# SPDX-License-Identifier: BSD-3-Clause
# Copyright (c) 2026 Open-IOV contributors
# gdb script: identify WHICH engine-setup hook returns 999.
#
# Run #4 named the target: file 0x4d1fa0 (the +0x4580 table slot) — an engine
# setup function that callocs a 4-pointer array and calls each enabled hook in
# order: descriptors 0x440f780 (fn 0x4d9350), 0x440f7c0 (0x4c8a70),
# 0x440f800 (0x4ad980), 0x440f840 (0x4d7e70); the first non-zero return is
# propagated (it returned 0x3e7). This script breaks on the indirect call site
# (0x4d20fe) and its return (0x4d2101), printing the descriptor index, the
# call target and the status; the first non-zero status names the failing
# engine setup step and its callee.
#
# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz5.py
import gdb
import time

out = gdb.execute("info proc mappings", to_string=True)
base = None
for line in out.splitlines():
    if "libcuda" in line and "r-xp" in line:
        f = line.split()
        base = int(f[0], 16) - int(f[3], 16)
        break
print("BASE=0x%x" % (base or 0))
if base is None:
    print("NO_LIBCUDA")
    raise SystemExit

gdb.execute("set pagination off")
gdb.execute("set confirm off")
for off in (0x4d20fe, 0x4d2101):
    gdb.execute("break *0x%x" % (base + off))

t0 = time.time()
for hit in range(40):
    try:
        gdb.execute("continue")
    except gdb.error as e:
        print("CONTINUE_END %s" % e)
        break
    rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
    off = rip - base
    try:
        r13 = int(gdb.parse_and_eval("$r13")) & 0xffffffffffffffff
        r12 = int(gdb.parse_and_eval("$r12")) & 0xffffffffffffffff
        idx = (r12 - r13) // 8
    except Exception:
        idx = -1
    if off == 0x4d20fe:
        rax = int(gdb.parse_and_eval("$rax")) & 0xffffffffffffffff
        tgt = int(gdb.parse_and_eval("*(unsigned long *)0x%x" % (rax + 8)))
        print("HIT %d t=%.3f CALL idx=%d desc=0x%x target=0x%x target_off=0x%x" %
              (hit, time.time() - t0, idx, rax, tgt, tgt - base))
    else:
        rax = int(gdb.parse_and_eval("$rax")) & 0xffffffffffffffff
        print("HIT %d t=%.3f RET idx=%d eax=0x%x" %
              (hit, time.time() - t0, idx, rax & 0xffffffff))
        if (rax & 0xffffffff) != 0:
            print("  >>> HOOK FAILED idx=%d status=0x%x" % (idx, rax & 0xffffffff))
            try:
                print(gdb.execute("bt 10", to_string=True))
            except Exception as e:
                print("bt_fail %s" % e)

try:
    gdb.execute("detach")
except Exception:
    pass