vgsp-disp: resolve the display instance table in the guest BAR2 shadow

The guest kernel RM builds the 64 KiB display instance block in FB but
writes it through the guest's BAR2 virtual aperture (memdescMapInternal
-> BAR2 with RMCFG_FEATURE_PLATFORM_GSP=0), while control 0x20800a49
hands only the FB PA to the display engine.  The hash table therefore
never appears in the FB shadow or guest RAM, which is why the notifier
context-DMA handles 0x10013/0x10075 could not be resolved and FINISHED
was never written (r1633).

- add a BAR2-shadow hash/object-entry search (8-byte entry walk, 4 KiB
  block-base candidates, target/limit validation) to the resolution
  chain after FB/shadow/RAM;
- fix the hash instance field mask to 11 bits (0x7ff);
- carry the object target and route the notifier status through the FB
  shadow for target 1, guest PA for sysmem targets 2/3;
- SET_NOTIFIER_CONTROL.OFFSET is in 16-byte units (was scaled by 4).

0 files changed, 0 insertions, 0 deletions