diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-18 15:30:23 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-18 15:30:38 -0400 |
| commit | 54a41db23985a82654ad4daeca283682e2b14b1e (patch) | |
| tree | 0a641ab0418301f3c17085b4d2dc060d7ce0bfc9 /kernel/main.c | |
| parent | 970ca73e82917c30d8ca2dfd24b10fff552900be (diff) | |
| download | open-iov-54a41db23985a82654ad4daeca283682e2b14b1e.tar.gz open-iov-54a41db23985a82654ad4daeca283682e2b14b1e.zip | |
vgsp: fail4 r231 - READ-ORDER guard/witness + 32KB copy-resolution witness
r231 probe: RAWA (fresh 64 KB upload -> straight D2H readback, no kernel)
returned foreign deterministic content (0x437F0000-family ramps) where the
uploaded ints 0..16383 must be, and PROBE2 == PROBE2B on that same content.
The upload/readback round trip inside the emulation is therefore not
content-preserving - before any engine execution. Two candidate mechanisms,
both now witnessed:
- READ-ORDER: a device-src copy reading a VA whose device-dst write is
still inside the m169 pin-guard window (the writer's bytes land only when
the guard resolves) - the read executes first. READ-ORDER-WIT logs the
coincidence; with sema_read_order_guard=1 (new param, default 0) the read
is deferred through the existing bounded-hold re-decode so it runs after
the write. Opt-in pending an A/B proving no green regression.
- RESOLUTION DIVERGENCE: the dst (H2D) resolution consults the ledger
before svc_op_translate while the src (D2H) resolution does the opposite,
so a stale ledger landing can make the writer and reader touch different
pages. The sema-bigcopy proof (va->pa/aperture/provenance for BOTH sides)
now fires from 32 KB (was 1 MB), so the probe-class copies are on record.
Build green; module param registered and visible.
(cherry picked from commit bfe5d295dd3922c0dbcd0bd1a29912a02acb58ec)
Diffstat (limited to 'kernel/main.c')
| -rw-r--r-- | kernel/main.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/kernel/main.c b/kernel/main.c index 52bd10a..c150a1a 100644 --- a/kernel/main.c +++ b/kernel/main.c @@ -2827,6 +2827,16 @@ module_param_named(sema_copy_dst_pin_guard, gsp_sema_copy_dst_pin_guard, bool, 0 MODULE_PARM_DESC(sema_copy_dst_pin_guard, "hold device-dst copies without a pin-resolved translation (default 1)"); /* + * r231 READ-ORDER guard: defer a device-src copy whose source VA has a + * pending device-dst write hold so the read re-decodes after the write + * resolves (fixes the ctaid_probe RAWA upload/readback inversion). + * Default 0: witness only (READ-ORDER-WIT). Opt-in pending an A/B proving + * no green regression. + */ +module_param_named(sema_read_order_guard, gsp_sema_read_order_guard, bool, 0644); +MODULE_PARM_DESC(sema_read_order_guard, "defer device-src reads of a VA with a pending held device-dst write (default 0: witness only)"); + +/* * COPYWIT fail4 (2026-10-18): per-boot budget for the sema-bigcopy resolution * witnesses. svc_copy's large-copy proof logs both operands' resolved * VA -> pa/aperture/provenance, which is the read side of the client data |