vgsp-mme: golden-only completion + mme-audit tool - accept golden slot 0 (entry=0 valid) + sema_gl_mme_golden_only=1 force-blanks non-golden called slots (stub/drop their CALL runs), overlay logs inspected/blank/maxa; tools/mme-audit: stdlib overlay-sim + booter-grammar walk + operand map + cross-boot table (decodes the r1448 slot-57 stall: IR 899-900 emits PIPELINE_BINDING(2) @0x2090 rejected only when the program-address pairs are carried)

1 files changed, 119 insertions, 4 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 073d7a3..fdeed09 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -18239,7 +18239,23 @@ module_param_named(sema_gl_mme_golden_force, gsp_phys_rmcall_gr_mme_golden_force
 MODULE_PARM_DESC(sema_gl_mme_golden_force,
 	"Force the golden overlay over captured slots too (A/B for a stale capture; default 0 = fill uncovered only)");
 
+/*
+ * r1448 STRATEGY 3.3 (golden-completion): with golden_force on, a called
+ * slot the golden library cannot serve is stubbed (SA pair -> harmless
+ * end-noop) and its CALL runs are dropped, and its captured body is
+ * zeroed in the packed IR - only golden bodies can execute. This closes
+ * the r1447 residual (slot 0, entry 0, was the one executed non-golden
+ * body). 0 = pre-r1448 behavior (capture bodies of non-golden slots may
+ * execute).
+ */
+static bool gsp_phys_rmcall_gr_mme_golden_only = true;
+module_param_named(sema_gl_mme_golden_only, gsp_phys_rmcall_gr_mme_golden_only,
+		   bool, 0644);
+MODULE_PARM_DESC(sema_gl_mme_golden_only,
+	"Golden-only completion: with golden_force on, blank the packed body and stub/drop CALL runs of every slot the golden library cannot serve (default 1; 0 = current behavior)");
+
 static u32 gsp_phys_gr_golden_log;
+static u32 gsp_phys_gr_golden0_log;
 
 static int gsp_phys_gr_golden_slot(u32 j, u32 *entry, const u32 **words,
 				   u32 *nwords)
@@ -18251,10 +18267,23 @@ static int gsp_phys_gr_golden_slot(u32 j, u32 *entry, const u32 **words,
 	if (j >= GOLDEN_MME_TU104_SLOTS || j >= 64u)
 		return 0;
 	gs = &golden_mme_tu104_sa[j];
-	if (!(gs->flags & GMME_F_PRESENT) || !gs->words || !gs->entry)
+	if (!(gs->flags & GMME_F_PRESENT) || !gs->words)
 		return 0;
 	if ((u64)gs->off + gs->words > GOLDEN_MME_TU104_WORDS)
 		return 0;
+	/*
+	 * r1448 STRATEGY 3.3: entry 0 is a valid IR address - slot 0's
+	 * SETUP_FIXED_CONST body begins at IR word 0, and the window calls
+	 * slot 0 (CALL at win-off 56). The pre-r1448 `!gs->entry` reject
+	 * left slot 0 as the only executed non-golden body (r1447 54/55
+	 * overlay). Accept it and log the acceptance once so the coverage
+	 * change is visible in dmesg.
+	 */
+	if (!gs->entry && !READ_ONCE(gsp_phys_gr_golden0_log)) {
+		WRITE_ONCE(gsp_phys_gr_golden0_log, 1u);
+		pr_info("vgsp-gr: MME-GOLDEN slot 0 accepted (entry=0 valid; golden body %u words)\n",
+			gs->words);
+	}
 	*entry = gs->entry;
 	*words = &golden_mme_tu104_words[gs->off];
 	*nwords = gs->words;
@@ -18262,6 +18291,23 @@ static int gsp_phys_gr_golden_slot(u32 j, u32 *entry, const u32 **words,
 }
 
