mirror of
https://github.com/MobileGL-Dev/MobileGL
synced 2026-11-07 18:13:23 +09:00
swung0x48
4cbf78c269
Wave 2 package X1. Three CI split-subset traces died on the Redmi under inproc and
passed under monolith on the same device and APK, on the client thread, in the
replayer's memcpy into a pointer MobileGL had handed it: SIGSEGV / SEGV_ACCERR on the
destination's FIRST byte, destination page-aligned.
The tombstone names the same address twice, in two different address spaces:
x0 b4000073ac9a5000 ... x2 0000000001800000
signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x00000073ac9a5000
x0 is the pointer the application writes through, carrying bionic's 0xb4 heap tag
(the same tombstone reports tagged_addr_ctrl PR_TAGGED_ADDR_ENABLE). fault addr is
si_addr, which the kernel reports UNTAGGED.
TrackWriteMap took shadowBase from MappedData() - a tagged heap pointer - kept the tag
through the page masking, mprotect()ed the mapped range PROT_READ and published the
TAGGED base/end into the slot. The handler compared si_addr against it:
if (base <= kSlotSettingUp || address < base) continue;
0x73ac9a5000 < 0xb4000073ac9a5000 is true for every fault, forever. Ownership test (2)
never matched, and every fault on a page the tracker had itself protected was chained
to debuggerd. mprotect was fine throughout - do_mprotect_pkey untags its own argument -
so the right pages really were read-only; only the recognition was broken. x86-64 has
no top-byte tag, which is why every host lane has always been green.
The fix is two rows and one ordering:
* UntagAddress(), applied to the shadow base at registration, to the shadow base in
PushBlocksFor (so trackedBase - shadowBase stays in one space) and to si_addr in
the handler. Written WITHOUT an #if defined(__aarch64__): masking bits 56-63 is
the identity for every valid userspace address off arm64, and an arch guard would
have put the only gate that can catch this on the one platform CI never runs.
Dereferences keep the tagged pointer they came from.
* SlotOwnsFault(), the ownership row the handler and the unit case both read.
* REGISTRATION ARMS NOTHING. AcquireMemoryRange registered and only then returned
Bytes() + range.start, so glMapBufferRange handed the application a PROT_READ
pointer whose writability depended on a handler reaching the writing thread - and
the application is free to write a mapped arena from a worker that blocks every
signal. Nothing is lost by waiting: every page bit is already set at registration,
so the first push ships the whole interior regardless, and it is that push which
arms the pages. 6144 pointless faults per 24 MB arena go with it, and the
invariant the file rests on (bit set <=> page writable) is now true from
registration onward instead of only from the first push.
Diagnostic, independent of the fix: one MGLOG_I_ONCE at the first registration naming
the mapping the way the device run needed and did not have (allocator, pointer, ITS
TAG, extent, range, published span, pages, alignment arm), and a decline record in the
handler - relaxed atomic stores plus one async-signal-safe write(2) - readable through
DeclinedFaults(). A non-zero decline count whose si_addr lies inside nearest-tracked
once the top byte is masked off is this defect's signature and nothing else's.
Not the mechanism, and checked: libsigchain (the tombstone's "F libc : Fatal signal 11"
is bionic's own handler, so the chain ran), the 16 KiB-page refusal (the device is a
4 KiB kernel and the protection demonstrably took), RefaultOfANonWriteAccess (matched
is false long before it is consulted), and the P5d shadow allocator (correct - it is
what makes the destination page-aligned in the tombstone).
Red-once, two and orthogonal (MG_Test/Wire/PersistentMapFaultTest.cpp, 6 cases):
dropping the two UntagAddress calls in SlotOwnsFault reds only
AKernelsUntaggedFaultAddressIsOwnedByATaggedShadowsSlot, which runs the device's own
two addresses through the real predicate on an x86-64 host; restoring the mprotect at
the end of TrackWriteMap reds only AMapHandsBackARangeWritableWithoutTheFaultHandler
(the child dies by SIGSEGV) and RegistrationLeavesEveryPageOfTheRangeReadWrite.
AnArmedPageIsStillAnsweredByTheHandlerAndMadeWritable is the anti-vacuity case.
Gates: ctest -L unit 2408/2408; integration-split 186/186; integration-spawn 102/102;
integration-magma-split 73/73 (PersistentCoherentMapScenario green in the Split, Spawn,
PersistentMapArm and SmallRing variants); fatal_census.py 0 unmarked. G1 holds - pull
.text 10822147 = 0xa52203 unchanged, symbol report 0 added / 0 removed / 0 resized /
0 renamed, nm --defined-only identical at 30570 and nm -D at 11933. Every line is under
MOBILEGL_BUILD_DISAGGREGATED (CMakeLists.txt:592-659), so the pull build sees none of it.
Evidence and the device experiment: docs/Disaggregated/notes/p7/x1-persistent-map-segv.md
工作笔记（原 ~/w7/notes/）
这一层是 MGPipe 各阶段的工作笔记原件：包计划（BRIEF-*.md）、契约草稿、集成者逐条裁定
（INTEGRATOR-DECISIONS-*.md）、只读审计、普查、设备记录、包任务书（TASK-*.md）与阶段报告。
它们此前只存在于一台机器的 ~/w7/notes/ 下。上层那几份文档（ROADMAP.md、
CURRENT_STAGE_PROGRESS.md、MEASUREMENTS.md …）大量引用它们——裁定编号、审计行号、
逐门数字的出处几乎全在这里。一份引用了几百次、却只存在于本地未跟踪目录的记录，等于没有记录。
所以整体移进仓库。
路径映射
~/w7/notes/<phase>/<file>.md → docs/Disaggregated/notes/<phase>/<file>.md
上层文档里凡写作 ~/w7/notes/... 的 .md 引用，都按这条规则读。
移进来的是什么，没移的是什么
| 移进来了 | 全部 .md，415 份，约 11 MB，目录结构原样保留 |
| 没有移 | 脚本（.sh / .py）、运行日志（.log / .out / .err）、普查与门的结果数据（.json / .txt / .tsv）、补丁、APK 与 .idsig、nm 转储 |
没移的那些仍在 ~/w7/notes/ 与各构建树下。它们是证据数据而不是文档：体积大、随每次运行
重新产生、且多数只在产生它的那台机器上有意义（绝对路径、设备序列号、构建目录）。上层文档引用
它们时给的是路径，不是内容。
两个需要知道的例外
- P6 的包计划已提升为正式文档：原
~/w7/notes/p6/BRIEF-P6.md现在是../P6-SPAWN-PLAN.md，本目录不再保留副本，避免两份同源文档各自漂移。 契约草稿同理，见../P6-CONTRACT-DRAFT.md。 recovered/是从失败的 workflow 运行里捞回来的材料（wf1…wf5），与同名阶段目录 可能重复，保留是因为其中几份是当时唯一的完整版本。查阶段记录请先看阶段目录。
不受 citation lint 管
CI 的文档引用 lint 只吃 docs/Disaggregated/*.md（非递归，.github/workflows/test.yml），
本目录不在其中，这是有意的：这些笔记的 file:line 是写在各自当时的代码头上的，拿今天的
HEAD 去解析必然大面积失败，而那不是错误——那是它们作为历史记录的正确状态。要核对某份笔记的
引用，用它自己声明的那个 revision：
python3 scripts/check_doc_citations.py --rev <当时的头> docs/Disaggregated/notes/<phase>/<file>.md