4 files changed, 166 insertions, 0 deletions
diff --git a/tools/guest-diag/wall2/README-session77.md b/tools/guest-diag/wall2/README-session77.md
index f45dd70..03b0099 100644
--- a/tools/guest-diag/wall2/README-session77.md
+++ b/tools/guest-diag/wall2/README-session77.md
@@ -573,3 +573,35 @@ into the "durable harness bundle": marker-clean + word-chase + count-clear
 + (once VKFRAME) the release/alloc phases. (3) The bNotifyList=1
 (gsp_rm_ev_nlist) path stays armed for the event-signal experiment;
 post/EVPOST logging re-budgeted (gsp_rm_ev_log=2000 set).
+
+**13. Session 93: THE ZERO-PTRACE PIPELINE (r693) - VKDEVICE with no gdb-wedge risk.**
+Split the harness by risk: (a) ONE gdb (t101.py) for the INSTANCE-phase
+marker clears only (base+0xB33D30 handler, clears u16@+0xe/+0xc and u32@+0
+of each entry; self-disables after 24 clears; NO other BPs so it cannot
+fire constantly); (b) the WAIT WORDS handled by /tmp/unwait.py - a guest
+python poller with ZERO ptrace that scans the newest vk_frame's rw-s
+nvidia mappings of exactly 0x4000 bytes and writes 1 to any zero u32 at
+mapping+0x80 via /proc/PID/mem (the session-77 geometry, confirmed by t79
+chains: word = the +0x80 of a 16 KB rw-s nvidiactl mapping). Result on
+fresh r693 (mdev 261980af): t101 CLEAR#1..#5 then idle; unwait wrote FIVE
+wait words (0x7876ead57080, 0x7876f1816080, 0x7876ea47f080,
+0x7876ea81a080, 0x7876ead51080); client reached `VKINSTANCE ok / VKDEVS 2
+/ VKPICK / VKDEVICE ok family=0` with NO wedge exposure. live_walk (PT-walk
+injector) ran alongside. The client then sat in the post-device wait that
+the +0x80 poller does not cover (t102.py = the one-shot safe diagnostic:
+attach -> print PC/base/A8-count(base+0x2070b7c)/bt -> detach, NO continue
+and NO breakpoints - use it when the slot is free).
+
+**14. THE RM-LOCK WEDGE ROOT CAUSE + RULE.** A gdb killed (SIGTERM) while
+the tracee sits AT a breakpoint leaves the tracee STOPPED; if that stop is
+inside an RM api critical section (the rwlock held across an RM call!), the
+RM write lock stays held and EVERY other client blocks in
+os_acquire_rwlock_write (state D) - observed directly: old client 1725
+stopped by its wedged t99 gdb -> new client 7967 hung `state=D wchan=
+os_acquire_rwlock_write` on ioctl 0xc020462b; killing the gdb + `kill -CONT`
+resumed 1725 out of the ptrace stop but it resumed INSIDE the same RM wait,
+so the lock stayed held until the VM was cycled. RULES: never let a gdb
+timeout fire while a tracee is at a frequent-firing BP; prefer BPs that
+fire once or self-disable; prefer no-ptrace pollers for anything with a
+repeating pattern; the safe diagnostic is attach -> read -> detach without
+continue.
diff --git a/tools/guest-diag/wall2/t101.py b/tools/guest-diag/wall2/t101.py
new file mode 100644
index 0000000..436c609
--- /dev/null
+++ b/tools/guest-diag/wall2/t101.py
@@ -0,0 +1,55 @@
+import gdb
+gr = gdb.execute
+inf = gdb.selected_inferior()
+pid = inf.pid
+base = None
+for line in open("/proc/%d/maps" % pid):
+    parts = line.split()
+    try:
+        lo, hi = [int(x,16) for x in parts[0].split('-')]
+    except Exception:
+        continue
+    if base is None and "libnvidia-eglcore" in line and int(parts[2],16) == 0:
+        base = lo
+print("BASE 0x%x PID %d" % (base or 0, pid))
+def u64(a): return int(gdb.parse_and_eval("*(unsigned long*)0x%x" % a))
+def u32(a): return int(gdb.parse_and_eval("*(unsigned int*)0x%x" % a))
+state = {"chits":0, "cleared":0}
+class BC(gdb.Breakpoint):
+    def __init__(self):
+        super().__init__("*0x%x" % (base + 0xB33D30), internal=False)
+        self.silent = True
+    def stop(self):
+        state["chits"] += 1
+        try:
+            obj = int(gdb.parse_and_eval("$rdi"))
+            n = int(gdb.parse_and_eval("$rsi"))
+            cnt = u32(obj + 0x22efc)
+            for i in range(0, min(cnt, 32)):
+                p = u64(obj + 0x1428 + i*8)
+                if not p:
+                    continue
+                tgt = p + n * 0x10
+                try:
