vgsp: fail4 - device-survival chain for the large-buffer sequence + CE both-side op advance

Survival (the death cascade is gone for the full user sequence):
1. pool residue re-seed applies ABSOLUTE (cur=0) - the UVM assert
   (uvm_channel.c:204) that took the device down no longer fires
   (committed earlier in 67148bd8).
2. completion-hint window 10s->1.5s (67148bd8).
3. status-ring free-space discipline in gsp_rm_send_flags: the
   guest's consumption cursor (msgqRxHeader.readPtr at stat+rxHdrOff,
   the msgqTxGetFreeSpace source) gates EVENT posts; events drop
   freely when short, replies wait (bounded) and proceed. A guard
   rejects a cursor the guest cannot be behind (peer > our writePtr -
   the observed mirror tracks writePtr+1 and gating on it silenced
   every wake-up and wedged the clients).
Verified live: mail OK, nvidia-smi OK, victory_matmul OK,
vector_add completes (content still wrong) and victory_transformer
STATUS OK AFTER it - no ISR panic, no guest death, guest ssh alive.

Content: CE linear auto-advance now applied to BOTH offset registers
after each executed op (the driver re-sets one side per op and the
engine advances the other; H2D ops showed an explicit advancing dst
with a fixed src base: the device a held h_a[0..1MB) replicated).
vector_add content still FAIL (~66% bad) - the H2D operand stream
under retry/replay passes is the next lead (opadd rows show five dst
x two src combos with heavy retry multiplicity).

1 files changed, 17 insertions, 6 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 587fb96..6c75a9e 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -8341,13 +8341,24 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf,
 				struct svc_memset_op *lm = &ops[n_ops - 1];
 
 				/*
-				 * fail4 A/B note: a CE-style auto-advance of
-				 * st.offset_out per op was tried here and
-				 * reverted - it did not change the memset
-				 * coverage and the driver's per-op re-sets are
-				 * already decoded, so the executed dsts match
-				 * the stream.
+				 * fail4 CE linear auto-advance, BOTH sides: the
+				 * driver re-sets only ONE offset per op and the
+				 * copy engine advances the other by the transfer
+				 * size. H2D ops show an explicit advancing DST
+				 * with a FIXED SRC base (every 1 MB chunk read
+				 * the source base again: vector_add's device a
+				 * held h_a[0..1MB) x4 -> 75% mismatch; the
+				 * readbacks are the mirror image). Advance both
+				 * registers; an explicit re-set simply overrides.
 				 */
+				{
+					u64 adv = (lm->type == 1) ? lm->bytes :
+						  (u64)lm->elem * lm->count;
+
+					st.offset_out += adv;
+					if (lm->type == 1)
+						st.offset_in += adv;
+				}
 				if (svc.opadd_log < 2048) {
 					svc.opadd_log++;
 					pr_info("sema-opadd: h=0x%x type=%u dst=0x%llx src=0x%llx bytes=%llu elem=%u count=%u ap=%u src_ap=%u phys=%u src_phys=%u\n",