tools: durable guest counter enumeration/injection and VA reader

The counter enumeration/injection workflow lived in the guest's /tmp and was
lost on every restart. Make it durable under tools/guest-diag:

- sem_counters.py: translate a process's per-channel u32 completion counters
  (16-byte stride in the /dev/nvidiactl counter page) to guest PAs through
  /proc/<pid>/pagemap; --pairs emits handle,va,pa triples.
- sem_slots.py: read/write the counter slots via /proc/<pid>/mem (fallback
  for the host counter publish).
- read_va.py: hex dump a process VA (UVM sysmem GPU VAs are usually valid
  CPU VAs in the owning process); --u32 for method streams.
- inject_counters.sh: host-side one-shot: push the tool, take the GR handles
  from the live chan_dump, enumerate, then register each counter with
  sema_counter and pin its VA with sema_map_add.
- push_guest_tools.sh: push the new tools after every VM start.
- launch_qemu_direct.sh: parameterized mdev UUID/paths instead of a stale
  hardcoded one; committed so it survives checkouts.

5 files changed, 273 insertions, 0 deletions

diff --git a/tools/guest-diag/inject_counters.sh b/tools/guest-diag/inject_counters.sh
new file mode 100755
index 0000000..a2a8371
--- /dev/null
+++ b/tools/guest-diag/inject_counters.sh
@@ -0,0 +1,68 @@
+#!/bin/bash
+# inject_counters.sh - register the running CUDA client's per-channel GPU
+# completion counters with the host sema service (the PART 45/46 manual
+# procedure, made durable). The service then publishes each GR channel's
+# consumed GPFIFO count into the client's counter, which is the completion
+# signal its trackers poll.
+#
+# Usage: tools/guest-diag/inject_counters.sh [guest-pid] [page-va] [count]
+#   guest-pid  default: pgrep -x cdt in the guest
+#   page-va    default: 0x20400f000 (observed counter page VA)
+#   count      default: 20 (one per GR channel)
+#
+# Handle order: GR channels (eng=0) from the host channel dump, ascending, are
+# zipped with ascending counter index (the observed 1:1 layout). Override the
+# list with GRS="0x...,0x...,...".
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+VMEXEC="$HERE/../../scripts/vgpu_vm.py"
+PARAM=/sys/module/open_iov_vfio/parameters
+
+PID="${1:-}"
+PAGE_VA="${2:-0x20400f000}"
+COUNT="${3:-20}"
+
+if [ -z "$PID" ]; then
+    PID=$(timeout 20 "$VMEXEC" exec "pgrep -x cdt" 2>/dev/null \
+        | grep -E '^[0-9]+$' | head -1 || true)
+fi
+if [ -z "$PID" ]; then
+    echo "ERROR: no cdt pid in the guest (pass one: $0 <pid> [page-va] [count])" >&2
+    exit 1
+fi
+
+# Push the enumeration tool (the guest's /tmp is wiped on boot).
+b64=$(base64 -w0 "$HERE/sem_counters.py")
+timeout 30 "$VMEXEC" exec "echo '$b64' | base64 -d > /tmp/sem_counters.py" >/dev/null
+
+# Channel handles: GR channels from the live channel dump, ascending.
+if [ -z "${GRS:-}" ]; then
+    echo 1 | sudo tee "$PARAM/chan_dump" >/dev/null
+    sleep 1
+    GRS=$(sudo dmesg | grep -o 'sema-chan-dump: h=0x[0-9a-f]* eng=0' \
+        | grep -o '0x[0-9a-f]*' | sort -u | paste -sd,)
+fi
+if [ -z "$GRS" ]; then
+    echo "ERROR: no GR channel handles (chan_dump empty; is a VM attached?)" >&2
+    exit 1
+fi
+
+PAIRS=$(timeout 30 "$VMEXEC" exec \
+    "python3 /tmp/sem_counters.py $PID $PAGE_VA --count=$COUNT --pairs $GRS" \
+    2>/dev/null | grep -E '^0x[0-9a-f]+,0x[0-9a-f]+,[0-9]+$')
+if [ -z "$PAIRS" ]; then
+    echo "ERROR: enumeration returned no pairs (pagemap access?)" >&2
+    exit 1
+fi
+
+while IFS=, read -r h va pa; do
+    # printf: sysfs writes carry a trailing newline that kstrtoull tolerates
+    # for both fields; use it anyway (no newline is also fine).
+    printf '%s,%s' "$h" "$pa" | sudo tee "$PARAM/sema_counter" >/dev/null
+    # Pin the counter VA->PA too: a push that releases the counter then
+    # resolves and applies through the normal release path, and pins survive
+    # the periodic map rebuilds.
+    printf '%s,%s' "$va" "$pa" | sudo tee "$PARAM/sema_map_add" >/dev/null
+    echo "registered h=$h counter va=$va pa=$pa"
+done <<< "$PAIRS"
diff --git a/tools/guest-diag/push_guest_tools.sh b/tools/guest-diag/push_guest_tools.sh
index 607cce4..42b91ae 100755
--- a/tools/guest-diag/push_guest_tools.sh
+++ b/tools/guest-diag/push_guest_tools.sh
@@ -27,6 +27,10 @@ push_b64 "$REPO/tools/test/cuda_drv_test.c" /tmp/cdt.c
 push_b64 "$HERE/dumpctx.py"     /tmp/dumpctx.py
 push_b64 "$HERE/trkinfo.py"     /tmp/trkinfo.py
 push_b64 "$HERE/bp999.py"       /tmp/bp999.py
+push_b64 "$HERE/sem_counters.py" /tmp/sem_counters.py
+push_b64 "$HERE/sem_slots.py"   /tmp/sem_slots.py
+push_b64 "$HERE/read_va.py"     /tmp/read_va.py
+push_b64 "$HERE/guest_pmap.py"  /tmp/guest_pmap.py
 
 echo "[*] compiling in guest..."
 "$VMEXEC" exec "gcc -O1 -w -o /tmp/ptio /tmp/ptio.c && \
diff --git a/tools/guest-diag/read_va.py b/tools/guest-diag/read_va.py
new file mode 100755
index 0000000..fca3994
--- /dev/null
+++ b/tools/guest-diag/read_va.py
@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+# read_va.py - dump a guest process's memory at a VA (GPU VAs of UVM sysmem
+# objects are usually also valid CPU VAs in the owning process).
+#
+# Usage:
+#   sudo python3 read_va.py <pid> <va-hex> [len] [--u32]
+#
+# --u32 prints one little-endian u32 per line (method-stream friendly).
+import os
+import sys
+
+
+def main():
+    if len(sys.argv) < 3:
+        print(__doc__)
+        return 1
+    pid = int(sys.argv[1])
+    va = int(sys.argv[2], 16)
+    ln = 256
+    as_u32 = False
+    for a in sys.argv[3:]:
+        if a == '--u32':
+            as_u32 = True
+        else:
+            ln = int(a, 0)
+
+    found = False
+    with open('/proc/%d/maps' % pid) as f:
+        for line in f:
+            rng = line.split()[0]
+            a, b = rng.split('-')
+            if int(a, 16) <= va < int(b, 16):
+                print('MAP: %s' % line.strip())
+                found = True
+                break
+    if not found:
+        print('VA 0x%x not in maps' % va)
+
+    mem = os.open('/proc/%d/mem' % pid, os.O_RDONLY)
+    try:
+        data = os.pread(mem, ln, va)
+    except OSError as e:
+        print('read error: %s' % e)
+        return 1
+    finally:
+        os.close(mem)
+
+    if as_u32:
+        for i in range(0, len(data) - 3, 4):
+            print('+0x%03x: 0x%08x' %
+                  (i, int.from_bytes(data[i:i + 4], 'little')))
+    else:
+        for i in range(0, len(data), 16):
+            chunk = data[i:i + 16]
+            hexs = ' '.join('%02x' % b for b in chunk)
+            print('+0x%03x: %s' % (i, hexs))
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/tools/guest-diag/sem_counters.py b/tools/guest-diag/sem_counters.py
new file mode 100755
index 0000000..66af258
--- /dev/null
+++ b/tools/guest-diag/sem_counters.py
@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+# sem_counters.py - enumerate a guest process's per-channel GPU completion
+# counters (the u32 slots the client polls to observe push completion).
+#
+# The counters live in one sysmem page mapped through /dev/nvidiactl (rw-s);
+# each channel owns a 16-byte-strided u32 in it (observed layout: 20 counters
+# at page offset 0xec0, one per GR channel). This translates the slots to
+# guest PAs through /proc/<pid>/pagemap so the host side can register them
+# with the sema_counter module parameter.
+#
+# Usage:
+#   sudo python3 sem_counters.py <pid> <page-va> [count] [stride]
+#   sudo python3 sem_counters.py <pid> <page-va> --pairs <h1,h2,...>
+#
+# --pairs zips the given channel handles with the counter indices in order
+# (ascending handle = ascending counter index, the observed layout) and
+# prints "<handle>,<va>,<pa>" lines: handle/pa for the sema_counter parameter,
+# va/pa for the sema_map_add pin so pushes releasing the counter resolve.
+#
+# Needs root in the guest (pagemap reads). Uses only os/sys.
+import os
+import sys
+
+
+def parse_args(argv):
+    pid = int(argv[0])
+    page_va = int(argv[1], 16)
+    count = 20
+    stride = 16
+    offset = 0xec0
+    handles = None
+    rest = argv[2:]
+    i = 0
+    while i < len(rest):
+        a = rest[i]
+        if a == '--pairs':
+            handles = [int(x, 16) for x in rest[i + 1].split(',') if x]
+            i += 2
