vgsp: eng56 - rewrite the window's own slot-1 SPH bind to the authored VTG image, and harden the author window-head decode

- gsp_phys_booter.c: after authoring the VTG SPH at family+0x900, scan the
  patched 3D window for its own 0x2054 slot-1 pair and rewrite an operand
  whose low 12 bits are 0x600/0x300 (client family VA or pair-cache shadow
  line) to <page>|0x900. The window's own later pair otherwise overwrites
  the synthesized prelude j1 and the DS validates the client's SASS page
  (c743: DS-IMAGE st1=0b0b7208). New SPH-SLOT1-REWRITE / SPH-SLOT1 receipts.
- gsp_phys_booter.c: reject an inline VTG candidate whose IMAP word (w6,
  offset 24) is zero; fall back to the builtin image. A 640 B w6=0 record
  authored a zero-map SPH and the DS went to the FECS/PRI sentinel
  (c749 fam 0x4350000: ds 80000000->badf1201).
- gsp_sema_service.c: the DDX ring-head decode scans past zero-payload
  and unreadable entries within the 8-entry bound instead of stopping
  (c746: the ring head is a zero dummy and the C36F release sits later);
  it still never fabricates a payload.

Validation: c749 is the first boot with DS-IMAGE st0=st1=020a0481
(code ff007321, the authored VSA/VSB image), a clean slot-1 rewrite
(old=0x01e00300 new=0x01e00900), beef MME-PACK-REARM, and the DS latch
reduced from 86040626 to 84000420; stores are still 0 and the DRAW_IAB
macro is the next gap.

1 files changed, 7 insertions, 4 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 4655e77..6cb7034 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -27987,7 +27987,7 @@ static void svc_ddx_head_decode(struct nv_vgpu_device *vgpu,
 				ring_ap, ent, sizeof(ent))) {
 			reason = "unreadable";
 			head_unreadable = true;
-			break;
+			continue;
 		}
 		memcpy(&e0, ent, 4);
 		memcpy(&e1, ent + 4, 4);
@@ -28017,17 +28017,20 @@ static void svc_ddx_head_decode(struct nv_vgpu_device *vgpu,
 		if (svc_read_va_push(vgpu, ch, va, buf, len)) {
 			reason = "unreadable";
 			head_unreadable = true;
-			break;
+			continue;
 		}
 		if (!memchr_inv(buf, 0, len)) {
 			/*
 			 * The push read succeeded but answered an all-zero
 			 * page (a stale/zero translation): there is no
-			 * release to decode and no value to apply.
+			 * release to decode and no value to apply. c746:
+			 * the ring head is a zero dummy entry and the real
+			 * C36F release sits at a later slot, so scan past
+			 * it (bounded) instead of stopping the pass.
 			 */
 			reason = "zero-payload";
 			head_unreadable = true;
-			break;
+			continue;
 		}
 		mark = svc_rel_count;
 		/*