guest-diag: bpz14 - dump guest TPC/SM count fields at the failing clock validation

2 files changed, 63 insertions, 0 deletions

diff --git a/tools/guest-diag/bpz14.py b/tools/guest-diag/bpz14.py
new file mode 100644
index 0000000..24302c9
--- /dev/null
+++ b/tools/guest-diag/bpz14.py
@@ -0,0 +1,62 @@
+# gdb script: dump the device-object TPC/SM count fields in the guest at the
+# FUN_003e3e80 call from FUN_00e0e970 (caller return 0xd0eae1).
+#
+# Host oracle: dev+0xB0=24 (TPC), devstate[0xea0]=2 (SM/TPC), dev+0xB4=48.
+# Guest FAILS FUN_003e35f0 because dev+0xB4 (== dev+0xB0 * devstate[0xea0])
+# is 0. This dumps which factor is zero.
+#
+# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz14.py
+import gdb
+import time
+
+out = gdb.execute("info proc mappings", to_string=True)
+base = None
+for line in out.splitlines():
+    if "libcuda" in line and "r-xp" in line:
+        f = line.split()
+        base = int(f[0], 16) - int(f[3], 16)
+        break
+print("BASE=0x%x" % (base or 0))
+if base is None:
+    raise SystemExit
+
+gdb.execute("set pagination off")
+gdb.execute("set confirm off")
+CALLER_RET = base + 0xd0eae1
+gdb.execute("break *0x%x" % (base + 0x2e3e80))
+
+def rd(addr, n=4, fmt="unsigned int"):
+    try:
+        return int(gdb.parse_and_eval("*(%s*)0x%x" % (fmt, addr))) & ((1 << (8 * n)) - 1)
+    except Exception:
+        return None
+
+t0 = time.time()
+for hit in range(300):
+    try:
+        gdb.execute("continue")
+    except gdb.error as e:
+        print("CONTINUE_END %s" % e)
+        break
+    ret = rd(int(gdb.parse_and_eval("$rsp")), 8, "unsigned long")
+    if ret != CALLER_RET:
+        continue
+    rdi = int(gdb.parse_and_eval("$rdi")) & 0xffffffffffffffff
+    ds = rd(rdi + 0x40, 8, "unsigned long")
+    print("FUN_003e3e80 from FUN_00e0e970 t=%.3f" % (time.time() - t0))
+    print("  dev=0x%x dev+0xb0=0x%x dev+0xb4=0x%x devstate=0x%x" %
+          (rdi, rd(rdi + 0xb0) or 0, rd(rdi + 0xb4) or 0, ds or 0))
+    if ds:
+        for off in [0xea0, 0x1094, 0x1074, 0xe98, 0xe94, 0x11a8, 0xec8,
+                    0xf5c, 0xeb4, 0xeb8, 0xeec, 0xc50, 0xc54, 0x4334]:
+            print("  devstate+0x%x = 0x%x" % (off, rd(ds + off) or 0))
+    try:
+        print(gdb.execute("bt 5", to_string=True))
+    except Exception:
+        pass
+    break
+
+try:
+    gdb.execute("detach")
+except Exception:
+    pass
diff --git a/tools/guest-diag/push_guest_tools.sh b/tools/guest-diag/push_guest_tools.sh
index df3e64a..68d4e64 100755
--- a/tools/guest-diag/push_guest_tools.sh
+++ b/tools/guest-diag/push_guest_tools.sh
@@ -41,6 +41,7 @@ push_b64 "$HERE/bpz10.py"      /tmp/bpz10.py
 push_b64 "$HERE/bpz11.py"      /tmp/bpz11.py
 push_b64 "$HERE/bpz12.py"      /tmp/bpz12.py
 push_b64 "$HERE/bpz13.py"      /tmp/bpz13.py
+push_b64 "$HERE/bpz14.py"      /tmp/bpz14.py
 push_b64 "$HERE/invd.py"        /tmp/invd.py
 push_b64 "$HERE/bpwait.py"      /tmp/bpwait.py
 push_b64 "$HERE/ctx999.py"      /tmp/ctx999.py