r586: demanded staging VAs resolve via the client pagemap; fail-closed at the r543 argument defer cap

Two halves of the staging-pin coverage class (r584/r585 boots):

1. guest_pin_stream demand handler: resolve_va_by_content rejects any VA
   outside the CE pushbuffer window (PB_CE_LO..PB_CE_HI), so the demands
   for the GRFILL dropped staging pages (high client VAs like
   0x703304e00000) were silent no-ops - no pin ever landed and the fills
   kept dropping them. r586 falls back to the client's own pagemap
   (scan_range on the exact page), the same walk the window scans use.

2. vgsp-work: the r543 argument-defer cap expiry now takes the r583
   fail-closed path instead of forwarding: the r585 boot's saxpy was
   forwarded with n_data=969 dropped=7 partial=1 at the cap and read
   stale operands (bad=1047527 csum=130523290); the r584 matmul
   (n_data=2 dropped=18) reached the r564 degenerate refusal. Refuse,
   author the QMD release in software (rel_done latched), consume,
   witness. The dropped pages were demanded first (r585), so the retry
   window had its chance; a launch that would run with unresolved
   operands is never silently forwarded.

1 files changed, 34 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 24cb034..e86c463 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -21375,6 +21375,40 @@ static bool svc_gr_request(struct nv_vgpu_device *vgpu,
 		return false;
 	}
 	/*
+	 * r586: the defer cap expired with argument pages still unresolved -
+	 * fail-closed like the r583 dstpend cap. The historical path
+	 * forwarded the launch with the partial set and the engine read
+	 * stale/zero operands (r585 boot saxpy: n_data=969 dropped=7
+	 * partial=1 -> forwarded at the cap -> bad=1047527 csum=130523290;
+	 * r584 matmul: n_data=2 dropped=18 -> r564 degenerate refusal ->
+	 * no-write). Refuse the forward, author the completion in software,
+	 * consume; the dropped pages were already demanded through the pin
+	 * channel (r585) so the retry path had its chance first.
+	 */
+	if (svc_fwd_req.gr_arg_partial && !svc_gr_data_stalled &&
+	    svc_gr_defer_expired(svc_gr_cand.push_va)) {
+		svc.fwd_gr_refused++;
+		svc.fwd_gr_closed++;
+		if (svc_gr_cand.rel_va) {
+			svc_gr_sw_release(vgpu, ch->h_object,
+					  svc_gr_cand.rel_va,
+					  svc_gr_cand.rel_payload);
+			svc_gr_cand.rel_done = true;
+		}
+		svc_gr_cand.offered = true;
+		svc_gr_cand.valid = false;
+		if (svc.fwd_gr_closed_log < 32) {
+			svc.fwd_gr_closed_log++;
+			pr_warn("vgsp-work: GR forward REFUSED at defer cap h=0x%x push=0x%llx (argument pages still unresolved: %u; fail-closed, QMD release authored in software)\n",
+				ch->h_object, svc_gr_cand.push_va,
+				svc_fwd_req.gr_dropped);
+		}
+		clear_bit_unlock(SVC_FWD_INFLIGHT, &svc_fwd_state);
+		mutex_unlock(&svc_fwd_lock);
+		return false;	/* no busy-defer: the pump consumes; the
+				 * candidate is owned and sw-completed */
+	}
+	/*
 	 * m150: the fill found high argument pointers that no source can
 	 * translate (the second-client zeros class). Do NOT forward a launch
 	 * whose kernel would dereference unresolved pointers: leave the