admin/cinder27
1
1 Fork 3
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

SPTM: record IOGPU handler addresses and selector-recovery blocker

Browse Source
This commit is contained in:
JBJF committed 2026-10-31 17:58:43 +08:00
1 parent 1cab5b2428
commit 4ed0f0b304
1 file changed
+7
Download Patch File Download Diff File Expand all files Collapse all files
docs/SPTM-MIE-27.2.md
+7
View File
@@ -225,6 +225,13 @@ skipped.
`uat_get_root_table_paddr`, `pmap_iommu_ioctl_internal` and `uat_get_root_table_paddr`, `pmap_iommu_ioctl_internal` and
`sptm_check_sapt_is_writable`. So the user path from IOGPU to the SPTM UAT `sptm_check_sapt_is_writable`. So the user path from IOGPU to the SPTM UAT
unmap exists unchanged. unmap exists unchanged.
- Method handler addresses in the final v6x kext:
`IOGPUDeviceUserClient::s_new_resource` = `0xfffffe000a176094`,
`s_submit_command_buffers` = `0xfffffe000a176424`. Selector recovery is still
blocked: there is no direct `bl` to either handler and no raw/chained pointer
in the kext or the kernelcache; the dispatch is indirect and the table is
relocated at boot. Recovering the selector numbers needs a decompiler
(Ghidra/IDA/Hopper) or a live kernel view, neither of which is available here.
- On iPhone19,7, the GMMU TLBI completion window is **not closed by 27.2**. - On iPhone19,7, the GMMU TLBI completion window is **not closed by 27.2**.
The UAT unmap → data page freed → GMMU stale translation race remains. The UAT unmap → data page freed → GMMU stale translation race remains.
- The fix is a code change plus a per-device DeviceTree gate; the gate is absent - The fix is a code change plus a per-device DeviceTree gate; the gate is absent