vgsp: eng55 - VTG SPH authoring at family+0x900, DDX ring-head tracker decode, MME pack carrier, and the pump atomic-sleep hoist

- gsp_phys_booter.c: sema_gl_sph_vtg_auth (default 1) authors the client's
  live VTG SPH image at family+0x900 and binds VSA/VSB there; new
  SPH-AUTHOR / SPH-ALIAS-auth receipts and a DS-IMAGE stage census at the
  DS latch (stage-start w0 + code word through the pair cache).
- gsp_phys_booter.c: sema_gl_mme_pack_carry (default 0) + _ms (default 100)
  host-initiated windowless continuation carrier for a split MME pack;
  MME-CARRY-ARM/FIRE/COMPLETE/CANCEL/ABORT receipts, beef-only, bounded.
- gsp_sema_service.c: sema_ddx_tracker_auth (default 0) ring-head decode
  for the DDX channel when the USERD is missing/reset (guest-authored
  C36F release applied verbatim); sema_gr_scan_top default raised to
  0x300000000 for the 12 GiB campaign guest.
- gsp_sema_service.c: hoist the r707e VAS candidate verify out of
  svc.chan_lock (its vfio_dma_rw path can sleep) and add in_atomic guards
  to svc_read/svc_write; fixes the gsp-sema-svc "scheduling while atomic"
  pump stall that lost the marked draw-window launch.
- tools: enable sema_ddx_tracker_auth=1 in params-r1624; use timeout -k in
  the guest GL/GZDoom wrappers so a wedged GPU wait cannot hang a cycle.

Validation: c741/c743 boots (VTG author byte readback, cross-lane and beef
pack completion + REARM, DS-IMAGE census) and the c743 DS-FAST chain; A/B
for the carrier and the tracker decode is still open.

1 files changed, 25 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h
index 92c8e69..dd7e64a 100644
--- a/kernel/gsp_phys_booter.h
+++ b/kernel/gsp_phys_booter.h
@@ -505,6 +505,16 @@ struct gsp_phys_gr_submit {
 	 */
 	u32 stream_rel;
 	/*
+	 * Host-initiated MME pack-continuation carrier (sema_gl_mme_pack_carry):
+	 * the caller is the service's synthetic request, not a guest push.
+	 * The submit path then ignores req->stream/pages/inl/data/releases,
+	 * emits the builder's static WAIT_FOR_IDLE stub window (never
+	 * executed: the launch is forced LOAD-ONLY with the CALL runs held)
+	 * and lets the builder carry the next packed-prelude part from its
+	 * own live cursor. No guest memory is read or written.
+	 */
+	bool mme_carrier;
+	/*
 	 * SESSION 153-CONTINUED-87: the first program VA the captured
 	 * window binds (SET_PIPELINE_PROGRAM_ADDRESS pair; 0 when none).
 	 * The launch builder uses its 4K page as the program family for
@@ -550,6 +560,21 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
  */
 bool gsp_phys_gr_mme_fe_defer_wanted(u32 h_object, u32 win3d_n);
 
+/*
+ * Host-initiated MME pack-continuation carrier (sema_gl_mme_pack_carry).
+ * The service pump peeks for a due carrier, then takes it (which re-validates
+ * the live pack cursor/handle/golden state) and submits the synthetic
+ * load-only request. On launch failure the service calls carry_failed so the
+ * next client window re-emits from word 0; carry_cancel drops a carrier on a
+ * non-launch path (queue failure etc.). All three are no-ops when no carrier
+ * is armed.
+ */
+bool gsp_phys_gr_mme_carry_peek(u32 *h_object);
+bool gsp_phys_gr_mme_carry_take(u32 h_object, u32 *gen, u32 *off,
+				u32 *maxa);
+void gsp_phys_gr_mme_carry_cancel(const char *reason);
+void gsp_phys_gr_mme_carry_failed(int rc);
+
 /* GR forwarding counters (submitted/verified/cancelled), plain reads. */
 void gsp_phys_backend_gr_counters(u64 *submitted, u64 *ok, u64 *refused,
 				  u64 *timed_out, u64 *pool_exhausted);