diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-11-05 18:51:56 -0500 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-11-05 18:51:56 -0500 |
| commit | be25496cdc7d08226daa26f0707997dee12612dd (patch) | |
| tree | 6b91b9614887530a681c9a4d06e5c9458eb956fa /kernel/gsp_phys_booter.c | |
| parent | 52a98cfc8d2100c4025f1ee3514fa5cc070c1284 (diff) | |
| download | open-iov-be25496cdc7d08226daa26f0707997dee12612dd.tar.gz open-iov-be25496cdc7d08226daa26f0707997dee12612dd.zip | |
vgsp-gl: sweep the beef ring head for the client's init uploads and quarantine the screen/code-heap overlap
The GL client's one-shot LOAD_INLINE_DATA uploads (code images, vertex
and index buffers) sit at the head of its GPFIFO ring, but the first
observed GP_PUT can already be far past them (r1508: put=8982), so the
continuation sweep never decoded them and the FB fetch pages stayed
zero. Sweep the head once per beef channel in inline-only mode with the
read-arbitrated, tail-aware decoder: r1509 receipts show
'sema-utilsweep swept=64 writes=16' and
'inline write dst=0x44ff000 -> pa=0xb9f000 bytes=1550
data8=9a996940...', after which sema_probe reads the client's real
vertex floats and the u16 index stream at 0xb9d410/0xb9fcc8.
The guest's shader/code-heap BAR1 upload can also land on the captured
X screen's pages (r1508/r1510: vidmem 0x200000 held a program image
while the X screen VA 0x120400000 maps there). Snapshot the captured
surface at bind time; before a launch whose surface page 0 carries the
code-heap/SPH signature, restore the surface from that snapshot (a
black X-clear baseline when the bind happened after the upload). The
quarantine is content-gated, preserves raster stores that follow, and
r1509/r1511 show the clean page 0 (0xff000000) with no code bytes.
Diffstat (limited to 'kernel/gsp_phys_booter.c')
| -rw-r--r-- | kernel/gsp_phys_booter.c | 23 |
1 files changed, 22 insertions, 1 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index c1d9936..98bbc4a 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -27488,8 +27488,14 @@ static void gsp_phys_gr_surface_alias_scan_locked( if (npages < 2u || npages > 4096u) goto next; for (sdi = 0; sdi < gsp_phys_gr_surf_n; sdi++) - if (gsp_phys_gr_surf[sdi].va == va) + if (gsp_phys_gr_surf[sdi].va == va) { + /* r1510: content-gated screen + * code-heap quarantine (no-op when + * the surface is clean). */ + (void)gsp_sema_surf_clean_restore( + va, npages); goto next; /* already aliased */ + } if (gsp_phys_gr_surface_alias_locked(req, va, npages, &alias)) { if (gsp_phys_gr_surf_n < @@ -29641,6 +29647,21 @@ gr_page_unmapped: const u32 *sp; u32 spn = 0, spg = 0; + /* + * r1510: if the guest's code-heap upload overlapped + * the captured X screen, restore the screen from the + * capture-time baseline before this launch's replay. + * Content-gated (see the sema service's + * gsp_sema_surf_clean_restore). + */ + { + u64 cva = 0; + u32 cnp = 0; + + if (gsp_sema_surf_va_get(&cva, &cnp)) + (void)gsp_sema_surf_clean_restore(cva, + cnp); + } sp = gsp_sema_surf_prelude_get(&spn, &spg); if (sp && spn && spg) { bool repatch = |