From 4ed0f0b304799574f1175e53e2c11058660eb396 Mon Sep 17 00:00:00 2001 From: JBJF Date: Sat, 31 Oct 2026 17:58:43 +0800 Subject: [PATCH] SPTM: record IOGPU handler addresses and selector-recovery blocker --- docs/SPTM-MIE-27.2.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/SPTM-MIE-27.2.md b/docs/SPTM-MIE-27.2.md index f92f4a0..d85ae99 100644 --- a/docs/SPTM-MIE-27.2.md +++ b/docs/SPTM-MIE-27.2.md @@ -225,6 +225,13 @@ skipped. `uat_get_root_table_paddr`, `pmap_iommu_ioctl_internal` and `sptm_check_sapt_is_writable`. So the user path from IOGPU to the SPTM UAT unmap exists unchanged. +- Method handler addresses in the final v6x kext: + `IOGPUDeviceUserClient::s_new_resource` = `0xfffffe000a176094`, + `s_submit_command_buffers` = `0xfffffe000a176424`. Selector recovery is still + blocked: there is no direct `bl` to either handler and no raw/chained pointer + in the kext or the kernelcache; the dispatch is indirect and the table is + relocated at boot. Recovering the selector numbers needs a decompiler + (Ghidra/IDA/Hopper) or a live kernel view, neither of which is available here. - On iPhone19,7, the GMMU TLBI completion window is **not closed by 27.2**. The UAT unmap → data page freed → GMMU stale translation race remains. - The fix is a code change plus a per-device DeviceTree gate; the gate is absent