From 889ccc0f3992022762d4a4d6a3641b64699d5bd3 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Wed, 11 Nov 2026 18:29:12 -0500 Subject: vgsp: gate the injected shared-surface pin author (default off) The strict signature scan used to locate the shared surface can match a guest page-table page: the same 1.4M 'refCount/lkr' values reappear at the same offsets across VMs, and writing the lkr into it coincides with guest bad-pmd and soft-lockup storms in unrelated processes. Keep the VAS-walk author on, but require sema_gl_shsurf_pin=1 for the injected-pin page; only a page proven to be the client's shared surface (release target VA resolved through a verified VAS) should be authored. --- kernel/gsp_sema_service.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index dcc998b..6da812d 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -6315,6 +6315,21 @@ module_param_named(sema_gl_shsurf_kick, gsp_sema_gl_shsurf_kick, MODULE_PARM_DESC(sema_gl_shsurf_kick, "Write 1 to run the shared-surface sync immediately on the service thread"); +/* + * DANGER (r1780 c16): the strict signature scan can match a guest page-table + * page (the 1.4M "refCount/lkr" values reappear at the same offsets across + * VMs, and writing the lkr into it coincides with guest bad-pmd/soft-lockup + * storms in unrelated processes). The injected-pin author is therefore + * DISABLED by default; only enable it with a page proven to be the client's + * shared surface (e.g. the release target VA resolved through a verified + * VAS). The VAS-walk author remains on. + */ +static bool gsp_sema_gl_shsurf_pin; +module_param_named(sema_gl_shsurf_pin, gsp_sema_gl_shsurf_pin, + bool, 0644); +MODULE_PARM_DESC(sema_gl_shsurf_pin, + "DANGER: author the injected shared-surface pin page (signature scans can hit page tables); default 0"); + #define SVC_GLSHSURF_VA 0x420a00800ULL /* @@ -43345,7 +43360,8 @@ static void svc_pump_channels(struct nv_vgpu_device *vgpu) if (sva != SVC_GLSHSURF_VA) (void)svc_gl_shsurf_sync(vgpu, 0, SVC_GLSHSURF_VA, 0); - svc_gl_shsurf_pin_sync(vgpu); + if (gsp_sema_gl_shsurf_pin) + svc_gl_shsurf_pin_sync(vgpu); } } /* Only ever called from the service thread. */ -- cgit v1.2.3