guest-diag: bpz8 - localize the ucode-load failure inside FUN_00e21850

Run #7 proved the membar-WAR descriptor lookup succeeds in the guest
(remap (7,5)->(7,0)); FUN_00e21850 then returns 1. bpz8 breaks after its
two inner calls (FUN_003e99d0 image create, FUN_003dfae0 image load) to name
which one fails.

2 files changed, 65 insertions, 0 deletions

diff --git a/tools/guest-diag/bpz8.py b/tools/guest-diag/bpz8.py
new file mode 100644
index 0000000..e0567e5
--- /dev/null
+++ b/tools/guest-diag/bpz8.py
@@ -0,0 +1,64 @@
+# gdb script: localize the ucode-image load failure inside FUN_00e21850.
+#
+# Run #7: in the membar-WAR hook the descriptor lookup FUN_0035a4d0(0x13,7,5)
+# SUCCEEDED (non-NULL, remap (7,5)->(7,0)), and FUN_00e21850 returned 1
+# (NV_ERR_INVALID_ARGUMENT) -> hook returns 999. FUN_00e21850 is two calls:
+#   FUN_003e99d0 (blob -> image object) at 0xd218e6, result tested at 0xd218ed
+#   FUN_003dfae0 (image load)         at 0xd21932, result tested at 0xd21937
+# Break after each; the first non-zero status names the failing step.
+#
+# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz8.py
+import gdb
+import time
+
+out = gdb.execute("info proc mappings", to_string=True)
+base = None
+for line in out.splitlines():
+    if "libcuda" in line and "r-xp" in line:
+        f = line.split()
+        base = int(f[0], 16) - int(f[3], 16)
+        break
+print("BASE=0x%x" % (base or 0))
+if base is None:
+    raise SystemExit
+
+gdb.execute("set pagination off")
+gdb.execute("set confirm off")
+SITES = [
+    (0xd218e6, "IMG_CREATE_CALL"),
+    (0xd218ed, "IMG_CREATE_RET"),
+    (0xd21932, "IMG_LOAD_CALL"),
+    (0xd21937, "IMG_LOAD_RET"),
+]
+for off, name in SITES:
+    gdb.execute("break *0x%x" % (base + off))
+
+t0 = time.time()
+for hit in range(30):
+    try:
+        gdb.execute("continue")
+    except gdb.error as e:
+        print("CONTINUE_END %s" % e)
+        break
+    rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
+    off = rip - base
+    name = dict(SITES).get(off, "?")
+    try:
+        rax = int(gdb.parse_and_eval("$rax")) & 0xffffffffffffffff
+        rdx = int(gdb.parse_and_eval("$rdx")) & 0xffffffffffffffff
+    except Exception:
+        rax = rdx = 0
+    print("HIT t=%.3f off=0x%x %s rax=0x%x rdx_off=0x%x" %
+          (time.time() - t0, off, name, rax, (rdx - base) & 0xffffffffffffffff if rdx else 0))
+    if off in (0xd218ed, 0xd21937) and (rax & 0xffffffff) != 0:
+        print("  >>> FAILED STEP %s status=0x%x" % (name, rax & 0xffffffff))
+        try:
+            print(gdb.execute("bt 10", to_string=True))
+        except Exception as e:
+            print("bt_fail %s" % e)
+        break
+
+try:
+    gdb.execute("detach")
+except Exception:
+    pass
diff --git a/tools/guest-diag/push_guest_tools.sh b/tools/guest-diag/push_guest_tools.sh
index 3a30272..4bfc15a 100755
--- a/tools/guest-diag/push_guest_tools.sh
+++ b/tools/guest-diag/push_guest_tools.sh
@@ -35,6 +35,7 @@ push_b64 "$HERE/bpz4.py"        /tmp/bpz4.py
 push_b64 "$HERE/bpz5.py"        /tmp/bpz5.py
 push_b64 "$HERE/bpz6.py"        /tmp/bpz6.py
 push_b64 "$HERE/bpz7.py"        /tmp/bpz7.py
+push_b64 "$HERE/bpz8.py"        /tmp/bpz8.py
 push_b64 "$HERE/invd.py"        /tmp/invd.py
 push_b64 "$HERE/bpwait.py"      /tmp/bpwait.py
 push_b64 "$HERE/ctx999.py"      /tmp/ctx999.py