1 files changed, 23 insertions, 0 deletions
diff --git a/tools/guest-diag/guest_pin_stream.py b/tools/guest-diag/guest_pin_stream.py
index 14cd526..031271c 100644
--- a/tools/guest-diag/guest_pin_stream.py
+++ b/tools/guest-diag/guest_pin_stream.py
@@ -166,6 +166,9 @@ class Kcore:
                 self._pa_cache[page] = 0
                 return None
             pa = e & 0x000FFFFFFFF000
+        if not _is_ram_pa(pa):
+            self._pa_cache[page] = 0
+            return None
         self._pa_cache[page] = pa
         return pa
 
@@ -178,6 +181,26 @@ def is_gpu_va(v):
     return v and 0x120000000 <= v < 0x200000000
 
 
+# Guest-RAM windows registered with the host (debugfs gsp-phys-guest-ram):
+# low 0..2 GiB and high 4..6 GiB. A CPU mapping of a channel block resolves
+# through the guest page tables to a phys address in one of these windows
+# when the backing is guest sysmem, but to a PCI BAR address (e.g.
+# 0x70000xxxxx, the mdev BAR1 aperture) when the backing is the emulated
+# vidmem. The host pin stream must only carry guest-RAM PAs: a BAR phys fed
+# to sema_map_add as a "sysmem" pin poisoned the ring/USERD lookups (r40:
+# rank2's ring resolved to pa=0x70000c0000 ap=SYS and read 66/66 garbage).
+RAM_WINDOWS = ((0x0, 0x80000000), (0x100000000, 0x180000000))
+
+
+def _is_ram_pa(pa):
+    if not pa:
+        return False
+    for lo, hi in RAM_WINDOWS:
+        if lo <= pa < hi:
+            return True
+    return False
+
+
 def _is_gpu_va_wide(v):
     """GPU VAs above 0x200000000 are the GR share window; accept them too."""
     return v and (is_gpu_va(v) or 0x200000000 <= v < 0x208000000)