guest-diag: bpz7 - split membar hook failure into lookup vs ucode load

Host oracle (real TU104, 570.211): FUN_0035a4d0(0x13,7,5) succeeds because
the 3-entry remap table at 0x3dc5b80 maps (7,5)->(7,0); the guest has the
same table. bpz7 breaks before/after the lookup and the FUN_00e21850 ucode
load in FUN_005d7e70 to see which one fails in the guest. Also fix invd.py's
lookup address (0x25a4d0, not 0x35a4d0).

3 files changed, 69 insertions, 1 deletions

diff --git a/tools/guest-diag/bpz7.py b/tools/guest-diag/bpz7.py
new file mode 100644
index 0000000..2294298
--- /dev/null
+++ b/tools/guest-diag/bpz7.py
@@ -0,0 +1,67 @@
+# gdb script: split the membar-WAR hook failure into lookup vs ucode-load.
+#
+# The remap table at file 0x3dc5b80 maps (chip=7,rev=5)->(7,0) (real Turing
+# CC7.5), so FUN_0035a4d0(0x13,7,5) should succeed on the static table as it
+# does on the host oracle (verified: type 0x13 (7,5) -> non-NULL on the real
+# TU104). FUN_005d7e70 then calls FUN_00e21850 to load the blob; either step
+# can set 999. Break before/after both calls.
+#
+# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz7.py
+import gdb
+import time
+
+out = gdb.execute("info proc mappings", to_string=True)
+base = None
+for line in out.splitlines():
+    if "libcuda" in line and "r-xp" in line:
+        f = line.split()
+        base = int(f[0], 16) - int(f[3], 16)
+        break
+print("BASE=0x%x" % (base or 0))
+if base is None:
+    raise SystemExit
+
+gdb.execute("set pagination off")
+gdb.execute("set confirm off")
+SITES = [
+    (0x4d7eb2, "LOOKUP_CALL"),
+    (0x4d7eb7, "LOOKUP_RET"),
+    (0x4d7ece, "LOAD_CALL"),
+    (0x4d7ed3, "LOAD_RET"),
+    (0x4d7ed7, "SET999"),
+]
+for off, name in SITES:
+    gdb.execute("break *0x%x" % (base + off))
+
+t0 = time.time()
+for hit in range(30):
+    try:
+        gdb.execute("continue")
+    except gdb.error as e:
+        print("CONTINUE_END %s" % e)
+        break
+    rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
+    off = rip - base
+    name = dict(SITES).get(off, "?")
+    try:
+        rax = int(gdb.parse_and_eval("$rax")) & 0xffffffffffffffff
+        esi = int(gdb.parse_and_eval("$esi")) & 0xffffffff
+        edx = int(gdb.parse_and_eval("$edx")) & 0xffffffff
+        edi = int(gdb.parse_and_eval("$edi")) & 0xffffffff
+    except Exception:
+        rax = esi = edx = edi = 0
+    print("HIT t=%.3f off=0x%x %s rax=0x%x esi=0x%x edx=0x%x edi=0x%x" %
+          (time.time() - t0, off, name, rax, esi, edx, edi))
+    if off in (0x4d7eb7, 0x4d7ed3, 0x4d7ed7):
+        if (off != 0x4d7eb7 and (rax & 0xffffffff) != 0) or (off == 0x4d7eb7 and rax == 0):
+            print("  >>> FAILURE POINT %s" % name)
+            try:
+                print(gdb.execute("bt 8", to_string=True))
+            except Exception as e:
+                print("bt_fail %s" % e)
+            break
+
+try:
+    gdb.execute("detach")
+except Exception:
+    pass
diff --git a/tools/guest-diag/invd.py b/tools/guest-diag/invd.py
index 1fc8491..313daa3 100644
--- a/tools/guest-diag/invd.py
+++ b/tools/guest-diag/invd.py
@@ -57,7 +57,7 @@ if dev:
                   (q or 0, (q or 0) & 0xffffffff, (q or 0) >> 32))
             print("  state+0xc54 = 0x%x" % (r32(st + 0xc54) or 0))
 
-f = base + 0x35a4d0
+f = base + 0x25a4d0
 
 
 def lookup(chip, rev):
diff --git a/tools/guest-diag/push_guest_tools.sh b/tools/guest-diag/push_guest_tools.sh
index e10c8ff..3a30272 100755
--- a/tools/guest-diag/push_guest_tools.sh
+++ b/tools/guest-diag/push_guest_tools.sh
@@ -34,6 +34,7 @@ push_b64 "$HERE/bpz3.py"        /tmp/bpz3.py
 push_b64 "$HERE/bpz4.py"        /tmp/bpz4.py
 push_b64 "$HERE/bpz5.py"        /tmp/bpz5.py
 push_b64 "$HERE/bpz6.py"        /tmp/bpz6.py
+push_b64 "$HERE/bpz7.py"        /tmp/bpz7.py
 push_b64 "$HERE/invd.py"        /tmp/invd.py
 push_b64 "$HERE/bpwait.py"      /tmp/bpwait.py
 push_b64 "$HERE/ctx999.py"      /tmp/ctx999.py