1 files changed, 54 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index abc9b06..756e644 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -486,6 +486,12 @@ struct svc_vaspace {
 	u64	pdb;
 	u32	entries;	/* root entry count */
 	int	ap;		/* SVC_APERTURE_* of the directory itself */
+	unsigned long stamp;	/* r459: last registration/use; LRU evict
+				 * when the table is full (a stale entry from
+				 * a dead client otherwise blocks every new
+				 * client after the 8th registration: the
+				 * mid-boot walk failure that made the 10th+
+				 * client's copies fail rc=-2) */
 };
 
 struct svc_lat {
@@ -1600,12 +1606,40 @@ void gsp_sema_service_vaspace_add(const struct sema_vaspace_desc *desc)
 		if (!vs && !svc.vas[i].valid)
 			vs = &svc.vas[i];
 	}
+	/*
+	 * r459: the table is 8 slots and the guest driver does not always
+	 * send a teardown for a client's VA space (observed: 23 distinct
+	 * registrations, 0 drops in one boot). Once all slots hold a dead
+	 * client's directory, a NEW client's registration found no slot and
+	 * every walk of its VAs failed (copies rc=-2, launches reading
+	 * stale pages - the 10th-client mid-boot degradation). Evict the
+	 * least-recently-registered entry instead of refusing the new one;
+	 * the old client is gone and its directory pointer is dead guest
+	 * memory, so the eviction can only remove stale authority.
+	 */
+	if (!vs) {
+		unsigned long oldest = 0;
+		int oi = 0;
+
+		for (i = 0; i < SVC_MAX_VASPACES; i++) {
+			if (!svc.vas[i].valid)
+				continue;
+			if (!oldest || time_before(svc.vas[i].stamp, oldest)) {
+				oldest = svc.vas[i].stamp;
+				oi = i;
+			}
+		}
+		vs = &svc.vas[oi];
+		pr_info("sema-svc: VA space table full; evicting 0x%x (pdb=0x%llx) for 0x%x\n",
+			vs->h_vaspace, vs->pdb, desc->h_vaspace);
+	}
 	if (vs) {
 		vs->valid = true;
 		vs->h_vaspace = desc->h_vaspace;
 		vs->pdb = desc->pdb;
 		vs->entries = desc->num_entries;
 		vs->ap = desc->b_vidmem ? SVC_APERTURE_FB : SVC_APERTURE_SYS;
+		vs->stamp = jiffies;
 		/* A new directory invalidates what we learned from the old one. */
 		memset(svc.lat, 0, sizeof(svc.lat));
 	}
@@ -1933,6 +1967,26 @@ static int svc_walk_vaspaces(struct nv_vgpu_device *vgpu, u64 va,
 	}
 	spin_unlock_irqrestore(&svc.vas_lock, flags);
 
+	/*
+	 * r459: try the NEWEST registration first. A dead client's stale
+	 * directory (the table outlives clients; only 8 slots) can still
+	 * resolve a VA - through guest memory the driver has since reused -
+	 * to a wrong page, and the first success wins. Ordering by the
+	 * registration stamp makes the live client's directory the
+	 * authority and only falls through to older ones when it cannot
+	 * answer.
+	 */
+	for (i = 1; i < n; i++) {
+		struct svc_vaspace k = local[i];
+		int j = i - 1;
+
+		while (j >= 0 && time_before(local[j].stamp, k.stamp)) {
+			local[j + 1] = local[j];
+			j--;
+		}
+		local[j + 1] = k;
+	}
+
 	for (i = 0; i < n; i++) {
 		int alt;