kernel: Fix guest-hang root cause (VFIO mmap garbage PFN) + rebuild mdev remove path

VFIO mmap (main.c): virt_to_phys() was used on vmalloc-family addresses
(vzalloc'd BAR0 shadow, ioremap'd BAR2/3), producing garbage PFNs. Guest
BAR0 access then hit a KVM make_spte reserved-bits WARN and an
EPT-violation livelock, hard-wedging the guest on every nvidia driver
probe (confirmed via QEMU GDB stub). BAR0 now maps per-page via
vmalloc_to_pfn(); BAR2/3/4/5 map bars[N].gpa directly (like BAR1);
config space uses new nv_vgpu_mmap_virt_to_pfn() helper.

mdev remove path (main.c): old path never list_del'd the device
(available_instances leaked), never ran cleanup (leaked gsp_emu kthread),
never unregistered VFIO (leaked /dev/vfio/N + iommu group), never put
pdev, never freed the struct. New kvmgt-style path: cancel init_work ->
wait fds -> vfio_unregister_group_dev -> cleanup work -> list_del ->
pci_dev_put -> vfio_put_device.

gsp_rpc_client.c: fix dma_map_page dma_addr_t->int truncation in
gsp_rpc_alloc_emul (corrupts >=4GB IOVAs); export gsp_client_init_emulation.

gsp_emulation.c: export gsp_emu_process_rpc and gsp_emu_get_stats.

main.c: remove wrong MODULE_SOFTDEP("pre: nvidia") - module has zero
nvidia imports, loads standalone, and must load BEFORE nvidia.ko
(it exports nvidia_vgpu_vfio_* for nvidia.ko to import).

nvidia-vgpu-vfio.h: NULL-safe nv_vgpu_{dbg,info,warn,err} macros.

tests/gsp_emulation_test.c: rewritten against current API - drives
gsp_emu_process_rpc() with crafted shared-memory messages (protocol
validation, SCHEDULE/YIELD/NOTIFY/DEBUG dispatch, stress). Builds with
KBUILD_EXTRA_SYMBOLS; depends: open-iov-vfio.

stack_manager.sh: vfio_mdev doesn't exist on >=6.4 (probe per-module);
load-nvidia detects foreign nvidia via /sys/module/nvidia/version and
errors with guidance instead of silently skipping.

1 files changed, 7 insertions, 5 deletions

diff --git a/kernel/gsp_rpc_client.c b/kernel/gsp_rpc_client.c
index e91d5f6..ae45513 100644
--- a/kernel/gsp_rpc_client.c
+++ b/kernel/gsp_rpc_client.c
@@ -562,7 +562,7 @@ int gsp_rpc_alloc_emul(struct gsp_client *client,
     struct nv_vgpu_device *vgpu = client->dev->driver_data;
     struct gsp_vram_alloc *alloc;
     u64 va = addr_hint ? addr_hint : 0x100000000ULL; /* Default 4GB */
-    int ret;
+    dma_addr_t iova;
 
     alloc = kzalloc(sizeof(*alloc), GFP_KERNEL);
     if (!alloc)
@@ -612,9 +612,10 @@ int gsp_rpc_alloc_emul(struct gsp_client *client,
     }
     alloc->mapping->pinned = true;
 
-    /* Map to IOVA for DMA */
-    ret = dma_map_page(&vgpu->pdev->dev, alloc->mapping->pages[0], 0, size, DMA_BIDIRECTIONAL);
-    if (dma_mapping_error(&vgpu->pdev->dev, ret)) {
+    /* Map to IOVA for DMA (dma_addr_t is 64-bit - do NOT truncate into int;
+     * with an IOMMU the IOVA may exceed 32 bits) */
+    iova = dma_map_page(&vgpu->pdev->dev, alloc->mapping->pages[0], 0, size, DMA_BIDIRECTIONAL);
+    if (dma_mapping_error(&vgpu->pdev->dev, iova)) {
         for (int i = 0; i < alloc->mapping->page_count; i++)
             __free_page(alloc->mapping->pages[i]);
         vfree(alloc->mapping->pages);
@@ -622,7 +623,7 @@ int gsp_rpc_alloc_emul(struct gsp_client *client,
         kfree(alloc);
         return -ENOMEM;
     }
-    alloc->mapping->iova = ret;
+    alloc->mapping->iova = iova;
     alloc->mapping->mapped = true;
 
     alloc->gpu_va = va;
@@ -1070,6 +1071,7 @@ int gsp_wpr_scratch_mutex_release(struct gsp_client *client, u32 wpr_id)
  * ============================================================ */
 
 EXPORT_SYMBOL(gsp_client_init);
+EXPORT_SYMBOL(gsp_client_init_emulation);
 EXPORT_SYMBOL(gsp_client_fini);
 EXPORT_SYMBOL(gsp_rpc_alloc);
 EXPORT_SYMBOL(gsp_rpc_free);