From 44f62038e39a7678a9213e314116ea72ce55db35 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Tue, 20 Oct 2026 17:31:38 -0400 Subject: sema: r375b drop the resolver-answer ledger store - a stale resolver page recorded as the write authority poisons every later write of the VA (r375 boot slab GPF in kmem_cache_alloc at guest t=77s before any client); the table is fed by writes and fresh pins only --- kernel/gsp_sema_service.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'kernel/gsp_sema_service.c') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index c5bc043..7c15a09 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -5711,15 +5711,15 @@ static int svc_copy(struct nv_vgpu_device *vgpu, u64 dst, u64 src, size_t total, src_prov = svc.op_tr_src; src_virt = true; /* - * r375: record the resolver's answer so the next - * reader (and the launch paths) converge on it. + * r375b: do NOT record a resolver answer into the + * landing table here. The resolver can return a stale + * PTE page (the m169 class) and the table is the WRITE + * authority - a poisoned entry makes every later write + * of this VA land on the stale page (r375 boot: slab + * GPF in kmem_cache_alloc at guest t=77s, before any + * client). The table is fed by writes and fresh pins + * only. */ - if (src_orig >= SVC_VAS_FLOOR) - svc_ledger_store(src_orig, - pa & ~(u64)(SEMA_PAGE_SIZE - 1), - (aper == CE_APERTURE_VID) ? - SVC_APERTURE_FB : - SVC_APERTURE_SYS); } } -- cgit v1.2.3