From 13a16975e311b9ee002573eb68ec5bce7eed25fe Mon Sep 17 00:00:00 2001 From: Gregory Lirent Date: Sun, 21 Jun 2026 00:03:40 +0300 Subject: [PATCH] fix: discover the vgpu region in the producer process user space The region is a shared mapping in a producer process's user address space, not a kernel VA: open a read-only process context, enumerate processes, and locate it by structural invariants under each process cr3. Frames, cursor, geometry and status are read under the producer's cr3. --- include/vgpu_perception.h | 157 ++++++++++++------- src/perception/control.c | 4 + src/perception/discover.c | 120 ++++++++++---- src/perception/include/perception-internal.h | 21 ++- src/perception/sample.c | 69 ++++---- src/perception/test/test_perception.c | 135 ++++++++-------- 6 files changed, 320 insertions(+), 186 deletions(-) diff --git a/include/vgpu_perception.h b/include/vgpu_perception.h index 0f29b0b..7cc648d 100644 --- a/include/vgpu_perception.h +++ b/include/vgpu_perception.h @@ -10,11 +10,20 @@ * coherence, never opens RW guest memory, never decides control or behavioural * timing, never emits events upward. * + * Where the region lives (the correction that shapes this API): the region is a + * RW shared mapping projected into the USER address space of a producer PROCESS, + * NOT a kernel VA in the System address space. So the core is handed a RO win32 + * context (which the caller opened with the System kcr3), enumerates processes + * with proc_list, and finds the region in a process user-AS under that process's + * own cr3 (process.cr3). The System kcr3 is needed ONLY to open the context and + * walk processes; once the region is found, it is always read under the + * producer's process.cr3 (cached in the handle). The handle carries proc_cr3. + * * What this core does NOT do (by design — those belong to the caller): - * - It does NOT own the vmie_mem / coherent address-space root: (m, kcr3) are - * BORROWED. The core never opens or closes a vmie_mem; the caller opens it - * for the current guest address-space mapping and closes it when that - * mapping goes stale. + * - It does NOT own the vmie_win32 context / vmie_mem: both are BORROWED. The + * caller opens the RO win32 context (its lifetime is tied to the guest + * address-space mapping epoch) and closes it when that mapping goes stale. + * The core never opens or closes either. * - It does NOT sleep / poll / spawn threads / arm timers: the two-phase * liveness handshake is two calls; the WAIT between them is the caller's. * - It does NOT transport frames. Frame transport is the caller's concern; @@ -24,88 +33,123 @@ * desired frame + offsets; the actual write is performed elsewhere, by a * component that holds read-write access to the region. * + * Two epochs + producer restart (the caller owns the policy; the core only + * reports facts — this is a flat pull model, no polling from below): + * - Address-space invalidation (new kcr3 / new epoch): the caller closes the + * win32 context, drops the old vgpup_region, opens a fresh context on the + * new epoch and re-discovers (vgpup_open). The old handle is invalid (a + * different address space entirely). + * - vgpu run_epoch advance while the context stays live (session break, same + * process): vgpup_read_status records r->run_epoch; vgpup_run_epoch reports + * it. The caller compares and decides whether to reset vgpu state — the + * region/process are unchanged. The core holds no reset policy. + * - Producer process restart (new pid/cr3 under the same live kcr3): the win32 + * context is still valid (kernel alive), but the old handle's proc_cr3 / + * region_gva point at a dead process address space. Symptom: a read under + * r->proc_cr3 returns <0 (the process pages are gone). The core only REPORTS + * this (<0 from a read); the DECISION to re-discover is the caller's — it + * calls vgpup_close(old) + vgpup_open(v) so a fresh proc_list finds the + * restarted producer with its new cr3. + * * Ownership convention: - * - vmie_mem* m, uintptr_t kcr3 — BORROWED. The caller owns their lifecycle + * - vmie_win32* v, vmie_mem* m — BORROWED. The caller owns their lifecycle * (tied to the address-space mapping). The core only reads through them. * - vgpup_region* — heap-owned by the core (small private state). Create with - * vgpup_open, release with vgpup_close. Closing it does NOT touch (m, kcr3). + * vgpup_open, release with vgpup_close. Closing it does NOT touch v / m. * * Conventions (mirror memmodel.h): - * - kcr3 is the System address space CR3 (the region is a pinned device - * shared-section visible as a kernel VA). A "GVA" is a 64-bit guest VA. + * - The System kcr3 opens the RO win32 context; the REGION lives in the USER + * address space of the producer process and is read under its process.cr3 + * (cached in the handle as proc_cr3). A "GVA" is a 64-bit guest VA in that + * process address space. * - All guest reads go through gva_read into a local copy; no borrowed * pointer into guest memory ever escapes a seqlock window or this API. * - Integer returns: 0 success / negative failure for deterministic calls. * Lossy read calls (sample/cursor/geometry) are tristate: 1 = consistent * snapshot produced, 0 = no fresh data / writer kept it busy past the retry * limit / would not fit (a SKIP, never an error — do not block), <0 = a - * hard memory-read error (page gone / mapping stale — the caller re-discovers). + * hard memory-read error (page gone / process restarted — the caller + * re-discovers; see "Two epochs + producer restart" above). * * Example (the caller drives the two-phase liveness and the read loop): * - * // caller already opened a RO vmie_mem for the current address-space mapping: - * vmie_mem* m = caller_mem; // BORROWED by the core - * uintptr_t kcr3 = caller_kcr3; // System AS + * // caller already opened a RO win32 context with the System kcr3: + * vmie_win32* v = caller_ctx; // BORROWED by the core + * vmie_mem* m = vmie_win32_mem(v); // BORROWED; for the generic gva_* * - * vgpup_region* r = vgpup_open(m, kcr3); // phase 1: candidate + hb0 - * if (!r) { return; } // no region under this AS + * vgpup_region* r = vgpup_open(v); // phase 1: find producer + candidate + * if (!r) { return; } // no region in any process * * // phase 2 is the caller's: it waits >= VGPU_HEARTBEAT_PERIOD_MS, then - * uint64_t region_gva, hb0; - * vgpup_discover_candidate(m, kcr3, ®ion_gva, &hb0); // (or reuse open's) + * uint64_t proc_cr3, region_gva, hb0; + * vgpup_discover_candidate(v, &proc_cr3, ®ion_gva, &hb0); // (or reuse open's) * // ... the caller sleeps here, NOT the core ... - * int alive = vgpup_confirm_alive(m, kcr3, region_gva, hb0); + * int alive = vgpup_confirm_alive(m, proc_cr3, region_gva, hb0); * * // sampling (lossy pull): * static uint8_t buf[VGPU_SLOT_STRIDE]; * vgpup_frame_info fi; - * if (vgpup_sample_frame(r, m, kcr3, buf, sizeof buf, &fi) == 1) { + * if (vgpup_sample_frame(r, m, buf, sizeof buf, &fi) == 1) { * // route fi.desc + buf[0..fi.bytes) to the chosen transport * } * - * vgpup_close(r); // frees core state only; (m, kcr3) stay with the caller + * vgpup_close(r); // frees core state only; v / m stay with the caller */ #include #include #include "vgpu_stream.h" /* region ABI: producer/control types, slot geometry */ -#include "memmodel.h" /* vmie_mem, gva_* (BORROWED access primitives) */ +#include "win32.h" /* vmie_win32*, proc_list, process, vmie_win32_mem; + * pulls in memmodel.h for vmie_mem / gva_* — the + * producer is found via proc_list under the System + * kcr3, then the region is read under process.cr3 */ -/* Opaque found vgpu region under (vmie_mem, kcr3). Heap-owned by the core; holds - * only small private state (region GVA, last frame_id, last run_epoch). It does - * NOT own (m, kcr3) — those are passed back in on every read. */ +/* Opaque found vgpu region in a producer's user address space. Heap-owned by the + * core; holds only small private state (proc_cr3, region/ctrl/ring GVA, last + * frame_id, last run_epoch). It does NOT own v / m — those are passed back in on + * every read. */ typedef struct vgpup_region vgpup_region; -/* ---- handle / lifecycle (the core does NOT own vmie_mem) ------------------ */ +/* ---- handle / lifecycle (the core does NOT own the win32 context) --------- */ -/* Phase-1 discover + bind: find the region by structural invariants, snapshot - * hb0, and build a handle. (m, kcr3) are BORROWED — the core reads them but - * never closes them. Returns a heap-owned vgpup_region*, or NULL if no region - * is found under this address space. Liveness is NOT yet proven: the caller must - * call vgpup_confirm_alive after waiting >= VGPU_HEARTBEAT_PERIOD_MS. Sampling - * before confirmation is allowed (lossy); "producer alive" is true only after a - * positive confirm. */ -vgpup_region* vgpup_open(vmie_mem* m, uintptr_t kcr3); +/* Phase-1 discover + bind: enumerate processes (proc_list) over the BORROWED RO + * win32 context v, scan each process user-AS by structural invariants, snapshot + * hb0, and build a handle carrying the producer's proc_cr3 + region/ctrl/ring + * GVA. v is BORROWED — the core reads through it but never closes it (its + * lifetime is the caller's, tied to the address-space mapping epoch). Returns a + * heap-owned vgpup_region*, or NULL if no region is found in any process. + * Liveness is NOT + * yet proven: the caller must call vgpup_confirm_alive after waiting + * >= VGPU_HEARTBEAT_PERIOD_MS. Sampling before confirmation is allowed (lossy); + * "producer alive" is true only after a positive confirm. + * + * If a later read returns <0, the producer process may have restarted (its + * pages are gone): the caller re-discovers via vgpup_close(r) + vgpup_open(v). */ +vgpup_region* vgpup_open(vmie_win32* v); -/* Release ONLY the core state. Does NOT touch (m, kcr3) — the caller closes - * those (their lifetime is the caller's). Safe on NULL. */ +/* Release ONLY the core state. Does NOT touch v / m — the caller closes those + * (their lifetime is the caller's). Safe on NULL. */ void vgpup_close(vgpup_region* r); /* ---- two-phase discovery (the WAIT belongs to the caller) ----------------- */ -/* Phase 1: find a candidate by structural invariants (no liveness). On success - * writes the region base GVA (== producer-block GVA) to *out_region_gva and the - * heartbeat snapshot to *out_hb0, and returns 0. Returns <0 if no candidate is - * found or a read fails. Pure; does NOT wait. */ -int vgpup_discover_candidate(vmie_mem* m, uintptr_t kcr3, +/* Phase 1: find a producer and a candidate region in its user-AS (no liveness). + * Walks proc_list over v and, for each process, scans its user-AS under + * process.cr3 by structural invariants. On the first hit writes the producer's + * cr3 to *out_proc_cr3, the region base GVA to *out_region_gva and the heartbeat + * snapshot to *out_hb0, and returns 0. Returns <0 if no candidate is found in + * any process or a read fails. Pure; does NOT wait. Needs v for proc_list. */ +int vgpup_discover_candidate(vmie_win32* v, uint64_t* out_proc_cr3, uint64_t* out_region_gva, uint64_t* out_hb0); /* Phase 2: confirm liveness. The caller calls this >= VGPU_HEARTBEAT_PERIOD_MS - * after phase 1. Re-reads heartbeat at region_gva and returns 1 if it advanced - * (alive producer), 0 if it did not tick (dead / not the region), <0 on a read - * error. Pure; does NOT wait — the inter-phase delay is the caller's. */ -int vgpup_confirm_alive(vmie_mem* m, uintptr_t kcr3, + * after phase 1. Re-reads heartbeat at region_gva under proc_cr3 and returns 1 + * if it advanced (alive producer), 0 if it did not tick (dead / not the region), + * <0 on a read error. Takes vmie_mem* m (== vmie_win32_mem(v)) and proc_cr3 — + * the win32 surface is no longer needed here, only gva_read. Pure; does NOT + * wait — the inter-phase delay is the caller's. */ +int vgpup_confirm_alive(vmie_mem* m, uint64_t proc_cr3, uint64_t region_gva, uint64_t hb0); /* ---- snapshots (POD values; read under their seqlock discipline) ---------- */ @@ -158,7 +202,12 @@ typedef struct { uint64_t content_change_ns; } vgpup_status; -/* ---- read API (lossy; seqlock discipline lives inside) -------------------- */ +/* ---- read API (lossy; seqlock discipline lives inside) -------------------- * + * All read functions read under r->proc_cr3 (the producer's cr3, cached in the + * handle at discovery). m is a BORROWED vmie_mem* (== vmie_win32_mem(v)); the + * cr3 is NOT in the signature — it travels in the handle. A <0 return is a hard + * memory-read error: the producer process may have restarted, so the caller + * re-discovers (see "Two epochs + producer restart" in the file header). */ /* Sample the latest frame. Seqlock-reads latest/seq[slot]/desc, copies the slot * bytes out of the RING via gva_read, then re-checks seq[slot] in one window. @@ -166,26 +215,23 @@ typedef struct { * copied (info filled), 0 = no new frame / writer busy past the retry limit / * frame would not fit cap (lossy SKIP, not an error), <0 = a memory-read error. * "Fresh" dedups by frame_id: a frame_id <= the last sampled one returns 0. */ -int vgpup_sample_frame(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, +int vgpup_sample_frame(vgpup_region* r, vmie_mem* m, uint8_t* dst, size_t cap, vgpup_frame_info* info); /* Read the cursor under the cursor_seq acquire gate. 1 = consistent snapshot, * 0 = writer busy past the retry limit, <0 = read error. */ -int vgpup_read_cursor(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, - vgpup_cursor* out); +int vgpup_read_cursor(vgpup_region* r, vmie_mem* m, vgpup_cursor* out); /* Read display geometry under the geom_seq seqlock. Returns as read_cursor. */ -int vgpup_read_geometry(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, - vgpup_geometry* out); +int vgpup_read_geometry(vgpup_region* r, vmie_mem* m, vgpup_geometry* out); /* Read the cold-line status/lifecycle. 0 = success, <0 = read error. The single * atomic fields carry no seqlock; the snapshot is "fresh enough" (lossy). */ -int vgpup_read_status(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, - vgpup_status* out); +int vgpup_read_status(vgpup_region* r, vmie_mem* m, vgpup_status* out); /* The run_epoch from the last vgpup_read_status — a session-break detector for - * the caller while kcr3 stays live. The core only reports the raw value; it - * holds no reset policy (what to reset is the caller's decision). */ + * the caller while the address space stays live. The core only reports the raw + * value; it holds no reset policy (what to reset is the caller's decision). */ uint32_t vgpup_run_epoch(const vgpup_region* r); /* ---- control-write — SEAM ONLY (this never writes) ------------------------ */ @@ -209,7 +255,10 @@ typedef struct { * consumer_tick/attached carry separate heartbeat/intent semantics and are NOT * part of this intent. * out_frame — filled vgpu_control_t (significant fields from `in`) - * out_ctrl_gva — control-block GVA (region base + VGPU_CONTROL_OFFSET) + * out_ctrl_gva — control-block GVA (region base + VGPU_CONTROL_OFFSET). This + * GVA is valid in the PRODUCER's user address space: the + * external write MUST be performed under r->proc_cr3, NOT the + * System kcr3. * out_off — offset of the first significant field (offsetof desired_state) * out_len — length of the significant range (through full_frame_req) * Returns 0 on success, <0 if r is NULL. The write itself is performed diff --git a/src/perception/control.c b/src/perception/control.c index ba2c782..1df3e3a 100644 --- a/src/perception/control.c +++ b/src/perception/control.c @@ -5,6 +5,10 @@ * the intent and computes the GVA + offset/length of the significant field range * for that atomic write under the ctrl_gen seqlock. There is no gva_write here * and there must not be — the source is a RO fd that would fault on a store anyway. + * + * The reported out_ctrl_gva is a GVA in the PRODUCER's user address space + * (region base + VGPU_CONTROL_OFFSET, cached as r->ctrl_gva): the external write + * MUST be performed under r->proc_cr3, NOT the System kcr3. */ #include "perception-internal.h" diff --git a/src/perception/discover.c b/src/perception/discover.c index eb03203..68b2055 100644 --- a/src/perception/discover.c +++ b/src/perception/discover.c @@ -1,49 +1,68 @@ -/* discover.c — region discovery by structural invariants (NO magic) + handle. +/* discover.c — process discovery + user-AS region scan (NO magic) + handle. * - * The region is a pinned device shared-section projected into the System address - * space under kcr3, so we scan the KERNEL canonical half [KERN_MIN, ~0]. We find - * a contiguous readable run >= VGPU_REGION_BYTES (the region is GVA-contiguous, - * possibly spread across adjacent same-protection runs), read the producer block - * at its base, and accept it iff the whole structural-invariant table holds. + * The region is a RW shared mapping projected into the USER address space of a + * producer PROCESS — NOT a kernel VA in the System address space. So discovery + * works by PROCESS: enumerate processes (proc_list) over the RO win32 context, + * and for each one scan its user-AS under process.cr3 in [USER_MIN, USER_MAX] + * for a contiguous RW run >= VGPU_REGION_BYTES, read the producer block at its + * base, and accept it iff the whole structural-invariant table holds. The System + * kcr3 is needed only to open the context and walk processes (the caller already + * baked it into v); the region itself is always read under the producer's cr3. * * There is NO magic field in the ABI and the owner forbids inventing one. The - * discriminator is the invariant table plus two-phase heartbeat liveness — and - * the inter-phase WAIT is the caller's (the core never sleeps). + * discriminator is the cheap RW-run filter + the invariant table + two-phase + * heartbeat liveness — and the inter-phase WAIT is the caller's (the core never + * sleeps). Discovery is STRUCTURAL: never filtered by process.name. + * + * Layering: the win32 dependency (proc_list, vmie_win32_mem) lives ONLY in this + * file, in the per-process loop. The per-cr3 scan (vgpup_scan_user_as_for_region) + * is pure gva_* so it stays win32-agnostic and unit-testable under a synthetic + * cr3. A <0 read after binding means the producer process may have restarted + * (its pages are gone); the core only reports it — re-discovery is the caller's. */ #include #include "perception-internal.h" -/* How many region records to ask for when probing the System AS. The kernel half - * has few large same-protection runs; this is generous for the shared-section. */ +/* How many region runs to ask for per process when probing its user-AS. A user + * address space has many runs; this is generous, and the scan early-exits on the + * first accepted candidate anyway. */ #define VGPUP_MAX_REGIONS 256 -/* Read the producer block at `region_gva` into *out (one gva_read of the whole - * block). 0 on success, <0 on read error. */ -static int read_producer_block(vmie_mem* m, uintptr_t kcr3, uint64_t region_gva, +/* How many processes to enumerate. proc_list stops at this; raising it would see + * more, but a producer is an ordinary user process well within this bound. */ +#define VGPUP_MAX_PROCS 512 + +/* Read the producer block at `region_gva` under `cr3` into *out (one gva_read of + * the whole block). 0 on success, <0 on read error. */ +static int read_producer_block(vmie_mem* m, uint64_t cr3, uint64_t region_gva, vgpu_producer_t* out) { - return gva_read(m, kcr3, (uintptr_t)region_gva, out, sizeof *out) < 0 ? -1 : 0; + return gva_read(m, (uintptr_t)cr3, (uintptr_t)region_gva, out, sizeof *out) < 0 ? -1 : 0; } -/* Walk the region runs in the kernel half and, for each contiguous readable span - * of >= VGPU_REGION_BYTES, test the producer block at the span base against the - * invariant table. On the first accepted candidate, write its base GVA + the - * heartbeat snapshot and return 0. Returns <0 if none is found / a read fails. +/* Scan ONE process user-AS (steps 3–5) under `cr3`: walk the RW runs in + * [USER_MIN, USER_MAX] and, for each contiguous run >= VGPU_REGION_BYTES, test + * the producer block at the run base against the invariant table. On the first + * accepted candidate write its base GVA + heartbeat snapshot and return 0; + * <0 if none is found / a read fails. Pure gva_* — no proc_list, no win32. * * Adjacent same-protection runs are coalesced: gva_regions reports VA-contiguous * runs, but a region can land as one run or as touching neighbours, so we extend - * a running span while the next run starts exactly where the current one ends. */ -int vgpup_discover_candidate(vmie_mem* m, uintptr_t kcr3, - uint64_t* out_region_gva, uint64_t* out_hb0) + * a running span while the next run starts exactly where the current one ends. + * The window [USER_MIN, USER_MAX] lies in one canonical half, as gva_regions + * requires. The RW filter (VR_R|VR_W) matches the shared mapping's protection + * and is cheap — it reads region metadata, not the 98 MiB of region bytes. */ +int vgpup_scan_user_as_for_region(vmie_mem* m, uint64_t cr3, + uint64_t* out_region_gva, uint64_t* out_hb0) { vregion runs[VGPUP_MAX_REGIONS]; int n, i; if (!m || !out_region_gva || !out_hb0) { return -1; } - n = gva_regions(m, kcr3, KERN_MIN, ~0ull, VR_R, runs, VGPUP_MAX_REGIONS); + n = gva_regions(m, (uintptr_t)cr3, USER_MIN, USER_MAX, VR_R | VR_W, runs, VGPUP_MAX_REGIONS); if (n < 0) { return -1; } if (n > VGPUP_MAX_REGIONS) { n = VGPUP_MAX_REGIONS; } /* truncated; probe what we got */ @@ -52,7 +71,7 @@ int vgpup_discover_candidate(vmie_mem* m, uintptr_t kcr3, uint64_t span_len = runs[i].len; int j = i; - /* coalesce adjacent readable runs into one contiguous span */ + /* coalesce adjacent RW runs into one contiguous span */ while (j + 1 < n && runs[j + 1].va == runs[j].va + runs[j].len) { span_len += runs[j + 1].len; ++j; @@ -60,7 +79,7 @@ int vgpup_discover_candidate(vmie_mem* m, uintptr_t kcr3, if (span_len >= VGPU_REGION_BYTES) { vgpu_producer_t p; - if (read_producer_block(m, kcr3, span_base, &p) == 0 && + if (read_producer_block(m, cr3, span_base, &p) == 0 && vgpup_invariants_hold(&p)) { *out_region_gva = span_base; *out_hb0 = p.heartbeat; @@ -71,30 +90,67 @@ int vgpup_discover_candidate(vmie_mem* m, uintptr_t kcr3, return -1; } -/* Phase 2: re-read heartbeat at region_gva and report whether it advanced. The - * caller must have waited >= VGPU_HEARTBEAT_PERIOD_MS since phase 1. */ -int vgpup_confirm_alive(vmie_mem* m, uintptr_t kcr3, +/* Phase 1: enumerate processes and scan each one's user-AS for the region. The + * win32 dependency is confined here: vmie_win32_mem(v) for the generic gva_*, + * proc_list(v, skip_system=1, ...) to drop PEB-less System/kernel-only entries + * (a producer is never one). On the first process that yields a candidate write + * its proc_cr3 + region base GVA + heartbeat snapshot and return 0; <0 if no + * process yields one or proc_list / the context is not ready. */ +int vgpup_discover_candidate(vmie_win32* v, uint64_t* out_proc_cr3, + uint64_t* out_region_gva, uint64_t* out_hb0) +{ + process procs[VGPUP_MAX_PROCS]; + vmie_mem* m; + int