vgsp: ring-ledger scrub release + gated flip-event fixes (CONT.418-419)HEADmaster

- gsp_sema_service: never fabricate scrub completions. The guest
  decrements its scrub-list size by the reported finish delta without
  a guard, so a fabricated delta larger than the pending list
  underflows it and the guest spins (~2^64) under the scrubber mutex
  (r1766-r1768 X soft-locks and guest panics; root-caused by static
  analysis + gdbstub decode of lastSeen/lastSubmitted/scrubListSize).
  The release now mirrors the registered channel's own ring: count new
  valid pushes (wrap-safe snapshot delta) and set the finish word
  forward-only to the cumulative count - exactly the work the guest
  submitted, never more. False ring-page registrations are detected
  and skipped (a mis-registered ring page had its first GPFIFO entry
  clobbered by an all-ones write). sema_scrub_ramp=0 keeps the legacy
  all-ones release for A/B; the finish word is never all-ones with the
  ledger enabled.
- gsp_rm_emulation/gsp_display_engine: gate the hSrcResource==0 -> alloc
  parent event association behind ev_assoc (default 0) and keep strict
  display-event posting behind disp_events_strict (default 0) - both
  remain A/B knobs for the flip-event delivery fix.
- Live validation (r1769): 4/4 green boots, 0 panics, 0 wedges;
  glprobe pixel=ff0000ff; gl_frames 500/500 non-black frames captured
  to a 45 s 640x480 mp4 via pbuffer -> sysmem -> ivshmem.

1 files changed, 9 insertions, 0 deletions

diff --git a/kernel/include/gsp_display_engine.h b/kernel/include/gsp_display_engine.h
index 8b62c21..064c95c 100644
--- a/kernel/include/gsp_display_engine.h
+++ b/kernel/include/gsp_display_engine.h
@@ -54,6 +54,15 @@ void gsp_disp_engine_channel_add(struct nv_vgpu_device *vgpu, u32 hclass,
 void gsp_disp_engine_note_object(struct nv_vgpu_device *vgpu, u32 hclass,
 				 u32 instance, u32 h_object);
 
+/*
+ * r1765 flip-event shield predicate: is @h_object a registered display
+ * channel object of @vgpu?  The event-post fallback paths consult this to
+ * keep display events under the display engine's 1:1 posts while
+ * disp_events_strict is enabled.  Returns false while the parameter is 0
+ * (the legacy default), so the call sites are inert in legacy mode.
+ */
+bool gsp_disp_engine_owns_object(struct nv_vgpu_device *vgpu, u32 h_object);
+
 /* Run one pass for a guest (called from the sema service thread). */
 void gsp_disp_engine_pump(struct nv_vgpu_device *vgpu);