vgsp: client-session boundary fixes - WD ring scan gate + forced session flush

Two changes from the r839/r840 multi-client forensics (session 147):

1. The guest-RAM content scan for a GR ring must not run for the kernel
   RC-watchdog channel (h=0x31415900). Its ring is a plain kernel allocation
   always resolvable through the driver-published VAS walk; on r840 the walk
   lost a registration race, the scan latched a foreign garbage page, and
   the bad latch poisoned the driver's DMA test ('Failed to initialize DMA',
   Xorg died). Gated, the walk retries per pass; r841 Xorg#1 passes DMA
   (DMAFAIL=0) where r840 failed.

2. sema_force_flush module parameter + gsp_sema_service_sess_flush_force():
   execute the ISSUE-0002 client-session flush even with live channels. The
   channel-close trigger never fires on real boots (driver-global channels
   stay valid), so later client sessions inherited stale discovery state.
   Verified on r841: flush executes mid-boot, Xorg survives it and
   re-registers its channels.

Remaining wall (addendum 9): GR client channels' pushbuffer reads return
all-zero through the trusted translation (va=0x4000000-class, src=4), so
first entries never complete and GL clients never render.

1 files changed, 19 insertions, 0 deletions

diff --git a/kernel/main.c b/kernel/main.c
index 7016647..a034b44 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -2554,6 +2554,25 @@ module_param_cb(sema_probe, &nv_vgpu_sema_probe_ops, NULL, 0200);
 MODULE_PARM_DESC(sema_probe, "Dump sema-service map + slot values for a GPU VA");
 
 /*
+ * ISSUE-0002 aid: force a client-session flush past the live-channel skip.
+ * Write anything (echo 1 > .../parameters/sema_force_flush).
+ */
+static int nv_vgpu_sema_force_flush_set(const char *val,
+					const struct kernel_param *kp)
+{
+	gsp_sema_service_sess_flush_force();
+	return 0;
+}
+
+static const struct kernel_param_ops nv_vgpu_sema_force_flush_ops = {
+	.set = nv_vgpu_sema_force_flush_set,
+};
+
+module_param_cb(sema_force_flush, &nv_vgpu_sema_force_flush_ops, NULL, 0200);
+MODULE_PARM_DESC(sema_force_flush,
+		 "Force a client-session flush even with live channels (ISSUE-0002 aid)");
+
+/*
  * Register the guest PMA scrubber channel buffer words (finish payload PA,
  * host-semaphore PA) the guest scanner resolved:
  *   echo 0x11a8ff004,0x11a8ff000 > .../parameters/sema_scrubbuf_add