From 0ffc3bf8effd69af2910ad38294cb99894c6b44b Mon Sep 17 00:00:00 2001
From: Arthur Hanson Rasmusson <arthur@vgpu.io>
Date: Wed, 30 Sep 2026 07:25:45 -0400
Subject: guest-diag: cdt2 scans its own mappings for the payload after HtoD
 (DtoH mechanism probe)

---
 tools/test/cuda_drv_test2.c | 48 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

(limited to 'tools')

diff --git a/tools/test/cuda_drv_test2.c b/tools/test/cuda_drv_test2.c
index a146bc2..cfe21d8 100644
--- a/tools/test/cuda_drv_test2.c
+++ b/tools/test/cuda_drv_test2.c
@@ -58,6 +58,52 @@ static void pause_env(const char *name)
     }
 }
 
+/*
+ * Scan this process's readable mappings for the payload pattern and print
+ * every mapping that looks like a device/BAR window. This answers whether the
+ * HtoD bytes are visible to the client CPU at all: the DtoH path can only be a
+ * CPU read if some mapping of this process contains them.
+ */
+static void scan_self_for_payload(const char *tag)
+{
+    const unsigned long long pat = 0x0000000400000001ULL;
+    FILE *f = fopen("/proc/self/maps", "r");
+    char line[512];
+    int hits = 0;
+
+    printf("SCAN %s:\n", tag);
+    if (!f) { printf("SCAN %s: no maps\n", tag); return; }
+    while (fgets(line, sizeof(line), f)) {
+        unsigned long long a = 0, b = 0, off = 0;
+        char perms[8] = {0};
+        char path[256] = {0};
+
+        if (sscanf(line, "%llx-%llx %7s %llx %*s %*s %255[^\n]",
+                   &a, &b, &perms, &off, path) < 4)
+            continue;
+        if (strstr(path, "vfio") || strstr(path, "nvidia") ||
+            strstr(path, "/dev/"))
+            printf("MAP %s: %llx-%llx %s off=%llx %s\n", tag, a, b,
+                   perms, off, path);
+        if (perms[0] != 'r' || b <= a || b - a > (512ULL << 20))
+            continue;
+        {
+            volatile unsigned long long *p;
+            for (p = (volatile unsigned long long *)a;
+                 (unsigned long long)p + 8 <= b; p++) {
+                if (*p == pat && hits < 16) {
+                    hits++;
+                    printf("SCAN %s: payload at %p (map %llx-%llx %s %s)\n",
+                           tag, (void *)p, a, b, perms, path);
+                }
+            }
+        }
+    }
+    if (!hits)
+        printf("SCAN %s: payload not visible in any mapping\n", tag);
+    fclose(f);
+}
+
 int main(void)
 {
     setvbuf(stdout, NULL, _IONBF, 0);
@@ -121,9 +167,11 @@ int main(void)
     MARK("cuMemcpyHtoD");
     CHECK(cuMemcpyHtoD(dptr, buf, sizeof(buf)));
     pause_env("CDT_HP_PAUSE");
+    scan_self_for_payload("after-HtoD");
     memset(back, 0, sizeof(back));
     MARK("cuMemcpyDtoH");
     CHECK(cuMemcpyDtoH(back, dptr, sizeof(buf)));
+    scan_self_for_payload("after-DtoH");
     {
         size_t matched = 0;
         for (i = 0; i < 64; i++)
-- 
cgit v1.2.3