vgsp-gl: decode the 570.144 MME-wrapper fixed-CB upload form

The guest GL driver streams the fixed constant buffer through the C597 MME
macros, not the native SET_CONSTANT_BUFFER_SELECTOR/LOAD_CONSTANT_BUFFER
methods the r1515 scanner decodes:

  - CALL_MME_MACRO(0) = SETUP_FIXED_CONST arrives as an IMMD run at method
    0x3800 carrying the VPC dword offset (the macro converts it to a byte
    address, so the fixed-CB offset is imm << 2).
  - CALL_MME_MACRO(57) = LOAD_CONSTANT_BUFFER_BUG2548370 arrives as a run
    at 0x39c8 whose payload is [count][count dwords]; the macro writes the
    data at the current fixed-CB offset and auto-increments it.
  - CALL_MME_MACRO(58) = LOAD_CONSTANT_BUFFER_OFFSET arrives at 0x39d0
    with [offsetBytes].

r1517's own CHUNK1 dump of the 7144-byte draw window carries the real
glxgears MVP this way (pixel-space 5.0/6.667 scales, -1.1818/36.3636
near/far row and the -1/40 w row = glFrustum(-1,1,-0.75,0.75,5,60) x
translate(0,0,-40)); the old scanner ignored those runs, assembled only
the 10 state-patch words, and the strict gate never passed, so every
launch ran with the synthetic identity and the geometry clipped.

With the wrapper form decoded the assembled 4 KB image carries the client's
real MVP at c[0x0][0x80..0xbc], passes svc_gl_cb_mvp_ok(), and
svc_gl_cb_copy() delivers it to the forced MME seed page as
src=const-upload (src_ssrc=15) instead of synthetic-id.

0 files changed, 0 insertions, 0 deletions