3 files changed, 33 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index f7ad153..cf5061d 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -18602,6 +18602,7 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 	const u8 *guest_param_pg;
 	u32 want_qmd = 0, want_ch = 0;
 	bool qmd_rel = false, ch_rel = false;
+	bool qmd_rel_redirected = false;	/* r420b: release0 -> module sem */
 	u64 qmd_rel_hpa = 0, ch_rel_hpa = 0;
 	u64 ch_sem_va = GSP_PHYS_RMCALL_VA_SEM + 4;
 	u64 qmd_dst = GSP_PHYS_RMCALL_VA_SRC;
@@ -18859,6 +18860,15 @@ int gsp_phys_backend_guest_gr_submit(const struct gsp_phys_gr_submit *req,
 			 */
 			qmd_rel_hpa = 0;
 			qmd_rel_off = 0;
+			/*
+			 * r420b: the ENGINE will not write the guest's QMD
+			 * release word this launch (rel_mod, or no targetable
+			 * guest release page). Tell the caller so it authors
+			 * the word in software on every outcome - otherwise a
+			 * launch without deferred release records is never
+			 * completed on the guest word (the r414 saxpy hang).
+			 */
+			qmd_rel_redirected = true;
 		}
 	}
 
@@ -21432,6 +21442,7 @@ out:
 		out->elapsed_ms = jiffies_to_msecs(jiffies - start);
 		out->rc = ret;
 		out->fault = fault;
+		out->qmd_rel_redirected = qmd_rel_redirected;
 	}
 	return ret;
 }
diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h
index 42729d8..80beb54 100644
--- a/kernel/gsp_phys_booter.h
+++ b/kernel/gsp_phys_booter.h
@@ -275,6 +275,17 @@ struct gsp_phys_backend_copy_result {
 	u32 elapsed_ms;		/* return-to-caller elapsed milliseconds */
 	int rc;			/* duplicated function return code */
 	struct gsp_phys_fault_info fault;	/* decoded engine fault, if any */
+	/*
+	 * r420b: the forwarded launch's QMD release0 was redirected to the
+	 * module semaphore (gsp_phys_rmcall_gr_rel_mod=1, or an unresolved
+	 * guest release page), so the ENGINE will never write the guest's own
+	 * QMD release word. The caller must author it in software on every
+	 * outcome (the same write the hold's success edge performs); without
+	 * this a rel_mod=1 launch with no deferred release records is never
+	 * completed on the guest word and the client hangs (the r414 saxpy
+	 * f0 cur=5 stall).
+	 */
+	bool qmd_rel_redirected;
 };
 
 int gsp_phys_backend_guest_ce_copy_ex(u64 src_hpa, u32 src_off, u64 dst_hpa,
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 6585aaf..a465469 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -17173,6 +17173,17 @@ static void svc_fwd_gr_work(void)
 			ga_va, ga_used, ga_led);
 
 	hw_rc = gsp_phys_backend_guest_gr_submit(&gs, &cp);
+	/*
+	 * r420b: the backend redirected the launch's QMD release0 to the
+	 * module semaphore (rel_mod=1 or no targetable guest release page), so
+	 * the ENGINE never writes the guest's own QMD release word. Treat the
+	 * word as unobserved so the bounded outcome check (and the hold's
+	 * edges) author it in software on every outcome; without this a
+	 * rel_mod=1 launch with no deferred release records is never completed
+	 * on the guest word and the client hangs (the r414 saxpy stall).
+	 */
+	if (cp.qmd_rel_redirected)
+		svc_fwd_req.gr_rel_unobserved = true;
 	if (!hw_rc) {
 		svc.fwd_gr_ok++;
 	} else {