vgsp: xw-mirror page-reuse guards + submit-status clearer scaffold (SESSION 148 r873)

The unguarded 3 ms mirror loop kept writing the count law into its latched
page after the guest had reused it (r872 evidence: guest 'Bad page map ...
pmd:102656067' pointing at exactly the mirrored page's PA as another
process's PTE table). The loop now latches the progress word's base bits and
stops permanently when they change or are zeroed, and re-checks the counter
object's signature every 64th tick. New sema_xw_comp parameter + vgsp-xwcomp
kthread can clear a submit member's armed 0x8000 status (value 0 pattern
only); r874 proved an unverified clear into a false member kills Xorg within
seconds, so it stays uninjected until the member address is watched live.

1 files changed, 24 insertions, 0 deletions

diff --git a/kernel/main.c b/kernel/main.c
index 0e9452b..509c560 100644
--- a/kernel/main.c
+++ b/kernel/main.c
@@ -3129,6 +3129,30 @@ module_param_cb(sema_xw_mirror, &nv_vgpu_sema_xw_mirror_ops, NULL, 0200);
 MODULE_PARM_DESC(sema_xw_mirror, "Mirror X frame counter (cnt_pa,mem_pa; 0,0=stop)");
 
 /*
+ * X/GL submit-kick completion clearer (SESSION 148 r873): PA of the u16
+ * status word (member page offset 0xBE) that the X submit path arms to
+ * 0x8000 and polls until 0. Cleared host-side so the kick settles in ms.
+ *   echo 0x1123456be > .../parameters/sema_xw_comp
+ *   echo 0           > .../parameters/sema_xw_comp  (stop)
+ */
+static int nv_vgpu_sema_xw_comp_set(const char *val,
+				    const struct kernel_param *kp)
+{
+	u64 pa = 0;
+
+	if (kstrtoull(val, 0, &pa))
+		return -EINVAL;
+	return gsp_sema_service_xw_comp(pa);
+}
+
+static const struct kernel_param_ops nv_vgpu_sema_xw_comp_ops = {
+	.set = nv_vgpu_sema_xw_comp_set,
+};
+
+module_param_cb(sema_xw_comp, &nv_vgpu_sema_xw_comp_ops, NULL, 0200);
+MODULE_PARM_DESC(sema_xw_comp, "Clear X submit member status at PA (0=stop)");
+
+/*
  * Debug: search the whole emulated vidmem for an 8-byte pattern:
  *   echo 0x0000000400000001,16 > .../parameters/sema_vidmem_find
  */