gsp-phys: relay verify hardening and counter exposure (default off)

- the work_relay state line now reports the real backend data-compare
  verify_fail plus a verify_transient count, distinct from the sema-service
  hold re-read verify_fail (previously the backend counter was dropped)
- a relayed copy whose host-side compare fails is re-read and re-compared
  once after a short delay; a transient mismatch counts as success and only
  a persistent mismatch falls back to the software apply as before
- the final-mismatch diagnostic now logs the semaphore target/payload/poll
  time, the first differing byte and 16-byte dumps of live dst, live src and
  a submit-time analysis material, flagging source mutation vs snapshot/dst
- the fault no_event path logs the post reason/return
All changes are behind the default-off relay path.

1 files changed, 24 insertions, 6 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 2b52c0e..d42edab 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -486,9 +486,10 @@ struct sema_svc {
 	 * engine-authored guest semaphore was verified with the software apply
 	 * skipped (fwd_relay_ok/fwd_relay_skipped_sw), relays that fell back to
 	 * the software apply (fwd_relay_fallback), hold re-reads that did not
-	 * see the payload (fwd_relay_verify_fail) and work-item semaphore HPA
-	 * resolution failures (fwd_relay_resolve_fail). All zero while the
-	 * parameter is off.
+	 * see the payload (fwd_relay_verify_fail, shown as hold_verify_fail in
+	 * the state line to keep it distinct from the booter compare's
+	 * verify_fail) and work-item semaphore HPA resolution failures
+	 * (fwd_relay_resolve_fail). All zero while the parameter is off.
 	 */
 	u64			fwd_relay_requested;
 	u64			fwd_relay_ok;
@@ -6121,11 +6122,28 @@ static void svc_fwd_fault_deliver(struct nv_vgpu_device *vgpu,
 		pr_info("gsp-phys-fault: FAULT RELAY ch=0x%x hwchid=%u rl=%u except=0x%x engine=%u delivered=%llu\n",
 			ch->h_object, f->chid, f->runlist_id, f->except_type,
 			engine, svc.fwd_fault_delivered);
-	if (gsp_rm_post_channel_event(vgpu, ch->h_object)) {
+	/*
+	 * C3 hardening: decode the helper's failure at the call site. -ENODEV
+	 * is a missing RM context / channel handle; -ENOENT is the helper's
+	 * post-attempt path finding no postable event at all (it already
+	 * retried every valid registered event as a fallback), so the exact
+	 * "no event for this handle" reason is not recoverable from the
+	 * return code alone.
+	 */
+	ret = gsp_rm_post_channel_event(vgpu, ch->h_object);
+	if (ret) {
+		const char *why;
+
+		if (ret == -ENODEV)
+			why = "no-rm-context-or-handle";
+		else if (ret == -ENOENT)
+			why = "no-postable-event";
+		else
+			why = "event-post-send-failed";
 		svc.fwd_fault_no_event++;
-		pr_info("gsp-phys-fault: FAULT RELAY no event ch=0x%x hwchid=%u rl=%u except=0x%x no_event=%llu\n",
+		pr_info("gsp-phys-fault: FAULT RELAY no event ch=0x%x hwchid=%u rl=%u except=0x%x reason=%s ret=%d no_event=%llu\n",
 			ch->h_object, f->chid, f->runlist_id, f->except_type,
-			svc.fwd_fault_no_event);
+			why, ret, svc.fwd_fault_no_event);
 	}
 }