gsp-phys: relay verify hardening and counter exposure (default off)

- the work_relay state line now reports the real backend data-compare
  verify_fail plus a verify_transient count, distinct from the sema-service
  hold re-read verify_fail (previously the backend counter was dropped)
- a relayed copy whose host-side compare fails is re-read and re-compared
  once after a short delay; a transient mismatch counts as success and only
  a persistent mismatch falls back to the software apply as before
- the final-mismatch diagnostic now logs the semaphore target/payload/poll
  time, the first differing byte and 16-byte dumps of live dst, live src and
  a submit-time analysis material, flagging source mutation vs snapshot/dst
- the fault no_event path logs the post reason/return
All changes are behind the default-off relay path.

1 files changed, 11 insertions, 6 deletions

diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h
index 52d9c43..81f1803 100644
--- a/kernel/gsp_phys_booter.h
+++ b/kernel/gsp_phys_booter.h
@@ -247,6 +247,10 @@ void gsp_phys_backend_work_counters(u64 *submitted, u64 *released,
  * semaphore word observed, the elapsed milliseconds and the return code. A
  * zero sem_hpa keeps the module-semaphore behavior byte-identical.
  * gsp_phys_backend_guest_ce_copy() is a wrapper for the zero-relay form.
+ * A relay data-verify mismatch sleeps 2 ms and re-reads both pages once
+ * (live guest-writable RAM): a mismatch that clears counts as a transient and
+ * stays a verified copy, a persistent one counts as verify_fail and fails
+ * closed to the caller's software release.
  */
 int gsp_phys_backend_guest_ce_copy(u64 src_hpa, u32 src_off, u64 dst_hpa,
 				   u32 dst_off, u32 bytes, u32 poll_ms);
@@ -281,14 +285,15 @@ int gsp_phys_backend_guest_ce_copy_ex(u64 src_hpa, u32 src_off, u64 dst_hpa,
 
 /*
  * gsp_phys_backend_relay_counters() reads the P6c relay-path counters
- * (requested relay copies, verified relays, data verify failures, guest
- * semaphore poll timeouts, gate/structural refusals and scratch-pool
- * exhaustion) for logging and the gsp-phys-state work_relay line. All zero
- * unless gsp_phys_relay=1 copies ran.
+ * (requested relay copies, verified relays, final data verify failures,
+ * transient verify mismatches resolved by the one retry, guest semaphore poll
+ * timeouts, gate/structural refusals and scratch-pool exhaustion) for logging
+ * and the gsp-phys-state work_relay line. All zero unless gsp_phys_relay=1
+ * copies ran.
  */
 void gsp_phys_backend_relay_counters(u64 *requested, u64 *ok, u64 *verify_fail,
-				     u64 *timeouts, u64 *refused,
-				     u64 *pool_exhausted);
+				     u64 *verify_transient, u64 *timeouts,
+				     u64 *refused, u64 *pool_exhausted);
 
 /*
  * P6c C3 fault observation/relay (gsp_phys_fault_relay=1; default off).