diff options
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/gsp_sema_service.c | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index dcc998b..6da812d 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -6315,6 +6315,21 @@ module_param_named(sema_gl_shsurf_kick, gsp_sema_gl_shsurf_kick, MODULE_PARM_DESC(sema_gl_shsurf_kick, "Write 1 to run the shared-surface sync immediately on the service thread"); +/* + * DANGER (r1780 c16): the strict signature scan can match a guest page-table + * page (the 1.4M "refCount/lkr" values reappear at the same offsets across + * VMs, and writing the lkr into it coincides with guest bad-pmd/soft-lockup + * storms in unrelated processes). The injected-pin author is therefore + * DISABLED by default; only enable it with a page proven to be the client's + * shared surface (e.g. the release target VA resolved through a verified + * VAS). The VAS-walk author remains on. + */ +static bool gsp_sema_gl_shsurf_pin; +module_param_named(sema_gl_shsurf_pin, gsp_sema_gl_shsurf_pin, + bool, 0644); +MODULE_PARM_DESC(sema_gl_shsurf_pin, + "DANGER: author the injected shared-surface pin page (signature scans can hit page tables); default 0"); + #define SVC_GLSHSURF_VA 0x420a00800ULL /* @@ -43345,7 +43360,8 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu) if (sva != SVC_GLSHSURF_VA) (void)svc_gl_shsurf_sync(vgpu, 0, SVC_GLSHSURF_VA, 0); - svc_gl_shsurf_pin_sync(vgpu); + if (gsp_sema_gl_shsurf_pin) + svc_gl_shsurf_pin_sync(vgpu); } } /* Only ever called from the service thread. */ |