From 28686940c486d30aeb40a084d1af4b6278ed87cd Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Tue, 3 Nov 2026 18:22:17 -0500 Subject: vgsp-sph: d24/d25 seed extension - capture 0x3490/0x3494 (scratch24/25) + params sema_mme_state_d24/d25 + fail-closed seed emissions after d19 (param>captured>skip, 3d-reloc) - the d28-forced slow path reads the 0x349x states after d19; +235/-1 --- kernel/gsp_sema_service.h | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'kernel/gsp_sema_service.h') diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h index 5b993a8..1e0dac6 100644 --- a/kernel/gsp_sema_service.h +++ b/kernel/gsp_sema_service.h @@ -578,6 +578,23 @@ bool gsp_sema_mme_scratch18_get(u32 *val); */ bool gsp_sema_mme_scratch19_get(u32 *val); +/* + * SESSION 153-CONTINUED-116: the client's own SET_MME_SHADOW_SCRATCH(0x24) + * write (method 0x3490) - STATE 0xD24, the next unseeded slow-path input the + * bug2548370 macro body reads beside the d19 selector. Companion of scratch + * 0x19 above; returns true (and stores the value exactly as pushed) once any + * decoded client push carried the write; sema_mme_state_d24 can supply the + * seed value instead. + */ +bool gsp_sema_mme_scratch24_get(u32 *val); + +/* + * SESSION 153-CONTINUED-116: the client's own SET_MME_SHADOW_SCRATCH(0x25) + * write (method 0x3494) - STATE 0xD25. Same first-write-wins capture and + * builder fallback (sema_mme_state_d25) as scratch 0x24 above. + */ +bool gsp_sema_mme_scratch25_get(u32 *val); + /* * SESSION 153-CONTINUED-87: the SPH VERSION of the live program images * (sema_gl_vs/ps_hex blobs), so the GR launch builder emits a -- cgit v1.2.3