vgsp-sema: SESSION 135 CE first-submission capture: reject a consumed-state USERD candidate (get >= put > 0)

At the first-submission instant the channel's own submission is by
definition unconsumed - the notifier clear this capture runs before is
what would let the driver treat it as consumed. A candidate whose USERD
reads a consumed state (put == get > 0) cannot be this channel's live
just-submitted work.

Observed r785 (CUDA-first boot, three Vulkan runs): the capture latched
fb 0x80000 / userd 0x90000 for beef0101 (rank 0) with put=1 get=1 - the
dead CUDA client's caf00012 block surviving in VRAM after its session
ended. The decoded entry (va=0x120000000 len=40) was the old session's,
the expectations seeded from the stale pool word (want=2/3 vs pay=1) and
the Vulkan client stalled into its fence timeout on every run.

All genuine first-submission latches on record read put=1 get=0 at the
capture instant (r779 caf00012 rank0, r785 caf00012 rank0, r781/run1
beef0101). Idle 0/0 stays acceptable per svc_userd_probe's own rule.
Session-scoped rank ownership (svc_ce_firstsub_off) does not cover this
class: the stale block belongs to a previous CLIENT, and its consumed
state is the only local signal that it is not this submission.

1 files changed, 15 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 1b94505..3ff38b6 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -14789,6 +14789,21 @@ static bool svc_ce_firstsub_try_off(struct nv_vgpu_device *vgpu,
 				      &p3, &g3);
 		if (prc && prc != -EAGAIN)
 			continue;
+		/*
+		 * SESSION 135: at the FIRST-SUBMISSION instant the channel's
+		 * submission is by definition unconsumed - the notifier clear
+		 * this capture runs before is what would let the driver treat
+		 * it as consumed. A candidate whose USERD reads a consumed
+		 * state (get >= put && put > 0) cannot be this channel's live
+		 * just-submitted work; it is a PREVIOUS session's leftover
+		 * block surviving in VRAM (r785: the capture latched the dead
+		 * CUDA client's caf00012 block at fb 0x80000, put=1 get=1,
+		 * for the Vulkan channel beef0101 - the decoded entry was the
+		 * old session's, the client stalled on its expectations).
+		 * Idle 0/0 stays acceptable (svc_userd_probe's own rule).
+		 */
+		if (p3 && p3 == g3)
+			continue;
 		/* latch exactly like the CE autopin */
 		svc_pin_store(ch->gpfifo_va, off, SVC_APERTURE_FB);
 		svc_lat_store(ch->gpfifo_va, off, SVC_APERTURE_FB);