vgsp+diag: SA-RAM table captured unbounded (entry[64], sema-mme-sa log), surf geometry accessor + completeness recs, fill seeds RT candidate 0 full span (<=1024 pages, completeness only on fully-resolved run); MME slot stub (called-but-uncaptured slots end-noop IR 0xC0, sema_gl_mme_sa_stub=1), reloc prefers tracked rec bounce VA; pin family += 0x4200000 - 0x238c wall root-caused (capture truncated buffer full=28 words=512, SA[0x22]=0 jump IR 0; sim proves slot-0 emits EMIT 0x238c=0x20020); fixes never executed (setup-push read lost, unreadable=1 first8=00040000 00001000); next: trustworthy pagemap resolve or accept ipin first-chunk - SESSION 153 r1117-r1120

1 files changed, 28 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index 0f32265..2b99274 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -507,6 +507,34 @@ const u64 *gsp_sema_attr_prelude_ptrs(u32 *n);
 const u32 *gsp_sema_surf_prelude_get(u32 *n, u32 *gen);
 
 /*
+ * SESSION 153-CONTINUED-63: surface geometry for render-target tracking
+ * (base VA + page count of the captured colour target).
+ */
+bool gsp_sema_surf_va_get(u64 *va, u32 *npages);
+
+/*
+ * SESSION 153-CONTINUED-63: the fill's completed render-target tracking run
+ * (base VA + page count), true only when every page of the surface resolved
+ * into contiguous data recs this pass. The booter prefers these recs over
+ * the identity surface alias when rewriting the target's operand pair, so
+ * the engine's stores land in the bounce (witness + copy-out) instead of
+ * the guest pages directly.
+ */
+bool gsp_sema_gr_surf_recs(u64 *va, u32 *n);
+
+/*
+ * SESSION 153-CONTINUED-63: the captured MME START-ADDRESS RAM table
+ * (macro slot -> IR instruction address; present-bitmask returned, entries
+ * copied into `entries`). The prelude buffer is capped at 512 words, so
+ * the SA table is recorded independently; the GR launch builder completes
+ * the SA RAM it replays and stubs every called-but-unknown slot with a
+ * harmless end-noop (the r1116 0x238c wall: SA[0x22] = 0 on a fresh
+ * context made CALL_MME_MACRO(0x22) jump to IR 0 and the slot-0 macro's
+ * emission trapped the lane).
+ */
+u64 gsp_sema_mme_sa_get(u32 *entries, u32 n);
+
+/*
  * r378 write guards. Both re-validate a guest-memory write target that was
  * resolved earlier (ledger/pin/walk/counter registration, or the GR submit's
  * per-page resolution) against the CURRENT resolution before the bytes land,