gr: r420b author the guest QMD release on every outcome when release0 is redirected

With gsp_phys_rmcall_gr_rel_mod=1 (release0 -> module semaphore, the
ordering fix for the engine-release-before-copy-out race) the engine never
writes the guest's own QMD release word, so the host must author it on
EVERY backend outcome. The hold's success/fail edges do; a launch with no
deferred release records (no hold engaged) fell through and its client hung
on a word nothing would ever write - the r414 saxpy f0 cur=5 stall.

The backend now reports qmd_rel_redirected in the copy result whenever it
points release0 at the module semaphore (rel_mod, or no targetable guest
release page). svc_fwd_gr_work folds that into the existing
gr_rel_unobserved latch, which makes the bounded outcome check author the
word on done (success or failure) - the same forward-only write the hold
edges perform. rel_mod=0 paths are unchanged (the engine still authors the
word and the latch is only set on an unresolved release page).

1 files changed, 11 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 6585aaf..a465469 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -17173,6 +17173,17 @@ static void svc_fwd_gr_work(void)
 			ga_va, ga_used, ga_led);
 
 	hw_rc = gsp_phys_backend_guest_gr_submit(&gs, &cp);
+	/*
+	 * r420b: the backend redirected the launch's QMD release0 to the
+	 * module semaphore (rel_mod=1 or no targetable guest release page), so
+	 * the ENGINE never writes the guest's own QMD release word. Treat the
+	 * word as unobserved so the bounded outcome check (and the hold's
+	 * edges) author it in software on every outcome; without this a
+	 * rel_mod=1 launch with no deferred release records is never completed
+	 * on the guest word and the client hangs (the r414 saxpy stall).
+	 */
+	if (cp.qmd_rel_redirected)
+		svc_fwd_req.gr_rel_unobserved = true;
 	if (!hw_rc) {
 		svc.fwd_gr_ok++;
 	} else {