vgsp: route direct-GL draw-synth captures through the verbatim 3D replay lane; beef rel_mod launches may take the ch_rel release branch (eng24)

Clause 1 (gsp_sema_service.c, svc_gl_flush): the direct-GL (beef-family)
section captures opened by the eng23 inside-run openers carry synthesized
PROG/PARAM/REL (src=draw-synth) but a REAL method window; include 'd' in
the stream-3d marking (single 448-word block and the method-aligned chunk
split) so the window replays verbatim on the engine like the X/stream/hold
lanes, instead of waiting on a synthesized compute-QMD release the engine
never writes. Verified live: '3D stream chunked h=0xbeef0100 push=0x4250110
window=779 words -> 3 chunk(s)' and 'GR LAUNCH submitted h=0xbeef0100 ...
polling qmd_rel=0'.

Clause 2 (gsp_phys_booter.c, gsp_phys_backend_guest_gr_submit): a
beef-family launch whose QMD release0 was redirected to the module
semaphore with the rel_mod sentinel (0x600df00d) may break its poll on the
channel release alone (the X lane's proven branch) once the engine has
retired the method block; witnessed by 'GR LAUNCH OK ch_rel branch (beef
rel_mod; ...)'. Verified live: 4+ beef launches now complete (engine fetch
OK, GUEST GR LAUNCH OK ok=22..25) where the c338 shape timed out
(qmd_rel=0xc0ffee01 want=0x600df00d).

Known residual (unchanged by this commit): the replayed beef windows retire
without stores (NOWRITE-CONFIRMED/AMBIGUOUS, wrote=0 -> px0=0), the same
engine-store wall the X lane shows; and with the default
sema_mme_immature_skip=1 the service soft-completes replayed beef windows
before any engine contact (A/B with the knob at 0 was used to put the real
window on the engine).

1 files changed, 31 insertions, 1 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index d61df37..e1563dd 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -28359,6 +28359,17 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 	u32 want_qmd = 0, want_ch = 0;
 	bool qmd_rel = false, ch_rel = false;
 	/*
+	 * eng24 (CONT.485): this launch's QMD release0 was redirected to the
+	 * module semaphore with the rel_mod sentinel (0x600df00d) - an edge
+	 * only the ENGINE writes when the QMD itself completes. On the
+	 * direct-GL (beef) lane the QMD is synthesized (draw-synth) and never
+	 * completes, while the engine DOES retire the method block (ch_rel).
+	 * The X lane's proven release branch is ch_rel alone; allow it for
+	 * this exact case so the launch does not wait on a synthetic edge.
+	 */
+	bool qmd_rel_mod_sem = false;
+	bool beef_lane = req && (req->h_object & 0xfffff000u) == 0xbeef0000u;
+	/*
 	 * r929 (Path A): this submission is a raw 3D method window. The QMD
 	 * machinery (qmdwin relocation, QMD prewrite, release0 redirect,
 	 * PCAS) does not apply: the block is SET_OBJECT C597 + the window +
@@ -28784,6 +28795,7 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 				GSP_PHYS_RMCALL_GR_QMD_REL_PAYLOAD;
 			want_qmd = qmd[25];
 			qmd_rel = true;
+			qmd_rel_mod_sem = rel_mod;
 			/*
 			 * The module-sem fallback leaves qmd_rel_hpa 0 so the
 			 * poll reads the SEM chunk through sem_va below.
@@ -31821,7 +31833,25 @@ gr_page_unmapped:
 						ch_rel_off));
 		else
 			w1 = READ_ONCE(*(u32 *)(sem_va + 4));
-		if ((!qmd_rel || w0 == want_qmd) && w1 == want_ch) {
+		if ((!qmd_rel || w0 == want_qmd ||
+		     (qmd_rel_mod_sem && beef_lane)) && w1 == want_ch) {
+			/*
+			 * eng24 (CONT.485): the alternate (beef rel_mod) break -
+			 * the engine retired the method block and wrote the
+			 * channel release, but the synthesized QMD's module-sem
+			 * release never landed. The X lane's branch is ch_rel
+			 * alone; witness this launch's use of it.
+			 */
+			if (qmd_rel_mod_sem && beef_lane && w0 != want_qmd) {
+				static u32 qmdrel_alt_log;
+
+				if (qmdrel_alt_log < 64) {
+					qmdrel_alt_log++;
+					pr_info("vgsp-gr: GR LAUNCH OK ch_rel branch (beef rel_mod; qmd=%08x want=%08x ch=%08x) h=0x%x push=0x%llx\n",
+						w0, want_qmd, w1,
+						req->h_object, req->push_va);
+				}
+			}
 			/*
 			 * r1453 PAIR-CHAIN: this launch retired. If its
 			 * emitted window carried BEGIN/END runs, the pair