From cc2c2ab40af45e3a14e93b87e4988909303f8a95 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Thu, 24 Sep 2026 10:01:22 -0400 Subject: kernel: resolve semaphores through trusted translations only; tools: dump the libcuda tracker wait The vidmem window convention turns any VA above the window base into a vidmem offset, but the CUDA client's GPU semaphores are sysmem objects mapped into its address space at those same VAs. A release applied through the convention therefore landed in the vidmem shadow instead of the page the client polls, and the completion was silently lost: the libcuda tracker it waits on never advanced. Semaphore reads and writes now use trusted translations only (pins, learned cache, discovered map, page walks), so an unresolved semaphore is counted as a miss and stays visible instead of corrupting a shadow. tools/guest-diag/trkinfo.py dumps the libcuda tracker the client spins on: the tracker object behind p+0x9410, the semaphore object it references, the u32 semaphore memory it polls (a /dev/nvidiactl mapping backed by guest RAM) and the VMA that memory lives in. --- kernel/gsp_sema_service.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index a67107b..34b9ffd 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -1068,7 +1068,16 @@ static int svc_resolve_va(struct nv_vgpu_device *vgpu, u64 va, u64 *addr, { int ap = SVC_APERTURE_SYS; - if (svc_lookup(vgpu, va, addr, &ap)) + /* + * Semaphore I/O must never go through the vidmem window convention. + * The convention turns any VA above the window base into a vidmem + * offset, and the client's GPU semaphores are sysmem objects mapped + * into its address space at those same VAs: the write would land in + * the vidmem shadow instead of the page the client polls, silently + * losing the release. Trusted translations only; an unresolved + * semaphore is counted as a miss so the gap stays visible. + */ + if (svc_lookup_trusted(vgpu, va, addr, &ap)) return -ENOENT; *aperture = (ap == SVC_APERTURE_FB) ? 1 : 0; return 0; -- cgit v1.2.3