From 392d62f860a6d8250d4a7331693219deb54e3c07 Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Wed, 4 Nov 2026 10:13:21 -0500 Subject: vgsp-mme: golden-only completion + mme-audit tool - accept golden slot 0 (entry=0 valid) + sema_gl_mme_golden_only=1 force-blanks non-golden called slots (stub/drop their CALL runs), overlay logs inspected/blank/maxa; tools/mme-audit: stdlib overlay-sim + booter-grammar walk + operand map + cross-boot table (decodes the r1448 slot-57 stall: IR 899-900 emits PIPELINE_BINDING(2) @0x2090 rejected only when the program-address pairs are carried) --- kernel/gsp_phys_booter.c | 123 +++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 119 insertions(+), 4 deletions(-) (limited to 'kernel/gsp_phys_booter.c') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index 073d7a3..fdeed09 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -18239,7 +18239,23 @@ module_param_named(sema_gl_mme_golden_force, gsp_phys_rmcall_gr_mme_golden_force MODULE_PARM_DESC(sema_gl_mme_golden_force, "Force the golden overlay over captured slots too (A/B for a stale capture; default 0 = fill uncovered only)"); +/* + * r1448 STRATEGY 3.3 (golden-completion): with golden_force on, a called + * slot the golden library cannot serve is stubbed (SA pair -> harmless + * end-noop) and its CALL runs are dropped, and its captured body is + * zeroed in the packed IR - only golden bodies can execute. This closes + * the r1447 residual (slot 0, entry 0, was the one executed non-golden + * body). 0 = pre-r1448 behavior (capture bodies of non-golden slots may + * execute). + */ +static bool gsp_phys_rmcall_gr_mme_golden_only = true; +module_param_named(sema_gl_mme_golden_only, gsp_phys_rmcall_gr_mme_golden_only, + bool, 0644); +MODULE_PARM_DESC(sema_gl_mme_golden_only, + "Golden-only completion: with golden_force on, blank the packed body and stub/drop CALL runs of every slot the golden library cannot serve (default 1; 0 = current behavior)"); + static u32 gsp_phys_gr_golden_log; +static u32 gsp_phys_gr_golden0_log; static int gsp_phys_gr_golden_slot(u32 j, u32 *entry, const u32 **words, u32 *nwords) @@ -18251,16 +18267,46 @@ static int gsp_phys_gr_golden_slot(u32 j, u32 *entry, const u32 **words, if (j >= GOLDEN_MME_TU104_SLOTS || j >= 64u) return 0; gs = &golden_mme_tu104_sa[j]; - if (!(gs->flags & GMME_F_PRESENT) || !gs->words || !gs->entry) + if (!(gs->flags & GMME_F_PRESENT) || !gs->words) return 0; if ((u64)gs->off + gs->words > GOLDEN_MME_TU104_WORDS) return 0; + /* + * r1448 STRATEGY 3.3: entry 0 is a valid IR address - slot 0's + * SETUP_FIXED_CONST body begins at IR word 0, and the window calls + * slot 0 (CALL at win-off 56). The pre-r1448 `!gs->entry` reject + * left slot 0 as the only executed non-golden body (r1447 54/55 + * overlay). Accept it and log the acceptance once so the coverage + * change is visible in dmesg. + */ + if (!gs->entry && !READ_ONCE(gsp_phys_gr_golden0_log)) { + WRITE_ONCE(gsp_phys_gr_golden0_log, 1u); + pr_info("vgsp-gr: MME-GOLDEN slot 0 accepted (entry=0 valid; golden body %u words)\n", + gs->words); + } *entry = gs->entry; *words = &golden_mme_tu104_words[gs->off]; *nwords = gs->words; return 1; } +/* + * r1448 STRATEGY 3.3 golden-only completion: with golden_force on and + * the golden_only knob on, a slot the golden library cannot serve must + * never execute. Returns true when the slot is outside the golden corpus + * and has to be blanked/stubbed (fail-closed). + */ +static bool gsp_phys_gr_slot_golden_blank(u32 j) +{ + u32 gent, gn; + const u32 *gw; + + if (!READ_ONCE(gsp_phys_rmcall_gr_mme_golden_only) || + !READ_ONCE(gsp_phys_rmcall_gr_mme_golden_force)) + return false; + return !gsp_phys_gr_golden_slot(j, &gent, &gw, &gn); +} + /* * SESSION 153-CONTINUED-79: per-launch method-block word cap + prelude drain. * The r1172-r1175 A/B: every beef launch whose emitted block exceeded ~2000 @@ -19071,6 +19117,12 @@ static bool gsp_phys_gr_slot_kept(u32 j, u64 sa_mask, const u32 *sa_ent) return false; if (READ_ONCE(gsp_phys_rmcall_gr_nop_drop) & (1ull << j)) return false; + /* + * r1448 STRATEGY 3.3: golden-only means the kept-slot exemption + * cannot resurrect a body outside the golden corpus (fail-closed). + */ + if (gsp_phys_gr_slot_golden_blank(j)) + return false; if (!READ_ONCE(gsp_phys_rmcall_gr_keep_clamp)) return true; if ((sa_mask & (1ull << j)) && gsp_sema_mme_ir_covered(sa_ent[j])) @@ -19110,6 +19162,13 @@ static bool gsp_phys_gr_slot_stubbed(u32 j, u64 sa_mask, const u32 *sa_ent) */ if (READ_ONCE(gsp_phys_rmcall_gr_nop_drop) & (1ull << j)) return true; + /* + * r1448 STRATEGY 3.3: no golden body, no execution - force-stub the + * slot so its captured body can never run (its CALL runs are then + * dropped and its SA pair points at the end-noop). + */ + if (gsp_phys_gr_slot_golden_blank(j)) + return true; if (gsp_phys_gr_slot_kept(j, sa_mask, sa_ent)) return false; /* @@ -19805,6 +19864,7 @@ if (gsp_phys_gr_slot_kept(j, sa_mask, if (sa_mask & (1ull << j)) { if (!READ_ONCE(gsp_phys_rmcall_gr_sa_stub_all) && gsp_sema_mme_ir_covered(sa_ent[j]) && + !gsp_phys_gr_slot_golden_blank(j) && !(READ_ONCE(gsp_phys_rmcall_gr_nop_drop) & (1ull << j))) { for (t = 0; t < sa_ncov; t++) @@ -20599,7 +20659,8 @@ if (gsp_phys_gr_slot_kept(j, sa_mask, * in mode 1 (the overlay then only logs). */ if (READ_ONCE(gsp_phys_rmcall_gr_mme_golden)) { - u32 gj, goldn = 0; + u32 gj, goldn = 0, ginsp = 0; + u32 gblank = 0; for (gj = 0; gj < 64u; gj++) { u32 gent, gn, q; @@ -20609,6 +20670,7 @@ if (gsp_phys_gr_slot_kept(j, sa_mask, gj, &gent, &gw, &gn)) continue; + ginsp++; if (!READ_ONCE(gsp_phys_rmcall_gr_mme_golden_force)) { /* * Mode 1: only slots the @@ -20636,10 +20698,63 @@ if (gsp_phys_gr_slot_kept(j, sa_mask, sa_ent[gj] = gent; goldn++; } + /* + * r1448 STRATEGY 3.3: force-blank + * the captured bodies of every slot + * the golden library cannot serve so + * no capture word can survive - only + * golden bodies may execute + * (fail-closed). The zero range is + * bounded by the next captured SA + * entry, exactly the bound the + * capture fill above applied. + * Clearing the local sa_mask/sa_ent + * pair also unpublishes the slot + * from the SA re-arm; its CALL runs + * are dropped via the stubbed-slot + * predicate (slot_stubbed -> + * golden_blank). + */ + if (READ_ONCE(gsp_phys_rmcall_gr_mme_golden_force) && + READ_ONCE(gsp_phys_rmcall_gr_mme_golden_only)) { + for (gj = 0; gj < 64u; gj++) { + u32 gent, gn, q, kk2; + const u32 *gw; + u32 bstart, bend; + u64 nmask; + + if (!(sa_mask & (1ull << gj)) || + !sa_ent[gj]) + continue; + if (gsp_phys_gr_golden_slot( + gj, &gent, &gw, + &gn)) + continue; + bstart = 3u * sa_ent[gj]; + bend = 4096u; + nmask = sa_mask & + ~(1ull << gj); + for (kk2 = 0; kk2 < 64u; kk2++) { + if (!(nmask & + (1ull << kk2)) || + !sa_ent[kk2]) + continue; + if (3u * sa_ent[kk2] > bstart && + 3u * sa_ent[kk2] < bend) + bend = 3u * sa_ent[kk2]; + } + for (q = bstart; q < bend; q++) + gsp_phys_gr_mme_ir_pack[q] = 0; + sa_mask &= ~(1ull << gj); + sa_ent[gj] = 0; + gblank++; + } + } if (goldn && gsp_phys_gr_golden_log < 8u) { gsp_phys_gr_golden_log++; - pr_info("vgsp-gr: MME-GOLDEN overlay %u slot(s) maxa=%u h=0x%x push=0x%llx\n", - goldn, maxa, + pr_info("vgsp-gr: MME-GOLDEN overlay %u slot(s) inspected=%u blank=%u maxa=%u h=0x%x push=0x%llx\n", + goldn, ginsp, gblank, + maxa, req->h_object, req->push_va); } -- cgit v1.2.3