1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
# gdb script: dump the device-object TPC/SM count fields in the guest at the
# FUN_003e3e80 call from FUN_00e0e970 (caller return 0xd0eae1).
#
# Host oracle: dev+0xB0=24 (TPC), devstate[0xea0]=2 (SM/TPC), dev+0xB4=48.
# Guest FAILS FUN_003e35f0 because dev+0xB4 (== dev+0xB0 * devstate[0xea0])
# is 0. This dumps which factor is zero.
#
# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz14.py
import gdb
import time
out = gdb.execute("info proc mappings", to_string=True)
base = None
for line in out.splitlines():
if "libcuda" in line and "r-xp" in line:
f = line.split()
base = int(f[0], 16) - int(f[3], 16)
break
print("BASE=0x%x" % (base or 0))
if base is None:
raise SystemExit
gdb.execute("set pagination off")
gdb.execute("set confirm off")
CALLER_RET = base + 0xd0eae1
gdb.execute("break *0x%x" % (base + 0x2e3e80))
def rd(addr, n=4, fmt="unsigned int"):
try:
return int(gdb.parse_and_eval("*(%s*)0x%x" % (fmt, addr))) & ((1 << (8 * n)) - 1)
except Exception:
return None
t0 = time.time()
for hit in range(300):
try:
gdb.execute("continue")
except gdb.error as e:
print("CONTINUE_END %s" % e)
break
ret = rd(int(gdb.parse_and_eval("$rsp")), 8, "unsigned long")
if ret != CALLER_RET:
continue
rdi = int(gdb.parse_and_eval("$rdi")) & 0xffffffffffffffff
ds = rd(rdi + 0x40, 8, "unsigned long")
print("FUN_003e3e80 from FUN_00e0e970 t=%.3f" % (time.time() - t0))
print(" dev=0x%x dev+0xb0=0x%x dev+0xb4=0x%x devstate=0x%x" %
(rdi, rd(rdi + 0xb0) or 0, rd(rdi + 0xb4) or 0, ds or 0))
if ds:
for off in [0xea0, 0x1094, 0x1074, 0xe98, 0xe94, 0x11a8, 0xec8,
0xf5c, 0xeb4, 0xeb8, 0xeec, 0xc50, 0xc54, 0x4334]:
print(" devstate+0x%x = 0x%x" % (off, rd(ds + off) or 0))
try:
print(gdb.execute("bt 5", to_string=True))
except Exception:
pass
break
try:
gdb.execute("detach")
except Exception:
pass
|
