From 8fc2b3a71a9a7ab0990cd7ea241e03dad67832eb Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Tue, 20 Oct 2026 14:43:43 -0400 Subject: sema: keep count=1 remapconst parts as flags only (NOT have_remap) - r365 proved below-floor window fills executing via unproven resolution zeroed guest RAM (slab GPF -> guest panic); add LOWFILL-WIT resolution witness for below-floor fills --- kernel/gsp_sema_service.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 2db3c83..2eb9610 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -4029,6 +4029,7 @@ static u32 svc_wait_log; /* per-session held-row print budget */ static u32 svc_wait_pass_log; /* per-session resolved-row budget */ static u32 svc_remapconst_log; /* r343 FILL: SET_REMAP_CONST_A rows */ static u32 svc_fill_raw_log; /* r365 FILL-RAW: raw dropped-fill dumps */ +static u32 svc_lowfill_log; /* r365b LOWFILL-WIT: below-floor fills */ static u32 svc_fill_noremap; /* r343 FILL: fail-closed holds */ static u64 svc_wait_rel_va; /* this entry's own release (mirror) */ static u32 svc_wait_rel_payload; @@ -4607,6 +4608,19 @@ static int svc_fill(struct nv_vgpu_device *vgpu, u64 addr, u64 value, u32 elem, addr = pa; aperture = aper; } + /* + * r365b LOWFILL-WIT: a below-floor virtual fill (the guest's + * vidmem-window page-table writes) is a corruption risk: its + * resolution must be proven before the op is allowed to run + * (r365: 16-byte and 32 KB zero fills landed in guest RAM and + * killed the guest kernel). Log every resolution bounded. + */ + if (va0 < SVC_VAS_FLOOR && svc_lowfill_log < 64) { + svc_lowfill_log++; + pr_info("sema-lowfill: va=0x%llx shadow=%d resolved=0x%llx ap=%u elem=%u count=%u value=0x%llx\n", + va0, shadow, addr, aperture, elem, count, + value); + } } if (gsp_sema_dbg && !shadow && svc_dst_watched(addr) && @@ -8763,29 +8777,30 @@ static void svc_decode_stream(struct nv_vgpu_device *vgpu, const u8 *buf, * r365: the driver also pushes the fill constants * as SEPARATE count=1 methods (the CE * page-table fills carry only SET_REMAP_CONST_A - * with A=0). The old count>=3-only decode - * dropped those, so have_remap stayed 0 and the - * fill decoded no op - the guest's page-table - * writes never reached the shadow (the - * first-client GRFILL-DROP class). + * with A=0). Capture the individual parts but do + * NOT set have_remap: r365b proved that letting + * these pass the fill guard executes below-floor + * window fills (0x2000c0xxx, 0x204020000) whose + * svc_fill resolution landed in GUEST RAM and + * zeroed slab pages (guest kernel GPF in + * kmem_cache_alloc -> panic at ~75 s). The + * window fills only run behind gsp_sema_winfill + * with the correct resolution proven first. */ st.remap_a = v0; st.have_remap_a = 1; - st.have_remap = 1; } break; case CE_M_SET_REMAP_CONST_B: if (count >= 1) { st.remap_b = v0; st.have_remap_b = 1; - st.have_remap = 1; } break; case CE_M_SET_REMAP_COMPONENTS: if (count >= 1) { st.remap_comp = v0; st.have_remap_c = 1; - st.have_remap = 1; } break; case CE_M_SET_SRC_PHYS_MODE: @@ -10051,6 +10066,7 @@ static void svc_session_flush(void) svc_wait_pass_log = 0; svc_remapconst_log = 0; svc_fill_raw_log = 0; + svc_lowfill_log = 0; svc_fill_noremap = 0; svc_wait_n = 0; svc_wait_rel_have = false; -- cgit v1.2.3