vgsp: family-aware GR ring scan + GR completion event post (CONT.400)

1. svc_gr_ram_ring_scan: the direct-GL client's kernel channels live in the
   RM low aperture (ring 0x4020000, pushes 0x4000000/0x4001004/0x4250000/
   0xcae2894). The scan rejected every one of them: entry VAs below
   SEMA_VA_LO (0x100000000), entry-1 outside +/-1MB of the ring, and the
   1MB-alignment gate in svc_gr_entry_plausible. For the low family
   (gpfifo_va in [0x4000000,0x10000000) or h_object 0xbeef0xxx) accept any
   low-aperture push VA, drop the 1MB alignment to 4 bytes, and use the low
   aperture as the upper bound. High-family rules unchanged.

2. GR completion event: a launch completion is an RM event edge, not only a
   memory word. The guest client waits in the RM software event queue
   (NV_ESC_RM_GET_EVENT_DATA), populated only by a GSP 0x1003
   EVENT_POST_EVENT record. Post it via gsp_rm_post_channel_event_force()
   after the release is visible, on both the hold success edge and the
   software/failure edge.

Diagnostics added: VAS-PROMOTE walk results and the RING-VAS probe.

Open (see handoff CONT.400): the beef ring VA is still not mapped by any
registered VAS, not at guest PA 0x4020000, not at vidmem 0x4020000. The
guest never publishes the channel's effective TSG/device-default VAS via
SET_PAGE_DIRECTORY; all registered VASes come from COPY_SERVER_PDES. Guest
screen is 100% black; glxgears 0.2 FPS.

0 files changed, 0 insertions, 0 deletions