1 files changed, 82 insertions, 0 deletions
diff --git a/tools/guest-diag/wall2/scan_r673.py b/tools/guest-diag/wall2/scan_r673.py
new file mode 100644
index 0000000..71a0128
--- /dev/null
+++ b/tools/guest-diag/wall2/scan_r673.py
@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+# Analyze the live r673 guest RAM: locate every reference to the validated ring
+# PA (0x12a783000) including flag-bit variants, and characterize the record
+# arrays around each hit. Also dump the two pages named in the handoff.
+import numpy as np, struct, sys, time
+
+RAM="/dev/shm/vgpu-guest-ram"
+RING=0x12a783000
+MASK=~0xfff & ((1<<64)-1)
+
+def gpa2off(pa):
+    if pa < 0x80000000: return pa
+    if pa < 0x180000000: return 0x80000000+(pa-0x100000000)
+    return None
+def off2gpa(off):
+    return off if off < 0x80000000 else 0x100000000+(off-0x80000000)
+
+img=open(RAM,"rb")
+import os
+fsz=os.path.getsize(RAM)
+print("ram size 0x%x" % fsz)
+
+t0=time.time()
+hits=[]
+CH=64<<20
+for pos in range(0,fsz,CH):
+    img.seek(pos); d=img.read(min(CH,fsz-pos))
+    n=len(d)//8
+    a=np.frombuffer(d[:n*8],dtype=np.uint64)
+    idx=np.nonzero((a & np.uint64(MASK))==np.uint64(RING))[0]
+    for i in idx:
+        off=pos+int(i)*8
+        val=int(a[i])
+        hits.append((off,val))
+print("hits=%d scan=%.1fs" % (len(hits), time.time()-t0))
+for off,val in hits:
+    print("  off=0x%x gpa=0x%x val=0x%x (low=0x%x)" % (off,off2gpa(off),val,val&0xfff))
+
+# characterize each hit page
+def rd(pa,n):
+    off=gpa2off(pa)
+    if off is None or off+n>fsz: return None
+    img.seek(off); return img.read(n)
+
+def plausible_pa(v): return 0x100000000 <= (v & MASK) < 0x180000000
+def ptrish(v):
+    return (0xffff800000000000 <= v < 0xffffffffffffffff)
+
+for off,val in hits:
+    gpa=off2gpa(off)
+    page=gpa & MASK
+    rec_off=gpa-page
+    d=rd(page,0x1000)
+    print("=== hit gpa=0x%x page=0x%x rec_off=0x%x ===" % (gpa,page,rec_off))
+    for stride in (0x20,0x40,0x60,0x30,0x50,0x28,0x48):
+        # record start such that the hit qword falls inside the record
+        for rel in range(0,stride,8):
+            start=rec_off-rel
+            if start<0: continue
+            # walk records; count plausible PA fields anywhere in each record
+            n_pa=0; n_ptr=0; n_1000=0
+            for o in range(start,0x1000-stride,stride):
+                rec=d[o:o+stride]
+                qs=struct.unpack_from("<%dQ"%(stride//8),rec,0)
+                if any(plausible_pa(q) for q in qs): n_pa+=1
+                if any(ptrish(q) for q in qs): n_ptr+=1
+                if 0x1000 in qs: n_1000+=1
+            if n_pa>=8:
+                print("  stride=0x%x start=0x%x: PA-records=%d ptr-records=%d 0x1000=%d" % (stride,start,n_pa,n_ptr,n_1000))
+    # dump the first 0x100 bytes of the page and around the hit
+    print("  page head: %s" % d[:0x60].hex())
+    s=max(0,rec_off-0x40); e=min(0x1000,rec_off+0x80)
+    print("  around hit [0x%x..0x%x]: %s" % (s,e,d[s:e].hex()))
+
+# dump the two named pages
+for pa in (0x101499000,0x127cf2000):
+    d=rd(pa,0x1000)
+    print("=== page 0x%x ===" % pa)
+    if d is None: print("  unreadable"); continue
+    for o in range(0,0x120,0x20):
+        qs=struct.unpack_from("<4Q",d,o)
+        print("  +0x%03x: %016x %016x %016x %016x" % ((o,)+qs))