vgsp-sema: derive and register the guest scrubber finish-payload words

The X DDX's NV_ESC_RM_VID_HEAP_CONTROL (ioctl 0x4a) allocates scrubbed
pages through the guest PMA's CeUtils scrubber channel; it waits on the
channel buffer's finish payload (channelWaitForFinishPayload), which the
host's svc_scrub_pass was supposed to author but never did because the
guest scanner had not registered fin_pa/hsem_pa (pa_ok=0 in every run).

The channel buffer is pb + GPFIFO + sema + finish, and the scrubber's
GPFIFO VA is pb + pbSize, so the host semaphore is gpfifo_va +
entries*8 and the finish payload is that +4. Resolve that VA through the
learned map or the VAS walk at the first pass and register the PAs in
place (SYS aperture only).

r1665: `scrub geometry hsem_va=0x12006c000 fin_va=0x12006c004 ->
hsem_pa=0x10f46a000 fin_pa=0x10f46a004`, then `scrub author put=1..11`
and the X server left the kernel scrub spin entirely: perf on Xorg is now
100 % in nvidia_drv.so+0xaee70 (a DDX userspace loop, next wall) with no
_nv018351rm/_nv015102rm samples.

0 files changed, 0 insertions, 0 deletions