vgsp: route direct-GL draw-synth captures through the verbatim 3D replay lane; beef rel_mod launches may take the ch_rel release branch (eng24)

Clause 1 (gsp_sema_service.c, svc_gl_flush): the direct-GL (beef-family)
section captures opened by the eng23 inside-run openers carry synthesized
PROG/PARAM/REL (src=draw-synth) but a REAL method window; include 'd' in
the stream-3d marking (single 448-word block and the method-aligned chunk
split) so the window replays verbatim on the engine like the X/stream/hold
lanes, instead of waiting on a synthesized compute-QMD release the engine
never writes. Verified live: '3D stream chunked h=0xbeef0100 push=0x4250110
window=779 words -> 3 chunk(s)' and 'GR LAUNCH submitted h=0xbeef0100 ...
polling qmd_rel=0'.

Clause 2 (gsp_phys_booter.c, gsp_phys_backend_guest_gr_submit): a
beef-family launch whose QMD release0 was redirected to the module
semaphore with the rel_mod sentinel (0x600df00d) may break its poll on the
channel release alone (the X lane's proven branch) once the engine has
retired the method block; witnessed by 'GR LAUNCH OK ch_rel branch (beef
rel_mod; ...)'. Verified live: 4+ beef launches now complete (engine fetch
OK, GUEST GR LAUNCH OK ok=22..25) where the c338 shape timed out
(qmd_rel=0xc0ffee01 want=0x600df00d).

Known residual (unchanged by this commit): the replayed beef windows retire
without stores (NOWRITE-CONFIRMED/AMBIGUOUS, wrote=0 -> px0=0), the same
engine-store wall the X lane shows; and with the default
sema_mme_immature_skip=1 the service soft-completes replayed beef windows
before any engine contact (A/B with the knob at 0 was used to put the real
window on the engine).

