vgsp: end-to-end CUDA acceptance in the guest

The no-claim emulation path now runs a stock CUDA program end to end:
device properties, cudaMalloc, a GPU-authored string kernel read back
byte-for-byte, two 4 MB host-to-device copies, a 1 M-element vectorAdd
executed on the physical GPU through the host bridge, and the
device-to-host copy-back verified element by element. Three consecutive
supervised cycles report MAIL + VADD bad=0 checksum=392344090.500000 +
STATUS OK with identical input/output hashes.

Two data-path correctness fixes make the transfers sound:

- Once-only op execution per GPFIFO entry. The pump replays recently
  consumed ring entries when translation batches are injected so missed
  releases can land; re-executing a CE copy is not idempotent because
  its source is a client staging buffer that may have been refilled.
  Slots now record their raw entry words and a replayed entry matching
  that identity suppresses operations while still processing releases.

- Per-page translation of virtual operands. svc_copy resolved only the
  first page of a VA range and walked the PA linearly; client staging
  ranges are frequently split (observed 195 + 61 pages), so the tail of
  alternating chunks was read from unrelated memory. Multi-page copies
  now re-resolve each 4 KB page through the trusted resolver.

Also carries the earlier uncommitted emulation fixes that got the client
to the launch (QMD address-window gate, counter registration
persistence, 512 MiB emulated FB, bridge slot hygiene) and bounded
diagnostics (sema-bigop, sema-bigcopy, bridge-in/out hashes, daemon
INCHECK/OUTCHECK/dumps).

1 files changed, 10 insertions, 8 deletions

diff --git a/kernel/bar_emulation.c b/kernel/bar_emulation.c
index 685831a..e095d8b 100644
--- a/kernel/bar_emulation.c
+++ b/kernel/bar_emulation.c
@@ -269,15 +269,17 @@ int nv_vgpu_bar_emul_init(struct nv_vgpu_device *vgpu)
 
 	/*
 	 * 0x100ce0  NV_PFB_PRI_MMU_LOCAL_MEMORY_RANGE - usable FB size.
-	 * Encoded as fbSize = LOWER_MAG << (LOWER_SCALE + 20). Set to
-	 * 256MB (matches our BAR1): mag=1, scale=8 -> 1 << 28. On real
-	 * hardware VBIOS devinit programs this after GFW boot; the guest
-	 * driver's kgspPopulateWprMeta reads it via kmemsysGetUsableFbSize
-	 * and uses it to compute the FRTS offset (fbSize - reservedFromEnd).
-	 * With it 0, the FRTS offset underflows and FWSEC verification
-	 * fails with "WPR2 initialized at an unexpected location".
+	 * Encoded as fbSize = LOWER_MAG << (LOWER_SCALE + 20) (LOWER_SCALE
+	 * bits 3:0, LOWER_MAG bits 9:4; kmemsysReadUsableFbSize_GP102).
+	 * Set to 512MB (mag=1, scale=9 -> 1 << 29): on real hardware VBIOS
+	 * devinit programs this after GFW boot; the guest driver's
+	 * kgspPopulateWprMeta reads it via kmemsysGetUsableFbSize and uses
+	 * it to compute the FRTS offset (fbSize - reservedFromEnd). With it
+	 * 0, the FRTS offset underflows and FWSEC verification fails with
+	 * "WPR2 initialized at an unexpected location". Must stay in
+	 * lockstep with GSCI fb_length/frtsOffset and wpr2_addr_lo.
 	 */
-	*(u32 *)((u8 *)ctx->bar0_shadow + 0x100ce0) = 0x00000018;
+	*(u32 *)((u8 *)ctx->bar0_shadow + 0x100ce0) = 0x00000019;
 
 	/*
 	 * NV_PCFG (BAR0+0x88000) - PCI config space mirror the driver reads