vgsp: m168 revert to session scope - the pool page is per-CLIENT (conflict line r171: cached=0x1247b5000 new=0x1321fa000); a cross-session cache served the previous client's dead page and silently absorbed releases. scanner: pool demand resolves against every known tracker sem (seen + resolved chains)

1 files changed, 12 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 68632c5..97c41d7 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -7502,6 +7502,18 @@ static void svc_session_flush(void)
 	svc_opdef_reset_all();
 	svc_pool_pa_n = 0;
 	svc_pool_pa_next = 0;
+	/*
+	 * m168 addendum (r171): the UVM semaphore pool is per-CLIENT, not
+	 * per-boot. The boot cache's conflict line proved it: the same VA
+	 * resolved to a different PA for the next client
+	 * (cached=0x1247b5000 new=0x1321fa000). A cache surviving the flush
+	 * therefore served the previous client's dead page: the release was
+	 * applied (read-back passes on a dead-but-readable page), dropped
+	 * from pending, and the live client spun forever. Session-scope the
+	 * cache; the scanner's per-client resolution is the source of truth.
+	 */
+	svc_pool_boot_n = 0;
+	svc_pool_boot_next = 0;
 	svc_retry_next = 0;
 	svc_fwd_rel_n = 0;
 	svc_grce_dst_ring_next = 0;