vgsp: xw-mirror page-reuse guards + submit-status clearer scaffold (SESSION 148 r873)

The unguarded 3 ms mirror loop kept writing the count law into its latched
page after the guest had reused it (r872 evidence: guest 'Bad page map ...
pmd:102656067' pointing at exactly the mirrored page's PA as another
process's PTE table). The loop now latches the progress word's base bits and
stops permanently when they change or are zeroed, and re-checks the counter
object's signature every 64th tick. New sema_xw_comp parameter + vgsp-xwcomp
kthread can clear a submit member's armed 0x8000 status (value 0 pattern
only); r874 proved an unverified clear into a false member kills Xorg within
seconds, so it stays uninjected until the member address is watched live.

1 files changed, 1 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index e96ce1c..69d6f33 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -134,6 +134,7 @@ int  gsp_sema_service_dump_channels(void);
 int  gsp_sema_service_add_map(u64 gpu_va, u64 pa, u64 len, u32 ap);
 int  gsp_sema_service_dump_vidmem(u64 addr, u64 len);
 int  gsp_sema_service_xw_mirror(u64 cnt_pa, u64 mem_pa);
+int  gsp_sema_service_xw_comp(u64 comp_pa);
 int  gsp_sema_service_find_vidmem(u64 pattern, u64 max_hits);
 int  gsp_sema_service_pdb_discover(u64 ring_va, u64 ring_pa);
 int  gsp_sema_service_chan_rewind(u32 h_object);