wall2 session 114: the COMPR+2MB VidHeap class (attr&0xF000==0x2000, owner 0x474C0000) is the last allocation gate - a live attr flip (COMPR_ANY->NONE at the ioctl) lets vkAllocateMemory through and the client runs the whole pipeline to the FIRST vkQueueSubmit, then times out on the FIRST fence (30 s, the new wall); the zero-touch create recipe is BC (eglcore+0xB33D30 marker clears) + BW (eglcore+0xDCEBD9 device wait-word chaser, the missing piece) + the a8clear count gate; the fence release (push-page readability/completion after the submit) is the only remaining gate to VKFRAME

1 files changed, 52 insertions, 0 deletions

diff --git a/tools/guest-diag/wall2/a8clear.py b/tools/guest-diag/wall2/a8clear.py
new file mode 100644
index 0000000..261312a
--- /dev/null
+++ b/tools/guest-diag/wall2/a8clear.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+# a8clear.py - no-ptrace A8/NvOgl count clearer: finds each live vk_frame's
+# libnvidia-eglcore base (the off==0 mapping) and writes 0 to the u32 at
+# base+0x2070b7c whenever it is nonzero (the count gate t91 cleared via gdb).
+import os, subprocess, sys, time
+DUR = float(sys.argv[1]) if len(sys.argv) > 1 else 600
+def pids():
+    try:
+        out = subprocess.run(["pgrep", "-x", "vk_frame"], capture_output=True).stdout
+        return [int(x) for x in out.split()]
+    except Exception:
+        return []
+log = set()
+end = time.time() + DUR
+while time.time() < end:
+    for pid in pids():
+        base = None
+        try:
+            for line in open("/proc/%d/maps" % pid):
+                p = line.split()
+                if len(p) < 6 or "libnvidia-eglcore" not in p[-1]:
+                    continue
+                try:
+                    off = int(p[2], 16)
+                except Exception:
+                    continue
+                if off == 0:
+                    base = int(p[0].split("-")[0], 16)
+                    break
+        except Exception:
+            continue
+        if not base:
+            continue
+        w = base + 0x2070b7c
+        try:
+            fd = os.open("/proc/%d/mem" % pid, os.O_RDWR)
+            os.lseek(fd, w, 0)
+            v = os.read(fd, 4)
+            if len(v) == 4:
+                n = int.from_bytes(v, "little")
+                if n:
+                    os.lseek(fd, w, 0)
+                    os.write(fd, b"\x00\x00\x00\x00")
+                    k = (pid, n)
+                    if len(log) < 40:
+                        log.add(k)
+                        print("A8CLEAR pid=%d count=%u -> 0" % (pid, n), flush=True)
+            os.close(fd)
+        except Exception:
+            pass
+    time.sleep(0.5)
+print("A8CLEAR-DONE", flush=True)