vgsp-sema: author the PMA scrubber channel's progress (third-client scrub freeze)

The guest PMA scrubber (in-guest CeUtils CE channel, 4096 GPFIFO entries)
waits on its channel buffer's finish payload (offset 0x6c004) after the
third CUDA session's pages must be scrubbed; nothing in the emulation
authored it, so cudaMalloc froze in scrubCheckAndWaitForSize.

- channel_add: detect the 4096-entry scrubber channel and stash its USERD
  PA/ring geometry (the channel itself is left untouched: no rank change,
  no pump change - the colliding numeric-handle FREE may still unregister
  it, the geometry survives).
- sema_scrubbuf_add debug param: register the finish/host-semaphore word
  PAs the guest scanner resolves (vmallocinfo + kcore walk), because the
  RM kernel VA space collides numerically with the client CE window in the
  global VA map and cannot be resolved through it.
- svc_scrub_pass (service thread, per pass): from the channel's own USERD
  GPPut, track submitted scrub blocks across wraps, then author USERD
  GP_GET = put, host semaphore = put and finish payload = submitted.
  Forward-only, idempotent, zero writes while the scrubber idles.

Live-validated mechanism (r137 VM): authoring the finish word at the kcore-
resolved PA let the frozen victory_matmul leave scrubCheckAndWaitForSize
and proceed to its launch.

1 files changed, 10 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index 4b04892..6822bd5 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -36,6 +36,16 @@ void gsp_sema_service_channel_add(const struct sema_channel_desc *desc);
 void gsp_sema_service_channel_del(u32 h_object);
 
 /*
+ * Register the guest PMA scrubber's channel-buffer words (the CeUtils
+ * finish payload the guest's scrub wait polls, and the channel's host
+ * semaphore). The PAs come from the guest scanner (vmallocinfo + kcore):
+ * the guest RM kernel channel lives in a GPU VA space that collides
+ * numerically with the client's CE window in the global translation map,
+ * so it cannot be resolved through that map.
+ */
+int gsp_sema_service_scrubbuf_add(u64 fin_pa, u64 hsem_pa);
+
+/*
  * A GPU VA space whose top-level page directory the driver has published (the
  * driver builds its own page tables for the address spaces it owns, then hands
  * the directory's physical address to the GPU through SET_PAGE_DIRECTORY).