vgsp-gl: deliver the fixed CB to the engine-visible seed page directly

The r1515/r1520 decode assembles the client's real fixed-CB image, but
svc_gl_cb_copy()'s write to the forced seed VA (0x120700000) is refused by
the r1506 authoring-VAS rule: the seed page belongs to the X server's VAS,
so the beef channel write only updated the VA shadow while the engine kept
reading the black screen page at pa 0x500000 (r1521 seed dump: the image
never arrived; the engine fetched the RT clear).

The seed is a service-forced engine input, not a client write, so resolve
its VA through the VAS/walk/trusted chain and write the backing shadow/FB
page directly with svc_write_ap(), bypassing the ownership rule. A bounded
CB-SEED receipt reports the destination PA, aperture and the m80 words.

Validated in r1522: the seed backing store at dpa 0x500000 holds the
assembled image (m80 = the client's projection, e.g. 40a00000/40d55555/
bf9745d1/4211745c/bf800000/42200000) and cb-copy uses
src=const-upload (ssrc=15).

1 files changed, 47 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 576582a..5d54990 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -15662,6 +15662,7 @@ static u32 svc_gl_cb_copy_h;
 static u32 svc_gl_cb_copy_val;
 static u32 svc_gl_cb_copy_hash;
 static u32 svc_gl_cb_copy_log;
+static u32 svc_gl_cb_seed_log;
 /*
  * r1512: provenance of the page most recently written into the forced MME
  * seed (what the VS's c[0x0] bank will contain). Read by the coverage
@@ -16455,6 +16456,52 @@ cb_ready:
 	(void)hash;
 	rc = svc_grce_inline_write(vgpu, sema_gl_cb_copy_to, buf, sizeof(buf),
 				   h_object);
+	/*
+	 * r1521: deliver the assembled image to the seed page's real backing
+	 * store as well. The forced seed page is an engine-visible page the
+	 * service chooses (a page of the captured X screen), not a client
+	 * allocation: the r1506 authoring-VAS rule correctly refuses a beef
+	 * channel write to it, so svc_grce_inline_write() above only updates
+	 * the VA shadow while the engine keeps reading the (black) screen
+	 * page. Resolve the seed VA through the VAS/walk/trusted chain and
+	 * write the shadow/FB page directly - the seed destination is a
+	 * service-forced engine input, so the ownership rule does not apply.
+	 */
+	{
+		u64 dpa = 0;
+		int dap = SVC_APERTURE_SYS;
+		bool resolved = false;
+
+		if (!svc_chanvas_lookup(vgpu,
+					sema_gl_cb_copy_to & ~0xfffULL,
+					&dpa, &dap))
+			resolved = true;
+		else if (!svc_walk_vaspaces(vgpu,
+					    sema_gl_cb_copy_to & ~0xfffULL,
+					    &dpa, &dap))
+			resolved = true;
+		else if (!svc_lookup_trusted(vgpu,
+					     sema_gl_cb_copy_to & ~0xfffULL,
+					     &dpa, &dap))
+			resolved = true;
+		if (resolved && dpa) {
+			u64 d = (dpa & ~0xfffULL) +
+				(sema_gl_cb_copy_to & 0xfffULL);
+
+			if (!svc_write_ap(vgpu, d, svc_ap_of(dap), buf,
+					  sizeof(buf)) &&
+			    svc_gl_cb_seed_log < 12u) {
+				u32 m[4];
+
+				memcpy(m, buf + 0x80, sizeof(m));
+				svc_gl_cb_seed_log++;
+				pr_info("vgsp-sema: sema-gl: CB-SEED h=0x%x seed=0x%llx dpa=0x%llx ap=%u ssrc=%d m80=%08x %08x %08x %08x (image written to the engine-visible seed page)\n",
+					h_object, sema_gl_cb_copy_to, d,
+					svc_ap_of(dap), ssrc,
+					m[0], m[1], m[2], m[3]);
+			}
+		}
+	}
 	if (svc_gl_cb_copy_log < 96u) {
 		u32 w[8];