vgsp-sema: keep the scrubber channel inert; publish its finish payload from GP_PUT (ISSUE-0002)

The CeUtils scrubber channel (entries=4096, GPU-global) stays registered
across client sessions now that deletion is client-scoped, but its channel
buffer memory is reused by later clients' push buffers: entry-pumping its
stale ring invented work and perturbed the session (r79/r80: the first
client wedged on an rwsem). The pump now skips channels with the
scrubber layout (entries >= 4096) and instead publishes the word the pma
scrub actually waits on - the channel buffer finish payload at
gpfifo_va + 8*entries + 4 (live-verified: 0x120064000 + 0x8000 + 4 =
0x12006c004, the address from the hung client's register dump) -
forward-only from the channel's own GP_PUT (one payload per submitted
push, the same counter the guest's ceutilsUpdateProgress polls).

Skipping the scrub's actual memset work is acceptable for the emulated
vidmem: the guest's scrub clears pages of its own shadow, and the
emulation's job here is the completion contract. Revisit if per-tenant
vidmem scrubbing is required.

0 files changed, 0 insertions, 0 deletions