gr: r420b author the guest QMD release on every outcome when release0 is redirected

With gsp_phys_rmcall_gr_rel_mod=1 (release0 -> module semaphore, the
ordering fix for the engine-release-before-copy-out race) the engine never
writes the guest's own QMD release word, so the host must author it on
EVERY backend outcome. The hold's success/fail edges do; a launch with no
deferred release records (no hold engaged) fell through and its client hung
on a word nothing would ever write - the r414 saxpy f0 cur=5 stall.

The backend now reports qmd_rel_redirected in the copy result whenever it
points release0 at the module semaphore (rel_mod, or no targetable guest
release page). svc_fwd_gr_work folds that into the existing
gr_rel_unobserved latch, which makes the bounded outcome check author the
word on done (success or failure) - the same forward-only write the hold
edges perform. rel_mod=0 paths are unchanged (the engine still authors the
word and the latch is only set on an unresolved release page).

1 files changed, 11 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index f7ad153..cf5061d 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -18602,6 +18602,7 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 	const u8 *guest_param_pg;
 	u32 want_qmd = 0, want_ch = 0;
 	bool qmd_rel = false, ch_rel = false;
+	bool qmd_rel_redirected = false;	/* r420b: release0 -> module sem */
 	u64 qmd_rel_hpa = 0, ch_rel_hpa = 0;
 	u64 ch_sem_va = GSP_PHYS_RMCALL_VA_SEM + 4;
 	u64 qmd_dst = GSP_PHYS_RMCALL_VA_SRC;
@@ -18859,6 +18860,15 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 			 */
 			qmd_rel_hpa = 0;
 			qmd_rel_off = 0;
+			/*
+			 * r420b: the ENGINE will not write the guest's QMD
+			 * release word this launch (rel_mod, or no targetable
+			 * guest release page). Tell the caller so it authors
+			 * the word in software on every outcome - otherwise a
+			 * launch without deferred release records is never
+			 * completed on the guest word (the r414 saxpy hang).
+			 */
+			qmd_rel_redirected = true;
 		}
 	}
 
@@ -21432,6 +21442,7 @@ out:
 		out->elapsed_ms = jiffies_to_msecs(jiffies - start);
 		out->rc = ret;
 		out->fault = fault;
+		out->qmd_rel_redirected = qmd_rel_redirected;
 	}
 	return ret;
 }