
+ * trap). The surface capture snapshots the screen; a later launch whose
+ * screen page 0 carries the code signature restores the surface from that
+ * snapshot before the engine runs (the baseline stays armed so a later
+ * client context's upload is caught too). Returns the pages restored (0
+ * when there is no pollution or no baseline).
+ */
+int gsp_sema_surf_clean_restore(u64 va, u64 npages);
+
+/*
  * SESSION 153-CONTINUED-63: the fill's completed render-target tracking run
  * (base VA + page count), true only when every page of the surface resolved
  * into contiguous data recs this pass. The booter prefers these recs over