kernel: capture the guest's PROMOTE_CTX entries; add promote mode 19 (guest-faithful 9-entry set)

- gsp_rm_emulation: dump every guest GPU_PROMOTE_CTX (0x2080012b) params and
  entries so the real client's promote shape is observable (captured on the
  emulation path: MAIN 2 MB PA+VA, PATCH, BUNDLE_CB/PAGEPOOL/ATTRIBUTE_CB/
  RTV_CB_GLOBAL VA-only, FECS, PRIV, UNRESTRICTED)
- gsp_phys_booter: promote mode 19 replays that exact 9-entry shape on the V5
  channel with host buffers (MAIN 2 MB + PDB map, small buffers, booking-only
  VAs); clamp 0..19
- docs/eng-ops: mode-19 result recorded - the server never replied (fn76 -110)
  and the release fail-safe held WPR2/GPU until an approved reboot; mode 19 is
  known-wedging

1 files changed, 61 insertions, 0 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index ad0b4f5..1f636de 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -3027,6 +3027,67 @@ static void gsp_rm_handle_rm_control(struct gsp_emu_context *ctx,
 			&out_status, reply + GSP_RM_CTRL_HDR_SIZE, &out_params_size);
 		break;
 
+	case 0x2080012b: { /* NV2080_CTRL_CMD_GPU_PROMOTE_CTX */
+		/*
+		 * The stock guest promotes its GR virtual contexts through this
+		 * control during channel setup. The emulation answers SUCCESS
+		 * (the physical backend owns execution), but the guest's entry
+		 * shapes are the ground truth for what a real client sends:
+		 * capture them (all fields, all entries) so the physical ladder
+		 * can be driven with the exact same promote shape.
+		 */
+		const u8 *pp = req_data + GSP_RM_CTRL_HDR_SIZE;
+		u32 engine_type = 0, h_cli = 0, ch_id = 0, h_chan_cli = 0;
+		u32 h_obj = 0, h_virt = 0, entry_count = 0, i, ecap;
+
+		if (req.paramsSize >= 48) {
+			memcpy(&engine_type, pp + 0, 4);
+			memcpy(&h_cli, pp + 4, 4);
+			memcpy(&ch_id, pp + 8, 4);
+			memcpy(&h_chan_cli, pp + 12, 4);
+			memcpy(&h_obj, pp + 16, 4);
+			memcpy(&h_virt, pp + 20, 4);
+			{
+				u64 va = 0, sz = 0;
+
+				memcpy(&va, pp + 24, 8);
+				memcpy(&sz, pp + 32, 8);
+				memcpy(&entry_count, pp + 40, 4);
+				ecap = min_t(u32, entry_count, 16u);
+				nv_vgpu_info(ctx->vgpu,
+					     "vgsp-rm: PROMOTE_CTX engine=0x%x hClient=0x%x chId=%u hChanClient=0x%x hObject=0x%x hVirtMemory=0x%x va=0x%llx size=0x%llx entryCount=%u",
+					     engine_type, h_cli, ch_id,
+					     h_chan_cli, h_obj, h_virt, va,
+					     sz, entry_count);
+			}
+			for (i = 0; i < ecap &&
+			     48u + (i + 1u) * 32u <= req.paramsSize; i++) {
+				const u8 *e = pp + 48 + i * 32;
+				u64 pa = 0, eva = 0, esz = 0;
+				u32 attr = 0;
+				u16 bid = 0;
+
+				memcpy(&pa, e + 0, 8);
+				memcpy(&eva, e + 8, 8);
+				memcpy(&esz, e + 16, 8);
+				memcpy(&attr, e + 24, 4);
+				memcpy(&bid, e + 28, 2);
+				nv_vgpu_info(ctx->vgpu,
+					     "vgsp-rm:   promote[%u] bufferId=%u bInitialize=%u bNonmapped=%u physAttr=0x%x pa=0x%llx va=0x%llx size=0x%llx",
+					     i, bid, e[30], e[31], attr, pa,
+					     eva, esz);
+			}
+		}
+		out_status = 0;
+		out_params_size = req.paramsSize;
+		if (req.paramsSize &&
+		    req.paramsSize + GSP_RM_CTRL_HDR_SIZE <=
+				GSPRM_MAX_SINGLE_ELEM_DATA)
+			memcpy(reply + GSP_RM_CTRL_HDR_SIZE, pp,
+			       req.paramsSize);
+		break;
+	}
+
 	default:
 		/* Unknown control command - return success with zeroed params.
 		 * Do NOT echo the request: pure queries pass uninitialized