vgsp: GR forwarding static-review fixes (GR/CE slot bit, release VA->PA, shadow refusal)

Five defects found in a static review of the default-off GR forwarding path
(no hardware test possible; GPU wedged):

- clear the shared request slot's GR mode bit when a CE request is filled,
  so a prior GR request can never make a later CE push run the GR work
  function with stale fields;
- resolve the QMD release0 guest VA to a guest PA on the service thread
  (counter pin/derive, else the trusted resolver) and only convert PA->HPA
  in the work item; the previous code fed the VA to the PA-based translator
  and would write release0 into an unrelated guest page;
- take the refusal path (goto gr_page_unmapped) on every Tier-2 shadow
  failure instead of continuing to submit a half-built method stream;
- consume the QMD run on replay passes when the GR forward is enabled so
  replayed QMD words are never reinterpreted as CE method headers;
- only queue a captured GR candidate against the channel that captured it.

Build clean (make -C kernel, W=1 only pre-existing warnings).

1 files changed, 4 insertions, 3 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index bf70cd5..ebe873b 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -11295,20 +11295,20 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 
 			if (n_shadow >= GSP_PHYS_RMCALL_GR_SHADOW_PAGES) {
 				gsp_phys_gr_pool_exhausted++;
-				continue;
+				goto gr_page_unmapped;
 			}
 			if (!sh->pages) {
 				ret = gsp_phys_chunk_alloc(boot_stage.pdev, sh,
 							   GSP_PHYS_RMCALL_GR_SHADOW_PAGES);
 				if (ret) {
 					gsp_phys_gr_pool_exhausted++;
-					continue;
+					goto gr_page_unmapped;
 				}
 				gsp_phys_chunk_zero(sh);
 			}
 			sh_page = gsp_phys_chunk_page_va(sh, n_shadow);
 			if (!sh_page)
-				continue;
+				goto gr_page_unmapped;
 			memset(sh_page, 0, GSP_PHYS_PAGE_SIZE);
 			for (j = 0; j < req->n_inl; j++) {
 				const struct gsp_phys_gr_inline *inl =
@@ -11351,6 +11351,7 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 				}
 			}
 		}
+gr_page_unmapped:
 		if (!mapped) {
 			mutex_unlock(&gsp_phys_rm_lock);
 			gsp_phys_gr_refused++;