wall-2 session-86: the DEVICE_LOCAL -2 wall CRACKED - the 512 MiB emulated VRAM was the gate (the ICD hooks captured ALLOC size=0x4000 typeIndex=1 valid; vk_memprops shows device-local heap[0]=512 MiB); the nvidia-nvidia-vgpu-turing-2g mdev type (2 GiB heap, VGPU_MDEV_TYPE env var honoured by start_vm_keep.sh) lets the same client with the same recipe proceed past vkAllocateMemory into a deeper wait (os_schedule, no -2); remaining: the later pushes at va=+0x52d4/+0x586c read pa=0x0 (window page list scattered; injections covered page 1 only) - extend the window injections; tools: vk_memprops.py, vk_alloc_test.py (hits -4 without the harness), t91.py

1 files changed, 27 insertions, 0 deletions

diff --git a/tools/guest-diag/wall2/README-session77.md b/tools/guest-diag/wall2/README-session77.md
index e2ad7eb..06dc2f2 100644
--- a/tools/guest-diag/wall2/README-session77.md
+++ b/tools/guest-diag/wall2/README-session77.md
@@ -288,3 +288,30 @@
 * Recipe for the next run: slotfill + word nudge -> VKDEVICE ok; then
   write 0 to lib_base+0x2070b7c (gdb; the harness) once the NvOgl wait
   starts (the A8 loop's count gate); then the memory-alloc wall.
+
+## ADDENDUM (r689, session 86) — **THE DEVICE_LOCAL -2 WALL CRACKED**: the 512 MiB emulated VRAM was the gate; the "nvidia-nvidia-vgpu-turing-2g" mdev type (2 GiB) lets the allocation proceed
+
+* Evidence chain: the ICD hooks (t91.py) captured the client's allocation
+  `ALLOC sType=5 size=0x4000 typeIndex=1` (a valid 16 KB DEVICE_LOCAL
+  request); the standalone memory-properties dump (vk_memprops.py)
+  showed device-local heap[0] = 512 MiB with a separate 2936 MiB
+  non-local heap. With 512 MiB the driver failed the allocation
+  (VK_ERROR_OUT_OF_DEVICE_MEMORY, no RM RPC).
+* **FIX TESTED**: the cycle with `VGPU_MDEV_TYPE=nvidia-nvidia-vgpu-turing-2g`
+  (start_vm_keep.sh honours the env var) -> `heap[0] size=0x80000000
+  (2048 MiB)` (vk_memprops.py) -> the SAME client with the SAME recipe
+  (slotfill + word nudge + count auto-clear) reaches `VKDEVICE ok` and
+  the allocation NO LONGER fails -2: the client proceeds into
+  `os_schedule` (a deeper wait).
+* REMAINING in the new state: the client's later pushes (va=0x44852d4 /
+  0x4ca52d4, then +0x586c) extend beyond the first window page and read
+  `pa=0x0`/zeros (the sema injections covered page 1 only; the window's
+  page list is scattered - the memdesc carries only the FIRST page).
+  NEXT: extend the window injections to the full scattered page list
+  (from the memdesc's page array) or accept 1-page pushes; then the
+  allocation completes and the client proceeds to the buffer/pipeline.
+* Tools: vk_memprops.py (standalone memory-properties dump; safe
+  alongside other clients), vk_alloc_test.py (standalone allocation
+  reproducer - NOTE: it hits vkCreateDevice -4 without the harness
+  (word nudge + count clear), so it cannot replace the vk_frame run),
+  t91.py (auto-clear + ICD memprops/alloc hooks).