From 054ab4721726ecf59983c2c178f304d31d8bc7e9 Mon Sep 17 00:00:00 2001
From: Arthur Hanson Rasmusson <arthur@vgpu.io>
Date: Sun, 25 Oct 2026 18:38:13 -0400
Subject: vgsp-sema: on an implausible primary push read for a GR entry, retry
 via the DIRECT registered-VAS walk (svc_walk_vaspaces + svc_read_ap, the
 exact path walk_probe proves) instead of svc_lookup_trusted - whose pin/lat
 hits would answer with the same wrong page again; r711/r712 evidence: the
 user VAS registers and walk_probe rc=0, the rewind replays, but the retry/log
 never appears and the entries still skip after ~250 failed rescues (the
 sema-pushfail witness budget is per-boot and was exhausted earlier, so the
 read-failure detail was invisible this boot)

---
 kernel/gsp_sema_service.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 64 insertions(+), 1 deletion(-)

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 21a39a2..76fcdf5 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -24484,7 +24484,70 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu)
 									kfree(fb);
 								}
 							} else {
-								unreadable = true;
+								/*
+								 * r707v: a primary-source
+								 * hit (injected pin, window
+								 * guess, lat cache) whose
+								 * content is implausible
+								 * must not shadow the
+								 * registered VAS walk - a
+								 * stale pin otherwise makes
+								 * every push read "resolve"
+								 * to the wrong page, fail
+								 * plausibility and turn the
+								 * entry unreadable forever.
+								 * Retry once with the pins
+								 * bypassed so the trusted
+								 * walk (svc_walk_vaspaces)
+								 * answers; accept only a
+								 * plausible stream.
+								 */
+								u8 *vb = kmalloc(len,
+										 GFP_KERNEL);
+
+								if (vb) {
+									u64 wpa = 0;
+									int wap = SVC_APERTURE_SYS;
+									bool ok = false;
+
+									/*
+									 * r707w: consult ONLY the
+									 * registered VAS walk (the
+									 * exact path walk_probe
+									 * proves) - not
+									 * svc_lookup_trusted, whose
+									 * pin/lat hits would answer
+									 * with the same wrong page
+									 * again and keep the entry
+									 * unreadable.
+									 */
+									if (!svc_walk_vaspaces(vgpu,
+										va & ~0xfffULL,
+										&wpa, &wap) &&
+									    !svc_read_ap(vgpu,
+										wpa + (va & 0xfff),
+										wap == SVC_APERTURE_FB ?
+											SVC_APERTURE_FB :
+											SVC_APERTURE_SYS,
+										vb, len) &&
+									    svc_method_stream_plausible(vb, len)) {
+										memcpy(pb, vb, len);
+										svc.pushpg_fallback++;
+										ok = true;
+										if (gsp_sema_dbg &&
+										    svc_pushpg_fb_log < 64) {
+											svc_pushpg_fb_log++;
+											pr_info("sema-pushpg: h=0x%x va=0x%llx viawalk ok pa=0x%llx\n",
+												ch->h_object, va,
+												wpa + (va & 0xfff));
+										}
+									}
+									kfree(vb);
+									if (!ok)
+										unreadable = true;
+								} else {
+									unreadable = true;
+								}
 							}
 							/*
 							 * Still implausible (or
-- 
cgit v1.2.3