diff options
| -rw-r--r-- | kernel/gsp_sema_service.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 75c7645..c8987b7 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -13078,10 +13078,17 @@ static int svc_chan_userd(struct nv_vgpu_device *vgpu, struct svc_channel *ch, eva = ((u64)(a1 & 0xff) << 32) | (u64)(a0 & 0xfffffffc); elen = ((a1 >> 10) & 0x1fffff) << 2; + /* + * Every entry the put claims must name a + * VA in the ring's allocation window - + * pushbuffers below the ring, the + * progress tracker above it. + */ if (!eva || - eva >= ch->gpfifo_va || eva + SVC_GR_RAM_WIN / 2 < ch->gpfifo_va || + eva >= ch->gpfifo_va + + SVC_GR_RAM_WIN / 2 || elen < 4 || elen > 0x100000) { ok = false; break; |