From 5d4d26f8e773f2871c1b5c9266b82495d390970e Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Mon, 21 Sep 2026 12:37:46 -0400 Subject: kernel: Fix guest-hang root cause (VFIO mmap garbage PFN) + rebuild mdev remove path VFIO mmap (main.c): virt_to_phys() was used on vmalloc-family addresses (vzalloc'd BAR0 shadow, ioremap'd BAR2/3), producing garbage PFNs. Guest BAR0 access then hit a KVM make_spte reserved-bits WARN and an EPT-violation livelock, hard-wedging the guest on every nvidia driver probe (confirmed via QEMU GDB stub). BAR0 now maps per-page via vmalloc_to_pfn(); BAR2/3/4/5 map bars[N].gpa directly (like BAR1); config space uses new nv_vgpu_mmap_virt_to_pfn() helper. mdev remove path (main.c): old path never list_del'd the device (available_instances leaked), never ran cleanup (leaked gsp_emu kthread), never unregistered VFIO (leaked /dev/vfio/N + iommu group), never put pdev, never freed the struct. New kvmgt-style path: cancel init_work -> wait fds -> vfio_unregister_group_dev -> cleanup work -> list_del -> pci_dev_put -> vfio_put_device. gsp_rpc_client.c: fix dma_map_page dma_addr_t->int truncation in gsp_rpc_alloc_emul (corrupts >=4GB IOVAs); export gsp_client_init_emulation. gsp_emulation.c: export gsp_emu_process_rpc and gsp_emu_get_stats. main.c: remove wrong MODULE_SOFTDEP("pre: nvidia") - module has zero nvidia imports, loads standalone, and must load BEFORE nvidia.ko (it exports nvidia_vgpu_vfio_* for nvidia.ko to import). nvidia-vgpu-vfio.h: NULL-safe nv_vgpu_{dbg,info,warn,err} macros. tests/gsp_emulation_test.c: rewritten against current API - drives gsp_emu_process_rpc() with crafted shared-memory messages (protocol validation, SCHEDULE/YIELD/NOTIFY/DEBUG dispatch, stress). Builds with KBUILD_EXTRA_SYMBOLS; depends: open-iov-vfio. stack_manager.sh: vfio_mdev doesn't exist on >=6.4 (probe per-module); load-nvidia detects foreign nvidia via /sys/module/nvidia/version and errors with guidance instead of silently skipping. --- kernel/gsp_rpc_client.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) (limited to 'kernel/gsp_rpc_client.c') diff --git a/kernel/gsp_rpc_client.c b/kernel/gsp_rpc_client.c index e91d5f6..ae45513 100644 --- a/kernel/gsp_rpc_client.c +++ b/kernel/gsp_rpc_client.c @@ -562,7 +562,7 @@ int gsp_rpc_alloc_emul(struct gsp_client *client, struct nv_vgpu_device *vgpu = client->dev->driver_data; struct gsp_vram_alloc *alloc; u64 va = addr_hint ? addr_hint : 0x100000000ULL; /* Default 4GB */ - int ret; + dma_addr_t iova; alloc = kzalloc(sizeof(*alloc), GFP_KERNEL); if (!alloc) @@ -612,9 +612,10 @@ int gsp_rpc_alloc_emul(struct gsp_client *client, } alloc->mapping->pinned = true; - /* Map to IOVA for DMA */ - ret = dma_map_page(&vgpu->pdev->dev, alloc->mapping->pages[0], 0, size, DMA_BIDIRECTIONAL); - if (dma_mapping_error(&vgpu->pdev->dev, ret)) { + /* Map to IOVA for DMA (dma_addr_t is 64-bit - do NOT truncate into int; + * with an IOMMU the IOVA may exceed 32 bits) */ + iova = dma_map_page(&vgpu->pdev->dev, alloc->mapping->pages[0], 0, size, DMA_BIDIRECTIONAL); + if (dma_mapping_error(&vgpu->pdev->dev, iova)) { for (int i = 0; i < alloc->mapping->page_count; i++) __free_page(alloc->mapping->pages[i]); vfree(alloc->mapping->pages); @@ -622,7 +623,7 @@ int gsp_rpc_alloc_emul(struct gsp_client *client, kfree(alloc); return -ENOMEM; } - alloc->mapping->iova = ret; + alloc->mapping->iova = iova; alloc->mapping->mapped = true; alloc->gpu_va = va; @@ -1070,6 +1071,7 @@ int gsp_wpr_scratch_mutex_release(struct gsp_client *client, u32 wpr_id) * ============================================================ */ EXPORT_SYMBOL(gsp_client_init); +EXPORT_SYMBOL(gsp_client_init_emulation); EXPORT_SYMBOL(gsp_client_fini); EXPORT_SYMBOL(gsp_rpc_alloc); EXPORT_SYMBOL(gsp_rpc_free); -- cgit v1.2.3