diff options
| -rw-r--r-- | kernel/gsp_sema_service.c | 36 |
1 files changed, 33 insertions, 3 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 83ab2db..9730c58 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -283,9 +283,30 @@ static bool gsp_sema_ce_ram; static inline u64 svc_pa_max(void) { u64 top = READ_ONCE(gsp_sema_gr_scan_top); + u64 reg = gsp_phys_guest_ram_top(); if (!top || top > SEMA_PA_MAX) - return SEMA_PA_MAX; + top = SEMA_PA_MAX; + /* + * CONT.478: the registered guest-RAM ranges are readable content + * truth - extend (never shrink) the live bound to the registered top. + * On the 12 GiB boot the guest's system RAM reaches GPA 0x380000000 + * (the 4-14 GiB high band) while the param/compile bounds stopped at + * 10 GiB, so svc_ap_ok rejected every page-table walk and push read + * above 10 GiB before vfio_dma_rw could answer: the direct-GL client + * parks its VAS page directory at 0x33e537000 (13.9 GiB) and its + * push pages in the same band, so every walk missed with "L0 read + * fail" / "walk rc=-2" while the ring page (4.3 GiB, below the old + * bound) resolved fine - entries decoded, bodies stayed unreadable. + * A read above the registered top can only return padding zeros, so + * the extension never invents content; the sanity clamp keeps a + * misregistered range from unbounding the scans. + */ + if (reg > top) { + if (reg > SVC_GR_SCAN_TOP_MAX) + reg = SVC_GR_SCAN_TOP_MAX; + top = reg; + } return top; } @@ -25947,8 +25968,17 @@ static u64 svc_push_pa_ceiling(void) if (top > SVC_GR_SCAN_TOP_MAX) top = SVC_GR_SCAN_TOP_MAX; - if (top < SEMA_PA_MAX) - top = SEMA_PA_MAX; + /* + * CONT.478: the floor is the live acceptance bound, not the old + * compile-time 10 GiB - svc_pa_max() now follows the registered + * guest-RAM top, so the read ceiling covers the same 4-14 GiB high + * band the direct-GL client's push pages live in. Without this the + * walk could resolve a push above 10 GiB and the read path would + * still reject it ("sema-pinrej ... ceiling") - the same bound bug + * on the other side of the source chain. + */ + if (top < svc_pa_max()) + top = svc_pa_max(); /* * SESSION 153-CONTINUED-67: never let the ceiling exceed the highest * GPA any registered guest-RAM range covers - a read above it can |