kernel: Fix GSP emulation shadow binding, eventfd wiring, RPC livelocks + docs suite + repo reorg

CRITICAL FIXES (guest driver bring-up):
- gsp_emulation.c: emulation engine bound to the WRONG BAR0 - it polled the
  host physical BAR0 (bars[0].vaddr ioremap) for the doorbell and read RPCs
  from a local dma_alloc_wc buffer, while the guest writes land in the
  vzalloc'd bar0_shadow. The RPC path could never work; PBA writes even
  corrupted the host GPU's physical BAR0+0x3000. gsp_emu_init now binds
  exclusively to bar0_shadow (doorbell/mailbox/PBA aliases;
  shared_mem_dma==0 marks the alias so cleanup never dma_free's it).
- main.c SET_IRQS: DATA_EVENTFD eventfds were DISCARDED ('TODO' + kfree) -
  the guest never received MSI-X completions. Full wiring now:
  eventfd_ctx_fdget per vector, fd -1 clears, dev_close releases refs.
  gsp_emu_inject_completion_interrupt looks up vgpu->irqs[0].trigger LIVE
  (init-time copy was permanently NULL since QEMU wires after gsp_emu_init).
- gsp_rpc_client.c: BAR_TRAP/MIGRATE in emulation mode called
  gsp_rpc_submit_raw which rings the SAME doorbell the thread polls -
  self-triggered RPC livelock + multi-second stalls. Now fail fast with
  -ENOTSUPP + pr_warn_ratelimited (guest BAR access is direct MMIO).

MORE FIXES:
- main.c: nv_vgpu_config_write returned SIZE_MAX (while(count--) wrap) and
  was dead code while the VFIO write handler did unfiltered byte copies
  (guest could rewrite vendor ID/BARs). Return fixed; VFIO write handler
  now routes through the per-register filter.
- kernel/Makefile: M=$(PWD) used the env var which is stale when invoked
  via the top-level make (pointed at repo root -> kbuild silently built
  NOTHING; explains every 'stale .ko' incident). Now M=$(CURDIR).
- Warnings sweep: header prototypes for mdev/type functions, format casts
  in gsp_comm.c DRY-RUN logs, unused variable.

ROBUSTNESS (harness/tooling):
- vgpu_vm.py: run had no timeout (start could block forever);
  guest_shell recv could block forever on a wedged guest. Both now bounded;
  guest_shell pre-flights guest-ping and reports wedge diagnostics.
- stack_manager.sh: qemu/qemu-debug now launch via the vgpu_vm.py harness
  (workflow rule: never raw QEMU).

REPO REORGANIZATION:
- driver/ (legacy guest-side gsp-vgpu.ko) moved to legacy-driver-guest/
  (reference only, not built; README explains). 3 legacy un-buildable test
  files moved to legacy-driver-guest/kernel-tests/. Top-level Makefile
  cleaned of the dead DRIVER_DIR reference.

DOCUMENTATION SUITE (new):
- docs/GSP_EMULATION_ARCHITECTURE.md - emulator deep-dive: shadow BAR0
  model, doorbell protocol, dispatch table, MSI-X path, lifecycle, memory-
  model caveats
- docs/DEBUGGING.md - QEMU GDB stub workflow, serial console, QMP NMI,
  failure taxonomy, full bring-up validation checklist, EPT-livelock case
  study, version-matrix discipline
- docs/ONBOARDING.md - repo tour, coding standards (incl. virt_to_phys /
  dma_addr_t / get-put rules), first build & test
- docs/VERSION_UPGRADE.md - end-to-end new-driver-version procedure
  (firmware fetch, Ghidra analysis, configs, signatures, validation)
- docs/PERFORMANCE.md - bare-metal A/B methodology + targets
- README.md doc index; STATE.md refreshed; DEVELOPMENT_WORKFLOW.md corrected
  (load order: open-iov-vfio BEFORE nvidia; stock-driver blacklist note)

1 files changed, 22 insertions, 6 deletions

diff --git a/README.md b/README.md
index 17bf93d..36b66ca 100644
--- a/README.md
+++ b/README.md
@@ -75,7 +75,8 @@ No Open-IOV component depends on a specific wrapper.
 kernel/         open-iov-vfio.ko host driver (mdev, VFIO, GSP emulation,
                 firmware analyzer, dynamic RPC dispatcher, arch/version layers)
 userspace/      libiov.so management library, examples, tests
-driver/         legacy guest driver (being removed in the host-only refactor)
+legacy-driver-guest/  historical guest-side driver, preserved for reference
+                only - NOT built (see its README)
 firmware/       GSP analysis: scripts, docs, address maps (blobs NOT in git -
                 fetched by install.sh from linux-firmware.git)
 patches/nvidia/ patch series applied to NVIDIA open-gpu-kernel-modules
@@ -103,15 +104,30 @@ images/ISOs, Ghidra project databases, and any local VM-wrapper stacks.
 
 ## Documentation
 
+Start here: **[Developer onboarding](docs/ONBOARDING.md)** — repo tour,
+coding standards, first build & test.
+
 - [STATE.md](STATE.md) — current state, limitations, bug tracker
-- [Portable architecture](docs/PORTABLE_ARCHITECTURE.md)
-- [Host-only GSP emulation design](docs/refactored-architecture.md)
+- [GSP emulation engine architecture](docs/GSP_EMULATION_ARCHITECTURE.md) —
+  how the host-side emulator works (shadow BAR0, doorbell protocol, dispatch,
+  MSI-X injection)
+- [Debugging guide](docs/DEBUGGING.md) — QEMU GDB stub, serial console,
+  failure taxonomy, bring-up validation checklist
+- [Version upgrade guide](docs/VERSION_UPGRADE.md) — supporting a new NVIDIA
+  driver/GSP version end-to-end (Ghidra workflow)
+- [Performance testing](docs/PERFORMANCE.md) — bare-metal A/B methodology
+- [Portable architecture](docs/PORTABLE_ARCHITECTURE.md) — multi-version,
+  multi-hardware design
+- [Host-only GSP emulation design](docs/refactored-architecture.md) —
+  original refactor plan
 - [Implementation TODO](docs/refactored-implementation-to-do.md)
-- [Firmware analysis](wiki/GSP-570.144W-Firmware-Analysis.md) —
+- [Development workflow reference](docs/DEVELOPMENT_WORKFLOW.md) — exhaustive
+  command reference
+- Firmware canon: [analysis](wiki/GSP-570.144W-Firmware-Analysis.md) —
   [RPC format](wiki/RPC-Message-Format.md) —
   [BAR emulation](wiki/BAR-Emulation-Specification.md) —
-  [Migration protocol](wiki/Migration-Protocol.md) —
-  [Address reference](wiki/Address-Reference.md)
+  [migration protocol](wiki/Migration-Protocol.md) —
+  [address reference](wiki/Address-Reference.md)
 
 ## License