vgsp-sema/wall2: host-triggered VAS pdb discovery (sema_pdb_discover va,pa -> verify the parked COPY_SERVER_PDES candidates against a content-verified ring pair, then fall back to the vidmem walk-root sweep) and a runtime-tunable candidate age-out (sema_vas_cand_ms; the default 15 s ages the client's candidate out exactly when its channels first register); tools: fasttick.py (triggers on the GR0 ring resolution line) and pdbtick.py (content-locates the ring page and triggers) - r706/r707 evidence: three parked candidates (0x11cd3d000/0x11cd48000/0x11cd50000 entries=4), the ring pair appears only at channel registration (the same second as the age-out), ring resolution is racy across runs (r706 rc=0 / r707 rc=-2), the skip starts 145-194 rescues (~8-10 s) after the submit; next run: keep candidates parked + trigger within the window

1 files changed, 44 insertions, 0 deletions

diff --git a/tools/guest-diag/wall2/fasttick.py b/tools/guest-diag/wall2/fasttick.py
new file mode 100644
index 0000000..413d3ba
--- /dev/null
+++ b/tools/guest-diag/wall2/fasttick.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+# fasttick.py - watch the service log for the GR0 channel's ring resolution
+# (sema-chan: h=0xbeec0100 ... ring rc=0 pa=0x...) and immediately hand the
+# verified {ring VA -> ring PA} pair to the service (sema_pdb_discover), so
+# the parked VAS pdb candidate can be verified before/at age-out.
+import re, subprocess, sys, time
+
+PARAM = "/sys/module/vgsp/parameters/sema_pdb_discover"
+RING_VA = 0x4cc0000
+
+def main():
+    dur = float(sys.argv[1]) if len(sys.argv) > 1 else 120
+    end = time.time() + dur
+    fired = set()
+    seen_pdbs = set()
+    print("# fasttick start (%.0fs)" % dur, flush=True)
+    while time.time() < end:
+        out = subprocess.run(["sudo", "dmesg"], capture_output=True).stdout.decode(errors="ignore")
+        tail = out.splitlines()[-120:]
+        for ln in tail:
+            m = re.search(r"sema-chan: h=0xbeec0100 eng=\d+ cid=\d+ gpfifo=0x([0-9a-f]+) ent=\d+ userd=0x[0-9a-f]+ as=\d+ put=\d+ get=\d+ ring rc=0 pa=0x([0-9a-f]+)", ln)
+            if m:
+                ring_va = int(m.group(1), 16)
+                ring_pa = int(m.group(2), 16)
+                key = (ring_va, ring_pa)
+                if key not in fired:
+                    fired.add(key)
+                    cmd = "echo 0x%x,0x%x > %s" % (ring_va, ring_pa, PARAM)
+                    r = subprocess.run(["sudo", "sh", "-c", cmd], capture_output=True)
+                    print("[%s] TRIGGER va=0x%x pa=0x%x rc=%d" % (
+                        time.strftime("%H:%M:%S"), ring_va, ring_pa, r.returncode), flush=True)
+            m2 = re.search(r"page directory (?:registered UNVERIFIED after \d+ ms parked \()?pdb=0x([0-9a-f]+) entries=(\d+)", ln)
+            if not m2:
+                m2 = re.search(r"VA space 0x[0-9a-f]+ page directory 0x([0-9a-f]+) entries=(\d+)", ln)
+            if m2:
+                key = int(m2.group(1), 16)
+                if key not in seen_pdbs:
+                    seen_pdbs.add(key)
+                    print("[%s] PDB candidate 0x%x entries=%s" % (
+                        time.strftime("%H:%M:%S"), key, m2.group(2)), flush=True)
+        time.sleep(0.3)
+    print("# fasttick end", flush=True)
+
+main()