vgsp: code-fetch content verification instrumentation (CODEHASH) + static trace

Static trace of the GR code-fetch path: the engine's instruction fetch base
is the QMD word 48/49 program pair (svc_gr_qmd_decode, gsp_sema_service.c);
the entry page resolves ledger-first (svc_gr_page_note) and is authored at
submit as either a Tier-1 guest-VA->HPA identity PTE (gsp_phys_rmcall_gr_map_va_locked)
or a win0 shadow copy of the guest page with the QMD pair rewritten to the
shadow VA (gsp_phys_backend_guest_gr_submit); the guest page content was
written by the emulated H2D copy path (svc_copy + svc_ledger_store landing).

CODEHASH: one bounded line per launch at author time sampling the resolved
code region (entry offset 16B + PA+0/mid/end windows, up to 4 consecutive
tracked code pages) on the source landing page and the engine-visible shadow
copy: 'vgsp-gr: CODEHASH va=0x%llx pa=0x%llx n=%u h0=0x%016llx ent=...
w=... sh0=... SUSPECT|ok'. Emitted for suspicious content (all-zero windows,
zero entry word pair, four identical entry words) or the first 3 healthy
launches per boot; 'CODEHASH-UNREADABLE' when the entry page has no
host-readable landing. Additive, no behavior change (Tier-1 and shadow call
sites, once per launch).

0 files changed, 0 insertions, 0 deletions