gsp-phys: relay verify hardening and counter exposure (default off)

- the work_relay state line now reports the real backend data-compare
  verify_fail plus a verify_transient count, distinct from the sema-service
  hold re-read verify_fail (previously the backend counter was dropped)
- a relayed copy whose host-side compare fails is re-read and re-compared
  once after a short delay; a transient mismatch counts as success and only
  a persistent mismatch falls back to the software apply as before
- the final-mismatch diagnostic now logs the semaphore target/payload/poll
  time, the first differing byte and 16-byte dumps of live dst, live src and
  a submit-time analysis material, flagging source mutation vs snapshot/dst
- the fault no_event path logs the post reason/return
All changes are behind the default-off relay path.

1 files changed, 5 insertions, 3 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index 4b429ea..d5a62e9 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -123,9 +123,11 @@ void gsp_sema_service_fwd_hold_stats(u64 *copy_skipped, u64 *copy_soft,
  * engine-authored guest semaphore was verified (ok) with their software
  * applies skipped (skipped_sw), relays that fell back to the software apply
  * (fallback: engine failure/timeout/abort or a word that did not carry the
- * payload), hold re-reads that did not see the payload (verify_fail) and
- * work-item semaphore HPA resolution failures (resolve_fail). All zero while
- * gsp_phys_relay=0. Plain reads, safe from the debugfs show path.
+ * payload), hold re-reads that did not see the payload (verify_fail, shown as
+ * hold_verify_fail in the state line, distinct from the backend compare's
+ * verify_fail) and work-item semaphore HPA resolution failures (resolve_fail).
+ * All zero while gsp_phys_relay=0. Plain reads, safe from the debugfs show
+ * path.
  */
 void gsp_sema_service_fwd_relay_stats(u64 *requested, u64 *ok, u64 *fallback,
 				      u64 *skipped_sw, u64 *verify_fail,