vgsp-rm r680 + wall-2 session-76 forensics: 0x2080a097 reply record-area tunables (wall2_a097_count/rec0..rec7, default 0xffffffff = echo) and the evidence set that re-questions the a097 gate

The real host RM 0x2080a097 handler (GSP-RM 570.144 control table entry,
params 0x490) overwrites params+4..+0x23 with up to four {u32,u32}
mode pairs (engine value + a x1000 clock/percent) and the client copies
back the first 16 bytes; the tick at eglcore 0xd5e3e0 consumes the
second word of the first pair as the per-engine progress (session
+0xe104, compared against per-boot config threshold 95 at
lib+0x2019320+0xffc with 10/20 bit-history cutoffs). New module params
let one boot sweep the record matrix; the r680 sweep (flag/v488/v48c +
count/rec matrix incl. progress 100..1000000) changed nothing
observable, and hw watchpoints show E+0x150 stays 0x00200000 with no
writer over 5+ minutes while the a097 poller is a worker thread and
the main thread sits in a 10 s poll() loop on /dev/nvidia0 inside
vkCreateDevice. Tools: t75g.py (in-guest gdb state/watch probes),
diag76.py (thread bt + address resolution), slots_probe.sh, run75g.sh;
README-session76.md records the firmware handler decode and the sweep.

1 files changed, 47 insertions, 0 deletions

diff --git a/tools/guest-diag/wall2/diag76.py b/tools/guest-diag/wall2/diag76.py
new file mode 100644
index 0000000..989abd3
--- /dev/null
+++ b/tools/guest-diag/wall2/diag76.py
@@ -0,0 +1,47 @@
+import gdb
+
+inf = gdb.selected_inferior()
+pid = inf.pid
+maps = []
+for line in open("/proc/%d/maps" % pid):
+    parts = line.split()
+    try:
+        lo, hi = [int(x, 16) for x in parts[0].split('-')]
+        off = int(parts[2], 16)
+        maps.append((lo, hi, off, parts[5] if len(parts) > 5 else ""))
+    except Exception:
+        pass
+
+def resolve(addr):
+    for lo, hi, off, name in maps:
+        if lo <= addr < hi:
+            return "%s+0x%x" % (name.split('/')[-1], off + (addr - lo))
+    return "?"
+
+gdb.execute("set pagination off")
+print("=== THREADS ===")
+for t in inf.threads():
+    try:
+        t.switch()
+    except Exception as e:
+        print("switch err", e)
+        continue
+    pc = int(gdb.parse_and_eval("$pc"))
+    print("TID %s pc=%s" % (t.ptid, resolve(pc)))
+    try:
+        bt = gdb.execute("bt 12", to_string=True)
+    except Exception as e:
+        bt = "bt err %s" % e
+    for ln in bt.splitlines():
+        ln = ln.strip()
+        if ln.startswith("#"):
+            try:
+                a = int(ln.split()[1], 16)
+                print("   ", ln, "=>", resolve(a))
+            except Exception:
+                print("   ", ln)
+        else:
+            print("   ", ln)
+print("DIAG-DONE")
+gdb.execute("detach")
+gdb.execute("quit")