From f7c626f1bcb1a031372c855db3e9e9cb545085a4 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 23 Oct 2026 17:19:17 -0400 Subject: vgsp-sema r565: session-scope the GR exactly-once caches (cross-client VA reuse) The UVM pool reuses the same launch push VAs for every client of a boot. svc_gr_cap_hist[8] matches on the push VA ALONE (no content hash) and was boot-scoped, so a previous client's capture could classify a later client's fresh launch as already captured and skip it (LAUNCH-SKIP (replay; already captured=1) from a dead session's record). svc_gr_seen (hash-keyed) and svc_inline_once (content-keyed) share the same lifetime and the same class of risk. Reset all three in svc_session_flush; they refill within the session from the live client's own pushes, so same-session dedup is unchanged. --- kernel/gsp_sema_service.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index d47ec08..e96a7b6 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -12248,6 +12248,22 @@ static void svc_session_flush(void) /* r551: delivered-release marks are per-session (same handles reused). */ memset(svc_opdef_done, 0, sizeof(svc_opdef_done)); svc_opdef_done_next = 0; + /* + * r565: the GR exactly-once memories are boot-scoped caches keyed + * (partly) by push VA, and the UVM pool reuses the same launch push + * VAs for every client of the boot. svc_gr_cap_hist matches on the VA + * ALONE (8 entries, no hash), so a previous client's capture could + * classify a later client's fresh launch as "already captured" and + * skip it (`LAUNCH-SKIP (replay; already captured=1)`); the hash-keyed + * svc_gr_seen and the content-keyed svc_inline_once are lower risk but + * share the same lifetime. Reset all three per session - they refill + * within the session from the live client's own pushes. + */ + memset(svc_gr_cap_hist, 0, sizeof(svc_gr_cap_hist)); + svc_gr_cap_hist_pos = 0; + memset(svc_gr_seen, 0, sizeof(svc_gr_seen)); + memset(svc_inline_once, 0, sizeof(svc_inline_once)); + svc_inline_once_next = 0; /* * Re-arm the diagnostic log budgets per session. The first client of * a boot would otherwise spend every budget and the next session's -- cgit v1.2.3