diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-11-13 09:33:17 -0500 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-11-13 09:33:17 -0500 |
| commit | 7d27df77ac1f52816a7a741b39674e99e9c5f7bd (patch) | |
| tree | ee46eeacc8053890520a8a6a5542d6a01a3c9583 /kernel | |
| parent | 6668e2d0ded583a81d8496facfb9ad86f3cc2ede (diff) | |
| download | open-iov-7d27df77ac1f52816a7a741b39674e99e9c5f7bd.tar.gz open-iov-7d27df77ac1f52816a7a741b39674e99e9c5f7bd.zip | |
vgsp: reject the dense-lookalike class in svc_gr_ram_ring_scan (entry0==entry1 gate)
The GL client ring content scan admitted the lookalike page measured at
pa 0x10a828000 / 0x10ad3e000 (dword 0x04000100 repeating) whose entry0 and
entry1 decode identically (va=0x4000100 len=262144) and which passed every
window/terminus gate. The pump then read a phantom 256 KiB push at VA
0x4000100 forever (sema-rdw rc=-2, sema-entry: unread, unregistered
submissions=0; c271/c285), poisoning the client-VAS verify chain. A real
ring does not repeat one entry verbatim in slots 0/1.
Partial validation: c288 (fixed module) resolved the REAL ring pair via the
VAS (pa=0x235f7c000, entry0 va=0x4000000 len=2236) and decoded real client
pushes (submissions=15, CB-DIAG match=67). End-to-end pixel validation
(gl_frames px0 != 0) is still pending; c286/c287 did not exercise the scan
(no channel created).
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/gsp_sema_service.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index ebbe3bd..83ab2db 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -30579,6 +30579,21 @@ static bool svc_gr_ram_ring_scan(struct nv_vgpu_device *vgpu, if (len1 < 4 || len1 > 0x100000) continue; /* + * eng17 (2026-11-13): reject the dense-lookalike class + * directly. The page measured masquerading as the GL + * client's ring (pa 0x10a828000 / 0x10ad3e000, dword + * 0x04000100 repeating) decodes entry0 == entry1 + * (va=0x4000100 len=262144) and passes every + * window/terminus gate, so the pump read a phantom + * 256 KiB push at VA 0x4000100 forever (`sema-rdw ... + * rc=-2`, `sema-entry: unread`, `unregistered + * (submissions=0)`; c271/c285). A real ring does not + * repeat one entry verbatim in slots 0/1 (r908's + * repeat shares the VA but not the len). + */ + if (va0 == va1 && len0 == len1) + continue; + /* * r979: kick-family ring discrimination. Shape alone * admitted a foreign table page ahead of the real ring * on r978 (pa=0x104fa9000, entries naming a bogus |