gsp-phys: P6c C3 - relay forwarded-engine faults to the guest (default off)

New default-off gsp_phys_fault_relay: when a relayed copy times out, the
GSP-RM status queue is drained and the first OS_ERROR_LOG (0x1006) recorded
after the submission's doorbell is decoded (NOCAT corroboration), matched
against the ladder channel's runlist/chid, and delivered to the guest by
writing its channel notifier (info32=exceptType, info16=engine type,
status=0xffff) and posting the channel event. A late-release recheck skips
delivery if the engine actually completed, one delivery per hold, and the
existing software fallback always runs first, so no release or data is lost.

- pure decode helpers extracted from the status printers; prints unchanged
- status-queue walks serialized with a mutex; unmatched 0x1006 records are
  no longer silently dropped
- fault epoch snapshot at the doorbell prevents stale records from matching
- fault counters and faults:/fault_relay: state lines
- default-off gsp_phys_fault_inject debug knob forces the next relayed
  pair's source PTE to zero to produce a real engine fault
- pump notifier latch prevents clobbering a delivered fault

Live: injection run produced a real CE0 FAULT_PTE (0x1f @0x200000), decoded
with errString, chid/runlist matched, notifier delivered, software fallback
applied (applied+fallback==engaged), clean release; the guest RM reacted to
the delivered fault by tearing down its channels (faithful semantics).
Healthy control: faults all zero, relay requested=40 ok=40, smoke
matched=64/64, clean release. Caveat: the auxiliary event post failed
(no_event=1, no MSI-X) and the guest teardown means fault injection is not
smoke-compatible; the parameter stays off.

1 files changed, 43 insertions, 0 deletions

diff --git a/kernel/gsp_phys_gpu.c b/kernel/gsp_phys_gpu.c
index fc84c1d..cfa3d4e 100644
--- a/kernel/gsp_phys_gpu.c
+++ b/kernel/gsp_phys_gpu.c
@@ -273,6 +273,49 @@ bool gsp_phys_relay_enabled(void)
 EXPORT_SYMBOL_GPL(gsp_phys_relay_enabled);
 
 /*
+ * P6c C3 engine-fault relay (default 0). When set together with
+ * gsp_phys_relay=1, gsp_phys_work_forward=1, gsp_phys_guest_mem=1 and
+ * gsp_phys_work_defer_release=1, a forwarded guest CE copy that times out
+ * drains the GSP-RM status queue for the engine's fault record (function
+ * 0x1006 OS_ERROR_LOG, corroborated by 0x1020 NOCAT when present), matches
+ * its runlistId/chid against the ladder channel derived from the work-submit
+ * token and, on a match, writes the guest channel's notifier (info32=
+ * exceptType, info16=Nv2080 engine type, status=0xffff) and posts the channel
+ * event through the existing MSI-X path. The software release fallback stays
+ * in charge either way; no fault is delivered for a mismatch, a stale record
+ * or a release that landed late. With 0, every relay-timeout behavior is
+ * byte-identical to C0+C1. One-line rollback: gsp_phys_fault_relay=0.
+ */
+static bool gsp_phys_fault_relay_param;
+module_param_named(gsp_phys_fault_relay, gsp_phys_fault_relay_param, bool, 0644);
+MODULE_PARM_DESC(gsp_phys_fault_relay,
+		 "Relay a real CE engine fault to the guest channel notifier when a forwarded relay copy times out (default 0: software fallback only; requires gsp_phys_relay=1 and gsp_phys_work_forward=1 and gsp_phys_guest_mem=1 and gsp_phys_work_defer_release=1)");
+
+bool gsp_phys_fault_relay_enabled(void)
+{
+	return gsp_phys_fault_relay_param;
+}
+EXPORT_SYMBOL_GPL(gsp_phys_fault_relay_enabled);
+
+/*
+ * P6c C3 fault-injection debug knob (default 0). When set, the source PTE of
+ * a relayed pair is written as an invalid zero entry instead of the resolved
+ * host PA, so the next relay submission faults on the engine and the fault
+ * drain/decode/relay path can be observed on demand. Only a relayed pair
+ * (nonzero sem_hpa) is affected; with 0 the PTE write is byte-identical.
+ */
+static bool gsp_phys_fault_inject_param;
+module_param_named(gsp_phys_fault_inject, gsp_phys_fault_inject_param, bool, 0644);
+MODULE_PARM_DESC(gsp_phys_fault_inject,
+		 "Write the relayed pair's source PTE as zero to force an engine fault on the next relay submission (debug, default 0: program the real source HPA)");
+
+bool gsp_phys_fault_inject_enabled(void)
+{
+	return gsp_phys_fault_inject_param;
+}
+EXPORT_SYMBOL_GPL(gsp_phys_fault_inject_enabled);
+
+/*
  * One-way power latch (default). Re-enabling runtime PM and D3cold after a
  * claim lets the board power-gate and the host hard-freeze on resume
  * (observed 2026-10-01); keep the pre-claim D0 policy instead and require