vgsp-sph: d24/d25 seed extension - capture 0x3490/0x3494 (scratch24/25) + params sema_mme_state_d24/d25 + fail-closed seed emissions after d19 (param>captured>skip, 3d-reloc) - the d28-forced slow path reads the 0x349x states after d19; +235/-1

1 files changed, 118 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index ab52e06..c04ae70 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -18912,6 +18912,14 @@ static u32 gsp_phys_rmcall_gr_mme_state_d19;
 module_param_named(sema_mme_state_d19, gsp_phys_rmcall_gr_mme_state_d19,
 		   uint, 0644);
 MODULE_PARM_DESC(sema_mme_state_d19, "Seed value for STATE 0xD19 CONSTANT_BUFFER_SELECTOR_B_C (method 0x3464, CB VA>>8); 0 = use the client's captured 0x3464 write");
+static u32 gsp_phys_rmcall_gr_mme_state_d24;
+module_param_named(sema_mme_state_d24, gsp_phys_rmcall_gr_mme_state_d24,
+		   uint, 0644);
+MODULE_PARM_DESC(sema_mme_state_d24, "Seed value for STATE 0xD24 slow-path input (method 0x3490); 0 = use the client's captured 0x3490 write");
+static u32 gsp_phys_rmcall_gr_mme_state_d25;
+module_param_named(sema_mme_state_d25, gsp_phys_rmcall_gr_mme_state_d25,
+		   uint, 0644);
+MODULE_PARM_DESC(sema_mme_state_d25, "Seed value for STATE 0xD25 slow-path input (method 0x3494); 0 = use the client's captured 0x3494 write");
 
 /*
  * SESSION 153-CONTINUED-105: split the packed MME prelude emission across
@@ -20097,6 +20105,116 @@ if (gsp_phys_gr_slot_kept(j, sa_mask,
 			}
 		}
 		/*
+		 * SESSION 153-CONTINUED-116: STATE 0xD24 seed (shadow scratch
+		 * 0x24, method 0x3490 = SET_MME_SHADOW_SCRATCH(0x24)). The
+		 * bug2548370 slow path reads the 0x349x family beside the d19
+		 * selector; the replay context never received the client's
+		 * once-per-channel 0x3490 write, so d24 read whatever the
+		 * replay left (r1440: ILLEGAL_OPCODE in the same post-slot-57
+		 * window). Value: sema_mme_state_d24 when nonzero, else the
+		 * captured write (0x3490); fail-closed - a missed shadow
+		 * translation skips the emission instead of writing an
+		 * untranslated value. Gated by sema_gl_mme_state_seed.
+		 */
+		if (READ_ONCE(gsp_phys_rmcall_gr_mme_state_seed)) {
+			static u32 mme_state_d24_log;
+			u32 sv = READ_ONCE(gsp_phys_rmcall_gr_mme_state_d24);
+			bool have = sv != 0u;
+
+			if (!have)
+				have = gsp_sema_mme_scratch24_get(&sv);
+			if (have && sv &&
+			    (u32)(p - pb) + 8u < GSP_PHYS_RMCALL_GR_METHOD_WORDS) {
+				u64 va = (u64)sv << 8;
+				bool xl = false;
+				bool ok = true;
+
+				if (READ_ONCE(gsp_phys_rmcall_gr_mme_seed_xlat)
+				    && va) {
+					u32 up_w = (u32)((va >> 32) & 0xffu);
+					u32 lo_w = (u32)va & 0xfffffffcu;
+					u32 n_sh = 0;
+
+					if (gsp_phys_rmcall_gr_3d_reloc(
+						    &up_w, &lo_w, req,
+						    &n_sh)) {
+						va = ((u64)(up_w & 0xffu)
+						      << 32) |
+						     (u64)(lo_w & 0xfffffffcu);
+						sv = (u32)(va >> 8);
+						xl = true;
+					} else {
+						ok = false;
+					}
+				}
+				if (ok) {
+					*p++ = ((u32)GSP_PHYS_RMCALL_METHOD_IMM
+						<< 29) |
+					       (1u << 16) | (0x3490u >> 2);
+					*p++ = sv;
+					if (mme_state_d24_log < 16u) {
+						mme_state_d24_log++;
+						pr_info("vgsp-gr: MME-STATE-SEED d24=0x%08x (va=0x%llx xlat=%u) h=0x%x push=0x%llx\n",
+							sv, va, xl,
+							req->h_object,
+							req->push_va);
+					}
+				}
+			}
+		}
+		/*
+		 * SESSION 153-CONTINUED-116: STATE 0xD25 seed (shadow scratch
+		 * 0x25, method 0x3494 = SET_MME_SHADOW_SCRATCH(0x25)), the
+		 * next unseeded input on the same slow path; same value
+		 * policy, translation and fail-closed rule as d24 above.
+		 */
+		if (READ_ONCE(gsp_phys_rmcall_gr_mme_state_seed)) {
+			static u32 mme_state_d25_log;
+			u32 sv = READ_ONCE(gsp_phys_rmcall_gr_mme_state_d25);
+			bool have = sv != 0u;
+
+			if (!have)
+				have = gsp_sema_mme_scratch25_get(&sv);
+			if (have && sv &&
+			    (u32)(p - pb) + 8u < GSP_PHYS_RMCALL_GR_METHOD_WORDS) {
+				u64 va = (u64)sv << 8;
+				bool xl = false;
+				bool ok = true;
+
+				if (READ_ONCE(gsp_phys_rmcall_gr_mme_seed_xlat)
+				    && va) {
+					u32 up_w = (u32)((va >> 32) & 0xffu);
+					u32 lo_w = (u32)va & 0xfffffffcu;
+					u32 n_sh = 0;
+
+					if (gsp_phys_rmcall_gr_3d_reloc(
+						    &up_w, &lo_w, req,
+						    &n_sh)) {
+						va = ((u64)(up_w & 0xffu)
+						      << 32) |
+						     (u64)(lo_w & 0xfffffffcu);
+						sv = (u32)(va >> 8);
+						xl = true;
+					} else {
+						ok = false;
+					}
+				}
+				if (ok) {
+					*p++ = ((u32)GSP_PHYS_RMCALL_METHOD_IMM
+						<< 29) |
+					       (1u << 16) | (0x3494u >> 2);
+					*p++ = sv;
+					if (mme_state_d25_log < 16u) {
+						mme_state_d25_log++;
+						pr_info("vgsp-gr: MME-STATE-SEED d25=0x%08x (va=0x%llx xlat=%u) h=0x%x push=0x%llx\n",
+							sv, va, xl,
+							req->h_object,
+							req->push_va);
+					}
+				}
+			}
+		}
+		/*
 		 * SESSION 153-CONTINUED-105: golden MME runtime state seed
 		 * (see the sema_gl_mme_state_seed comment). Five idempotent
 		 * shadow-scratch writes ahead of the window so the