vgsp-sema: SESSION 140 the n_data wiring - QMD-page note, qmd-ptr candidate seed, pin-aware scan reads

Three corrections that take the GR fill from 'no candidates' to the
launch's real pointer set:

1. Note the QMD page itself into the request's page list (word 34) so the
   32..48-even bank scan covers it - the pointer VALUES live inside the
   QMD (r790: word 34 = 0xdff0febc00) and were never scanned.
2. Seed the fill's candidate set directly from the launch's own QMD
   pointer pairs (gr_qmd words 34..47, decoded from the push's inline-QMD
   run): r793 'sema-gr: qmd-ptr seed va=0xdff0feb000 (word 34)' - the
   values need no page scan (the pages' shadows read empty; the invisible
   -vidmem-write class).
3. Read the scanned pages pin-aware (svc_read_va first, host mapping of
   pp->pa as fallback): the push-buffer discovery's pinned staging copy
   holds the content the decode reads; a raw mapping of the vidmem pa
   sees zeros.

Verified r793/r794: candidates now appear (fill cand n=1 with the QMD
window page seeded); the page is correctly classified launch-internal by
the R3 hygiene filter (n_data stays 0 - nothing external to relocate for
this launch). With the r564 degenerate-set guard bypassed (min_data=0),
the forward ENTERS the backend and oopses in
gsp_phys_backend_guest_gr_submit+0x4394 ('Oops: 0000 [#2]', workqueue
gsp-phys-work svc_fwd_work_fn, NULL-base table walk CR2=0x1e93c R14=0) -
the empty-set path needs that guard before min_data=0 can be used.
This launch's QMD declares exactly one pointer pair, and it names its own
QMD window: a launch with no external data is legitimate and the refusal
class must not treat it as degenerate.

0 files changed, 0 insertions, 0 deletions