# SPDX-License-Identifier: BSD-3-Clause
# Copyright (c) 2026 Open-IOV contributors
# gdb script: split FUN_00391ee0 (ucode-image registration, file 0x291ee0).
#
# PART 76 + bpz10 run: FUN_003e90c0's failing call is FUN_00391ee0, which
# returns 1. FUN_00391ee0 (6519 bytes) has a single epilogue at 0x292258
# (mov r15d,eax) with status in r15d; every checked call does
# "test; jne 0x292248" (error exit). This script traces every call return,
# printing nonzero values, then at the epilogue prints the final status and
# the recent history tail.
#
# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz11.py
import gdb
import time

out = gdb.execute("info proc mappings", to_string=True)
base = None
for line in out.splitlines():
    if "libcuda" in line and "r-xp" in line:
        f = line.split()
        base = int(f[0], 16) - int(f[3], 16)
        break
print("BASE=0x%x" % (base or 0))
if base is None:
    raise SystemExit

gdb.execute("set pagination off")
gdb.execute("set confirm off")

SITES = [
    (0x291f0c, "c_179350_lock"),
    (0x2920b6, "c_179560_snprintf"),
    (0x292108, "c_4fbb50"),
    (0x29211b, "c_1799e0_calloc"),
    (0x29217a, "c_279110_a"),
    (0x2921a6, "c_2f9fa0"),
    (0x2921c6, "c_279110_b"),
    (0x2921fd, "c_279210"),
    (0x29223d, "c_2f9e20"),
    (0x29227f, "c_512230_a"),
    (0x292295, "c_512230_b"),
    (0x2922b9, "c_5277f0_a"),
    (0x2922d5, "c_24a4d0_bool"),
    (0x29232f, "c_5277f0_b"),
    (0x292392, "c_285410"),
    (0x2923bd, "c_2f9f00"),
    (0x2923f6, "c_4fd080"),
    (0x29240e, "c_4fd1a0"),
    (0x292418, "c_4fbf20"),
    (0x292457, "c_279900"),
    (0x292497, "c_286020"),
    (0x2924e3, "c_2df340_bool"),
    (0x292518, "c_263790"),
    (0x292572, "c_512910"),
    (0x292580, "c_5277f0_c"),
    (0x29258f, "c_5277f0_d"),
    (0x2925f8, "c_2df340_bool2"),
    (0x29262e, "c_263980"),
    (0x29269b, "c_3aa550_a"),
    (0x2926c1, "c_d663e0_a"),
    (0x2927cc, "c_277c70_a"),
    (0x292835, "c_3aa740"),
    (0x29291c, "c_277c70_b"),
    (0x292999, "c_d4b570_a"),
    (0x292a35, "c_d4b570_b"),
    (0x292aaf, "c_d4b570_c"),
    (0x292b29, "c_d4b570_d"),
    (0x292b62, "c_277900"),
    (0x292b96, "c_d4b570_e"),
    (0x292bb7, "c_278c70"),
    (0x292c1e, "c_d4b570_f"),
    (0x292c3f, "c_2874a0"),
    (0x292c6e, "c_27c3a0"),
    (0x292c81, "c_27c8f0"),
    (0x292ca9, "c_ind_0x4770"),
    (0x292d34, "c_d4b980"),
    (0x292d6e, "c_27c870"),
    (0x292dc7, "c_27c6a0_a"),
    (0x292e04, "c_27c6a0_b"),
    (0x292e43, "c_27c6a0_c"),
    (0x292e82, "c_27c6a0_d"),
    (0x292ef3, "c_27c6a0_e"),
    (0x292f38, "c_2df340_bool3"),
    (0x292f65, "c_25c0a0"),
    (0x29304d, "c_3aa550_b"),
    (0x29307a, "c_d663e0_b"),
    (0x2931e4, "c_3ab420"),
    (0x29328d, "c_27a9e0_a"),
    (0x293305, "c_27be70"),
    (0x29333e, "c_27a9e0_b"),
    (0x29336d, "c_3aa820_alloc"),
    (0x2933f8, "c_28fb00"),
    (0x29340b, "c_277960"),
    (0x29343f, "c_d6c560"),
    (0x29354d, "c_28f6b0"),
    (0x29361b, "c_179980_strcmp_a"),
    (0x293640, "c_179980_strcmp_b"),
    (0x2936ca, "c_d664f0_a"),
    (0x2936f2, "c_d664f0_b"),
    (0x29371a, "c_d664f0_c"),
    (0x293742, "c_d664f0_d"),
    (0x29376a, "c_d664f0_e"),
    (0x293830, "c_179350_lock2"),
    (0x292258, "FRET"),
]
NAMES = dict(SITES)
for off, name in SITES:
    gdb.execute("break *0x%x" % (base + off))

t0 = time.time()
hits = 0
hist = []
inv = 0
while hits < 800:
    try:
        gdb.execute("continue")
    except gdb.error as e:
        print("CONTINUE_END %s" % e)
        break
    hits += 1
    rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
    off = rip - base
    name = NAMES.get(off, "?")
    eax = int(gdb.parse_and_eval("$eax")) & 0xffffffff
    r15 = int(gdb.parse_and_eval("$r15d")) & 0xffffffff
    if name == "FRET":
        inv += 1
        print("INV %d FRET r15d=0x%x (eax=0x%x)" % (inv, r15, eax))
        print("  tail:", " | ".join("%s=0x%x" % (n, v) for n, v in hist[-10:]))
        if r15 != 0:
            nz = [x for x in hist if x[1] != 0]
            print("  nonzero call returns (last 12):")
            for n, v in nz[-12:]:
                print("    %s = 0x%x" % (n, v))
            try:
                print(gdb.execute("bt 6", to_string=True))
            except Exception as e:
                print("bt_fail %s" % e)
            break
        hist = []
    else:
        hist.append((name, eax))
        if eax != 0:
            print("HIT %d t=%.3f %-18s eax=0x%x" % (hits, time.time() - t0, name, eax))
        elif hits % 100 == 0:
            print("HIT %d t=%.3f %s eax=0" % (hits, time.time() - t0, name))

try:
    gdb.execute("detach")
except Exception:
    pass