diff options
| -rw-r--r-- | kernel/gsp_sema_service.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index c5bc043..7c15a09 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -5711,15 +5711,15 @@ static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total, src_prov = svc.op_tr_src; src_virt = true; /* - * r375: record the resolver's answer so the next - * reader (and the launch paths) converge on it. + * r375b: do NOT record a resolver answer into the + * landing table here. The resolver can return a stale + * PTE page (the m169 class) and the table is the WRITE + * authority - a poisoned entry makes every later write + * of this VA land on the stale page (r375 boot: slab + * GPF in kmem_cache_alloc at guest t=77s, before any + * client). The table is fed by writes and fresh pins + * only. */ - if (src_orig >= SVC_VAS_FLOOR) - svc_ledger_store(src_orig, - pa & ~(u64)(SEMA_PAGE_SIZE - 1), - (aper == CE_APERTURE_VID) ? - SVC_APERTURE_FB : - SVC_APERTURE_SYS); } } |