From 7d27df77ac1f52816a7a741b39674e99e9c5f7bd Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Fri, 13 Nov 2026 09:33:17 -0500 Subject: vgsp: reject the dense-lookalike class in svc_gr_ram_ring_scan (entry0==entry1 gate) The GL client ring content scan admitted the lookalike page measured at pa 0x10a828000 / 0x10ad3e000 (dword 0x04000100 repeating) whose entry0 and entry1 decode identically (va=0x4000100 len=262144) and which passed every window/terminus gate. The pump then read a phantom 256 KiB push at VA 0x4000100 forever (sema-rdw rc=-2, sema-entry: unread, unregistered submissions=0; c271/c285), poisoning the client-VAS verify chain. A real ring does not repeat one entry verbatim in slots 0/1. Partial validation: c288 (fixed module) resolved the REAL ring pair via the VAS (pa=0x235f7c000, entry0 va=0x4000000 len=2236) and decoded real client pushes (submissions=15, CB-DIAG match=67). End-to-end pixel validation (gl_frames px0 != 0) is still pending; c286/c287 did not exercise the scan (no channel created). --- kernel/gsp_sema_service.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'kernel') diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index ebbe3bd..83ab2db 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -30578,6 +30578,21 @@ static bool svc_gr_ram_ring_scan(struct nv_vgpu_device *vgpu, } if (len1 < 4 || len1 > 0x100000) continue; + /* + * eng17 (2026-11-13): reject the dense-lookalike class + * directly. The page measured masquerading as the GL + * client's ring (pa 0x10a828000 / 0x10ad3e000, dword + * 0x04000100 repeating) decodes entry0 == entry1 + * (va=0x4000100 len=262144) and passes every + * window/terminus gate, so the pump read a phantom + * 256 KiB push at VA 0x4000100 forever (`sema-rdw ... + * rc=-2`, `sema-entry: unread`, `unregistered + * (submissions=0)`; c271/c285). A real ring does not + * repeat one entry verbatim in slots 0/1 (r908's + * repeat shares the VA but not the len). + */ + if (va0 == va1 && len0 == len1) + continue; /* * r979: kick-family ring discrimination. Shape alone * admitted a foreign table page ahead of the real ring -- cgit v1.2.3