2 files changed, 59 insertions, 5 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index d61df37..e1563dd 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -28359,6 +28359,17 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 	u32 want_qmd = 0, want_ch = 0;
 	bool qmd_rel = false, ch_rel = false;
 	/*
+	 * eng24 (CONT.485): this launch's QMD release0 was redirected to the
+	 * module semaphore with the rel_mod sentinel (0x600df00d) - an edge
+	 * only the ENGINE writes when the QMD itself completes. On the
+	 * direct-GL (beef) lane the QMD is synthesized (draw-synth) and never
+	 * completes, while the engine DOES retire the method block (ch_rel).
+	 * The X lane's proven release branch is ch_rel alone; allow it for
+	 * this exact case so the launch does not wait on a synthetic edge.
+	 */
+	bool qmd_rel_mod_sem = false;
+	bool beef_lane = req && (req->h_object & 0xfffff000u) == 0xbeef0000u;
+	/*
 	 * r929 (Path A): this submission is a raw 3D method window. The QMD
 	 * machinery (qmdwin relocation, QMD prewrite, release0 redirect,
 	 * PCAS) does not apply: the block is SET_OBJECT C597 + the window +
@@ -28784,6 +28795,7 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 				GSP_PHYS_RMCALL_GR_QMD_REL_PAYLOAD;
 			want_qmd = qmd[25];
 			qmd_rel = true;
+			qmd_rel_mod_sem = rel_mod;
 			/*
 			 * The module-sem fallback leaves qmd_rel_hpa 0 so the
 			 * poll reads the SEM chunk through sem_va below.
@@ -31821,7 +31833,25 @@ gr_page_unmapped:
 						ch_rel_off));
 		else
 			w1 = READ_ONCE(*(u32 *)(sem_va + 4));
-		if ((!qmd_rel || w0 == want_qmd) && w1 == want_ch) {
+		if ((!qmd_rel || w0 == want_qmd ||
+		     (qmd_rel_mod_sem && beef_lane)) && w1 == want_ch) {
+			/*
+			 * eng24 (CONT.485): the alternate (beef rel_mod) break -
+			 * the engine retired the method block and wrote the
+			 * channel release, but the synthesized QMD's module-sem
+			 * release never landed. The X lane's branch is ch_rel
+			 * alone; witness this launch's use of it.
+			 */
+			if (qmd_rel_mod_sem && beef_lane && w0 != want_qmd) {
+				static u32 qmdrel_alt_log;
+
+				if (qmdrel_alt_log < 64) {
+					qmdrel_alt_log++;
+					pr_info("vgsp-gr: GR LAUNCH OK ch_rel branch (beef rel_mod; qmd=%08x want=%08x ch=%08x) h=0x%x push=0x%llx\n",
+						w0, want_qmd, w1,
+						req->h_object, req->push_va);
+				}
+			}
 			/*
 			 * r1453 PAIR-CHAIN: this launch retired. If its
 			 * emitted window carried BEGIN/END runs, the pair
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index de92b8e..e0f1897 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -12815,7 +12815,17 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
 	 * references is covered by the candidate's own mapped pages. The
 	 * 448-word cap leaves headroom for the backend's 512-word method
 	 * block (2 bind words + the window + the 8-word release tail).
-	 * Draw-synth/hold captures are never marked.
+	 *
+	 * eng24 (CONT.485): op_src=draw-synth is now included for the
+	 * direct-GL (beef-family) lane when the raw window geometry holds.
+	 * The draw-synth op_src only means the section's PROGRAM/PARAM/REL
+	 * operands were synthesized (the beef push carries none); the WINDOW
+	 * itself is the client's real method stream (BEGIN/END + RT setup +
+	 * draw state), which is exactly what the verbatim 3D replay lane
+	 * wants. Excluding 'd' sent these captures down the synthesized
+	 * compute-QMD lane, where the launch waits for a QMD release the
+	 * engine never writes (qmd_rel=0xc0ffee01 want=0x600df00d) instead
+	 * of taking the X lane's proven ch_rel branch.
 	 *
 	 * SESSION 153-CONTINUED-10: op_src=hold is included. The GLX
 	 * server's per-frame CONTENT pushes carry the draw window but no
@@ -12827,7 +12837,17 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
 	 * raw 3D method window the r929 replay lane wants; the synthesized
 	 * compute fields are what stream_3d bypasses.
 	 */
-	if ((op_src[0] == 's' || op_src[0] == 'h') && svc_gr_cand.valid &&
+	/*
+	 * eng24 (CONT.485): the direct-GL lane's draw-synth captures ('d')
+	 * join the replay lanes when the whole push survived in raw[] and
+	 * the window starts at a real method (same geometry gates as 's'/'h';
+	 * the 'd' operands are synthetic but the window bytes are real). Gate
+	 * to the beef family so no other client's capture changes lane.
+	 */
+	if ((op_src[0] == 's' || op_src[0] == 'h' ||
+	     (op_src[0] == 'd' &&
+	      (ch->h_object & 0xfffff000u) == 0xbeef0000u)) &&
+	    svc_gr_cand.valid &&
 	    len == svc_gr_cand.push_n * 4 &&
 	    svc_gl.start_off + 8u <= at_off &&
 	    (at_off - svc_gl.start_off) / 4u <= 448u) {
@@ -12837,7 +12857,9 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
 		pr_info("sema-gl: 3D stream marked h=0x%x push=0x%llx window=%u words @off=0x%x (verbatim replay from the C597 bind)\n",
 			ch->h_object, push_va, svc_gr_cand.stream_n,
 			svc_gl.start_off);
-	} else if ((op_src[0] == 's' || op_src[0] == 'h') &&
+	} else if ((op_src[0] == 's' || op_src[0] == 'h' ||
+		    (op_src[0] == 'd' &&
+		     (ch->h_object & 0xfffff000u) == 0xbeef0000u)) &&
 		   svc_gr_cand.valid) {
 		/*
 		 * SESSION 153-CONTINUED-45: a REAL-operand section whose
@@ -12875,7 +12897,9 @@ static void svc_gl_flush(struct nv_vgpu_device *vgpu,
 	 * This is read-only and names the exact values the ENGINE will see;
 	 * an index size of 1 means the buffer is read as 16-bit indices.
 	 */
-	if ((op_src[0] == 's' || op_src[0] == 'h') &&
+	if ((op_src[0] == 's' || op_src[0] == 'h' ||
+	     (op_src[0] == 'd' &&
+	      (ch->h_object & 0xfffff000u) == 0xbeef0000u)) &&
 	    svc_gl_draw_args_log < 64 && svc_gl.start_off < at_off &&
 	    at_off <= len) {
 		u32 o = svc_gl.start_off;