From 45978e9202412fb9fc6088718e9720f22ece7b30 Mon Sep 17 00:00:00 2001
From: Arthur Hanson Rasmusson <arthur@vgpu.io>
Date: Sun, 25 Oct 2026 05:21:29 -0400
Subject: wall-2 forensics tools: GR channel-init push localization (session
 73)

Tools and findings from the live wall-2 campaign (r674/r675): the vk_frame
client's GR channel-init push (va=0x4480000 len=1432) cannot be translated by
the sema service, so no release is applied and vkCreateDevice fails -4.

Captured: the RM window-record/memdesc layout (ring memdesc PA == the
service's validated ring pa; push memdesc PA injected live and read by the
service without a false-translation line), the CE-only shape of the service
rescue matcher, the notrace status of nvidia/modeset kprobes (QEMU gdb hbreak
works), and the ring-entry encoding from channelFillGpFifo/nvWriteGpEntry
(neither runs for this channel's kick).

New tools: wall2_resolver{2..5}.py, wall2_livecap{1..3}.py, RAM structure
scanners (scan_r673*.py, trace_push674.py), gdb675*.gdb probes, plus a
README with the ranked next steps.
---
 tools/guest-diag/wall2/trace_push674.py | 71 +++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 tools/guest-diag/wall2/trace_push674.py

(limited to 'tools/guest-diag/wall2/trace_push674.py')

diff --git a/tools/guest-diag/wall2/trace_push674.py b/tools/guest-diag/wall2/trace_push674.py
new file mode 100644
index 0000000..ced4168
--- /dev/null
+++ b/tools/guest-diag/wall2/trace_push674.py
@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+# r674: find every reference to the push VA 0x4480000 and follow RM structures
+# (direct-map pointers: PA = ptr - page_offset_base) toward a page list.
+import numpy as np, struct, os, time, sys
+
+RAM="/dev/shm/vgpu-guest-ram"
+VA=0x4480000
+BASE=0xffff8916c0000000   # r674 page_offset_base (from dmesg rebuild #15)
+img=open(RAM,"rb"); fsz=os.path.getsize(RAM)
+def gpa2off(pa):
+    if pa<0x80000000: return pa
+    if pa<0x180000000: return 0x80000000+(pa-0x100000000)
+    return None
+def off2gpa(off):
+    return off if off<0x80000000 else 0x100000000+(off-0x80000000)
+def rd(pa,n):
+    off=gpa2off(pa)
+    if off is None or off+n>fsz: return None
+    img.seek(off); return img.read(n)
+def ptr2pa(v):
+    if BASE<=v<BASE+0x180000000:
+        return v-BASE
+    return None
+
+CH=64<<20
+hits=[]
+t0=time.time()
+for pos in range(0,fsz,CH):
+    img.seek(pos); d=img.read(min(CH,fsz-pos))
+    n=len(d)//8
+    a=np.frombuffer(d[:n*8],dtype=np.uint64)
+    idx=np.nonzero(a==np.uint64(VA))[0]
+    for i in idx: hits.append(off2gpa(pos+int(i)*8))
+print("VA hits:", len(hits), "(%.1fs)" % (time.time()-t0))
+
+def tag(v):
+    bs=struct.pack("<Q",v)
+    return bs.decode() if all(32<=c<127 for c in bs) else ""
+
+for gpa in hits:
+    page=gpa&~0xfff
+    d=rd(page,0x1000)
+    if not d: continue
+    ro=gpa-page
+    print("== hit gpa=0x%x page=0x%x off=0x%x ==" % (gpa,page,ro))
+    # print 0x60 before, 0x80 after
+    s=max(0,ro-0x60); e=min(0x1000,ro+0x80)
+    for o in range(s,e,0x10):
+        a,b=struct.unpack_from("<QQ",d,o)
+        print("   +0x%03x: %016x %016x %s %s" % (o,a,b,tag(a),tag(b)))
+    # follow direct-map pointers in this page
+    for o in range(0,0x1000-8,8):
+        v=struct.unpack_from("<Q",d,o)[0]
+        pa=ptr2pa(v)
+        if pa is None: continue
+        dd=rd(pa&~0xfff,0x1000)
+        if not dd: continue
+        # search that page for PA runs (>=8 page-aligned RAM PAs ascending/descending)
+        runs=[]; cur=[]
+        for oo in range(0,0xff8,8):
+            vv=struct.unpack_from("<Q",dd,oo)[0]
+            if 0x100000000<=vv<0x180000000 and (vv&0xfff)==0:
+                cur.append((oo,vv))
+            else:
+                if len(cur)>=8: runs.append(cur)
+                cur=[]
+        if len(cur)>=8: runs.append(cur)
+        if runs:
+            print("   ptr +0x%03x -> pa=0x%x has %d PA-run(s):" % (o,pa&~0xfff,len(runs)))
+            for r in runs[:4]:
+                print("      run at +0x%x: %d pages first=0x%x last=0x%x" % (r[0][0],len(r),r[0][1],r[-1][1]))
-- 
cgit v1.2.3