diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-11-11 18:29:12 -0500 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-11-11 18:29:12 -0500 |
| commit | 889ccc0f3992022762d4a4d6a3641b64699d5bd3 (patch) | |
| tree | b055793fa8adb2a9cf32f328ac10ed9f14ac1176 | |
| parent | 9edeefe52936211744fb7f4d37d2ccc3641f8af5 (diff) | |
| download | open-iov-889ccc0f3992022762d4a4d6a3641b64699d5bd3.tar.gz open-iov-889ccc0f3992022762d4a4d6a3641b64699d5bd3.zip | |
vgsp: gate the injected shared-surface pin author (default off)
The strict signature scan used to locate the shared surface can match a guest
page-table page: the same 1.4M 'refCount/lkr' values reappear at the same
offsets across VMs, and writing the lkr into it coincides with guest bad-pmd
and soft-lockup storms in unrelated processes. Keep the VAS-walk author on,
but require sema_gl_shsurf_pin=1 for the injected-pin page; only a page proven
to be the client's shared surface (release target VA resolved through a
verified VAS) should be authored.
| -rw-r--r-- | kernel/gsp_sema_service.c | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index dcc998b..6da812d 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -6315,6 +6315,21 @@ module_param_named(sema_gl_shsurf_kick, gsp_sema_gl_shsurf_kick, MODULE_PARM_DESC(sema_gl_shsurf_kick, "Write 1 to run the shared-surface sync immediately on the service thread"); +/* + * DANGER (r1780 c16): the strict signature scan can match a guest page-table + * page (the 1.4M "refCount/lkr" values reappear at the same offsets across + * VMs, and writing the lkr into it coincides with guest bad-pmd/soft-lockup + * storms in unrelated processes). The injected-pin author is therefore + * DISABLED by default; only enable it with a page proven to be the client's + * shared surface (e.g. the release target VA resolved through a verified + * VAS). The VAS-walk author remains on. + */ +static bool gsp_sema_gl_shsurf_pin; +module_param_named(sema_gl_shsurf_pin, gsp_sema_gl_shsurf_pin, + bool, 0644); +MODULE_PARM_DESC(sema_gl_shsurf_pin, + "DANGER: author the injected shared-surface pin page (signature scans can hit page tables); default 0"); + #define SVC_GLSHSURF_VA 0x420a00800ULL /* @@ -43345,7 +43360,8 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu) if (sva != SVC_GLSHSURF_VA) (void)svc_gl_shsurf_sync(vgpu, 0, SVC_GLSHSURF_VA, 0); - svc_gl_shsurf_pin_sync(vgpu); + if (gsp_sema_gl_shsurf_pin) + svc_gl_shsurf_pin_sync(vgpu); } } /* Only ever called from the service thread. */ |