diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-09-21 20:43:39 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-09-21 20:43:39 -0400 |
| commit | 92fa88178956b94439857b8ec97da7f29f42bf9f (patch) | |
| tree | 5ba65db30dac154b73790af24bfb2d4d07599027 /scripts | |
| parent | 1e73a2e00c76e25e4ce2980e5d04a533b0c6158d (diff) | |
| download | open-iov-92fa88178956b94439857b8ec97da7f29f42bf9f.tar.gz open-iov-92fa88178956b94439857b8ec97da7f29f42bf9f.zip | |
kernel: Fix guest memory corruption from non-page-aware queue I/O + fn-10 logging
ROOT CAUSE (guest userspace segfaults): the GSP-RM msgq buffer is
NV_MEMORY_NONCONTIGUOUS (129 independent 4K pages). gsp_rm_send wrote
multi-element records CONTIGUOUSLY from a translated start GPA - a record
crossing a page boundary scribbled into arbitrary guest RAM (pages are
unrelated GPAs). Observed as pgrep/ls segfaulting in the guest.
- gsp_rm_write_buf/gsp_rm_read_buf: split every shared-buffer access at
page boundaries and translate each page via the buffer page table
(gsp_rm_off_to_gpa). All queue record/element/header accesses converted.
- fn-10 (FREE) / fn-47 (UNLOADING) handler now logs hClient/hObject +
cmd_read for unload-cycle debugging.
Diagnosis captured: driver sends UNLOADING(47) then final FREEs during
teardown; queue-death detector can strand the last frees (fn-10 timeout
blocks close -> nvidia-smi hangs in exit).
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions
