wall2 session 91: vkCreateInstance wall BREACHED - the event-slot pending-marker (u16@+0xe=0xffff) cleared at each +0xB33D30 retry entry passes the instance phase for the first time; client then persists in vkCreateDevice's nvidia0 poll waiting for the event-fd signal (guest dispatch gap); tools t93/t94/t96b/t97

7 files changed, 239 insertions, 0 deletions

diff --git a/tools/guest-diag/wall2/README-session77.md b/tools/guest-diag/wall2/README-session77.md
index 46d3b8a..97f9a84 100644
--- a/tools/guest-diag/wall2/README-session77.md
+++ b/tools/guest-diag/wall2/README-session77.md
@@ -506,3 +506,33 @@ exit branch 0x...ebc9 vs retry 0x...eb93 to see the pass/fail contract);
 A8/NvOgl GL-ucode wait of sessions 78/79 (its completion comes from the
 emulated GR engine path); (c) only then re-test the count-clear + single
 word nudge recipes.
+
+**8. Session 91: THE vkCreateInstance WALL BREACHED (the marker-clear recipe).**
+The client's retry loop (eglcore+0xB33D30) waits until NO event-slot entry has
+the pending marker 0xffff: per entry ptr = *(u64*)(obj+0x1428+i*8),
+cnt = *(u32*)(obj+0x22efc), the checked slot = ptr + n*0x10 (n = the call's
+esi), marker = u16@+0xe == 0xffff (or u32@+0 when (esi-0x43)<=4) via the
+check at +0xB1C750 (OR of all pending markers). The guest's event dispatch
+NEVER clears it, so the client burns its 10 s -4 timeout. PROVEN FIX:
+clear {u16@slot+0xe, u16@slot+0xc, u32@slot+0} to 0 at every hit of
++0xB33D30 (t93 single-shot; t94 auto-clearer, 4000 hits) -> the client
+passes vkCreateInstance AND device enumeration FOR THE FIRST TIME
+(`VKINSTANCE ok / VKDEVS 2 / VKPICK`, previously the 10 s -4 fired during
+this phase). t94 cleared 5+ distinct module objects (obj=0x5d67063a84a0,
+0x5d670661ad80, 0x5d670673eed0, 0x5d67067ebb50, ...) over the client's life.
+The client then sat in vkCreateDevice's poll(/dev/nvidia0, nfds=1,
+timeout=10 ms) loop at eglcore+0xA12DDF..+0xA12DE4 WITHOUT any -4 for 5+
+minutes (vs the old ~11 s death) - the longest the client has ever run.
+
+**9. The remaining gap (single): the event-fd signal.** The device-phase wait
+is a poll() on /dev/nvidia0 (fd 27) - nvidia_poll wakes only when the guest
+RM signals the client's event state; the guest consumes our POST_EVENT
+records but never performs the event signaling (session 78's "residual
+delivery gap"). Writing to /proc/PID/fd/<nvidia0> is not a signal. The
+session-84 count write (base+0x2070b7c, read 4, wrote 0, t97) did not flip
+this wait alone. NEXT: fix the host POST_EVENT -> guest dispatch association
+(gsp_rm_emulation.c r579 area: the payload fields hClient/hEvent/notifyIndex/
+data/info/status; compare against the guest's _kgspRpcPostEvent ->
+gpuNotifySubDeviceEvent expectations) so the guest signals the event and
+nvidia_poll returns POLLIN; then the same t94-pattern (or a service-side
+equivalent) durably unblocks both waits per boot.
diff --git a/tools/guest-diag/wall2/t89.py b/tools/guest-diag/wall2/t89.py
new file mode 100644
index 0000000..92c1de3
--- /dev/null
+++ b/tools/guest-diag/wall2/t89.py
@@ -0,0 +1,17 @@
+import gdb
+gr = gdb.execute
+inf = gdb.selected_inferior()
+pid = inf.pid
+base = None
+for line in open("/proc/%d/maps" % pid):
+    parts = line.split()
+    try:
+        lo, hi = [int(x,16) for x in parts[0].split('-')]
+    except Exception:
+        continue
+    if base is None and "libnvidia-eglcore" in line and int(parts[2],16) == 0:
+        base = lo
+print("BASE 0x%x" % (base or 0))
+print(gr("x/70i 0x%x" % (base + 0xB28519), to_string=True))
+print(gr("x/40i 0x%x" % (base + 0xB28560), to_string=True))
+print("T89-DONE")
diff --git a/tools/guest-diag/wall2/t93.py b/tools/guest-diag/wall2/t93.py
new file mode 100644
index 0000000..6a0c23d
--- /dev/null
+++ b/tools/guest-diag/wall2/t93.py
@@ -0,0 +1,57 @@
+import gdb
+gr = gdb.execute
+inf = gdb.selected_inferior()
+pid = inf.pid
+base = None
+for line in open("/proc/%d/maps" % pid):
+    parts = line.split()
+    try:
+        lo, hi = [int(x,16) for x in parts[0].split('-')]
+    except Exception:
+        continue
+    if base is None and "libnvidia-eglcore" in line and int(parts[2],16) == 0:
+        base = lo
+print("BASE 0x%x" % (base or 0))
+class B(gdb.Breakpoint):
+    def __init__(self):
+        super().__init__("*0x%x" % (base + 0xB33D30), internal=False)
+        self.silent = True; self.done = False
+    def stop(self):
+        if self.done:
+            return True
+        self.done = True
+        try:
+            obj = int(gdb.parse_and_eval("$rdi"))
+            n = int(gdb.parse_and_eval("$rsi"))
+            print("RETRYFN obj=0x%x n=0x%x" % (obj, n))
+            cnt = int(gdb.parse_and_eval("*(unsigned int*)0x%x" % (obj + 0x22efc)))
+            print("CNT %d" % cnt)
+            wrote = 0
+            for i in range(0, min(cnt, 32)):
+                p = int(gdb.parse_and_eval("*(unsigned long*)0x%x" % (obj + 0x1428 + i*8)))
+                if not p:
+                    continue
+                tgt = p + n * 0x10
+                try:
+                    v16 = int(gdb.parse_and_eval("*(unsigned short*)0x%x" % (tgt + 0xe)))
+                    v0 = int(gdb.parse_and_eval("*(unsigned int*)0x%x" % tgt))
+                    print("E%d ptr=0x%x tgt=0x%x w0=0x%x w16e=0x%x" % (i, p, tgt, v0, v16))
+                    if v16 == 0xffff:
+                        gr("set {unsigned short}0x%x = 0" % (tgt + 0xe))
+                        gr("set {unsigned int}0x%x = 0" % tgt)
+                        gr("set {unsigned short}0x%x = 0" % (tgt + 0xc))
+                        wrote += 1
+                except Exception as e:
+                    print("E%d fail %s" % (i, e))
+            print("CLEARED %d" % wrote)
+            gr("detach")
+        except Exception as e:
+            print("fail %s" % e)
+        return True
+try:
+    B()
+    print("BP-SET")
+    gr("continue")
+except Exception as e:
+    print("bpfail %s" % e)
+print("T92-DONE")
diff --git a/tools/guest-diag/wall2/t94.py b/tools/guest-diag/wall2/t94.py
new file mode 100644
index 0000000..0d2aa27
--- /dev/null
+++ b/tools/guest-diag/wall2/t94.py
@@ -0,0 +1,54 @@
+import gdb
+gr = gdb.execute
+inf = gdb.selected_inferior()
+pid = inf.pid
+base = None
+for line in open("/proc/%d/maps" % pid):
+    parts = line.split()
+    try:
+        lo, hi = [int(x,16) for x in parts[0].split('-')]
+    except Exception:
+        continue
+    if base is None and "libnvidia-eglcore" in line and int(parts[2],16) == 0:
+        base = lo
+print("BASE 0x%x" % (base or 0))
+state = {"hits":0, "cleared":0}
+class B(gdb.Breakpoint):
+    def __init__(self):
+        super().__init__("*0x%x" % (base + 0xB33D30), internal=False)
+        self.silent = True
+    def stop(self):
+        state["hits"] += 1
+        try:
+            obj = int(gdb.parse_and_eval("$rdi"))
+            n = int(gdb.parse_and_eval("$rsi"))
+            cnt = int(gdb.parse_and_eval("*(unsigned int*)0x%x" % (obj + 0x22efc)))
+            if state["hits"] <= 6:
+                print("HIT %d obj=0x%x n=0x%x cnt=%d" % (state["hits"], obj, n, cnt))
+            for i in range(0, min(cnt, 32)):
+                p = int(gdb.parse_and_eval("*(unsigned long*)0x%x" % (obj + 0x1428 + i*8)))
+                if not p:
+                    continue
+                tgt = p + n * 0x10
+                try:
+                    v16 = int(gdb.parse_and_eval("*(unsigned short*)0x%x" % (tgt + 0xe)))
+                    if v16 == 0xffff:
+                        gr("set {unsigned short}0x%x = 0" % (tgt + 0xe))
+                        gr("set {unsigned int}0x%x = 0" % tgt)
+                        gr("set {unsigned short}0x%x = 0" % (tgt + 0xc))
+                        state["cleared"] += 1
+                        if state["cleared"] <= 12:
+                            print("CLEAR#%d obj=0x%x n=0x%x tgt=0x%x" % (state["cleared"], obj, n, tgt))
+                except Exception as e:
+                    if state["hits"] <= 6:
+                        print("E%d fail %s" % (i, e))
+        except Exception as e:
+            if state["hits"] <= 6:
+                print("hitfail %s" % e)
+        return state["hits"] >= 4000
+try:
+    B(); print("BP-SET")
+    gr("continue")
+except Exception as e:
+    print("bpfail %s" % e)
+print("T94-DONE hits=%d cleared=%d" % (state["hits"], state["cleared"]))
diff --git a/tools/guest-diag/wall2/t95.py b/tools/guest-diag/wall2/t95.py
new file mode 100644
index 0000000..8daf6ca
--- /dev/null
+++ b/tools/guest-diag/wall2/t95.py
@@ -0,0 +1,19 @@
+import gdb
+gr = gdb.execute
+inf = gdb.selected_inferior()
+pid = inf.pid
+base = None
+for line in open("/proc/%d/maps" % pid):
+    parts = line.split()
+    try:
+        lo, hi = [int(x,16) for x in parts[0].split('-')]
+    except Exception:
+        continue
+    if base is None and "libnvidia-eglcore" in line and int(parts[2],16) == 0:
+        base = lo
+print("BASE 0x%x" % (base or 0))
+print("--- wait site +0xA12D90..:")
+print(gr("x/60i 0x%x" % (base + 0xA12D90), to_string=True))
+print("--- caller +0xD690D0..:")
+print(gr("x/40i 0x%x" % (base + 0xD690D0), to_string=True))
+print("T95-DONE")
diff --git a/tools/guest-diag/wall2/t96b.py b/tools/guest-diag/wall2/t96b.py
new file mode 100644
index 0000000..cd3b7ab
--- /dev/null
+++ b/tools/guest-diag/wall2/t96b.py
@@ -0,0 +1,40 @@
+import gdb
+gr = gdb.execute
+inf = gdb.selected_inferior()
+pid = inf.pid
+base = None
+for line in open("/proc/%d/maps" % pid):
+    parts = line.split()
+    try:
+        lo, hi = [int(x,16) for x in parts[0].split('-')]
+    except Exception:
+        continue
+    if base is None and "libnvidia-eglcore" in line and int(parts[2],16) == 0:
+        base = lo
+print("BASE 0x%x" % (base or 0))
+class B(gdb.Breakpoint):
+    def __init__(self):
+        super().__init__("*0x%x" % (base + 0xA12DDF), internal=False)
+        self.silent = True; self.done = False
+    def stop(self):
+        if self.done:
+            return True
+        self.done = True
+        try:
+            rdi = int(gdb.parse_and_eval("$rdi"))
+            rsi = int(gdb.parse_and_eval("$rsi"))
+            rdx = int(gdb.parse_and_eval("$rdx"))
+            print("POLL nfds=%d timeout=%d arr=0x%x" % (rsi, rdx, rdi))
+            fd = int(gdb.parse_and_eval("*(int*)0x%x" % rdi))
+            ev = int(gdb.parse_and_eval("*(unsigned short*)0x%x" % (rdi + 4)))
+            rv = int(gdb.parse_and_eval("*(unsigned short*)0x%x" % (rdi + 6)))
+            print("FDPOLL fd=%d events=0x%x revents=0x%x" % (fd, ev, rv))
+        except Exception as e:
+            print("fail %s" % e)
+        return True
+try:
+    B(); print("BP-SET")
+    gr("continue")
+except Exception as e:
+    print("bpfail %s" % e)
+print("T96-DONE")
diff --git a/tools/guest-diag/wall2/t97.py b/tools/guest-diag/wall2/t97.py
new file mode 100644
index 0000000..5a12348
--- /dev/null
+++ b/tools/guest-diag/wall2/t97.py
@@ -0,0 +1,22 @@
+import gdb
+gr = gdb.execute
+inf = gdb.selected_inferior()
+pid = inf.pid
+base = None
+for line in open("/proc/%d/maps" % pid):
+    parts = line.split()
+    try:
+        lo, hi = [int(x,16) for x in parts[0].split('-')]
+    except Exception:
+        continue
+    if base is None and "libnvidia-eglcore" in line and int(parts[2],16) == 0:
+        base = lo
+print("BASE 0x%x" % (base or 0))
+C = base + 0x2070b7c
+v = int(gdb.parse_and_eval("*(unsigned int*)0x%x" % C))
+print("COUNT %u" % v)
+print(gr("x/8wx 0x%x" % (C - 0x10), to_string=True))
+if v:
+    gr("set {unsigned int}0x%x = 0" % C)
+    print("WROTE 0")
+print("T97-DONE")