summaryrefslogtreecommitdiffstats
path: root/scripts
diff options
context:
space:
mode:
authorArthur Hanson Rasmusson <arthur@vgpu.io>2026-09-21 20:43:39 -0400
committerArthur Hanson Rasmusson <arthur@vgpu.io>2026-09-21 20:43:39 -0400
commit92fa88178956b94439857b8ec97da7f29f42bf9f (patch)
tree5ba65db30dac154b73790af24bfb2d4d07599027 /scripts
parent1e73a2e00c76e25e4ce2980e5d04a533b0c6158d (diff)
downloadopen-iov-92fa88178956b94439857b8ec97da7f29f42bf9f.tar.gz
open-iov-92fa88178956b94439857b8ec97da7f29f42bf9f.zip
kernel: Fix guest memory corruption from non-page-aware queue I/O + fn-10 logging
ROOT CAUSE (guest userspace segfaults): the GSP-RM msgq buffer is NV_MEMORY_NONCONTIGUOUS (129 independent 4K pages). gsp_rm_send wrote multi-element records CONTIGUOUSLY from a translated start GPA - a record crossing a page boundary scribbled into arbitrary guest RAM (pages are unrelated GPAs). Observed as pgrep/ls segfaulting in the guest. - gsp_rm_write_buf/gsp_rm_read_buf: split every shared-buffer access at page boundaries and translate each page via the buffer page table (gsp_rm_off_to_gpa). All queue record/element/header accesses converted. - fn-10 (FREE) / fn-47 (UNLOADING) handler now logs hClient/hObject + cmd_read for unload-cycle debugging. Diagnosis captured: driver sends UNLOADING(47) then final FREEs during teardown; queue-death detector can strand the last frees (fn-10 timeout blocks close -> nvidia-smi hangs in exit).
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions