1 files changed, 103 insertions, 0 deletions
diff --git a/tools/guest-diag/bpz6.py b/tools/guest-diag/bpz6.py
new file mode 100644
index 0000000..7742da2
--- /dev/null
+++ b/tools/guest-diag/bpz6.py
@@ -0,0 +1,103 @@
+# gdb script: at the membar-WAR hook failure, read the device arch/impl and
+# test the FUN_0035a4d0(0x13, arch, rev) descriptor lookup in-process.
+#
+# Run #5: hook idx=3 (FUN_005d7e70) returned 0x3e7; its only 999 source is
+# `FUN_0035a4d0(0x13, *(u32*)(dev+0xc50), *(u32*)(dev+0xc54)) == 0` or the
+# ucode load failing. Break on the hook return; when the status is non-zero,
+# eval the lookup with the live values and scan nearby (arch, rev) pairs.
+#
+# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz6.py
+import gdb
+import time
+
+out = gdb.execute("info proc mappings", to_string=True)
+base = None
+for line in out.splitlines():
+    if "libcuda" in line and "r-xp" in line:
+        f = line.split()
+        base = int(f[0], 16) - int(f[3], 16)
+        break
+print("BASE=0x%x" % (base or 0))
+if base is None:
+    raise SystemExit
+
+gdb.execute("set pagination off")
+gdb.execute("set confirm off")
+for off in (0x4d20fe, 0x4d2101):
+    gdb.execute("break *0x%x" % (base + off))
+
+f = base + 0x35a4d0
+
+
+def r64(a):
+    try:
+        return int(gdb.parse_and_eval("*(unsigned long *)0x%x" % a)) & 0xffffffffffffffff
+    except Exception:
+        return None
+
+
+def r32(a):
+    try:
+        return int(gdb.parse_and_eval("*(unsigned int *)0x%x" % a)) & 0xffffffff
+    except Exception:
+        return None
+
+
+def lookup(chip, rev):
+    try:
+        return int(gdb.parse_and_eval(
+            "((void*(*)(long,int,int))0x%x)(0x13,%d,%d)" % (f, chip, rev))) & 0xffffffffffffffff
+    except Exception as e:
+        print("  call_fail chip=0x%x rev=0x%x: %s" % (chip, rev, e))
+        return None
+
+
+t0 = time.time()
+for hit in range(40):
+    try:
+        gdb.execute("continue")
+    except gdb.error as e:
+        print("CONTINUE_END %s" % e)
+        break
+    rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
+    off = rip - base
+    if off == 0x4d20fe:
+        try:
+            rax = int(gdb.parse_and_eval("$rax")) & 0xffffffffffffffff
+            print("CALL t=%.3f target_off=0x%x" %
+                  (time.time() - t0, (int(gdb.parse_and_eval(
+                      "*(unsigned long *)0x%x" % (rax + 8))) - base) & 0xffffffffffffffff))
+        except Exception as e:
+            print("call_dump_fail %s" % e)
+        continue
+    rax = int(gdb.parse_and_eval("$rax")) & 0xffffffffffffffff
+    print("RET t=%.3f eax=0x%x" % (time.time() - t0, rax & 0xffffffff))
+    if (rax & 0xffffffff) == 0:
+        continue
+    try:
+        ctx = int(gdb.parse_and_eval("$rbx")) & 0xffffffffffffffff
+        st = r64(ctx + 0x40)
+        chip = r32(st + 0xc50)
+        rev = r32(st + 0xc54)
+        print("ctx=0x%x state=0x%x state+0xc50=0x%x (arch=0x%x) +0xc54=0x%x" %
+              (ctx, st or 0, r64(st + 0xc50) or 0, chip or 0, rev or 0))
+        v = lookup(chip, rev)
+        print("lookup(0x13,0x%x,0x%x) = 0x%x" % (chip, rev, v or 0))
+        if v:
+            print("  desc+0x10=0x%x desc+0x18=0x%x" %
+                  (r64(v + 0x10) or 0, r64(v + 0x18) or 0))
+        print("scan:")
+        for c in (0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0x160, 0x170):
+            for rv in range(0, 4):
+                vv = lookup(c, rv)
+                if vv:
+                    print("  chip=0x%x rev=0x%x -> 0x%x size=0x%x" %
+                          (c, rv, vv, r64(vv + 0x18) or 0))
+    except Exception as e:
+        print("live_probe_fail %s" % e)
+    break
+
+try:
+    gdb.execute("detach")
+except Exception:
+    pass