vgsp-sph: d24/d25 seed extension - capture 0x3490/0x3494 (scratch24/25) + params sema_mme_state_d24/d25 + fail-closed seed emissions after d19 (param>captured>skip, 3d-reloc) - the d28-forced slow path reads the 0x349x states after d19; +235/-1

1 files changed, 100 insertions, 1 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 08f2309..532f89d 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -14790,13 +14790,52 @@ bool gsp_sema_mme_scratch19_get(u32 *val)
 	return svc_scratch19_seen;
 }
 
+/*
+ * SESSION 153-CONTINUED-116: companion captures for the bug2548370 slow-path
+ * state family. STATE 0xD24 / shadow scratch 0x24 (method 0x3490 =
+ * SET_MME_SHADOW_SCRATCH(0x24)) is read by the macro body alongside the d19
+ * selector; the replayed context never received the client's
+ * once-per-channel write, so the value resolves to whatever the replay left.
+ * The value is stored exactly as pushed (first write wins); the GR launch
+ * builder can fall back to sema_mme_state_d24 when this never fires.
+ */
+static u32 svc_scratch24_val;
+static bool svc_scratch24_seen;
+static u32 svc_scratch24_log;
+
+bool gsp_sema_mme_scratch24_get(u32 *val)
+{
+	if (svc_scratch24_seen && val)
+		*val = READ_ONCE(svc_scratch24_val);
+	return svc_scratch24_seen;
+}
+
+/*
+ * SESSION 153-CONTINUED-116: companion of scratch 0x24 above - STATE 0xD25 /
+ * shadow scratch 0x25 (method 0x3494 = SET_MME_SHADOW_SCRATCH(0x25)), the
+ * next unseeded input on the same slow path. Same first-write-wins capture
+ * and builder fallback (sema_mme_state_d25).
+ */
+static u32 svc_scratch25_val;
+static bool svc_scratch25_seen;
+static u32 svc_scratch25_log;
+
+bool gsp_sema_mme_scratch25_get(u32 *val)
+{
+	if (svc_scratch25_seen && val)
+		*val = READ_ONCE(svc_scratch25_val);
+	return svc_scratch25_seen;
+}
+
 static void svc_scratch18_watch(const u8 *buf, u32 len, u64 push_va,
 				u32 h_object)
 {
 	u32 off = 0;
 
 	if (svc_scratch18_seen && svc_scratch18_log >= 24u &&
-	    svc_scratch19_seen && svc_scratch19_log >= 24u)
+	    svc_scratch19_seen && svc_scratch19_log >= 24u &&
+	    svc_scratch24_seen && svc_scratch24_log >= 24u &&
+	    svc_scratch25_seen && svc_scratch25_log >= 24u)
 		return;
 	while (off + 4u <= len) {
 		u32 hdr, op, cnt, addr;
@@ -14841,6 +14880,40 @@ static void svc_scratch18_watch(const u8 *buf, u32 len, u64 push_va,
 				off += 4u + cnt * 4u;
 				continue;
 			}
+			if (addr == 0x3490u) {
+				u32 val;
+
+				memcpy(&val, buf + off + 4, 4);
+				if (!svc_scratch24_seen) {
+					svc_scratch24_seen = true;
+					WRITE_ONCE(svc_scratch24_val, val);
+				}
+				if (svc_scratch24_log < 24u) {
+					svc_scratch24_log++;
+					pr_info("sema-scratch24: h=0x%x va=0x%llx off=0x%x op=%u cnt=%u val=0x%08x (SET_MME_SHADOW_SCRATCH(0x24); slow-path state d24)\n",
+						h_object, push_va, off, op, cnt,
+						val);
+				}
+				off += 4u + cnt * 4u;
+				continue;
+			}
+			if (addr == 0x3494u) {
+				u32 val;
+
+				memcpy(&val, buf + off + 4, 4);
+				if (!svc_scratch25_seen) {
+					svc_scratch25_seen = true;
+					WRITE_ONCE(svc_scratch25_val, val);
+				}
+				if (svc_scratch25_log < 24u) {
+					svc_scratch25_log++;
+					pr_info("sema-scratch25: h=0x%x va=0x%llx off=0x%x op=%u cnt=%u val=0x%08x (SET_MME_SHADOW_SCRATCH(0x25); slow-path state d25)\n",
+						h_object, push_va, off, op, cnt,
+						val);
+				}
+				off += 4u + cnt * 4u;
+				continue;
+			}
 			off += 4u + cnt * 4u;
 			continue;
 		}
@@ -14870,6 +14943,32 @@ static void svc_scratch18_watch(const u8 *buf, u32 len, u64 push_va,
 					h_object, push_va, off, val);
 			}
 		}
+		if (op == 4u && addr == 0x3490u) {
+			u32 val = (hdr >> 16) & 0x1fffu;
+
+			if (!svc_scratch24_seen) {
+				svc_scratch24_seen = true;
+				WRITE_ONCE(svc_scratch24_val, val);
+			}
+			if (svc_scratch24_log < 24u) {
+				svc_scratch24_log++;
+				pr_info("sema-scratch24: h=0x%x va=0x%llx off=0x%x op=4 immd val=0x%08x (SET_MME_SHADOW_SCRATCH(0x24))\n",
+					h_object, push_va, off, val);
+			}
+		}
+		if (op == 4u && addr == 0x3494u) {
+			u32 val = (hdr >> 16) & 0x1fffu;
+
+			if (!svc_scratch25_seen) {
+				svc_scratch25_seen = true;
+				WRITE_ONCE(svc_scratch25_val, val);
+			}
+			if (svc_scratch25_log < 24u) {
+				svc_scratch25_log++;
+				pr_info("sema-scratch25: h=0x%x va=0x%llx off=0x%x op=4 immd val=0x%08x (SET_MME_SHADOW_SCRATCH(0x25))\n",
+					h_object, push_va, off, val);
+			}
+		}
 		off += 4u;
 	}
 }