 /*
+ * r1448 STRATEGY 3.3 golden-only completion: with golden_force on and
+ * the golden_only knob on, a slot the golden library cannot serve must
+ * never execute. Returns true when the slot is outside the golden corpus
+ * and has to be blanked/stubbed (fail-closed).
+ */
+static bool gsp_phys_gr_slot_golden_blank(u32 j)
+{
+	u32 gent, gn;
+	const u32 *gw;
+
+	if (!READ_ONCE(gsp_phys_rmcall_gr_mme_golden_only) ||
+	    !READ_ONCE(gsp_phys_rmcall_gr_mme_golden_force))
+		return false;
+	return !gsp_phys_gr_golden_slot(j, &gent, &gw, &gn);
+}
+
+/*
  * SESSION 153-CONTINUED-79: per-launch method-block word cap + prelude drain.
  * The r1172-r1175 A/B: every beef launch whose emitted block exceeded ~2000
  * words (3083-word full-SA prelude + window, 3315-3484 words) NEVER STARTED
@@ -19071,6 +19117,12 @@ static bool gsp_phys_gr_slot_kept(u32 j, u64 sa_mask, const u32 *sa_ent)
 		return false;
 	if (READ_ONCE(gsp_phys_rmcall_gr_nop_drop) & (1ull << j))
 		return false;
+	/*
+	 * r1448 STRATEGY 3.3: golden-only means the kept-slot exemption
+	 * cannot resurrect a body outside the golden corpus (fail-closed).
+	 */
+	if (gsp_phys_gr_slot_golden_blank(j))
+		return false;
 	if (!READ_ONCE(gsp_phys_rmcall_gr_keep_clamp))
 		return true;
 	if ((sa_mask & (1ull << j)) && gsp_sema_mme_ir_covered(sa_ent[j]))
@@ -19110,6 +19162,13 @@ static bool gsp_phys_gr_slot_stubbed(u32 j, u64 sa_mask, const u32 *sa_ent)
 	 */
 	if (READ_ONCE(gsp_phys_rmcall_gr_nop_drop) & (1ull << j))
 		return true;
+	/*
+	 * r1448 STRATEGY 3.3: no golden body, no execution - force-stub the
+	 * slot so its captured body can never run (its CALL runs are then
+	 * dropped and its SA pair points at the end-noop).
+	 */
+	if (gsp_phys_gr_slot_golden_blank(j))
+		return true;
 	if (gsp_phys_gr_slot_kept(j, sa_mask, sa_ent))
 		return false;
 	/*
@@ -19805,6 +19864,7 @@ if (gsp_phys_gr_slot_kept(j, sa_mask,
 					if (sa_mask & (1ull << j)) {
 						if (!READ_ONCE(gsp_phys_rmcall_gr_sa_stub_all) &&
 						    gsp_sema_mme_ir_covered(sa_ent[j]) &&
+						    !gsp_phys_gr_slot_golden_blank(j) &&
 						    !(READ_ONCE(gsp_phys_rmcall_gr_nop_drop) &
 						      (1ull << j))) {
 							for (t = 0; t < sa_ncov; t++)
@@ -20599,7 +20659,8 @@ if (gsp_phys_gr_slot_kept(j, sa_mask,
 				 * in mode 1 (the overlay then only logs).
 				 */
 				if (READ_ONCE(gsp_phys_rmcall_gr_mme_golden)) {
-					u32 gj, goldn = 0;
+					u32 gj, goldn = 0, ginsp = 0;
+					u32 gblank = 0;
 
 					for (gj = 0; gj < 64u; gj++) {
 						u32 gent, gn, q;
@@ -20609,6 +20670,7 @@ if (gsp_phys_gr_slot_kept(j, sa_mask,
 							    gj, &gent, &gw,
 							    &gn))
 							continue;
+						ginsp++;
 						if (!READ_ONCE(gsp_phys_rmcall_gr_mme_golden_force)) {
 							/*
 							 * Mode 1: only slots the
@@ -20636,10 +20698,63 @@ if (gsp_phys_gr_slot_kept(j, sa_mask,
 						sa_ent[gj] = gent;
 						goldn++;
 					}
+					/*
+					 * r1448 STRATEGY 3.3: force-blank
+					 * the captured bodies of every slot
+					 * the golden library cannot serve so
+					 * no capture word can survive - only
+					 * golden bodies may execute
+					 * (fail-closed). The zero range is
+					 * bounded by the next captured SA
+					 * entry, exactly the bound the
+					 * capture fill above applied.
+					 * Clearing the local sa_mask/sa_ent
+					 * pair also unpublishes the slot
+					 * from the SA re-arm; its CALL runs
+					 * are dropped via the stubbed-slot
+					 * predicate (slot_stubbed ->
+					 * golden_blank).
+					 */
+					if (READ_ONCE(gsp_phys_rmcall_gr_mme_golden_force) &&
+					    READ_ONCE(gsp_phys_rmcall_gr_mme_golden_only)) {
+						for (gj = 0; gj < 64u; gj++) {
+							u32 gent, gn, q, kk2;
+							const u32 *gw;
+							u32 bstart, bend;
+							u64 nmask;
+
+							if (!(sa_mask & (1ull << gj)) ||
+							    !sa_ent[gj])
+								continue;
+							if (gsp_phys_gr_golden_slot(
+								    gj, &gent, &gw,
+								    &gn))
+								continue;
+							bstart = 3u * sa_ent[gj];
+							bend = 4096u;
+							nmask = sa_mask &
+								~(1ull << gj);
+							for (kk2 = 0; kk2 < 64u; kk2++) {
+								if (!(nmask &
+								      (1ull << kk2)) ||
+								    !sa_ent[kk2])
+									continue;
+								if (3u * sa_ent[kk2] > bstart &&
+								    3u * sa_ent[kk2] < bend)
+									bend = 3u * sa_ent[kk2];
+							}
+							for (q = bstart; q < bend; q++)
+								gsp_phys_gr_mme_ir_pack[q] = 0;
+							sa_mask &= ~(1ull << gj);
+							sa_ent[gj] = 0;
+							gblank++;
+						}
+					}
 					if (goldn && gsp_phys_gr_golden_log < 8u) {
 						gsp_phys_gr_golden_log++;
-						pr_info("vgsp-gr: MME-GOLDEN overlay %u slot(s) maxa=%u h=0x%x push=0x%llx\n",
-							goldn, maxa,
+						pr_info("vgsp-gr: MME-GOLDEN overlay %u slot(s) inspected=%u blank=%u maxa=%u h=0x%x push=0x%llx\n",
+							goldn, ginsp, gblank,
+							maxa,
 							req->h_object,
 							req->push_va);
 					}