sema: store the landing table for every launch page in svc_gr_page_note - indirect/bank operands (the kernel output buffer) resolved there while the client D2H readback used an older ledger landing, read stale zeros and the kernel looked wrong (victory_reduce sum=0 with the correct sum proven in the bounce page)

1 files changed, 15 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index a800fab..6f73f0f 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -16388,6 +16388,21 @@ static void svc_gr_page_note(struct nv_vgpu_device *vgpu, u64 va, u32 qmd_word)
 		return;
 	svc_fwd_req.gr_pages[i].pa = pa & ~(u64)(SEMA_PAGE_SIZE - 1);
 	svc_fwd_req.gr_pages[i].ap = (u8)svc_ap_of(ap);
+	/*
+	 * r370: store the landing table for EVERY launch page, not just the
+	 * data-fill spans. An indirect/bank operand (the kernel's output
+	 * buffer, qmd_word NONE) was resolved HERE, the engine wrote it via
+	 * this hpa, the copy-out wrote it back to this hpa - and the client's
+	 * D2H readback then resolved the same VA through the ledger/pin to a
+	 * DIFFERENT page (an older landing), read stale zeros and the kernel
+	 * looked wrong (victory_reduce sum=0 with the correct sum proven in
+	 * the bounce page by OUT-PAGE-WIT). Recording this resolution makes
+	 * the readback read exactly the page the engine wrote.
+	 */
+	svc_ledger_store(page, pa & ~(u64)(SEMA_PAGE_SIZE - 1),
+			 (u32)svc_ap_of(ap));
+	svc_pin_store(page, pa & ~(u64)(SEMA_PAGE_SIZE - 1),
+		      (int)svc_ap_of(ap));
 }
 
 /* Does any captured inline write land in this page? */