From f476a6ea431f39560d69d6129f3167d8c55ecb6d Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 9 Oct 2026 12:11:29 -0400 Subject: vgsp-sema: bust the verified pool cache on every fresh injection + ipin store/lookup probes (ISSUE-0002) --- kernel/gsp_sema_service.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) (limited to 'kernel/gsp_sema_service.c') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index a09a3c5..384b804 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -1886,16 +1886,38 @@ static void svc_pin_store_win(u64 va, u64 pa, int ap) * (observed: the CE push-buffer page resolved to a zero-filled page and * every push was "implausible"). */ +static inline bool svc_pool_sem_va(u64 va); +static void svc_pool_pa_forget(u64 va); + static int svc_ipin_lookup(u64 va, u64 *pa, int *ap) { - return pin_lookup_tab(svc.ipin, SVC_IPIN_SLOTS, SVC_IPIN_PROBE, va, pa, - ap, false); + int rc = pin_lookup_tab(svc.ipin, SVC_IPIN_SLOTS, SVC_IPIN_PROBE, va, pa, + ap, false); + + if (svc_pool_sem_va(va) && gsp_sema_dbg && svc.counter_rel_dbg < 256) { + svc.counter_rel_dbg++; + pr_info("vgsp-sema: ipin-lookup va=0x%llx rc=%d pa=0x%llx\n", + va, rc, rc ? 0 : *pa); + } + return rc; } static void svc_ipin_store(u64 va, u64 pa, int ap) { pin_store_tab(svc.ipin, SVC_IPIN_SLOTS, SVC_IPIN_PROBE, &svc.ipin_n, &svc.ipin_drop, va, pa, ap, 0); + /* + * A fresh injection supersedes every older translation for this + * page: drop the verified pool cache entry so a subsequent pool + * release re-resolves through the pin we just stored instead of + * a cached page that may belong to the previous client. + */ + if (svc_pool_sem_va(va)) + svc_pool_pa_forget(va); + if (svc_pool_sem_va(va) && gsp_sema_dbg && svc.counter_rel_dbg < 256) { + svc.counter_rel_dbg++; + pr_info("vgsp-sema: ipin-store va=0x%llx pa=0x%llx\n", va, pa); + } } /* Any pinned translation: injected truth first, then self-discovered pins. */ -- cgit v1.2.3