vgsp: USERD index/alias resolution, DDX kick-idle fix, completion-slot authorship (CONT.403-412)

Ten debugging rounds against the direct-GL channel, each fixing the wall that
blocked the previous one:

- USERD index: honour USERD_INDEX_VALUE/PAGE_VALUE from NVOS04 flags
  (X idx=3, GL idx=4) instead of always reading the block at base+0. This
  fixed the X "Failed to initialize DMA" wall.
- USERD alias: learn the BAR1-alias bias from the first ring-validated FB
  latch (wire 0x80600 -> live 0x910000) and prefer alias/wire-page
  candidates before falling back to the RAM scan, which previously adopted
  another channel's control page.
- USERD latch: keep a ring-validated kick-family block across a transient
  put=0 instead of dropping it (bounded, per-channel log).
- VAS alias: DUP_OBJECT copies pdb/entries/ap/verified so hVASpace 0xbfef0001
  resolves to 0x10005 and its gpfifo VA stops re-resolving to a bogus FB PA.
- Short-kick NOTIFY: complete a kick that has no armed class-2D target
  (release + event, no write) so the client proceeds past setup.
- DDX kick-idle: slot 0 of the 0x01xxxxxx family is the pb_kickIfIdle gate and
  0xFFFF is its IDLE value; the keepalive no longer zeroes it. Removes the
  GR-STALL-stale-wedge on the X channel.
- Completion slots: register a per-channel completion on every successful
  kick and reuse it when a NOTIFY has no per-push SET_NOTIFY; prefer the
  channel's notifier page over the VA walk.
- Empty/no-op submit: author the completion even when there is no push to
  replay, so a synchronous GL submit does not wait forever.
- Scrub records: multi-record per guest, stash-first lookup, registered PA is
  authoritative against the GPU-VAS walk, scanner-only records author the
  proven 0xffffffff/0xffffffff pair.
- GL attachment: accept a draw run whose own subchannel is the engine
  subchannel the channel uses (bind is subch 0, draws on subch 3), not only
  the bind subchannel.

Measured: glxgears 427 -> 526 FPS sustained with no GR stall; X binds and
renders its 2D path; 3D draw capture on the GL channel still does not occur
(see CONT.412: the GL thread blocks on the NVRM RM write lock before it
reaches any ioctl).

Adds tools/guest-diag/scrub_pin_qmp.py to register guest channel-buffer
vmap pages as scrub records from the host.

0 files changed, 0 insertions, 0 deletions