kernel: validate learned semaphore maps and post guest GPU events

- admit {GPU VA -> PA} pairs only when the preceding bytes form a valid
  client memory descriptor header (type 0/1, CPU+GPU mapped bits), prefer
  validated pairs over headerless candidates under first-wins dedup, and
  invalidate the translation cache on every rebuild; fixes stale identity
  entries shadowing live pool pages and lets the guest UVM channel
  bring-up complete on its own
- capture OS event allocations (class 0x79) and post event records
  (function 0x1003) into the guest status queue when a channel's busy
  notification is consumed, with a broadcast fallback, serialized with
  replies via a queue lock
- add BAR0 shadow introspection (dump_bar0/scan_bar0) and guest-side
  diagnostic scripts for the VM cycle

1 files changed, 30 insertions, 0 deletions

diff --git a/tools/guest-diag/inject_tracker.sh b/tools/guest-diag/inject_tracker.sh
new file mode 100755
index 0000000..a563b0d
--- /dev/null
+++ b/tools/guest-diag/inject_tracker.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+# inject_tracker.sh - find the libcuda tracker slot the stuck cdt is polling,
+# translate its page through the guest pagemap, pin the mapping in the service.
+set -u
+cd "$(dirname "$(readlink -f "$0")")/../.."
+
+OUT=$(timeout 100 ./scripts/vgpu_vm.py exec --timeout 90 'PID=$(pgrep -x cdt | head -1); B=$(sudo grep libcuda.so.570.144 /proc/$PID/maps | head -1 | cut -d- -f1); sudo timeout -s KILL 70 gdb -p $PID -batch -ex "set pagination off" -ex "set confirm off" -ex "break *(long)(0x$B+0x3c7970)" -ex "continue" -ex "set \$p2 = *(unsigned long*)(\$rdi+0x20)" -ex "set \$vp = *(unsigned long*)(\$p2+0x10)" -ex "printf \"VALPTR=0x%lx EXPECTED=%lu PID=%d\n\", \$vp, \$rsi, $PID" -ex "detach" 2>&1; sudo kill -CONT $PID' 2>/dev/null)
+LINE=$(echo "$OUT" | grep "VALPTR=" | head -1)
+VALPTR_HEX=$(echo "$LINE" | sed -n 's/.*VALPTR=0x\([0-9a-f]*\).*/\1/p')
+PID=$(echo "$LINE" | sed -n 's/.*PID=\([0-9]*\).*/\1/p')
+[ -n "$VALPTR_HEX" ] || { echo "NO VALPTR FOUND"; echo "$OUT" | tail -3; exit 1; }
+echo "valptr=0x$VALPTR_HEX pid=$PID"
+
+PA=$(timeout 40 ./scripts/vgpu_vm.py exec --timeout 35 "sudo python3 -c \"
+import os
+pid=$PID
+va=0x$VALPTR_HEX
+fd=os.open('/proc/%d/pagemap'%pid, os.O_RDONLY)
+os.lseek(fd, (va//4096)*8, 0)
+e=int.from_bytes(os.read(fd,8),'little')
+os.close(fd)
+pfn=e & ((1<<55)-1)
+print('PA=0x%x'%((pfn<<12)|(va&0xfff)))
+\"" 2>/dev/null | grep -o 'PA=0x[0-9a-f]*' | head -1 | sed 's/^PA=//')
+[ -n "$PA" ] || { echo "NO PA FOUND"; exit 1; }
+echo "target pa=$PA"
+
+sudo sh -c "echo 0x$VALPTR_HEX,$PA > /sys/module/open_iov_vfio/parameters/sema_map_add" || exit 1
+sleep 1
+sudo dmesg -T | grep "injected mapping" | tail -1