gr: r420b author the guest QMD release on every outcome when release0 is redirected

With gsp_phys_rmcall_gr_rel_mod=1 (release0 -> module semaphore, the
ordering fix for the engine-release-before-copy-out race) the engine never
writes the guest's own QMD release word, so the host must author it on
EVERY backend outcome. The hold's success/fail edges do; a launch with no
deferred release records (no hold engaged) fell through and its client hung
on a word nothing would ever write - the r414 saxpy f0 cur=5 stall.

The backend now reports qmd_rel_redirected in the copy result whenever it
points release0 at the module semaphore (rel_mod, or no targetable guest
release page). svc_fwd_gr_work folds that into the existing
gr_rel_unobserved latch, which makes the bounded outcome check author the
word on done (success or failure) - the same forward-only write the hold
edges perform. rel_mod=0 paths are unchanged (the engine still authors the
word and the latch is only set on an unresolved release page).

1 files changed, 11 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h
index 42729d8..80beb54 100644
--- a/kernel/gsp_phys_booter.h
+++ b/kernel/gsp_phys_booter.h
@@ -275,6 +275,17 @@ struct gsp_phys_backend_copy_result {
 	u32 elapsed_ms;		/* return-to-caller elapsed milliseconds */
 	int rc;			/* duplicated function return code */
 	struct gsp_phys_fault_info fault;	/* decoded engine fault, if any */
+	/*
+	 * r420b: the forwarded launch's QMD release0 was redirected to the
+	 * module semaphore (gsp_phys_rmcall_gr_rel_mod=1, or an unresolved
+	 * guest release page), so the ENGINE will never write the guest's own
+	 * QMD release word. The caller must author it in software on every
+	 * outcome (the same write the hold's success edge performs); without
+	 * this a rel_mod=1 launch with no deferred release records is never
+	 * completed on the guest word and the client hangs (the r414 saxpy
+	 * f0 cur=5 stall).
+	 */
+	bool qmd_rel_redirected;
 };
 
 int gsp_phys_backend_guest_ce_copy_ex(u64 src_hpa, u32 src_off, u64 dst_hpa,