vgsp: refuse PTE-page code sources in the Tier-2 program-pair path (CODESRC-SUSPECT fallback)

r221 evidence: six CODEHASH-suspect launches resolved six different client
code VAs to the same page (deterministic guest allocation within one boot)
and all carried valid kernel prologue words at the QMD entry offset; the
SUSPECT tag was the zero-window false-positive mode of the CODEHASH content
test, and no source page observed was PTE-shaped. The class remains real:
the program pair (QMD w48/49) is copied verbatim into the page the engine
I-fetches from, so a stale landing, walk or pin answering with an empty,
PTE-shaped or module page-tree page would execute PTE/filler bytes as SASS.

CODESRC, before the Tier-2 program-pair copy (additive, once per launch):
- detect (a) empty source (entry+sampled windows zero), (b) PTE-shaped
  entry run (>=12/16 identically-flagged valid entries, or mostly-zero
  with only PTE-signed entries), (c) source HPA on one of the engine
  page-tree's own module chunks (main PT, guest PT pool, shadow pools,
  qmdwin);
- on detection re-resolve through the late resolver (guest-walk order,
  the alternative to the fill's ledger-first order) and adopt it only if
  different and not itself suspicious; otherwise withdraw the page from
  the submission (no copy, no mapping, QMD pair kept at the guest VA -
  the per-pair ptr_guest behaviour). One rate-limited
  'vgsp-gr: CODESRC-SUSPECT va= pa= alt= used= why=' line.

Greens-safety: no observed launch (green or suspect) matches any trigger:
entry words are non-zero and distinct, entry runs are not PTE-signed, and
a guest HPA cannot equal a module chunk DMA; with no match the flow is
byte-identical to before (same memcpy, copied++ and dump gate).

0 files changed, 0 insertions, 0 deletions