vgsp: end-to-end CUDA acceptance in the guest

The no-claim emulation path now runs a stock CUDA program end to end:
device properties, cudaMalloc, a GPU-authored string kernel read back
byte-for-byte, two 4 MB host-to-device copies, a 1 M-element vectorAdd
executed on the physical GPU through the host bridge, and the
device-to-host copy-back verified element by element. Three consecutive
supervised cycles report MAIL + VADD bad=0 checksum=392344090.500000 +
STATUS OK with identical input/output hashes.

Two data-path correctness fixes make the transfers sound:

- Once-only op execution per GPFIFO entry. The pump replays recently
  consumed ring entries when translation batches are injected so missed
  releases can land; re-executing a CE copy is not idempotent because
  its source is a client staging buffer that may have been refilled.
  Slots now record their raw entry words and a replayed entry matching
  that identity suppresses operations while still processing releases.

- Per-page translation of virtual operands. svc_copy resolved only the
  first page of a VA range and walked the PA linearly; client staging
  ranges are frequently split (observed 195 + 61 pages), so the tail of
  alternating chunks was read from unrelated memory. Multi-page copies
  now re-resolve each 4 KB page through the trusted resolver.

Also carries the earlier uncommitted emulation fixes that got the client
to the launch (QMD address-window gate, counter registration
persistence, 512 MiB emulated FB, bridge slot hygiene) and bounded
diagnostics (sema-bigop, sema-bigcopy, bridge-in/out hashes, daemon
INCHECK/OUTCHECK/dumps).

1 files changed, 7 insertions, 6 deletions

diff --git a/kernel/gsp_emulation.c b/kernel/gsp_emulation.c
index 5b75ec6..b1c67a4 100644
--- a/kernel/gsp_emulation.c
+++ b/kernel/gsp_emulation.c
@@ -742,14 +742,15 @@ int gsp_emu_init(struct nv_vgpu_device *vgpu)
 
     /* Physical GSP boot emulation state. wpr2_addr_lo matches what the
      * guest driver expects WPR2_ADDR_LO to read after FWSEC FRTS:
-     * frtsOffset = fbSize - reservedFromEnd. With fbSize = 256MB
-     * (LOCAL_MEMORY_RANGE) and the 570.144 image's 2MB reservation,
-     * frtsOffset = 0x10000000 - 0x200000 = 0xfe00000; the register's
-     * _VAL field (bits31:4) must equal frtsOffset >> 12 = 0xfe00, so the
-     * raw register value is 0xfe000. */
+     * frtsOffset = fbSize - reservedFromEnd. With fbSize = 512MB
+     * (LOCAL_MEMORY_RANGE / GSCI fb_length) and the 570.144 image's 2MB
+     * reservation, frtsOffset = 0x20000000 - 0x200000 = 0x1fe00000; the
+     * register's _VAL field (bits31:4) must equal frtsOffset >> 12 =
+     * 0x1fe00, so the raw register value is 0x1fe000. Kept in lockstep
+     * with GSCI fb_length/frtsOffset and NV_PFB_PRI_MMU_LOCAL_MEMORY_RANGE. */
     ctx->boot_stage = 0;    /* GSP_BOOT_STAGE_IDLE */
     ctx->flcn_kick_count = 0;
-    ctx->wpr2_addr_lo = 0x000fe000;
+    ctx->wpr2_addr_lo = 0x001fe000;
 
     /* The guest's BAR0 is the emulation shadow (vzalloc'd by
      * nv_vgpu_bar_emul_init, mapped to the guest via VFIO mmap) - NOT the