1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
# gdb script: name the silent-rollback 999 site in the cuCtxCreate path.
#
# Sites (file vaddr of libcuda.so.570.144; runtime = base + off):
# 0x222e99 FUN_00322190: cmp $0x88,%eax (work-submission offset delta
# computed from two RM helper calls); next insn jumps to the
# 999 store when delta > 0x88.
# 0x223402 FUN_00322190: rc=999 (delta > 0x88)
# 0x223452 FUN_00322190: rc=999 (neither GR nor CE engine pointer found)
# 0x2231ab FUN_00322190: store of FUN_0031a3b0 (engine event pump) return
# 0x277840 FUN_00377680: rc=999 (context-register helper failed)
# 0x27640b FUN_00374240: rc=999 (malloc(0x40) failed)
# 0x44fb80 FUN_0054fa00: scanner forced 999
# 0x44fb6c FUN_0054fa00: scanner return 0x2cf
#
# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz.py
import gdb
out = gdb.execute("info proc mappings", to_string=True)
base = None
for line in out.splitlines():
if "libcuda" in line and "r-xp" in line:
f = line.split()
base = int(f[0], 16) - int(f[3], 16)
break
print("BASE=0x%x" % (base or 0))
if base is None:
print("NO_LIBCUDA")
raise SystemExit
gdb.execute("set pagination off")
gdb.execute("set confirm off")
SITES = [
(0x222e99, "SIZEDELTA"),
(0x223402, "SIZE999"),
(0x223452, "ENGINE999"),
(0x2231ab, "AFTER_PUMP"),
(0x277840, "CTXREF999"),
(0x27640b, "MALLOC999"),
(0x44fb80, "SCAN999"),
(0x44fb6c, "SCAN2cf"),
]
for off, name in SITES:
gdb.execute("break *0x%x" % (base + off))
for hit in range(80):
try:
gdb.execute("continue")
except gdb.error as e:
print("CONTINUE_END %s" % e)
break
try:
rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
rax = int(gdb.parse_and_eval("$rax")) & 0xffffffffffffffff
r14 = int(gdb.parse_and_eval("$r14")) & 0xffffffffffffffff
r12 = int(gdb.parse_and_eval("$r12")) & 0xffffffffffffffff
except Exception as e:
print("REGS_GONE %s" % e)
break
off = rip - base
name = dict(SITES).get(off, "?")
print("=== HIT %d rip=0x%x off=0x%x %s rax=0x%x r14=0x%x r12=0x%x" %
(hit, rip, off, name, rax, r14, r12))
try:
if off in (0x222e99, 0x223402):
print(" delta(eax)=0x%x u32(r14)=0x%x u32(r14+0x14)=0x%x" %
(rax & 0xffffffff,
int(gdb.parse_and_eval("*(unsigned int *)0x%x" % r14)),
int(gdb.parse_and_eval("*(unsigned int *)0x%x" % (r14 + 0x14)))))
if off == 0x223452:
print(" ctx+0x9830=0x%x ctx+0x9838=0x%x" %
(int(gdb.parse_and_eval("*(unsigned long *)0x%x" % (r12 + 0x9830))),
int(gdb.parse_and_eval("*(unsigned long *)0x%x" % (r12 + 0x9838)))))
except Exception as e:
print(" deref_fail %s" % e)
try:
print(gdb.execute("bt 10", to_string=True))
except Exception as e:
print("bt_fail %s" % e)
for t in gdb.selected_inferior().threads():
t.switch()
print("== tid %s" % t.num)
try:
print(gdb.execute("bt 6", to_string=True).rstrip())
except Exception as e:
print("bt_fail %s" % e)
try:
gdb.execute("detach")
except Exception:
pass
|
