gsp-phys: P6a - real copy engine reads/writes guest RAM pages

- file-backed guest RAM (launcher memory-backend-file share=on) and
  in-kernel GPA->HPA translation through the shared file page cache
  (read_cache_page + page_to_phys + pfn_valid), opened O_LARGEFILE;
  new default-off gsp_phys_guest_mem parameter
- debugfs gsp-phys-guest-ram (path + gpa/off/size ranges) and
  gsp-phys-guest-gpa (one pinned GPA per boot); rm-call triggers 6/7 run
  host->guest and guest->host 4 KiB CE copies; trigger 8 is a PTE
  self-test through a fresh slot
- guest page-table slots are pre-built during ladder stage 3: runtime
  PTE writes into an already-walked page-table line are not observed
  without a TLB invalidate
- guest RAM layout (q35 4.2, 4 GiB): below-4G GPA == file offset,
  above-4G offset = GPA - 0x80000000 (2 GiB PCI hole)
- tests: tools/test/gpage_test.c guest probe; docs + STATE-CURRENT
  record the live green (G2H/W2G with semaphore release, guest observed
  the write, smoke ALL OK 64/64, clean latched release)

1 files changed, 15 insertions, 0 deletions

diff --git a/docs/04-implementation/01-known-knowns-and-unknowns.md b/docs/04-implementation/01-known-knowns-and-unknowns.md
index 29558b0..1a5967b 100644
--- a/docs/04-implementation/01-known-knowns-and-unknowns.md
+++ b/docs/04-implementation/01-known-knowns-and-unknowns.md
@@ -129,6 +129,21 @@ running its own validation paths (UVM page-tree init exercises this).
 
 **Cost:** days to weeks.
 
+**Reachability resolution note (2026-10-02):** the related IOMMU/DMA
+reachability question is closed on the reference host. The physical GPU's
+IOMMU group is an identity domain (all-RAM identity) and the mediated device
+registers as an emulated-IOMMU VFIO device, so its type-1 container holds
+guest DMA mappings privately and no kernel `iommu_domain` exists for it:
+`iommu_iova_to_phys` cannot translate guest GPAs. Guest RAM is backed by a
+shared file instead, and the module translates GPA->HPA through that file's
+page cache. A channel page-table line the GMMU has already walked cannot be
+updated at runtime (no TLB-invalidate path exists), so channel page-table
+slots for the guest window are pre-built before any engine access. Live proof:
+the physical copy engine copied 4 KiB from a real guest page into a module
+buffer and back, semaphore released, with the guest process observing the
+write and the driver-API smoke green (`ALL OK` 64/64). Wrong-page-table writes
+remain the top risk; the division-of-labour question above is unchanged.
+
 ### 2.3 Fault semantics
 
 **Unknown:** fault buffer formats and replay/cancel semantics as the *guest*