gsp_sema_service: add content rescue for unmapped push-buffer pool VAs

- Add expected_sem_payload tracking to svc_channel for CE channels
- Implement svc_rescue_push_page() to scan guest RAM for push with
  expected semaphore release when VA translation fails
- Add svc_init_expected_payload() to initialize expected payload from pool
- Add rate-limited logging of distinct stalled VAs (svc_log_stalled_va)
- Advance expected_sem_payload on successful push decode
- Pushes SEMA_MAP_MAX to 65536, SVC_PIN_SLOTS to 32768 for scale

1 files changed, 39 insertions, 10 deletions

diff --git a/tools/guest-diag/trkinfo.py b/tools/guest-diag/trkinfo.py
index 46b6a69..0d6d629 100644
--- a/tools/guest-diag/trkinfo.py
+++ b/tools/guest-diag/trkinfo.py
@@ -1,9 +1,9 @@
 #!/usr/bin/env python3
 # gdb script (run with: sudo gdb -p <pid> -batch -x /tmp/trkinfo.py)
-# Drills into the libcuda tracker the client spins on (the wait loop around
-# libcuda+0x23f700): dumps the tracker object at p+0x9410, the semaphore
-# object it references at +0x20, and the u32 semaphore memory that object
-# points at (+0x10), plus the VMA that memory lives in.
+# Drills into the libcuda tracker wait: dumps every wait entry, the tracker
+# objects they reference (channel/context layout at p+0x9410 with the sem
+# object at +0x9430), and the progress object at p+0x48 (size/idx/cursor and
+# the 0x38-byte slots it indexes).
 import gdb
 
 def r32(a):
@@ -66,18 +66,25 @@ if not found:
     raise SystemExit
 
 tid, pc, ctx = found
-print("SPINNER tid=%s pc=0x%x ctx=0x%x" % (tid, pc, ctx))
+print("SPINNER tid=%s pc=0x%x ctx=0x%x libbase=0x%x" % (tid, pc, ctx, base))
 count = r32(ctx + 0x10)
 ent = r64(ctx + 0x18)
 print("count=%d entries=0x%x" % (count, ent))
-n = min(count, 32)
+n = min(count, 48)
 for i in range(n):
     e = ent + i * 0x28
     typ = r32(e)
     p = r64(e + 8)
-    v = r32(e + 0x10)
+    v = r64(e + 0x10)
+    x18 = r64(e + 0x18)
+    x20 = r64(e + 0x20)
     if typ != 1:
-        print("e%d type=%d p=0x%x v=0x%x (skip)" % (i, typ, p, v))
+        print("e%d type=0x%x p=0x%x v=0x%x x18=0x%x x20=0x%x" % (i, typ, p, v, x18, x20))
+        if p:
+            try:
+                print("  obj[0:0x28]=%s" % rmem(p, 0x28).hex())
+            except Exception:
+                pass
         continue
     t = p + 0x9410
     try:
@@ -85,11 +92,12 @@ for i in range(n):
     except Exception as ex:
         print("e%d tracker unreadable: %s" % (i, ex))
         continue
+    sub = int.from_bytes(trk[0x08:0x10], "little")
     last = int.from_bytes(trk[0x10:0x18], "little")
     cur = int.from_bytes(trk[0x18:0x20], "little")
     sem = int.from_bytes(trk[0x20:0x28], "little")
-    print("e%d p=0x%x v=0x%x TRK=0x%x last=0x%x cur=0x%x sem_obj=0x%x"
-          % (i, p, v, t, last, cur, sem))
+    print("e%d p=0x%x v=0x%x TRK=0x%x sub=0x%x last=0x%x cur=0x%x sem_obj=0x%x"
+          % (i, p, v, t, sub, last, cur, sem))
     try:
         so = rmem(sem, 0x40)
         print("  sem_obj[0:0x40]=%s" % so.hex())
@@ -102,4 +110,25 @@ for i in range(n):
             print("  sem_page unreadable: %s" % ex)
     except Exception as ex:
         print("  sem_obj unreadable: %s" % ex)
+    try:
+        q = r64(p + 0x48)
+        print("  prog_obj=0x%x next=0x%x cblist=0x%x idx_u32=0x%x flags95bc=0x%x"
+              % (q, r64(p + 0x9470), r64(p + 0x9458), r32(p + 0x34), r32(p + 0x95bc)))
+        if q:
+            size = r32(q + 8)
+            idx = r32(q + 0x48)
+            cur2 = r32(q + 0x4c)
+            arr = r64(q + 0x40)
+            print("    q+8=size=%d idx=0x%x cursor=0x%x arr=0x%x" % (size, idx, cur2, arr))
+            for s in (idx, cur2):
+                if size:
+                    slot = arr + (s % size) * 0x38
+                else:
+                    slot = arr + s * 0x38
+                try:
+                    print("    slot[%d]@0x%x=%s" % (s, slot, rmem(slot, 0x38).hex()))
+                except Exception as ex:
+                    print("    slot[%d] unreadable: %s" % (s, ex))
+    except Exception as ex:
+        print("  prog unreadable: %s" % ex)
 print("DONE_TRK")
\ No newline at end of file