guest-diag: widen pushbuffer chain scan (256KB, slab-prefix filter)

1 files changed, 11 insertions, 5 deletions

diff --git a/tools/guest-diag/semfix_watch.py b/tools/guest-diag/semfix_watch.py
index c4d45fc..ffadb05 100644
--- a/tools/guest-diag/semfix_watch.py
+++ b/tools/guest-diag/semfix_watch.py
@@ -154,14 +154,20 @@ def resolve_pushbuffer(q, sem):
     """Find the pushbuffer rm_mem near the channel and return (gpu_vas, cpu, gpa)."""
     base = sem & ~0xFFF
     words = []
-    for i in range(9):
-        chunk = q.read64(base - 0x8000 + i * 0x1000, 512)
+    for i in range(64):
+        chunk = q.read64(base - 0x40000 + i * 0x1000, 512)
         if not chunk:
-            break
+            continue
         words += chunk
-    cands = list(dict.fromkeys(w for w in words if is_kern(w)))
+    # The manager/pushbuffer live in the same slab region as the channel.
+    prefix = sem >> 32
+    cands = list(dict.fromkeys(w for w in words
+                               if is_kern(w) and (w >> 32) == prefix))
     # Chain 1: value is the channel manager; +8 pushbuffer, +8 rm_mem.
-    for M in cands:
+    deadline = time.time() + 45
+    for M in cands[:1200]:
+        if time.time() > deadline:
+            break
         pb = q.read64(M + 8)
         if not pb or not is_kern(pb[0]):
             continue