kernel: validate learned semaphore maps and post guest GPU events

- admit {GPU VA -> PA} pairs only when the preceding bytes form a valid
  client memory descriptor header (type 0/1, CPU+GPU mapped bits), prefer
  validated pairs over headerless candidates under first-wins dedup, and
  invalidate the translation cache on every rebuild; fixes stale identity
  entries shadowing live pool pages and lets the guest UVM channel
  bring-up complete on its own
- capture OS event allocations (class 0x79) and post event records
  (function 0x1003) into the guest status queue when a channel's busy
  notification is consumed, with a broadcast fallback, serialized with
  replies via a queue lock
- add BAR0 shadow introspection (dump_bar0/scan_bar0) and guest-side
  diagnostic scripts for the VM cycle

1 files changed, 53 insertions, 0 deletions

diff --git a/tools/guest-diag/run_traced.sh b/tools/guest-diag/run_traced.sh
new file mode 100755
index 0000000..e8d3a09
--- /dev/null
+++ b/tools/guest-diag/run_traced.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+# run_traced.sh - run cdt under the ioctl tracer, keep the libcuda tracker page
+# mapped (pagemap + sema_map_add) and poke UVM's tracking semaphore forward as
+# the sweep completes pushes, so the run reaches the rc=999 rollback where the
+# tracer records the failing driver call.
+set -u
+cd "$(dirname "$(readlink -f "$0")")/../.."
+
+EXEC() { timeout 30 ./scripts/vgpu_vm.py exec --timeout 25 "$1" 2>/dev/null; }
+
+EXEC 'sudo pkill -9 -x cdt; sudo pkill -9 -x ptio; sleep 1; sudo rm -f /tmp/cdt.out /tmp/tr.log; sudo setsid /tmp/ptio /tmp/cdt > /tmp/cdt.out 2> /tmp/tr.log & sleep 3; pgrep -x cdt | head -1'
+
+for i in $(seq 1 40); do
+    sleep 10
+    PID=$(EXEC 'pgrep -x cdt | head -1' | tail -1)
+    [ -n "$PID" ] || { echo "[*] cdt gone at $((i*10))s"; break; }
+
+    # pin the tracker page when the guest has it mapped
+    PA=$(EXEC "sudo python3 -c \"
+import os
+fd=os.open('/proc/$PID/pagemap', os.O_RDONLY)
+os.lseek(fd, (0x20480f000//4096)*8, 0)
+e=int.from_bytes(os.read(fd,8),'little')
+os.close(fd)
+pfn=e & ((1<<55)-1)
+print('PA=0x%x'%((pfn<<12)|0xeb0))
+\"" | grep -o 'PA=0x[0-9a-f]*' | head -1 | sed 's/PA=//')
+    if [ -n "$PA" ]; then
+        sudo sh -c "echo 0x20480feb0,$PA > /sys/module/open_iov_vfio/parameters/sema_map_add" 2>/dev/null
+    fi
+
+    # nudge UVM's tracking semaphore forward when the sweep has stalled
+    sudo sh -c 'echo 0x121000010,1 > /sys/module/open_iov_vfio/parameters/sema_probe' 2>/dev/null
+    sleep 1
+    VALS=$(sudo dmesg -T | grep -A4 "sema-probe: va=0x121000010" | tail -4)
+    SPA=$(echo "$VALS" | grep -oE "pa=0x[0-9a-f]+" | head -1 | cut -d= -f2)
+    CUR=$(echo "$VALS" | grep -oE "\[0\] 0x[0-9a-f]+" | head -1 | awk '{print $2}')
+    if [ -n "$SPA" ] && [ -n "$CUR" ]; then
+        NEXT=$(printf '0x%x' $(( CUR + 1 )))
+        sudo sh -c "echo 0x$SPA,$NEXT > /sys/module/open_iov_vfio/parameters/poke_guest" 2>/dev/null
+        echo "  [$((i*10))s] cdt=$PID sema $CUR -> $NEXT"
+    else
+        echo "  [$((i*10))s] cdt=$PID (sema unresolved)"
+    fi
+
+    STATE=$(EXEC 'tail -1 /tmp/cdt.out' | tail -1)
+    case "$STATE" in
+        *FAILED*|*"ALL OK"*|*cuMemAlloc*) echo "[*] finished: $STATE"; break ;;
+    esac
+done
+
+echo "=== trace tail ==="
+EXEC 'tail -25 /tmp/tr.log'