r496j VAS candidates are registered only after a content-verified ring walk (+3 fixes)

The r496g blast registration of every COPY_SERVER_PDES directory let a
stale kernel directory answer another client's VA in the walker's
first-success order (the r459 stale-directory class) - measured as a CUDA
client hanging after DEVICE. Candidates are now parked and registered only
when a walk of the client's own content-validated ring VA through them
reproduces that ring's PA; the r496f vidmem sweep remains as a fallback.

Also in this batch:
- svc_chan_userd's VRAM shape scan now prefers a block with work PENDING
  (get < put) and then the one nearest the registered memdesc offset: on a
  channel re-registration the stale previous USERD still validates (it
  holds the same put/entry values) and the old first-match adoption made
  the pump write GP_GET into the dead block (r504 second DMA init).
- The USERD/FB scan and the CE caps byte-1 BL bits (r496i) are unchanged;
  TU104_CE_CAPS1 = 0x03 needs the CUDA battery re-verification.

1 files changed, 23 insertions, 20 deletions

diff --git a/kernel/gsp_rm_emulation.c b/kernel/gsp_rm_emulation.c
index 4c848b8..eddfab5 100644
--- a/kernel/gsp_rm_emulation.c
+++ b/kernel/gsp_rm_emulation.c
@@ -2509,25 +2509,24 @@ static void gsp_rm_handle_copy_server_pdes(struct gsp_emu_context *ctx,
 	}
 
 	/*
-	 * r496g: this control IS the kernel RM publishing the page-table
+	 * r496j: this control IS the kernel RM publishing the page-table
 	 * chain of its internal VAS (the level[0..] instances with their
-	 * phys addresses and page shifts). Register the root with the
-	 * progress service so the walker can translate every VA of this
-	 * client - the X/GL channel's pushbuffer pages and its progress
-	 * semaphore, for which no other translation source exists (the
-	 * fn-54 SET_PAGE_DIRECTORY path is external-VAS/UVM only). The
-	 * level values are sanity-gated; a wrong chain only costs failed
-	 * walks.
+	 * phys addresses and page shifts). The chain can name the X/GL
+	 * channel's pushbuffer pages and progress semaphore, for which no
+	 * other translation source exists (the fn-54 SET_PAGE_DIRECTORY
+	 * path is external-VAS/UVM only). It is NOT registered directly:
+	 * a blast registration of every client's directory let a stale
+	 * kernel directory answer another client's VA in the walker's
+	 * first-success order (the r459 stale-directory class; observed
+	 * as a CUDA client hanging after DEVICE with r496g). Instead the
+	 * root is offered as a CANDIDATE; the progress service registers
+	 * it only after it has been VERIFIED against a content-validated
+	 * pair of that very client (the ring found by the RAM content
+	 * scan).
 	 */
 	if (num_levels >= 1 && rm->pt.levels[0].phys &&
 	    rm->pt.levels[0].size >= 16 &&
 	    rm->pt.levels[0].size <= 4096 * 8) {
-		struct sema_vaspace_desc d;
-
-		memset(&d, 0, sizeof(d));
-		d.h_vaspace = h_object;
-		d.pdb = rm->pt.levels[0].phys;
-		d.num_entries = (u32)(rm->pt.levels[0].size / 8);
 		/*
 		 * The level phys values are guest PAs on this platform
 		 * (observed 4+ GiB, above any FB shadow); aperture 3 in the
@@ -2536,13 +2535,17 @@ static void gsp_rm_handle_copy_server_pdes(struct gsp_emu_context *ctx,
 		 * FB, everything else sysmem. The walker also retries the
 		 * other aperture, so a misclassification only costs a walk.
 		 */
-		d.b_vidmem = rm->pt.levels[0].phys <
-			     (u64)ctx->vgpu->bars[1].size;
-		gsp_sema_service_vaspace_add(&d);
+		bool vidmem = rm->pt.levels[0].phys <
+			      (u64)ctx->vgpu->bars[1].size;
+
+		gsp_sema_service_vaspace_candidate_add(
+			h_object, rm->pt.levels[0].phys,
+			(u32)(rm->pt.levels[0].size / 8), vidmem);
 		nv_vgpu_info(ctx->vgpu,
-			     "vgsp-rm: VAS 0x%x page directory registered from COPY_SERVER_PDES pdb=0x%llx entries=%u (%s)",
-			     h_object, d.pdb, d.num_entries,
-			     d.b_vidmem ? "vidmem" : "sysmem");
+			     "vgsp-rm: VAS 0x%x page directory offered as candidate pdb=0x%llx entries=%u (%s; registered only after a content-verified ring walk)",
+			     h_object, (u64)rm->pt.levels[0].phys,
+			     (u32)(rm->pt.levels[0].size / 8),
+			     vidmem ? "vidmem" : "sysmem");
 	}
 }