+                    v16 = int(gdb.parse_and_eval("*(unsigned short*)0x%x" % (tgt + 0xe)))
+                    if v16 == 0xffff:
+                        gr("set {unsigned short}0x%x = 0" % (tgt + 0xe))
+                        gr("set {unsigned int}0x%x = 0" % tgt)
+                        gr("set {unsigned short}0x%x = 0" % (tgt + 0xc))
+                        state["cleared"] += 1
+                        print("CLEAR#%d obj=0x%x n=0x%x tgt=0x%x" % (state["cleared"], obj, n, tgt), flush=True)
+                except Exception:
+                    pass
+        except Exception as e:
+            if state["chits"] <= 4:
+                print("chitfail %s" % e, flush=True)
+        if state["cleared"] >= 24:
+            self.enabled = False
+            print("BC-DISABLED", flush=True)
+        return False
+try:
+    BC(); print("BPS-SET", flush=True)
+    gr("continue")
+except Exception as e:
+    print("bpfail %s" % e, flush=True)
+print("T101-DONE chits=%d cleared=%d" % (state["chits"], state["cleared"]), flush=True)
diff --git a/tools/guest-diag/wall2/t102.py b/tools/guest-diag/wall2/t102.py
new file mode 100644
index 0000000..759d974
--- /dev/null
+++ b/tools/guest-diag/wall2/t102.py
@@ -0,0 +1,31 @@
+import gdb
+gr = gdb.execute
+inf = gdb.selected_inferior()
+pid = inf.pid
+base = None
+for line in open("/proc/%d/maps" % pid):
+    parts = line.split()
+    try:
+        lo, hi = [int(x,16) for x in parts[0].split('-')]
+    except Exception:
+        continue
+    if base is None and "libnvidia-eglcore" in line and int(parts[2],16) == 0:
+        base = lo
+print("BASE 0x%x PID %d" % (base or 0, pid))
+try:
+    pc = int(gdb.parse_and_eval("$pc"))
+    print("PC 0x%x off=0x%x" % (pc, pc - base if base else 0))
+except Exception as e:
+    print("pcfail %s" % e)
+try:
+    C = base + 0x2070B7C
+    print("A8COUNT %u" % int(gdb.parse_and_eval("*(unsigned int*)0x%x" % C)))
+except Exception as e:
+    print("countfail %s" % e)
+try:
+    print(gr("bt 6", to_string=True))
+except Exception as e:
+    print("btfail %s" % e)
+gr("detach")
+gr("quit")
+print("T102-DONE")
diff --git a/tools/guest-diag/wall2/unwait.py b/tools/guest-diag/wall2/unwait.py
new file mode 100644
index 0000000..94e677c
--- /dev/null
+++ b/tools/guest-diag/wall2/unwait.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+# unwait.py - guest-side, zero-ptrace wait-word poller: writes 1 to the +0x80
+# u32 of every zero 16 KB rw-s nvidiactl mapping of the newest vk_frame.
+import os, re, subprocess, sys, time
+DUR = float(sys.argv[1]) if len(sys.argv) > 1 else 600
+def newest_pid():
+    try:
+        out = subprocess.run(["pgrep", "-n", "-x", "vk_frame"], capture_output=True).stdout
+        return int(out.decode().strip())
+    except Exception:
+        return None
+def maps(pid):
+    try:
+        return open("/proc/%d/maps" % pid).read()
+    except Exception:
+        return ""
+logged = set()
+end = time.time() + DUR
+while time.time() < end:
+    pid = newest_pid()
+    if pid:
+        for line in maps(pid).splitlines():
+            p = line.split()
+            if len(p) < 6 or "nvidia" not in p[-1] or "rw-s" not in p[1]:
+                continue
+            try:
+                lo, hi = [int(x, 16) for x in p[0].split("-")]
+            except Exception:
+                continue
+            if hi - lo != 0x4000:
+                continue
+            wa = lo + 0x80
+            try:
+                fd = os.open("/proc/%d/mem" % pid, os.O_RDWR)
+                os.lseek(fd, wa, 0)
+                v = os.read(fd, 4)
+                if len(v) == 4 and v == b"\x00\x00\x00\x00":
+                    os.lseek(fd, wa, 0)
+                    os.write(fd, b"\x01\x00\x00\x00")
+                    key = (pid, wa)
+                    if key not in logged:
+                        logged.add(key)
+                        print("WORDWROTE pid=%d va=0x%x" % (pid, wa), flush=True)
+                os.close(fd)
+            except Exception:
+                pass
+    time.sleep(0.4)
+print("UNWAIT-DONE", flush=True)