sema: r375b drop the resolver-answer ledger store - a stale resolver page recorded as the write authority poisons every later write of the VA (r375 boot slab GPF in kmem_cache_alloc at guest t=77s before any client); the table is fed by writes and fresh pins only

1 files changed, 8 insertions, 8 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index c5bc043..7c15a09 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -5711,15 +5711,15 @@ static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total,
 			src_prov = svc.op_tr_src;
 			src_virt = true;
 			/*
-			 * r375: record the resolver's answer so the next
-			 * reader (and the launch paths) converge on it.
+			 * r375b: do NOT record a resolver answer into the
+			 * landing table here. The resolver can return a stale
+			 * PTE page (the m169 class) and the table is the WRITE
+			 * authority - a poisoned entry makes every later write
+			 * of this VA land on the stale page (r375 boot: slab
+			 * GPF in kmem_cache_alloc at guest t=77s, before any
+			 * client). The table is fed by writes and fresh pins
+			 * only.
 			 */
-			if (src_orig >= SVC_VAS_FLOOR)
-				svc_ledger_store(src_orig,
-						 pa & ~(u64)(SEMA_PAGE_SIZE - 1),
-						 (aper == CE_APERTURE_VID) ?
-						 SVC_APERTURE_FB :
-						 SVC_APERTURE_SYS);
 		}
 	}