+            continue
+        if a.startswith('--count='):
+            count = int(a.split('=', 1)[1], 0)
+        elif a.startswith('--stride='):
+            stride = int(a.split('=', 1)[1], 0)
+        elif a.startswith('--offset='):
+            offset = int(a.split('=', 1)[1], 0)
+        elif i == 0:
+            count = int(a, 0)
+        elif i == 1:
+            stride = int(a, 0)
+        i += 1
+    return pid, page_va, count, stride, offset, handles
+
+
+def main():
+    pid, page_va, count, stride, offset, handles = parse_args(sys.argv[1:])
+
+    fd = os.open('/proc/%d/pagemap' % pid, os.O_RDONLY)
+    try:
+        pas = []
+        for i in range(count):
+            va = page_va + offset + i * stride
+            os.lseek(fd, (va // 4096) * 8, 0)
+            e = int.from_bytes(os.read(fd, 8), 'little')
+            present = (e >> 63) & 1
+            pfn = e & ((1 << 55) - 1)
+            pa = (pfn << 12) | (va & 0xfff)
+            pas.append((va, present, pa))
+    finally:
+        os.close(fd)
+
+    if handles is not None:
+        if len(handles) != len(pas):
+            print('ERROR: %d handles but %d counters' %
+                  (len(handles), len(pas)), file=sys.stderr)
+            return 1
+        for h, (va, present, pa) in zip(handles, pas):
+            if not present:
+                print('ERROR: VA=0x%x not present for handle 0x%x' %
+                      (va, h), file=sys.stderr)
+                return 1
+            print('0x%x,0x%x,%d' % (h, va, pa))
+    else:
+        for i, (va, present, pa) in enumerate(pas):
+            print('idx=%d VA=0x%x present=%d PA=0x%x' %
+                  (i, va, present, pa))
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/tools/guest-diag/sem_slots.py b/tools/guest-diag/sem_slots.py
new file mode 100755
index 0000000..70d184c
--- /dev/null
+++ b/tools/guest-diag/sem_slots.py
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+# sem_slots.py - read or write the per-channel u32 completion counters of a
+# guest process (verification and fallback for the host's counter publish).
+#
+# Usage:
+#   sudo python3 sem_slots.py <pid> <first-va> [count]              # read
+#   sudo python3 sem_slots.py <pid> <first-va> [count] --write <v>  # write
+#
+# The slots are 16 bytes apart (one u32 per channel). Reading needs pagemap/
+# mem access as root; writing uses /proc/<pid>/mem and mirrors the gdb poke
+# used in earlier sessions (e.g. --write 1 to arm every waiter).
+import os
+import sys
+
+
+def main():
+    if len(sys.argv) < 3:
+        print(__doc__)
+        return 1
+    pid = int(sys.argv[1])
+    first = int(sys.argv[2], 16)
+    count = 20
+    write_val = None
+    i = 3
+    while i < len(sys.argv):
+        if sys.argv[i] == '--write':
+            write_val = int(sys.argv[i + 1], 0)
+            i += 2
+            continue
+        count = int(sys.argv[i], 0)
+        i += 1
+
+    flags = os.O_RDWR if write_val is not None else os.O_RDONLY
+    mem = os.open('/proc/%d/mem' % pid, flags)
+    try:
+        for n in range(count):
+            va = first + n * 16
+            if write_val is not None:
+                os.pwrite(mem, write_val.to_bytes(4, 'little'), va)
+                print('idx=%d VA=0x%x written=%u' % (n, va, write_val))
+            else:
+                v = int.from_bytes(os.pread(mem, 4, va), 'little')
+                print('idx=%d VA=0x%x val=%u' % (n, va, v))
+    finally:
+        os.close(mem)
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())