vgsp-sema: publish GR channels at end-of-pass again (regression fix for the cudaMalloc spin)

m140 published every channel with the pass-computed put and GR clients
advanced (green counter publish val=put). The H3 change restricted the
end-of-pass site to CE and moved GR to the safety-net early call, which
reads GP_PUT from the snapshot USERD and returned 0 on live GR channels
while the pass's own put was 1. GR never published; victory_mail spun at
100% CPU in the first cudaMalloc (wchan=0). Publish GR here again; the
early call remains the fallback for early-continue passes and both are
monotonic.

1 files changed, 15 insertions, 7 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index ed8610f..7837d32 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -12721,14 +12721,22 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 		 * re-register: once per pass is enough and the derivation is
 		 * not free.
 		 *
-		 * H3 (FORENSICS-v2): GR channels publish in the safety-net
-		 * block at the top of the pass - the early `continue`s above
-		 * make this call unreachable exactly when the ring or USERD
-		 * cannot be read, which is the case the publish must still
-		 * cover. Keep this site for the CE channels only, so a GR
-		 * pass does not publish twice.
+		 * REGRESSION FIX (2026-10-08): this site published every
+		 * channel in the m140 green design and GR clients advanced
+		 * (green: counter publish val=put writes). The H3 change
+		 * restricted it to CE and moved GR to the safety-net early
+		 * call, which reads GP_PUT from the snapshot USERD and
+		 * returned 0 on the GR channels while the pass's own put
+		 * (probed/read below) was 1 - so GR never published, the
+		 * client's tracker poll never advanced, and victory_mail spun
+		 * at 100% CPU inside the first cudaMalloc (wchan=0). Publish
+		 * GR here with the pass-computed put again; the early
+		 * safety-net call stays as the fallback for passes that
+		 * early-`continue` (H3's coverage), and both are monotonic
+		 * (val <= counter_last -> return), so a pass that runs both
+		 * does not write twice.
 		 */
-		if (!held && ch->engine_type)
+		if (!held)
 			svc_counter_publish(vgpu, ch, put);
 
 		spin_lock_irqsave(&svc.chan_lock, flags);