gsp-phys: P6b wave 1 - shadow-forward guest CE copies to the physical engine

- the sema service captures the first eligible copy per push from the
  software resolver's own operands (the real push shape mixes guest RAM
  with emulated-VRAM shadow addresses, including physical destinations)
- HPA resolution: guest RAM through the shared guest-RAM file page cache,
  emulated VRAM through the mapping of its kernel shadow
- new scratch page-table pool: 16 zeroed page-table pages with their
  page-directory entries built before any engine access, handing out one
  whole 128-byte GMMU PTE fetch line per copy pair (16 PTEs, 512 pairs
  per boot, never reused; a PTE written into an already-fetched line is
  not observed and there is no invalidate path)
- the backend submits the copy on the module-owned channel and verifies
  the result host-side; every miss falls back to the ladder shadow copy,
  and the software pump remains authoritative
- live (full smoke, both parameters on): req=42 ok=42 verify_ok=42
  verify_fail=0 fallback=0, guest payload roundtrip ALL OK 64/64,
  clean latched release; defaults stay off

1 files changed, 17 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index ae9b7da..9638dde 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -77,6 +77,23 @@ void gsp_sema_service_work_quiesce(void);
 void gsp_sema_service_work_resume(void);
 
 /*
+ * P6b wave-1 guest-forwarding counters for the gsp-phys-state work_guest
+ * line: guest-eligible requests seen by the pump, requests that fell back to
+ * the ladder copy, and verified hardware copies. Plain reads of the service
+ * counters; safe from the debugfs show path.
+ */
+void gsp_sema_service_fwd_guest_stats(u64 *req, u64 *fallback, u64 *ok);
+
+/*
+ * P6b wave-1 candidate accounting for the same work_guest line: how many
+ * forwarding requests found no eligible captured copy, and of those that did,
+ * the operand aperture mix (SYS/SYS, mixed, VID/VID), plus guest-work
+ * resolution failures on the work item. All zero while the feature is off.
+ */
+void gsp_sema_service_fwd_cand_stats(u64 *none, u64 *sys_sys, u64 *mixed,
+				     u64 *vid_vid, u64 *resolve_fail);
+
+/*
  * Discover and pin GR (compute) channel rings after the CE region of the
  * channel video-memory allocation. Set false to leave GR rings untranslated
  * (the pump then only runs the CE channels).