diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-21 03:29:12 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-21 03:29:12 -0400 |
| commit | 0b307461d22a7bfa85d4ec87b80a0e5205fc3cd6 (patch) | |
| tree | 1862e0c6a6b9492bc47a9739f11c5eedb5409ead /debug/risc-v-gsp-rm-vm/Makefile | |
| parent | 7a1f48057fe3bd96d26d9ae3f85263ffdd93d374 (diff) | |
| download | open-iov-0b307461d22a7bfa85d4ec87b80a0e5205fc3cd6.tar.gz open-iov-0b307461d22a7bfa85d4ec87b80a0e5205fc3cd6.zip | |
docs: GPUBreach-class audit and threat model for the host write paths
Audit of every host-side write whose target derives from guest data,
against the GPUBreach (IEEE S&P 2026) chain: GPU PTE corruption ->
arbitrary device read/write -> driver bugs -> CPU root.
Findings: the host is structurally off that path (guest GPU page tables
host-emulated, physical GPU PTEs host-owned, every write aperture-bounded
by vfio_dma_rw to guest RAM or the vidmem shadow, no guest DMA to host
buffers), and the remaining wrong-but-valid write class is bounded by the
per-page resolution + refusal guards (FILL-TRUNC, FILL-PT-REFUSED,
LOWFILL-REFUSED, GRFILL-DROP, stalled-VA demand, sema_copy_dst_pin_guard,
DST-DIVERGE). Documents residual risks, what is not claimed (no isolation
or side-channel claim; physical Rowhammer is out of scope), and three
follow-ups.
Diffstat (limited to 'debug/risc-v-gsp-rm-vm/Makefile')
0 files changed, 0 insertions, 0 deletions