np, i; + + if (!v || !out_proc_cr3 || !out_region_gva || !out_hb0) { return -1; } + + m = vmie_win32_mem(v); + if (!m) { return -1; } + + np = proc_list(v, /*skip_system=*/1, procs, VGPUP_MAX_PROCS); + if (np < 0) { return -1; } + if (np > VGPUP_MAX_PROCS) { np = VGPUP_MAX_PROCS; } /* truncated; probe what we got */ + + for (i = 0; i < np; ++i) { + uint64_t region_gva = 0, hb0 = 0; + if (vgpup_scan_user_as_for_region(m, procs[i].cr3, ®ion_gva, &hb0) == 0) { + *out_proc_cr3 = procs[i].cr3; + *out_region_gva = region_gva; + *out_hb0 = hb0; + return 0; + } + } + return -1; +} + +/* Phase 2: re-read heartbeat at region_gva under proc_cr3 and report whether it + * advanced. The caller must have waited >= VGPU_HEARTBEAT_PERIOD_MS since phase + * 1. <0 here can also mean the producer process restarted (pages gone). */ +int vgpup_confirm_alive(vmie_mem* m, uint64_t proc_cr3, uint64_t region_gva, uint64_t hb0) { uint64_t hb_now; if (!m) { return -1; } - if (gva_read(m, kcr3, (uintptr_t)region_gva + offsetof(vgpu_producer_t, heartbeat), + if (gva_read(m, (uintptr_t)proc_cr3, + (uintptr_t)region_gva + offsetof(vgpu_producer_t, heartbeat), &hb_now, sizeof hb_now) < 0) { return -1; } return (hb_now - hb0) > 0u ? 1 : 0; } -vgpup_region* vgpup_open(vmie_mem* m, uintptr_t kcr3) +vgpup_region* vgpup_open(vmie_win32* v) { - uint64_t region_gva = 0, hb0 = 0; + uint64_t proc_cr3 = 0, region_gva = 0, hb0 = 0; vgpup_region* r; - if (vgpup_discover_candidate(m, kcr3, ®ion_gva, &hb0) != 0) { return NULL; } + if (vgpup_discover_candidate(v, &proc_cr3, ®ion_gva, &hb0) != 0) { return NULL; } r = (vgpup_region*)calloc(1, sizeof *r); if (!r) { return NULL; } + r->proc_cr3 = proc_cr3; r->region_gva = region_gva; r->ctrl_gva = region_gva + VGPU_CONTROL_OFFSET; r->ring_gva = region_gva + VGPU_RING_OFFSET; @@ -105,7 +161,7 @@ vgpup_region* vgpup_open(vmie_mem* m, uintptr_t kcr3) void vgpup_close(vgpup_region* r) { - free(r); /* core state only; (m, kcr3) belong to the caller */ + free(r); /* core state only; v / m belong to the caller */ } uint32_t vgpup_run_epoch(const vgpup_region* r) diff --git a/src/perception/include/perception-internal.h b/src/perception/include/perception-internal.h index d56eabf..ceea25f 100644 --- a/src/perception/include/perception-internal.h +++ b/src/perception/include/perception-internal.h @@ -29,8 +29,10 @@ #define VGPUP_SEQLOCK_RETRIES 8u /* Private core state. Owns nothing of the address space — only where the region - * lives and the last-seen monotonic markers for dedup / session-break. */ + * lives (in the producer's user-AS, keyed by proc_cr3) and the last-seen + * monotonic markers for dedup / session-break. */ struct vgpup_region { + uint64_t proc_cr3; /* producer process cr3 — key to its user-AS */ uint64_t region_gva; /* producer-block GVA == region base */ uint64_t ctrl_gva; /* region_gva + VGPU_CONTROL_OFFSET (cached) */ uint64_t ring_gva; /* region_gva + VGPU_RING_OFFSET (cached) */ @@ -38,15 +40,26 @@ struct vgpup_region { uint32_t run_epoch; /* last run_epoch seen via vgpup_read_status */ }; +/* Per-cr3 user-AS region scan (discovery steps 3–5 for ONE address space): scan + * gva_regions over [USER_MIN, USER_MAX] under `cr3` for a contiguous RW run of + * >= VGPU_REGION_BYTES, read the producer block at its base, and accept it iff + * the structural-invariant table holds. On the first hit writes the region base + * GVA to *out_region_gva and the heartbeat snapshot to *out_hb0 and returns 0; + * <0 if none is found / a read fails. Pure gva_* (no proc_list / win32) so it is + * testable under a synthetic cr3; vgpup_discover_candidate calls it per process. */ +int vgpup_scan_user_as_for_region(vmie_mem* m, uint64_t cr3, + uint64_t* out_region_gva, uint64_t* out_hb0); + /* ---- seqlock primitives -------------------------------------------------- */ static inline int vgpup_seq_is_writing(uint32_t seq) { return (seq & 1u) != 0u; } -/* Read one 32-bit seq field at `gva` into *out. 0 on success, <0 on read error. */ -static inline int vgpup_read_seq(vmie_mem* m, uintptr_t kcr3, uint64_t gva, +/* Read one 32-bit seq field at `gva` into *out under `cr3` (the producer's + * user-AS cr3). 0 on success, <0 on read error. */ +static inline int vgpup_read_seq(vmie_mem* m, uintptr_t cr3, uint64_t gva, uint32_t* out) { - return gva_read(m, kcr3, (uintptr_t)gva, out, sizeof *out) < 0 ? -1 : 0; + return gva_read(m, cr3, (uintptr_t)gva, out, sizeof *out) < 0 ? -1 : 0; } /* ---- packed-field unpackers (cursor line) -------------------------------- */ diff --git a/src/perception/sample.c b/src/perception/sample.c index e59b091..4d7dd41 100644 --- a/src/perception/sample.c +++ b/src/perception/sample.c @@ -8,18 +8,24 @@ * Lossy by contract: when a writer keeps a window busy past VGPUP_SEQLOCK_RETRIES * we return 0 (skip), never block. Blocking longer would be behavioural timing * (control's concern), which has no place in the sensor. + * + * All reads go under r->proc_cr3 (the producer's user-AS cr3, cached in the + * handle at discovery), NOT the System kcr3. A <0 from any gva_read means a page + * is gone — the producer process may have restarted; we propagate <0 and the + * caller re-discovers (see vgpu_perception.h "Two epochs + producer restart"). */ #include "perception-internal.h" -/* Read one cold-line / packed field at producer offset `off` into dst. */ -static int read_field(vmie_mem* m, uintptr_t kcr3, uint64_t region_gva, +/* Read one cold-line / packed field at producer offset `off` into dst under the + * producer's user-AS cr3. */ +static int read_field(vmie_mem* m, uintptr_t cr3, uint64_t region_gva, size_t off, void* dst, size_t n) { - return gva_read(m, kcr3, (uintptr_t)region_gva + off, dst, n) < 0 ? -1 : 0; + return gva_read(m, cr3, (uintptr_t)region_gva + off, dst, n) < 0 ? -1 : 0; } -int vgpup_sample_frame(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, +int vgpup_sample_frame(vgpup_region* r, vmie_mem* m, uint8_t* dst, size_t cap, vgpup_frame_info* info) { unsigned attempt; @@ -33,7 +39,7 @@ int vgpup_sample_frame(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, size_t frame_bytes; /* latest (acquire-equivalent: its own read) */ - if (read_field(m, kcr3, r->region_gva, + if (read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, latest), &latest, sizeof latest) < 0) { return -1; } @@ -42,10 +48,10 @@ int vgpup_sample_frame(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, seq_gva = r->region_gva + offsetof(vgpu_producer_t, seq) + (uint64_t)latest * sizeof(uint32_t); desc_gva = r->region_gva + offsetof(vgpu_producer_t, desc) + (uint64_t)latest * sizeof(vgpu_desc_t); - if (vgpup_read_seq(m, kcr3, seq_gva, &seq_before) < 0) { return -1; } + if (vgpup_read_seq(m, r->proc_cr3, seq_gva, &seq_before) < 0) { return -1; } if (vgpup_seq_is_writing(seq_before)) { continue; } /* writer in slot */ - if (gva_read(m, kcr3, (uintptr_t)desc_gva, &d, sizeof d) < 0) { return -1; } + if (gva_read(m, (uintptr_t)r->proc_cr3, (uintptr_t)desc_gva, &d, sizeof d) < 0) { return -1; } /* dedup by frame_id: nothing newer than what we already sampled */ if (d.frame_id <= r->last_frame_id) { return 0; } @@ -62,10 +68,10 @@ int vgpup_sample_frame(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, if (frame_bytes > cap) { return 0; } /* would not fit → lossy drop */ slot_gva = r->ring_gva + (uint64_t)latest * VGPU_SLOT_STRIDE; - if (gva_read(m, kcr3, (uintptr_t)slot_gva, dst, frame_bytes) < 0) { return -1; } + if (gva_read(m, (uintptr_t)r->proc_cr3, (uintptr_t)slot_gva, dst, frame_bytes) < 0) { return -1; } /* re-check the slot seq: unchanged and still even → snapshot consistent */ - if (vgpup_read_seq(m, kcr3, seq_gva, &seq_after) < 0) { return -1; } + if (vgpup_read_seq(m, r->proc_cr3, seq_gva, &seq_after) < 0) { return -1; } if (seq_after != seq_before || vgpup_seq_is_writing(seq_after)) { continue; /* the slot was rewritten under us — retry */ } @@ -84,8 +90,7 @@ int vgpup_sample_frame(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, return 0; /* writer kept the slot busy past the retry limit — skip */ } -int vgpup_read_cursor(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, - vgpup_cursor* out) +int vgpup_read_cursor(vgpup_region* r, vmie_mem* m, vgpup_cursor* out) { unsigned attempt; @@ -98,19 +103,19 @@ int vgpup_read_cursor(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, uint32_t visible = 0, hotspot = 0, glyph = 0, id = 0; uint64_t pos = 0; - if (vgpup_read_seq(m, kcr3, r->region_gva + offsetof(vgpu_producer_t, cursor_seq), + if (vgpup_read_seq(m, r->proc_cr3, r->region_gva + offsetof(vgpu_producer_t, cursor_seq), &seq_before) < 0) { return -1; } if (vgpup_seq_is_writing(seq_before)) { continue; } - if (read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, cursor_visible), &visible, sizeof visible) < 0 || - read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, cursor_pos), &pos, sizeof pos) < 0 || - read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, cursor_hotspot), &hotspot, sizeof hotspot) < 0 || - read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, cursor_glyph), &glyph, sizeof glyph) < 0 || - read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, cursor_id), &id, sizeof id) < 0) { + if (read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, cursor_visible), &visible, sizeof visible) < 0 || + read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, cursor_pos), &pos, sizeof pos) < 0 || + read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, cursor_hotspot), &hotspot, sizeof hotspot) < 0 || + read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, cursor_glyph), &glyph, sizeof glyph) < 0 || + read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, cursor_id), &id, sizeof id) < 0) { return -1; } - if (vgpup_read_seq(m, kcr3, r->region_gva + offsetof(vgpu_producer_t, cursor_seq), + if (vgpup_read_seq(m, r->proc_cr3, r->region_gva + offsetof(vgpu_producer_t, cursor_seq), &seq_after) < 0) { return -1; } if (seq_after != seq_before || vgpup_seq_is_writing(seq_after)) { continue; } @@ -128,8 +133,7 @@ int vgpup_read_cursor(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, return 0; } -int vgpup_read_geometry(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, - vgpup_geometry* out) +int vgpup_read_geometry(vgpup_region* r, vmie_mem* m, vgpup_geometry* out) { unsigned attempt; @@ -140,22 +144,22 @@ int vgpup_read_geometry(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, int32_t virt_x = 0, virt_y = 0, cap_x = 0, cap_y = 0; uint32_t virt_w = 0, virt_h = 0, dpi = 0, refresh_mhz = 0; - if (vgpup_read_seq(m, kcr3, r->region_gva + offsetof(vgpu_producer_t, geom_seq), + if (vgpup_read_seq(m, r->proc_cr3, r->region_gva + offsetof(vgpu_producer_t, geom_seq), &seq_before) < 0) { return -1; } if (vgpup_seq_is_writing(seq_before)) { continue; } - if (read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, virt_x), &virt_x, sizeof virt_x) < 0 || - read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, virt_y), &virt_y, sizeof virt_y) < 0 || - read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, virt_w), &virt_w, sizeof virt_w) < 0 || - read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, virt_h), &virt_h, sizeof virt_h) < 0 || - read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, cap_x), &cap_x, sizeof cap_x) < 0 || - read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, cap_y), &cap_y, sizeof cap_y) < 0 || - read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, dpi), &dpi, sizeof dpi) < 0 || - read_field(m, kcr3, r->region_gva, offsetof(vgpu_producer_t, refresh_mhz), &refresh_mhz, sizeof refresh_mhz) < 0) { + if (read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, virt_x), &virt_x, sizeof virt_x) < 0 || + read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, virt_y), &virt_y, sizeof virt_y) < 0 || + read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, virt_w), &virt_w, sizeof virt_w) < 0 || + read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, virt_h), &virt_h, sizeof virt_h) < 0 || + read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, cap_x), &cap_x, sizeof cap_x) < 0 || + read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, cap_y), &cap_y, sizeof cap_y) < 0 || + read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, dpi), &dpi, sizeof dpi) < 0 || + read_field(m, r->proc_cr3, r->region_gva, offsetof(vgpu_producer_t, refresh_mhz), &refresh_mhz, sizeof refresh_mhz) < 0) { return -1; } - if (vgpup_read_seq(m, kcr3, r->region_gva + offsetof(vgpu_producer_t, geom_seq), + if (vgpup_read_seq(m, r->proc_cr3, r->region_gva + offsetof(vgpu_producer_t, geom_seq), &seq_after) < 0) { return -1; } if (seq_after != seq_before || vgpup_seq_is_writing(seq_after)) { continue; } @@ -172,8 +176,7 @@ int vgpup_read_geometry(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, return 0; } -int vgpup_read_status(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, - vgpup_status* out) +int vgpup_read_status(vgpup_region* r, vmie_mem* m, vgpup_status* out) { vgpu_producer_t p; @@ -182,7 +185,7 @@ int vgpup_read_status(vgpup_region* r, vmie_mem* m, uintptr_t kcr3, /* Cold line: single naturally-aligned atomic fields with no seqlock. Read * the whole producer block once and pick the cold fields — "fresh enough" * by the lossy contract. */ - if (gva_read(m, kcr3, (uintptr_t)r->region_gva, &p, sizeof p) < 0) { return -1; } + if (gva_read(m, (uintptr_t)r->proc_cr3, (uintptr_t)r->region_gva, &p, sizeof p) < 0) { return -1; } out->heartbeat = p.heartbeat; out->run_epoch = p.run_epoch; diff --git a/src/perception/test/test_perception.c b/src/perception/test/test_perception.c index 986d024..8da8653 100644 --- a/src/perception/test/test_perception.c +++ b/src/perception/test/test_perception.c @@ -1,16 +1,21 @@ -/* test_perception.c — table-driven invariant predicates + flat sampling smoke. +/* test_perception.c — table-driven invariant predicates + per-cr3 user-AS scan. * - * Two layers: + * Two layers (no proc_list / win32 — that path needs a real Windows kernel + * bring-up and is covered by an out-of-tree integration run, not this unit): * 1) Invariant predicates as a TABLE of cases over a synthesized producer * block (pure, no vmie): valid / latest==NONE / torn odd seq / non-BGRA / * stride!=width*4 / dims out of range — each asserts accept-vs-reject. - * 2) Flat sampling smoke: lay out a real region per vgpu_stream.h in a memfd, - * build a minimal x86-64 identity page table (2 MiB large pages) that maps - * the region at a kernel VA, open it RO via vmie_mem_from_ro_fd, and run the - * real gva_*-driven discovery + frame/cursor/geometry/status reads and a - * two-phase heartbeat liveness check under that cr3. (cr3 0 over a flat - * image cannot translate — gva_* needs real page tables — so we synthesize - * them; this exercises the actual translation path the caller will use.) + * 2) Per-cr3 user-AS scan + sampling under a SYNTHETIC cr3: lay out a real + * region per vgpu_stream.h in a memfd, build a minimal x86-64 identity page + * table (2 MiB large pages) that maps the region at a USER VA (the region + * really lives in a producer's user-AS), open it RO via vmie_mem_from_ro_fd, + * and run vgpup_scan_user_as_for_region + a two-phase heartbeat liveness + * check, then construct a handle (proc_cr3 = synth cr3) and run the real + * frame/cursor/geometry/status reads and the control-write seam under it. + * (cr3 0 over a flat image cannot translate — gva_* needs real page tables — + * so we synthesize them; this exercises the actual translation path the + * caller will use.) The win32 proc_list wrapper is deliberately NOT exercised + * here: vgpup_scan_user_as_for_region is the pure per-cr3 core it calls. * * Exit 0 on all-pass; nonzero on the first failure. */ @@ -97,17 +102,19 @@ static void run_invariant_table(void) } } -/* ---- layer 2: flat sampling smoke over a real RO vmie_mem ----------------- */ +/* ---- layer 2: per-cr3 user-AS scan + sampling over a real RO vmie_mem ------ */ /* x86-64 paging entry flags for the synthetic identity table. */ #define PTE_P 0x1u /* present */ #define PTE_RW 0x2u /* writable */ +#define PTE_US 0x4u /* user-accessible (the region is in a user-AS) */ #define PTE_PS 0x80u /* page size (2 MiB leaf at PD level) */ #define LARGE_PAGE (2ull * 1024 * 1024) -/* Build a minimal identity page table mapping [0, span) of the image at kernel - * VA `base` using 2 MiB large pages, with the PML4/PDPT/PD pages laid out right - * after the region in the same image. Returns the cr3 (PML4 GPA). The mapped VA +/* Build a minimal identity page table mapping [0, span) of the image at user VA + * `base` using 2 MiB large pages, with the PML4/PDPT/PD pages laid out right + * after the region in the same image. Every level carries US so the run reports + * VR_W|VR_U (a real user-AS mapping). Returns the cr3 (PML4 GPA). The mapped VA * range fits one PD (covers up to 1 GiB), which is plenty for the region. */ static uint64_t build_identity_table(uint8_t* img, uint64_t region_bytes, uint64_t base, uint64_t span) @@ -124,10 +131,10 @@ static uint64_t build_identity_table(uint8_t* img, uint64_t region_bytes, uint64_t mapped = 0; unsigned k = 0; - pml4[pml4i] = pdpt_gpa | PTE_P | PTE_RW; - pdpt[pdpti] = pd_gpa | PTE_P | PTE_RW; + pml4[pml4i] = pdpt_gpa | PTE_P | PTE_RW | PTE_US; + pdpt[pdpti] = pd_gpa | PTE_P | PTE_RW | PTE_US; while (mapped < span) { - pd[pdi0 + k] = mapped | PTE_P | PTE_RW | PTE_PS; /* VA base+k*2M → GPA mapped */ + pd[pdi0 + k] = mapped | PTE_P | PTE_RW | PTE_US | PTE_PS; /* VA base+k*2M → GPA mapped */ mapped += LARGE_PAGE; ++k; } @@ -140,7 +147,9 @@ static void run_flat_smoke(void) /* region rounded up to a 2 MiB boundary for the large-page identity map */ const uint64_t mapped_span = (region_bytes + LARGE_PAGE - 1) & ~(LARGE_PAGE - 1); const size_t total_bytes = (size_t)region_bytes + 0x3000; /* + PML4/PDPT/PD */ - const uint64_t base_va = KERN_MIN; /* kernel VA */ + /* a USER VA, 2 MiB-aligned, within [USER_MIN, USER_MAX] — the region lives in + * a producer's user address space, so we map it there (not at a kernel VA). */ + const uint64_t base_va = 0x0000000010000000ull; const uint32_t w = 64, h = 32; const size_t frame_bytes = (size_t)w * h * 4u; int fd; @@ -176,13 +185,13 @@ static void run_flat_smoke(void) CHECK(m != NULL, "vmie_mem_from_ro_fd"); if (!m) { munmap(img, total_bytes); close(fd); return; } - /* discovery: candidate found at the kernel VA with hb0 == 42 */ + /* per-cr3 user-AS scan: candidate found at the user VA with hb0 == 42 */ { uint64_t rgva = 0xdead, hb0 = 0; - int rc = vgpup_discover_candidate(m, cr3, &rgva, &hb0); - CHECK(rc == 0, "discover_candidate rc"); - CHECK(rgva == base_va, "discover_candidate region gva"); - CHECK(hb0 == 42, "discover_candidate hb0"); + int rc = vgpup_scan_user_as_for_region(m, cr3, &rgva, &hb0); + CHECK(rc == 0, "scan_user_as rc"); + CHECK(rgva == base_va, "scan_user_as region gva"); + CHECK(hb0 == 42, "scan_user_as hb0"); /* two-phase liveness: not alive until heartbeat advances */ CHECK(vgpup_confirm_alive(m, cr3, rgva, hb0) == 0, "confirm not-yet-alive"); @@ -190,56 +199,55 @@ static void run_flat_smoke(void) CHECK(vgpup_confirm_alive(m, cr3, rgva, hb0) == 1, "confirm alive after tick"); } - /* open handle + read API */ + /* construct a handle directly (the proc_list/win32 path is not unit-testable; + * proc_cr3 is the synthetic cr3 here) and exercise the read API + control seam */ { - vgpup_region* r = vgpup_open(m, cr3); - CHECK(r != NULL, "vgpup_open"); - if (r) { - uint8_t* dst = malloc(frame_bytes); - vgpup_frame_info fi; - vgpup_cursor cur; - vgpup_geometry geo; - vgpup_status st; - int rc; + vgpup_region rr; + vgpup_region* r = &rr; + uint8_t* dst = malloc(frame_bytes); + vgpup_frame_info fi; + vgpup_cursor cur; + vgpup_geometry geo; + vgpup_status st; + int rc; - CHECK(dst != NULL, "malloc dst"); + memset(&rr, 0, sizeof rr); + rr.proc_cr3 = cr3; + rr.region_gva = base_va; + rr.ctrl_gva = base_va + VGPU_CONTROL_OFFSET; + rr.ring_gva = base_va + VGPU_RING_OFFSET; - rc = vgpup_sample_frame(r, m, cr3, dst, frame_bytes, &fi); - CHECK(rc == 1, "sample_frame fresh"); - if (rc == 1) { - CHECK(fi.desc.width == w && fi.desc.height == h, "sample dims"); - CHECK(fi.bytes == frame_bytes, "sample bytes"); - CHECK(dst[0] == marker && dst[frame_bytes - 1] == marker, "sample content"); - } + CHECK(dst != NULL, "malloc dst"); - /* same frame_id → no fresh frame (dedup) */ - CHECK(vgpup_sample_frame(r, m, cr3, dst, frame_bytes, &fi) == 0, "sample dedup"); - - /* too-small buffer → lossy drop (0), not error */ - CHECK(vgpup_sample_frame(r, m, cr3, dst, 1, &fi) == 0, "sample tiny-cap"); - - CHECK(vgpup_read_cursor(r, m, cr3, &cur) == 1, "read_cursor"); - CHECK(vgpup_read_geometry(r, m, cr3, &geo) == 1, "read_geometry"); - CHECK(vgpup_read_status(r, m, cr3, &st) == 0, "read_status"); - CHECK(st.status == VGPU_ST_CAPTURING, "status value"); - CHECK(st.heartbeat == 43, "status heartbeat"); - CHECK(vgpup_run_epoch(r) == st.run_epoch, "run_epoch accessor"); - - free(dst); - vgpup_close(r); + rc = vgpup_sample_frame(r, m, dst, frame_bytes, &fi); + CHECK(rc == 1, "sample_frame fresh"); + if (rc == 1) { + CHECK(fi.desc.width == w && fi.desc.height == h, "sample dims"); + CHECK(fi.bytes == frame_bytes, "sample bytes"); + CHECK(dst[0] == marker && dst[frame_bytes - 1] == marker, "sample content"); } - } - /* control-write seam: builds frame + offsets, writes nothing */ - { - vgpup_region* r = vgpup_open(m, cr3); - if (r) { + /* same frame_id → no fresh frame (dedup) */ + CHECK(vgpup_sample_frame(r, m, dst, frame_bytes, &fi) == 0, "sample dedup"); + + /* too-small buffer → lossy drop (0), not error */ + CHECK(vgpup_sample_frame(r, m, dst, 1, &fi) == 0, "sample tiny-cap"); + + CHECK(vgpup_read_cursor(r, m, &cur) == 1, "read_cursor"); + CHECK(vgpup_read_geometry(r, m, &geo) == 1, "read_geometry"); + CHECK(vgpup_read_status(r, m, &st) == 0, "read_status"); + CHECK(st.status == VGPU_ST_CAPTURING, "status value"); + CHECK(st.heartbeat == 43, "status heartbeat"); + CHECK(vgpup_run_epoch(r) == st.run_epoch, "run_epoch accessor"); + + /* control-write seam: builds frame + offsets, writes nothing */ + { vgpup_control_intent in = { VGPU_CMD_RUN, 60, 1, 7 }; vgpu_control_t frame; uint64_t ctrl_gva = 0; uint32_t off = 0, len = 0; - int rc = vgpup_build_control_write(r, &in, &frame, &ctrl_gva, &off, &len); - CHECK(rc == 0, "build_control_write rc"); + int crc = vgpup_build_control_write(r, &in, &frame, &ctrl_gva, &off, &len); + CHECK(crc == 0, "build_control_write rc"); CHECK(frame.desired_state == VGPU_CMD_RUN, "control desired_state"); CHECK(frame.target_fps == 60, "control target_fps"); CHECK(frame.full_frame_req == 7, "control full_frame_req"); @@ -248,8 +256,9 @@ static void run_flat_smoke(void) CHECK(off == offsetof(vgpu_control_t, desired_state), "control off"); CHECK(len == offsetof(vgpu_control_t, full_frame_req) + sizeof(uint32_t) - offsetof(vgpu_control_t, desired_state), "control len"); - vgpup_close(r); } + + free(dst); } vmie_mem_close(m); /* the TEST owns vmie_mem here (it is the caller) */