1 files changed, 149 insertions, 0 deletions
diff --git a/tools/guest-diag/bpz11.py b/tools/guest-diag/bpz11.py
new file mode 100644
index 0000000..601a73d
--- /dev/null
+++ b/tools/guest-diag/bpz11.py
@@ -0,0 +1,149 @@
+# gdb script: split FUN_00391ee0 (ucode-image registration, file 0x291ee0).
+#
+# PART 76 + bpz10 run: FUN_003e90c0's failing call is FUN_00391ee0, which
+# returns 1. FUN_00391ee0 (6519 bytes) has a single epilogue at 0x292258
+# (mov r15d,eax) with status in r15d; every checked call does
+# "test; jne 0x292248" (error exit). This script traces every call return,
+# printing nonzero values, then at the epilogue prints the final status and
+# the recent history tail.
+#
+# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz11.py
+import gdb
+import time
+
+out = gdb.execute("info proc mappings", to_string=True)
+base = None
+for line in out.splitlines():
+    if "libcuda" in line and "r-xp" in line:
+        f = line.split()
+        base = int(f[0], 16) - int(f[3], 16)
+        break
+print("BASE=0x%x" % (base or 0))
+if base is None:
+    raise SystemExit
+
+gdb.execute("set pagination off")
+gdb.execute("set confirm off")
+
+SITES = [
+    (0x291f0c, "c_179350_lock"),
+    (0x2920b6, "c_179560_snprintf"),
+    (0x292108, "c_4fbb50"),
+    (0x29211b, "c_1799e0_calloc"),
+    (0x29217a, "c_279110_a"),
+    (0x2921a6, "c_2f9fa0"),
+    (0x2921c6, "c_279110_b"),
+    (0x2921fd, "c_279210"),
+    (0x29223d, "c_2f9e20"),
+    (0x29227f, "c_512230_a"),
+    (0x292295, "c_512230_b"),
+    (0x2922b9, "c_5277f0_a"),
+    (0x2922d5, "c_24a4d0_bool"),
+    (0x29232f, "c_5277f0_b"),
+    (0x292392, "c_285410"),
+    (0x2923bd, "c_2f9f00"),
+    (0x2923f6, "c_4fd080"),
+    (0x29240e, "c_4fd1a0"),
+    (0x292418, "c_4fbf20"),
+    (0x292457, "c_279900"),
+    (0x292497, "c_286020"),
+    (0x2924e3, "c_2df340_bool"),
+    (0x292518, "c_263790"),
+    (0x292572, "c_512910"),
+    (0x292580, "c_5277f0_c"),
+    (0x29258f, "c_5277f0_d"),
+    (0x2925f8, "c_2df340_bool2"),
+    (0x29262e, "c_263980"),
+    (0x29269b, "c_3aa550_a"),
+    (0x2926c1, "c_d663e0_a"),
+    (0x2927cc, "c_277c70_a"),
+    (0x292835, "c_3aa740"),
+    (0x29291c, "c_277c70_b"),
+    (0x292999, "c_d4b570_a"),
+    (0x292a35, "c_d4b570_b"),
+    (0x292aaf, "c_d4b570_c"),
+    (0x292b29, "c_d4b570_d"),
+    (0x292b62, "c_277900"),
+    (0x292b96, "c_d4b570_e"),
+    (0x292bb7, "c_278c70"),
+    (0x292c1e, "c_d4b570_f"),
+    (0x292c3f, "c_2874a0"),
+    (0x292c6e, "c_27c3a0"),
+    (0x292c81, "c_27c8f0"),
+    (0x292ca9, "c_ind_0x4770"),
+    (0x292d34, "c_d4b980"),
+    (0x292d6e, "c_27c870"),
+    (0x292dc7, "c_27c6a0_a"),
+    (0x292e04, "c_27c6a0_b"),
+    (0x292e43, "c_27c6a0_c"),
+    (0x292e82, "c_27c6a0_d"),
+    (0x292ef3, "c_27c6a0_e"),
+    (0x292f38, "c_2df340_bool3"),
+    (0x292f65, "c_25c0a0"),
+    (0x29304d, "c_3aa550_b"),
+    (0x29307a, "c_d663e0_b"),
+    (0x2931e4, "c_3ab420"),
+    (0x29328d, "c_27a9e0_a"),
+    (0x293305, "c_27be70"),
+    (0x29333e, "c_27a9e0_b"),
+    (0x29336d, "c_3aa820_alloc"),
+    (0x2933f8, "c_28fb00"),
+    (0x29340b, "c_277960"),
+    (0x29343f, "c_d6c560"),
+    (0x29354d, "c_28f6b0"),
+    (0x29361b, "c_179980_strcmp_a"),
+    (0x293640, "c_179980_strcmp_b"),
+    (0x2936ca, "c_d664f0_a"),
+    (0x2936f2, "c_d664f0_b"),
+    (0x29371a, "c_d664f0_c"),
+    (0x293742, "c_d664f0_d"),
+    (0x29376a, "c_d664f0_e"),
+    (0x293830, "c_179350_lock2"),
+    (0x292258, "FRET"),
+]
+NAMES = dict(SITES)
+for off, name in SITES:
+    gdb.execute("break *0x%x" % (base + off))
+
+t0 = time.time()
+hits = 0
+hist = []
+inv = 0
+while hits < 800:
+    try:
+        gdb.execute("continue")
+    except gdb.error as e:
+        print("CONTINUE_END %s" % e)
+        break
+    hits += 1
+    rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
+    off = rip - base
+    name = NAMES.get(off, "?")
+    eax = int(gdb.parse_and_eval("$eax")) & 0xffffffff
+    r15 = int(gdb.parse_and_eval("$r15d")) & 0xffffffff
+    if name == "FRET":
+        inv += 1
+        print("INV %d FRET r15d=0x%x (eax=0x%x)" % (inv, r15, eax))
+        print("  tail:", " | ".join("%s=0x%x" % (n, v) for n, v in hist[-10:]))
+        if r15 != 0:
+            nz = [x for x in hist if x[1] != 0]
+            print("  nonzero call returns (last 12):")
+            for n, v in nz[-12:]:
+                print("    %s = 0x%x" % (n, v))
+            try:
+                print(gdb.execute("bt 6", to_string=True))
+            except Exception as e:
+                print("bt_fail %s" % e)
+            break
+        hist = []
+    else:
+        hist.append((name, eax))
+        if eax != 0:
+            print("HIT %d t=%.3f %-18s eax=0x%x" % (hits, time.time() - t0, name, eax))
+        elif hits % 100 == 0:
+            print("HIT %d t=%.3f %s eax=0" % (hits, time.time() - t0, name))
+
+try:
+    gdb.execute("detach")
+except Exception:
+    pass