kernel: GSP-RM msgq emulation + TU104 hardware tables (GET_GSP_STATIC_INFO, GSP_RM_CONTROL)

Implements the GSP-RM reply content layer for the msgq RPC channel:

- kernel/gsp_rm_emulation.c/h: GSP-RM msgq emulation engine
  - Queue chain discovery (libos args → RMARGS → GSP_ARGUMENTS_CACHED)
  - Status queue link + GSP_INIT_DONE emission
  - Command queue polling + RPC dispatch
  - SET_GUEST_SYSTEM_INFO version negotiation (VGX 41.12)
  - GET_GSP_STATIC_INFO(65) with 1656-byte GspStaticConfigInfo
  - GSP_RM_CONTROL(76) sub-command dispatch:
    - FIFO_GET_DEVICE_INFO_TABLE (0x20801112)
    - INTERNAL_INTR_GET_KERNEL_TABLE (0x20800a5c)
    - GPU_GET_CONSTRUCTED_FALCON_INFO (0x208001b0)
    - INTERNAL_GET_DEVICE_INFO_TABLE (0x20800a40)

- kernel/gsp_rm_tu104.h: TU104 hardware tables
  - 12-entry FIFO engine table (GR0, CE0-4, NVDEC0-1, NVENC0, SEC2, NVJPG, SW)
  - 8-entry interrupt table (from intr_phys_tu102.c)
  - 1-entry constructed falcon table (FBFLCN)
  - 11-entry internal device info table
  - GspStaticConfigInfo layout (1656 bytes, ABI-verified offsets)
  - Data from NVIDIA driver material (ext-tree) + hwref/turing/tu104

- tools/rmq/: Userspace RM API client (oracle for ground-truth tables)

KNOWN ISSUE: gsp_rm_send crashes (fortify_panic) on multi-element messages
when reply data exceeds one 4096-byte queue element. Affects cmd 0x20800a41
(paramsSize=8204). Multi-element splitting is the next fix.

1 files changed, 36 insertions, 1 deletions

diff --git a/kernel/gsp_emulation.h b/kernel/gsp_emulation.h
index 53560e9..668d567 100644
--- a/kernel/gsp_emulation.h
+++ b/kernel/gsp_emulation.h
@@ -38,7 +38,27 @@
  * physical GSP boot sequence is visible on the host (guest BAR0 access is
  * mmap-based and otherwise invisible). Offsets are BAR0-relative, GSP falcon
  * block at 0x110000. */
-#define GSP_EMU_FALCON_WATCH_COUNT  17
+#define GSP_EMU_FALCON_WATCH_COUNT  20
+
+/* BAR0 shadow offsets used by the guest's physical GSP boot */
+#define GSP_EMU_REG_GSP_CPUCTL		0x110100  /* bit1 STARTCPU, bit4 HALTED */
+#define GSP_EMU_REG_GSP_ENGINE		0x1103c0  /* bit0 RESET */
+#define GSP_EMU_REG_GSP_MAILBOX0	0x110040
+#define GSP_EMU_REG_VBIOS_SCRATCH_0E	0x001438  /* FRTS err code (0=NONE) */
+#define GSP_EMU_REG_WPR2_ADDR_LO	0x1fa824
+#define GSP_EMU_REG_WPR2_ADDR_HI	0x1fa828
+#define GSP_EMU_REG_RISCV_STATUS	0x111240  /* bit0 ACTIVE (NV_PRISCV_RISCV
+						     CORE_SWITCH_RISCV_STATUS=0x240 at
+						     GSP riscvRegisterBase =
+						     NV_FALCON2_GSP_BASE=0x111000) */
+
+/* SEC2 falcon (Booter Load/Unload runs here, not on the GSP falcon) */
+#define GSP_EMU_REG_SEC2_CPUCTL		0x840100
+#define GSP_EMU_REG_SEC2_MAILBOX0	0x840040
+#define GSP_EMU_REG_SEC2_ENGINE		0x8403c0
+
+#define GSP_EMU_CPUCTL_STARTCPU		0x2
+#define GSP_EMU_CPUCTL_HALTED		0x10
 
 /* ============================================================
  * GSP Emulation Context
@@ -78,8 +98,23 @@ struct gsp_emu_context {
     u32 boot_stage;         /* enum gsp_emu_boot_stage */
     u32 flcn_kick_count;    /* STARTCPU kicks seen since last ENGINE reset */
     u32 wpr2_addr_lo;       /* WPR2_ADDR_LO value to report after FWSEC */
+
+    /* GSP-RM msgq emulation (physical path, guest-sysmem queues) */
+    struct gsp_rm_emu *rm_emu;
 };
 
+/* Shadow accessors shared with gsp_rm_emulation.c */
+static inline void gsp_emu_shadow_write32(struct gsp_emu_context *ctx,
+					  u32 offset, u32 val)
+{
+	writel(val, ctx->bar0_vaddr + offset);
+}
+
+static inline u32 gsp_emu_shadow_read32(struct gsp_emu_context *ctx, u32 offset)
+{
+	return readl(ctx->bar0_vaddr + offset);
+}
+
 /* ============================================================
  * Public API
  * ============================================================ */