diff options
Diffstat (limited to 'kernel/gsp_sema_service.c')
| -rw-r--r-- | kernel/gsp_sema_service.c | 47 |
1 files changed, 47 insertions, 0 deletions
diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c index 576582a..5d54990 100644 --- a/kernel/gsp_sema_service.c +++ b/kernel/gsp_sema_service.c @@ -15662,6 +15662,7 @@ static u32 svc_gl_cb_copy_h; static u32 svc_gl_cb_copy_val; static u32 svc_gl_cb_copy_hash; static u32 svc_gl_cb_copy_log; +static u32 svc_gl_cb_seed_log; /* * r1512: provenance of the page most recently written into the forced MME * seed (what the VS's c[0x0] bank will contain). Read by the coverage @@ -16455,6 +16456,52 @@ cb_ready: (void)hash; rc = svc_grce_inline_write(vgpu, sema_gl_cb_copy_to, buf, sizeof(buf), h_object); + /* + * r1521: deliver the assembled image to the seed page's real backing + * store as well. The forced seed page is an engine-visible page the + * service chooses (a page of the captured X screen), not a client + * allocation: the r1506 authoring-VAS rule correctly refuses a beef + * channel write to it, so svc_grce_inline_write() above only updates + * the VA shadow while the engine keeps reading the (black) screen + * page. Resolve the seed VA through the VAS/walk/trusted chain and + * write the shadow/FB page directly - the seed destination is a + * service-forced engine input, so the ownership rule does not apply. + */ + { + u64 dpa = 0; + int dap = SVC_APERTURE_SYS; + bool resolved = false; + + if (!svc_chanvas_lookup(vgpu, + sema_gl_cb_copy_to & ~0xfffULL, + &dpa, &dap)) + resolved = true; + else if (!svc_walk_vaspaces(vgpu, + sema_gl_cb_copy_to & ~0xfffULL, + &dpa, &dap)) + resolved = true; + else if (!svc_lookup_trusted(vgpu, + sema_gl_cb_copy_to & ~0xfffULL, + &dpa, &dap)) + resolved = true; + if (resolved && dpa) { + u64 d = (dpa & ~0xfffULL) + + (sema_gl_cb_copy_to & 0xfffULL); + + if (!svc_write_ap(vgpu, d, svc_ap_of(dap), buf, + sizeof(buf)) && + svc_gl_cb_seed_log < 12u) { + u32 m[4]; + + memcpy(m, buf + 0x80, sizeof(m)); + svc_gl_cb_seed_log++; + pr_info("vgsp-sema: sema-gl: CB-SEED h=0x%x seed=0x%llx dpa=0x%llx ap=%u ssrc=%d m80=%08x %08x %08x %08x (image written to the engine-visible seed page)\n", + h_object, sema_gl_cb_copy_to, d, + svc_ap_of(dap), ssrc, + m[0], m[1], m[2], m[3]); + } + } + } if (svc_gl_cb_copy_log < 96u) { u32 w[8]; |