From c332445746b8a8ef46869c3b47e165c375bb1f8d Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Tue, 3 Nov 2026 17:43:19 -0500 Subject: vgsp-sph: C4 - capture scratch 0x19 (CB selector, mthd 0x3464) + seed STATE 0xD19 emission (param sema_mme_state_d19 > captured, 3d-reloc, fail-closed) - the d28-forced slow path reads an unseeded d19 and faults the consumer at VA 0 (HUBCLIENT_PD); +129/-1 --- kernel/gsp_sema_service.h | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'kernel/gsp_sema_service.h') diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h index 7efc2f3..5b993a8 100644 --- a/kernel/gsp_sema_service.h +++ b/kernel/gsp_sema_service.h @@ -567,6 +567,17 @@ u64 gsp_sema_mme_sa_get(u32 *entries, u32 n); */ bool gsp_sema_mme_scratch18_get(u32 *val); +/* + * SESSION 153-CONTINUED-115: the client's own SET_MME_SHADOW_SCRATCH(0x19) + * write (method 0x3464) - STATE 0xD19, the constant-buffer selector B/C + * (address>>8) the bug2548370 loadConstantBuffer macro's in-band update + * emits from once the fast path is refused. Companion of scratch 0x18 + * above; returns true (and stores the value exactly as pushed) once any + * decoded client push carried the write. false until then (never observed + * live so far; sema_mme_state_d19 can supply the seed value instead). + */ +bool gsp_sema_mme_scratch19_get(u32 *val); + /* * SESSION 153-CONTINUED-87: the SPH VERSION of the live program images * (sema_gl_vs/ps_hex blobs), so the GR launch builder emits a -- cgit v1.2.3