vgsp-gr: re-target the captured render surface per launch so a partial VA-colliding allocation cannot receive the draw

The SURF-PRELUDE target pair was patched once per capture generation and
then reused; the re-patch test was dead because gsp_sema_gr_surf_recs()
only fills in the VA when it returns true and the code negated the call,
so 'want' could never be computed. A later draw whose ~10-page SYS
allocation sits at the same 0x1204xxxxx VA as the X server's 1280x720
screen inherited the X server's 900-page target; the engine's RT pair then
named the client's command/operand buffer, which is why the 'surface' held
method words and copy-out saw no engine pixels.

Add gsp_phys_gr_surf_launch_target(): only a complete contiguous rec run
for the captured surface may use its data-rec bounce lane; a partial run
falls back to the boot-time contiguous alias built from the captured
bind's VAS pages (the real screen HPAs). Re-patch whenever the cached pair
differs from that effective target (SURF-PRELUDE retarget); RT0 copies the
same words, so the RT0==RT1 design is unchanged.

r1490 (VP_MODE=6 RT0=1, r1476-args): 15 launches, poison=0, retarget
have=0xa000000 want=0x15e0000 for the partial lane then 900-page targets,
output retirement up to 3/900 with 2 copy-out pages changed by engine, and
a non-empty 3.69 MB xwd. New wall: the draw still produces no raster
fragments - the only changed pages are the forced MME constant-buffer
pages inside the screen (offset pages 768/772/773, 0xff000000 fills).

Also harden tools/guest-diag/qga_fetch.py (retry open, long timeout,
atomic .part write, clear error exit) for evidence capture.

0 files changed, 0 insertions, 0 deletions