sema: r376 pin-agreement on the copy ledger-first branches - a fresh disagreeing pin beats a recorded landing on both dst (write) and src (read) at top level and per page, repairing the entry; closes the stale-entry write (guest-corruption) and read (wrong-result) classes

1 files changed, 69 insertions, 1 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 7c15a09..ffdb5f2 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -5573,7 +5573,35 @@ static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total,
 			 * for where a new write lands); it also spares the
 			 * m169 stale-walk hold below, which exists precisely
 			 * because no pin was known.
+			 *
+			 * r376 pin-agreement: a FRESH pin that disagrees is
+			 * newer than the recorded landing - the guest freed
+			 * or moved the buffer - so the pin wins and the
+			 * entry is repaired (the same rule the fills and the
+			 * launch paths apply; without it a stale entry
+			 * writes a freed page - the guest-corruption class).
 			 */
+			{
+				u64 ipa = 0;
+				int iap = SVC_APERTURE_SYS;
+
+				if (!svc_ipin_lookup(dst, &ipa, &iap) &&
+				    (((ipa & ~(u64)(SEMA_PAGE_SIZE - 1)) !=
+				      (pa & ~(u64)(SEMA_PAGE_SIZE - 1))) ||
+				     (u32)iap != (u32)aper)) {
+					svc_ledger_pin_repairs++;
+					if (svc_ledger_pin_repairs <= 64)
+						pr_info("sema-ledger: PIN-WINS copy-dst va=0x%llx ledger=0x%llx/%u pin=0x%llx/%d\n",
+							dst,
+							pa & ~(u64)(SEMA_PAGE_SIZE - 1),
+							aper, ipa, iap);
+					svc_ledger_store(dst,
+							 ipa & ~(u64)(SEMA_PAGE_SIZE - 1),
+							 (u32)iap);
+					pa = ipa;
+					aper = (u32)iap;
+				}
+			}
 			dst = pa;
 			dst_aperture = (aper == SVC_APERTURE_FB) ?
 				CE_APERTURE_VID : CE_APERTURE_SYS;
@@ -5675,7 +5703,32 @@ static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total,
 			 * aperture - so the table wins for device VAs; only a
 			 * VA with no recorded landing falls through to the
 			 * resolver below.
+			 *
+			 * r376 pin-agreement: unless a FRESH pin disagrees -
+			 * then the pin is newer (the guest re-pinned the VA)
+			 * and wins, and the entry is repaired.
 			 */
+			{
+				u64 ipa = 0;
+				int iap = SVC_APERTURE_SYS;
+
+				if (!svc_ipin_lookup(src, &ipa, &iap) &&
+				    (((ipa & ~(u64)(SEMA_PAGE_SIZE - 1)) !=
+				      (pa & ~(u64)(SEMA_PAGE_SIZE - 1))) ||
+				     (u32)iap != (u32)aper)) {
+					svc_ledger_pin_repairs++;
+					if (svc_ledger_pin_repairs <= 64)
+						pr_info("sema-ledger: PIN-WINS copy-src va=0x%llx ledger=0x%llx/%u pin=0x%llx/%d\n",
+							src,
+							pa & ~(u64)(SEMA_PAGE_SIZE - 1),
+							aper, ipa, iap);
+					svc_ledger_store(src,
+							 ipa & ~(u64)(SEMA_PAGE_SIZE - 1),
+							 (u32)iap);
+					pa = ipa;
+					aper = (u32)iap;
+				}
+			}
 			src = pa;
 			src_aperture = (aper == SVC_APERTURE_FB) ?
 				CE_APERTURE_VID : CE_APERTURE_SYS;
@@ -6051,10 +6104,25 @@ static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total,
 			 * authority for device VAs (see the top-level src
 			 * resolve). Per page, the table wins whenever it has
 			 * an entry; the resolver below only answers a VA the
-			 * table has never seen.
+			 * table has never seen. r376: a fresh disagreeing pin
+			 * is newer than the table and wins (repaired).
 			 */
 			if (src_orig >= SVC_VAS_FLOOR &&
 			    !svc_ledger_lookup(src_orig + o, &lpa, &lap)) {
+				u64 ipa = 0;
+				int iap = SVC_APERTURE_SYS;
+
+				if (!svc_ipin_lookup(src_orig + o, &ipa, &iap) &&
+				    (((ipa & ~(u64)(SEMA_PAGE_SIZE - 1)) !=
+				      (lpa & ~(u64)(SEMA_PAGE_SIZE - 1))) ||
+				     (u32)iap != (u32)lap)) {
+					svc_ledger_pin_repairs++;
+					svc_ledger_store(src_orig + o,
+							 ipa & ~(u64)(SEMA_PAGE_SIZE - 1),
+							 (u32)iap);
+					lpa = ipa & ~(u64)(SEMA_PAGE_SIZE - 1);
+					lap = (u32)iap;
+				}
 				pa = lpa;
 				aper = (lap == SVC_APERTURE_FB) ?
 					CE_APERTURE_VID : CE_APERTURE_SYS;