vgsp-sph: d24/d25 seed extension - capture 0x3490/0x3494 (scratch24/25) + params sema_mme_state_d24/d25 + fail-closed seed emissions after d19 (param>captured>skip, 3d-reloc) - the d28-forced slow path reads the 0x349x states after d19; +235/-1

1 files changed, 17 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index 5b993a8..1e0dac6 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -579,6 +579,23 @@ bool gsp_sema_mme_scratch18_get(u32 *val);
 bool gsp_sema_mme_scratch19_get(u32 *val);
 
 /*
+ * SESSION 153-CONTINUED-116: the client's own SET_MME_SHADOW_SCRATCH(0x24)
+ * write (method 0x3490) - STATE 0xD24, the next unseeded slow-path input the
+ * bug2548370 macro body reads beside the d19 selector. Companion of scratch
+ * 0x19 above; returns true (and stores the value exactly as pushed) once any
+ * decoded client push carried the write; sema_mme_state_d24 can supply the
+ * seed value instead.
+ */
+bool gsp_sema_mme_scratch24_get(u32 *val);
+
+/*
+ * SESSION 153-CONTINUED-116: the client's own SET_MME_SHADOW_SCRATCH(0x25)
+ * write (method 0x3494) - STATE 0xD25. Same first-write-wins capture and
+ * builder fallback (sema_mme_state_d25) as scratch 0x24 above.
+ */
+bool gsp_sema_mme_scratch25_get(u32 *val);
+
+/*
  * SESSION 153-CONTINUED-87: the SPH VERSION of the live program images
  * (sema_gl_vs/ps_hex blobs), so the GR launch builder emits a
  * SET_SPH_VERSION window that MATCHES the images the engine will fetch