vgsp: route direct-GL draw-synth captures through the verbatim 3D replay lane; beef rel_mod launches may take the ch_rel release branch (eng24)

Clause 1 (gsp_sema_service.c, svc_gl_flush): the direct-GL (beef-family)
section captures opened by the eng23 inside-run openers carry synthesized
PROG/PARAM/REL (src=draw-synth) but a REAL method window; include 'd' in
the stream-3d marking (single 448-word block and the method-aligned chunk
split) so the window replays verbatim on the engine like the X/stream/hold
lanes, instead of waiting on a synthesized compute-QMD release the engine
never writes. Verified live: '3D stream chunked h=0xbeef0100 push=0x4250110
window=779 words -> 3 chunk(s)' and 'GR LAUNCH submitted h=0xbeef0100 ...
polling qmd_rel=0'.

Clause 2 (gsp_phys_booter.c, gsp_phys_backend_guest_gr_submit): a
beef-family launch whose QMD release0 was redirected to the module
semaphore with the rel_mod sentinel (0x600df00d) may break its poll on the
channel release alone (the X lane's proven branch) once the engine has
retired the method block; witnessed by 'GR LAUNCH OK ch_rel branch (beef
rel_mod; ...)'. Verified live: 4+ beef launches now complete (engine fetch
OK, GUEST GR LAUNCH OK ok=22..25) where the c338 shape timed out
(qmd_rel=0xc0ffee01 want=0x600df00d).

Known residual (unchanged by this commit): the replayed beef windows retire
without stores (NOWRITE-CONFIRMED/AMBIGUOUS, wrote=0 -> px0=0), the same
engine-store wall the X lane shows; and with the default
sema_mme_immature_skip=1 the service soft-completes replayed beef windows
before any engine contact (A/B with the knob at 0 was used to put the real
window on the engine).

1 files changed, 28 insertions, 4 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index de92b8e..e0f1897 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -12815,7 +12815,17 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
 	 * references is covered by the candidate's own mapped pages. The
 	 * 448-word cap leaves headroom for the backend's 512-word method
 	 * block (2 bind words + the window + the 8-word release tail).
-	 * Draw-synth/hold captures are never marked.
+	 *
+	 * eng24 (CONT.485): op_src=draw-synth is now included for the
+	 * direct-GL (beef-family) lane when the raw window geometry holds.
+	 * The draw-synth op_src only means the section's PROGRAM/PARAM/REL
+	 * operands were synthesized (the beef push carries none); the WINDOW
+	 * itself is the client's real method stream (BEGIN/END + RT setup +
+	 * draw state), which is exactly what the verbatim 3D replay lane
+	 * wants. Excluding 'd' sent these captures down the synthesized
+	 * compute-QMD lane, where the launch waits for a QMD release the
+	 * engine never writes (qmd_rel=0xc0ffee01 want=0x600df00d) instead
+	 * of taking the X lane's proven ch_rel branch.
 	 *
 	 * SESSION 153-CONTINUED-10: op_src=hold is included. The GLX
 	 * server's per-frame CONTENT pushes carry the draw window but no
@@ -12827,7 +12837,17 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
 	 * raw 3D method window the r929 replay lane wants; the synthesized
 	 * compute fields are what stream_3d bypasses.
 	 */
-	if ((op_src[0] == 's' || op_src[0] == 'h') && svc_gr_cand.valid &&
+	/*
+	 * eng24 (CONT.485): the direct-GL lane's draw-synth captures ('d')
+	 * join the replay lanes when the whole push survived in raw[] and
+	 * the window starts at a real method (same geometry gates as 's'/'h';
+	 * the 'd' operands are synthetic but the window bytes are real). Gate
+	 * to the beef family so no other client's capture changes lane.
+	 */
+	if ((op_src[0] == 's' || op_src[0] == 'h' ||
+	     (op_src[0] == 'd' &&
+	      (ch->h_object & 0xfffff000u) == 0xbeef0000u)) &&
+	    svc_gr_cand.valid &&
 	    len == svc_gr_cand.push_n * 4 &&
 	    svc_gl.start_off + 8u <= at_off &&
 	    (at_off - svc_gl.start_off) / 4u <= 448u) {
@@ -12837,7 +12857,9 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
 		pr_info("sema-gl: 3D stream marked h=0x%x push=0x%llx window=%u words @off=0x%x (verbatim replay from the C597 bind)\n",
 			ch->h_object, push_va, svc_gr_cand.stream_n,
 			svc_gl.start_off);
-	} else if ((op_src[0] == 's' || op_src[0] == 'h') &&
+	} else if ((op_src[0] == 's' || op_src[0] == 'h' ||
+		    (op_src[0] == 'd' &&
+		     (ch->h_object & 0xfffff000u) == 0xbeef0000u)) &&
 		   svc_gr_cand.valid) {
 		/*
 		 * SESSION 153-CONTINUED-45: a REAL-operand section whose
@@ -12875,7 +12897,9 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
 	 * This is read-only and names the exact values the ENGINE will see;
 	 * an index size of 1 means the buffer is read as 16-bit indices.
 	 */
-	if ((op_src[0] == 's' || op_src[0] == 'h') &&
+	if ((op_src[0] == 's' || op_src[0] == 'h' ||
+	     (op_src[0] == 'd' &&
+	      (ch->h_object & 0xfffff000u) == 0xbeef0000u)) &&
 	    svc_gl_draw_args_log < 64 && svc_gl.start_off < at_off &&
 	    at_off <= len) {
 		u32 o = svc_gl.start_off;