diff options
| author | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-25 14:14:32 -0400 |
|---|---|---|
| committer | Arthur Hanson Rasmusson <arthur@vgpu.io> | 2026-10-25 14:14:32 -0400 |
| commit | 8e9f0fa727a7fd5720ba5d1a351bb548f04f713b (patch) | |
| tree | c976763abb38e02e338e6dac08fe758609028fda /tools | |
| parent | 721c35c8eca61c0301f9763ab87e007c9b520d13 (diff) | |
| download | open-iov-8e9f0fa727a7fd5720ba5d1a351bb548f04f713b.tar.gz open-iov-8e9f0fa727a7fd5720ba5d1a351bb548f04f713b.zip | |
wall2 session 104: sema VA 0x4b19b10 verified NOT the loop page (converged FB 0x660b10 pokes landed, no flip; perf still 24.52%); kprobe on channelReadChannelMemdesc names the real authTagBufSemaOffset (offset=%si) + the channel pointer -> memdesc
Diffstat (limited to 'tools')
| -rw-r--r-- | tools/guest-diag/wall2/README-session77.md | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/tools/guest-diag/wall2/README-session77.md b/tools/guest-diag/wall2/README-session77.md index 11e895f..b585fdf 100644 --- a/tools/guest-diag/wall2/README-session77.md +++ b/tools/guest-diag/wall2/README-session77.md @@ -874,3 +874,22 @@ actually uses) is a small number; or take the buffer aperture from the channel's alloc params (the service's registration) and walk with that aperture exclusively. The fix remains: advance that u32 (write via the host RAM file if SYS, poke_vidmem if FB). + +**31. Session 104: THE SEMA VA 0x4b19b10 IS NOT THE LOOP'S PAGE; THE KPROBE IS THE ANSWER.** +The validated multi-chain walk (small-4KB and big chains BOTH) resolves +VA 0x4b19b10 -> FB 0x660b10 (both chains converge; the guest's own PTs say +the object lives in vidmem). poke_vidmem writes at 0x660b10 (0x1, +0x40000000) and 0x660b14 (0x1, 0x40000000) LANDED (verified via +sema_vidmem_dump: [0x660b10]=0x11112222) yet the client does not flip and +perf still shows channelReadChannelMemdesc at 24.52%. CONCLUSION: the +REPORT_SEM VA 0x4b19b10 (and 0x4b17e30) are NOT the auth-tag sema the loop +reads - they are the GL-init release objects; the real auth-tag sema is at +pChannelBufferMemdesc + finishPayloadOffset + 4 (a VA and page we do not +yet know; finishPayloadOffset is NOT 0x19b10). THE DEFINITIVE INSTRUMENT: +a guest kprobe on channelReadChannelMemdesc (the offset argument = %si = +the authTagBufSemaOffset VALUE; and the pChannel pointer lets us read the +channel struct -> pChannelBufferMemdesc): `echo 'p:crcd +channelReadChannelMemdesc offset=%si' >> /sys/kernel/tracing/kprobe_events` ++ enable the event + read tracing pipe WHILE the loop runs. This names the +offset and the memdesc in one shot, then the sema page = walk(memdesc+off) +and the advance (RAM file if SYS; FB + poke if the converged mapping). |