From 203d3ff5378d4825e039b7cbd9a15adca5aea867 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Thu, 22 Oct 2026 17:54:30 -0400 Subject: r496d USERD shape-scan validation: the progress-tracker entry sits ABOVE the ring The ring-ownership check rejected every entry VA >= ring_va, but the driver writes TWO GPFIFO entries per kickoff - the main pushbuffer BELOW the ring and the progress tracker ABOVE it (nvidia-push-priv.h). Accept VAs anywhere in the 2 MB allocation window. --- kernel/gsp_sema_service.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'kernel/gsp_sema_service.c') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 75c7645..c8987b7 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -13078,10 +13078,17 @@ static int svc_chan_userd(struct nv_vgpu_device *vgpu, struct svc_channel *ch, eva = ((u64)(a1 & 0xff) << 32) | (u64)(a0 & 0xfffffffc); elen = ((a1 >> 10) & 0x1fffff) << 2; + /* + * Every entry the put claims must name a + * VA in the ring's allocation window - + * pushbuffers below the ring, the + * progress tracker above it. + */ if (!eva || - eva >= ch->gpfifo_va || eva + SVC_GR_RAM_WIN / 2 < ch->gpfifo_va || + eva >= ch->gpfifo_va + + SVC_GR_RAM_WIN / 2 || elen < 4 || elen > 0x100000) { ok = false; break; -- cgit v1.2.3