vgsp: CONT-84 - SA-REARM moved before window copy (was appended after, calls ran against prelude SA clobber); WIN-PATCH reaches beef path at last (sweep runs=383 matched=4, 0x124 off65 0x2->0x1 x4); prelude-capture pages bitmask + ring-drop log 8->64 - capture completeness FIXED (pages=0x7fff -> words=3083 covered=55 sa_mask=0x63fffefffffffff code_words=2854); sema_map_add_max=4096 guard (stale host writer re-injecting stale mapping every ~2s racing per-page pins - REFUSED, first-read capture complete); sema_gl_mme_version=1 (SET_MME_VERSION 0x234, absent from capture) + sema_gl_mme_track (0x124<-0) - no change observed; GATE1 black: call-bearing launches park+poison every boot (r1245/1250/1265/1270) even w/ complete prelude+rearm+TRACK+VERSION, gen0=0 MME never starts, shadow2[c597] 0x3810=0x11 0x3910=0; trap=80001614 + transient ds a2040a00 noted; next: A/B version=0/track=-1 (lane destabilized vs MME never starts), shadow port read at first call launch, track=2 PASSTHROUGH - SESSION 153 r1237-r1270

1 files changed, 47 insertions, 3 deletions

diff --git a/kernel/gsp_sema_service.c b/kernel/gsp_sema_service.c
index 29d28d6..5224dad 100644
--- a/kernel/gsp_sema_service.c
+++ b/kernel/gsp_sema_service.c
@@ -14433,6 +14433,14 @@ static void svc_mme_prelude_capture(const u8 *buf, u32 len, u64 push_va,
 {
 	u32 off = 0, added = 0, dups = 0, full = 0;
 	u32 words0 = svc_mme_prelude_n;
+	/*
+	 * SESSION 153-CONTINUED-84: which 4K pages of the push delivered at
+	 * least one setup run. r1240's carrier read decoded only pages 0 of
+	 * 0x4001004 (15 slots, 933 code words) while r1236's identical
+	 * stream decoded all 16 (55 slots, 2854 code words) - the bitmap
+	 * names the truncation page in one line.
+	 */
+	u64 page_bits = 0;
 
 	if (!READ_ONCE(svc_mme_prelude_flag))
 		return;
@@ -14511,6 +14519,7 @@ static void svc_mme_prelude_capture(const u8 *buf, u32 len, u64 push_va,
 			off += span * 4u;
 			continue;
 		}
+		page_bits |= 1ull << ((off >> 12) & 63u);
 		sig = svc_mme_run_sig(buf + off, span, hdr);
 		for (i = 0; i < svc_mme_prelude_sig_n; i++) {
 			if (svc_mme_prelude_sigs[i] == sig) {
@@ -14572,10 +14581,10 @@ static void svc_mme_prelude_capture(const u8 *buf, u32 len, u64 push_va,
 			u32 k;
 
 			svc_mme_prelude_dump_n++;
-			pr_info("sema-mme-prelude: capture h=0x%x va=0x%llx len=%u added=%u words=%u gen=%u (was %u)\n",
+			pr_info("sema-mme-prelude: capture h=0x%x va=0x%llx len=%u added=%u words=%u gen=%u (was %u) pages=0x%llx\n",
 				h_object, push_va, len, added,
 				svc_mme_prelude_n, svc_mme_prelude_gen,
-				words0);
+				words0, (unsigned long long)page_bits);
 			for (k = 0; k + 4u <= svc_mme_prelude_n &&
 			     k < 512u; k += 4u)
 				pr_info("sema-mme-prelude[%03u] %08x %08x %08x %08x\n",
@@ -39405,6 +39414,23 @@ int gsp_sema_service_dump_channels(void)
 #define SVC_PIN_REWIND	8
 #define SVC_MAP_ADD_MAX	4096
 
+/*
+ * SESSION 153-CONTINUED-84: optional length guard for injected mappings.
+ * A stale producer on the host (observed 2026-11-01: a periodic writer
+ * enqueueing (0x4001004,0x11f168000,0x10000) every ~2 s from an unknown
+ * leftover process) re-applies a whole-64K contiguous mapping over the
+ * per-page SA-carrier pins and can win the read of the client's push
+ * region, leaving every page past the first reading zeros (r1240/r1260:
+ * the replayed prelude captured only the first 15 SA slots while r1236/
+ * r1245/r1250 captured all 55). When set, requests longer than this many
+ * bytes are refused with a bounded log, so only per-page (4K) pins land.
+ * 0 = accept any length (the historical behaviour).
+ */
+static u32 gsp_sema_map_add_max;
+module_param_named(sema_map_add_max, gsp_sema_map_add_max, uint, 0644);
+MODULE_PARM_DESC(sema_map_add_max,
+	"Refuse injected mapping requests longer than this many bytes (0 = off; set 4096 to defeat stale whole-window injections)");
+
 struct svc_map_add_req {
 	u64 va;
 	u64 pa;
@@ -39488,6 +39514,24 @@ static void svc_handle_map_add(void)
 		svc_map_add_tail++;
 		spin_unlock_irqrestore(&svc_map_add_lock, flags);
 
+		/*
+		 * SESSION 153-CONTINUED-84: refuse oversized requests when
+		 * the guard is set (see the sema_map_add_max comment) - the
+		 * page pins from pin_loop2 (len 0x1000) are unaffected.
+		 */
+		if (READ_ONCE(gsp_sema_map_add_max) &&
+		    req.len > (u64)READ_ONCE(gsp_sema_map_add_max)) {
+			static u32 map_rej_log;
+
+			if (map_rej_log < 8) {
+				map_rej_log++;
+				pr_info("sema-svc: injected mapping va=0x%llx pa=0x%llx len=0x%llx REFUSED (len > sema_map_add_max=%u)\n",
+					req.va, req.pa, req.len,
+					READ_ONCE(gsp_sema_map_add_max));
+			}
+			continue;
+		}
+
 		ap = req.ap ? req.ap : SVC_APERTURE_SYS;
 		for (off = 0; off < (req.len ? req.len : 1);
 		     off += SEMA_PAGE_SIZE) {
@@ -39511,7 +39555,7 @@ static void svc_handle_map_add(void)
 			 */
 			if (svc_va_hits_chan_ring(va)) {
 				svc_ring_pin_skips++;
-				if (svc_ring_pin_skips <= 8)
+				if (svc_ring_pin_skips <= 64)
 					pr_info("sema-svc: injected pin va=0x%llx DROPPED (live channel ring range; ring reads stay on the channel's own translation)\n",
 						va);
 				continue;