vgsp-sema (FOLD): verify the parked COPY_SERVER_PDES VAS candidates the moment any channel's ring resolves through the channel object, so the user-VAS page directory can register BEFORE the submit's first push reads (the host-triggered path could not win that window: a failed GR entry read is never retried with the fresh VAS); r709 evidence: three VASes registered (h=0xc/0xbaba0042/0xcaf00000, pdb=0x11b8db000/0x11b8e6000/0x11b8ef000) and walk_probe still rc=-2 for the client's push VAs - the registered directories do not cover the user VAS, so the content-pair verify against the ring must still land for that one

1 files changed, 15 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index f21f589..25fd408 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -23885,6 +23885,21 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 
 		if (!rrc)
 			svc_pb_pair(vgpu, ch);
+		/*
+		 * r707f (FOLD): the moment ANY channel's ring resolves through
+		 * the channel object, verify the parked COPY_SERVER_PDES VAS
+		 * candidates against that content-backed pair. The candidates
+		 * are parked at device-create time, before the client's compute
+		 * channels first submit, so registering here lands the VAS page
+		 * directory BEFORE the submit's entries get their first push
+		 * read - the window the host-triggered path could not win (the
+		 * entry's first read and the ring's first resolution happen in
+		 * the same pass; a pair that arrives later cannot help, because
+		 * a failed GR entry read is never retried with the fresh VAS).
+		 */
+		if (!rrc)
+			svc_vas_candidates_verify(vgpu, ch->gpfifo_va,
+						  ring_pa);
 
 		/*
 		 * ISSUE-0002 (r47 diag): run the deferred CE USERD sweep for a