diff options
Diffstat (limited to 'tools')
| -rw-r--r-- | tools/guest-diag/bpz14.py | 62 | ||||
| -rwxr-xr-x | tools/guest-diag/push_guest_tools.sh | 1 |
2 files changed, 63 insertions, 0 deletions
diff --git a/tools/guest-diag/bpz14.py b/tools/guest-diag/bpz14.py new file mode 100644 index 0000000..24302c9 --- /dev/null +++ b/tools/guest-diag/bpz14.py @@ -0,0 +1,62 @@ +# gdb script: dump the device-object TPC/SM count fields in the guest at the +# FUN_003e3e80 call from FUN_00e0e970 (caller return 0xd0eae1). +# +# Host oracle: dev+0xB0=24 (TPC), devstate[0xea0]=2 (SM/TPC), dev+0xB4=48. +# Guest FAILS FUN_003e35f0 because dev+0xB4 (== dev+0xB0 * devstate[0xea0]) +# is 0. This dumps which factor is zero. +# +# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz14.py +import gdb +import time + +out = gdb.execute("info proc mappings", to_string=True) +base = None +for line in out.splitlines(): + if "libcuda" in line and "r-xp" in line: + f = line.split() + base = int(f[0], 16) - int(f[3], 16) + break +print("BASE=0x%x" % (base or 0)) +if base is None: + raise SystemExit + +gdb.execute("set pagination off") +gdb.execute("set confirm off") +CALLER_RET = base + 0xd0eae1 +gdb.execute("break *0x%x" % (base + 0x2e3e80)) + +def rd(addr, n=4, fmt="unsigned int"): + try: + return int(gdb.parse_and_eval("*(%s*)0x%x" % (fmt, addr))) & ((1 << (8 * n)) - 1) + except Exception: + return None + +t0 = time.time() +for hit in range(300): + try: + gdb.execute("continue") + except gdb.error as e: + print("CONTINUE_END %s" % e) + break + ret = rd(int(gdb.parse_and_eval("$rsp")), 8, "unsigned long") + if ret != CALLER_RET: + continue + rdi = int(gdb.parse_and_eval("$rdi")) & 0xffffffffffffffff + ds = rd(rdi + 0x40, 8, "unsigned long") + print("FUN_003e3e80 from FUN_00e0e970 t=%.3f" % (time.time() - t0)) + print(" dev=0x%x dev+0xb0=0x%x dev+0xb4=0x%x devstate=0x%x" % + (rdi, rd(rdi + 0xb0) or 0, rd(rdi + 0xb4) or 0, ds or 0)) + if ds: + for off in [0xea0, 0x1094, 0x1074, 0xe98, 0xe94, 0x11a8, 0xec8, + 0xf5c, 0xeb4, 0xeb8, 0xeec, 0xc50, 0xc54, 0x4334]: + print(" devstate+0x%x = 0x%x" % (off, rd(ds + off) or 0)) + try: + print(gdb.execute("bt 5", to_string=True)) + except Exception: + pass + break + +try: + gdb.execute("detach") +except Exception: + pass diff --git a/tools/guest-diag/push_guest_tools.sh b/tools/guest-diag/push_guest_tools.sh index df3e64a..68d4e64 100755 --- a/tools/guest-diag/push_guest_tools.sh +++ b/tools/guest-diag/push_guest_tools.sh @@ -41,6 +41,7 @@ push_b64 "$HERE/bpz10.py" /tmp/bpz10.py push_b64 "$HERE/bpz11.py" /tmp/bpz11.py push_b64 "$HERE/bpz12.py" /tmp/bpz12.py push_b64 "$HERE/bpz13.py" /tmp/bpz13.py +push_b64 "$HERE/bpz14.py" /tmp/bpz14.py push_b64 "$HERE/invd.py" /tmp/invd.py push_b64 "$HERE/bpwait.py" /tmp/bpwait.py push_b64 "$HERE/ctx999.py" /tmp/ctx999.py |