From 79545530c4b54202b69b01b13f28a9ca874e88db Mon Sep 17 00:00:00 2001 From: Arthur Hanson Rasmusson Date: Wed, 4 Nov 2026 11:10:27 -0500 Subject: vgsp-mme: sema_gl_mme_sph_bind_binding (default 0) - drop the synthesized BINDING(2)/(5)=0 data writes from the SPH-BIND emission (the FE rejects the 0x2090 word with Class Error EC4 when walking the window; the real client never emits 0x2090), keep the REG_COUNT(2)/(5)=0x1a runs; size guard 19->17 when dropped; 1 = legacy bytes --- kernel/gsp_phys_booter.c | 55 ++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 46 insertions(+), 9 deletions(-) (limited to 'kernel/gsp_phys_booter.c') diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c index fdeed09..8ad3e64 100644 --- a/kernel/gsp_phys_booter.c +++ b/kernel/gsp_phys_booter.c @@ -19025,6 +19025,25 @@ bool gsp_phys_rmcall_gr_sph_bind_value(void) return READ_ONCE(gsp_phys_rmcall_gr_sph_bind); } +/* + * CONT-119 (r1450): the BINDING words of the synthesized stage-2/5 + * REGISTER_COUNT runs. CONT-90 emitted each as a 2-word + * REGISTER_COUNT/BINDING run (`20020823 0000001a 00000000` for j=2, the + * j=5 twin on 0x214c) so the DS SPH validation saw a full stage-1-shaped + * pair. The FE walking our replayed window then rejects the synthesized + * `0x2090 <- 0` write with Class Error EC4 - it is the only 0x2090 writer + * in the stream (the client never emits a stage-2/5 BINDING), and it + * wedges the slot-57 macro at mpc 899/900. Default 0 drops the BINDING + * data words and emits only the 1-word REG_COUNT runs + * (`20010823 0000001a`, `20010853 0000001a`); 1 keeps the legacy CONT-90 + * bytes for a same-boot A/B. + */ +static bool gsp_phys_rmcall_gr_sph_bind_binding; +module_param_named(sema_gl_mme_sph_bind_binding, + gsp_phys_rmcall_gr_sph_bind_binding, bool, 0644); +MODULE_PARM_DESC(sema_gl_mme_sph_bind_binding, + "1 = legacy emit BINDING(2)/(5)=0 which the FE rejects EC4 @0x2090 when walking the window; 0 = drop the BINDING writes, keep the REG_COUNT runs (default 0)"); + /* * SESSION 153-CONTINUED-92: leave program-family operands at their ORIGINAL * guest VAs when the operand's page is resolved and identity-mappable. @@ -27798,6 +27817,8 @@ gr_page_unmapped: u32 in[64], out[64]; u32 nfin = 0, nrun = 0, on = 0, odrop = 0, orel; u32 bi; + bool bind_binding = + READ_ONCE(gsp_phys_rmcall_gr_sph_bind_binding); /* * SESSION 153-CONTINUED-89 (2nd half): the client's @@ -27927,7 +27948,7 @@ gr_page_unmapped: * from guest RAM (`20020825 [0,04400200]`, * `20020855 [0,04400000]`). */ - if (nfin + 19u <= 64u) { + if (nfin + (bind_binding ? 19u : 17u) <= 64u) { in[nfin++] = 0x20000000u | (2u << 16) | (0x2094u >> 2); in[nfin++] = (u32)((fam + 0x200u) >> 32) & 0xffu; @@ -27963,15 +27984,31 @@ gr_page_unmapped: * validation's last missing per-stage input; * same shape as the captured stage-1 pair * (reg count 26, group 0). + * CONT-119 (r1450): the client never emits a + * stage-2/5 BINDING, and the FE walking the + * window rejects our synthesized BINDING=0 + * word (0x2090) with Class Error EC4. Drop + * the BINDING data writes by default and keep + * the 1-word REG_COUNT runs only; the knob + * restores the legacy CONT-90 2-word runs. */ - in[nfin++] = 0x20000000u | (2u << 16) | - (0x208cu >> 2); - in[nfin++] = 0x1au; - in[nfin++] = 0x0u; - in[nfin++] = 0x20000000u | (2u << 16) | - (0x214cu >> 2); - in[nfin++] = 0x1au; - in[nfin++] = 0x0u; + if (bind_binding) { + in[nfin++] = 0x20000000u | (2u << 16) | + (0x208cu >> 2); + in[nfin++] = 0x1au; + in[nfin++] = 0x0u; + in[nfin++] = 0x20000000u | (2u << 16) | + (0x214cu >> 2); + in[nfin++] = 0x1au; + in[nfin++] = 0x0u; + } else { + in[nfin++] = 0x20000000u | (1u << 16) | + (0x208cu >> 2); + in[nfin++] = 0x1au; + in[nfin++] = 0x20000000u | (1u << 16) | + (0x214cu >> 2); + in[nfin++] = 0x1au; + } /* * SESSION 153-CONTINUED-89: the client's * init-push stage-1 REGISTER_COUNT/BINDING -- cgit v1.2.3