From be25496cdc7d08226daa26f0707997dee12612dd Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Thu, 5 Nov 2026 18:51:56 -0500 Subject: vgsp-gl: sweep the beef ring head for the client's init uploads and quarantine the screen/code-heap overlap The GL client's one-shot LOAD_INLINE_DATA uploads (code images, vertex and index buffers) sit at the head of its GPFIFO ring, but the first observed GP_PUT can already be far past them (r1508: put=8982), so the continuation sweep never decoded them and the FB fetch pages stayed zero. Sweep the head once per beef channel in inline-only mode with the read-arbitrated, tail-aware decoder: r1509 receipts show 'sema-utilsweep swept=64 writes=16' and 'inline write dst=0x44ff000 -> pa=0xb9f000 bytes=1550 data8=9a996940...', after which sema_probe reads the client's real vertex floats and the u16 index stream at 0xb9d410/0xb9fcc8. The guest's shader/code-heap BAR1 upload can also land on the captured X screen's pages (r1508/r1510: vidmem 0x200000 held a program image while the X screen VA 0x120400000 maps there). Snapshot the captured surface at bind time; before a launch whose surface page 0 carries the code-heap/SPH signature, restore the surface from that snapshot (a black X-clear baseline when the bind happened after the upload). The quarantine is content-gated, preserves raster stores that follow, and r1509/r1511 show the clean page 0 (0xff000000) with no code bytes. --- kernel/gsp_sema_service.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'kernel/gsp_sema_service.h') diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h index ff3d088..8fec320 100644 --- a/kernel/gsp_sema_service.h +++ b/kernel/gsp_sema_service.h @@ -548,6 +548,17 @@ const u32 *gsp_sema_surf_prelude_get(u32 *n, u32 *gen); */ bool gsp_sema_surf_va_get(u64 *va, u32 *npages); +/* + * SESSION 154 r1510: quarantine the guest code-heap/shader upload that can + * overlap the captured X screen (BAR1 mmap writes the emulator cannot + * trap). The surface capture snapshots the screen; a later launch whose + * screen page 0 carries the code signature restores the surface from that + * snapshot before the engine runs (the baseline stays armed so a later + * client context's upload is caught too). Returns the pages restored (0 + * when there is no pollution or no baseline). + */ +int gsp_sema_surf_clean_restore(u64 va, u64 npages); + /* * SESSION 153-CONTINUED-63: the fill's completed render-target tracking run * (base VA + page count), true only when every page of the surface resolved -- cgit v1.2.3