diff options
Diffstat (limited to 'kernel/gsp_phys_booter.c')
| -rw-r--r-- | kernel/gsp_phys_booter.c | 23 |
1 files changed, 22 insertions, 1 deletions
diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index c1d9936..98bbc4a 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -27488,8 +27488,14 @@ static void gsp_phys_gr_surface_alias_scan_locked( if (npages < 2u || npages > 4096u) goto next; for (sdi = 0; sdi < gsp_phys_gr_surf_n; sdi++) - if (gsp_phys_gr_surf[sdi].va == va) + if (gsp_phys_gr_surf[sdi].va == va) { + /* r1510: content-gated screen + * code-heap quarantine (no-op when + * the surface is clean). */ + (void)gsp_sema_surf_clean_restore( + va, npages); goto next; /* already aliased */ + } if (gsp_phys_gr_surface_alias_locked(req, va, npages, &alias)) { if (gsp_phys_gr_surf_n < @@ -29641,6 +29647,21 @@ gr_page_unmapped: const u32 *sp; u32 spn = 0, spg = 0; + /* + * r1510: if the guest's code-heap upload overlapped + * the captured X screen, restore the screen from the + * capture-time baseline before this launch's replay. + * Content-gated (see the sema service's + * gsp_sema_surf_clean_restore). + */ + { + u64 cva = 0; + u32 cnp = 0; + + if (gsp_sema_surf_va_get(&cva, &cnp)) + (void)gsp_sema_surf_clean_restore(cva, + cnp); + } sp = gsp_sema_surf_prelude_get(&spn, &spg); if (sp && spn && spg) { bool repatch = |