sem: run GR channels - accept CE methods on subchannel 0, discover GR rings

- The CE semaphore/memset method groups also arrive on subchannel 0 (CUDA's
  push library binds the copy class on compute channels to carry the
  work-submission releases), so the stream decoder accepts both 0 and 4.
- GR (compute) channel rings live in the same video-memory allocation as the
  CE rings, 0x3000 bytes per channel after them: ring (0x2000) at
  ce_end + 0x3000*rank, USERD at +0x2000. Discover and pin them once the CE
  ranks are known; verified against ring entry 0 (1 MB aligned push VA in
  the client window, sane length) and the USERD's put/get, so a layout
  change costs a failed pin, not a wrong one. Gated by sema_gr_rings
  (default on).
- memprobe: require the sem-VA triple in the sem-object scanner (a bare
  qword in the window matches thousands of unrelated pointers once the
  ring/pushbuffer windows are part of the range).

Live evidence: ring entries read through the guest's /proc/pid/mem decode to
the GR channels' first pushes; pinning the ring (fb 0x140000+0x3000*rank),
USERD (ring+0x2000) and first-push pages made all 20 GR channels execute
their entry 0 for the first time (get=1 sub=1).

1 files changed, 7 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index d5e41a6..f652ffd 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -61,4 +61,11 @@ int  gsp_sema_service_dump_channels(void);
 int  gsp_sema_service_add_map(u64 gpu_va, u64 pa, u64 len, u32 ap);
 void gsp_sema_service_doorbell(u32 token);
 
+/*
+ * Discover and pin GR (compute) channel rings after the CE region of the
+ * channel video-memory allocation. Set false to leave GR rings untranslated
+ * (the pump then only runs the CE channels).
+ */
+extern bool gsp_sema_gr_rings;
+
 #endif /* _GSP_SEMA_SERVICE_H_ */