vgsp: eng55 - VTG SPH authoring at family+0x900, DDX ring-head tracker decode, MME pack carrier, and the pump atomic-sleep hoist

- gsp_phys_booter.c: sema_gl_sph_vtg_auth (default 1) authors the client's
  live VTG SPH image at family+0x900 and binds VSA/VSB there; new
  SPH-AUTHOR / SPH-ALIAS-auth receipts and a DS-IMAGE stage census at the
  DS latch (stage-start w0 + code word through the pair cache).
- gsp_phys_booter.c: sema_gl_mme_pack_carry (default 0) + _ms (default 100)
  host-initiated windowless continuation carrier for a split MME pack;
  MME-CARRY-ARM/FIRE/COMPLETE/CANCEL/ABORT receipts, beef-only, bounded.
- gsp_sema_service.c: sema_ddx_tracker_auth (default 0) ring-head decode
  for the DDX channel when the USERD is missing/reset (guest-authored
  C36F release applied verbatim); sema_gr_scan_top default raised to
  0x300000000 for the 12 GiB campaign guest.
- gsp_sema_service.c: hoist the r707e VAS candidate verify out of
  svc.chan_lock (its vfio_dma_rw path can sleep) and add in_atomic guards
  to svc_read/svc_write; fixes the gsp-sema-svc "scheduling while atomic"
  pump stall that lost the marked draw-window launch.
- tools: enable sema_ddx_tracker_auth=1 in params-r1624; use timeout -k in
  the guest GL/GZDoom wrappers so a wedged GPU wait cannot hang a cycle.

Validation: c741/c743 boots (VTG author byte readback, cross-lane and beef
pack completion + REARM, DS-IMAGE census) and the c743 DS-FAST chain; A/B
for the carrier and the tracker decode is still open.

1 files changed, 9 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index f2a0777..ba1da96 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -686,6 +686,15 @@ int gsp_sema_gl_sph_blob_version(void);
 const u8 *gsp_sema_gl_prog_img(u64 va, u32 *len_out);
 
 /*
+ * eng52 (DS stage-image gate): the published VTG (vertex) SPH+SASS image,
+ * independent of the stage-typed gsp_sema_gl_prog_img fallback. The GR
+ * booter uses it to author the live VTG stage image at family+0x900 when
+ * the client's own VTG inline record is absent from the launch. NULL/0
+ * when no image is loaded.
+ */
+const u8 *gsp_sema_gl_vs_img(u32 *len_out);
+
+/*
  * SESSION 153-CONTINUED-68: furthest IR instruction covered by the CAPTURED
  * 0x114 uploads (pc + ceil(code words / 3)). The GR launch builder places
  * its end-noop macro stub at this address (aligned past the replayed