1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
# gdb script: trace the path through FUN_0042aec0 (GPU arch/config init) by
# attaching to a running cdt at the CDT_PAUSE (bpz18 variant).
#
# Host: c48=6 c4c=0x27 c50=7 c54=5 e94=0x18. Guest reaches same c48..c54 but
# e94=0, so some branch inside FUN_0042aec0 diverges. This logs hits on:
# 0x32aec0 FUN_0042aec0 entry
# 0x32b0b7 after chip-info store
# 0x32c911 the 0xc4c dispatch
# 0x32e8be case index 1 body (sets e94=0x18)
# 0x32e46a default target of the dispatch
# 0x2e3e80 FUN_003e3e80 (terminator; dumps ds fields)
import gdb
import time
gdb.execute("set pagination off")
gdb.execute("set confirm off")
out = gdb.execute("info proc mappings", to_string=True)
base = None
for line in out.splitlines():
if "libcuda" in line and "r-xp" in line:
f = line.split()
base = int(f[0], 16) - int(f[3], 16)
break
print("BASE=0x%x" % (base or 0))
if base is None:
raise SystemExit
SITES = [
(0x32aec0, "F42AEC0_ENTRY"),
(0x32b0b7, "AFTER_CHIPINFO"),
(0x32c911, "C4C_DISPATCH"),
(0x32e8be, "CASE1_e94_0x18"),
(0x32e46a, "DISPATCH_DEFAULT"),
]
for off, name in SITES:
gdb.execute("break *0x%x" % (base + off))
CALLER_RET = base + 0xd0eae1
gdb.execute("break *0x%x" % (base + 0x2e3e80))
def rd(addr, n=4, fmt="unsigned int"):
try:
return int(gdb.parse_and_eval("*(%s*)0x%x" % (fmt, addr))) & ((1 << (8 * n)) - 1)
except Exception:
return None
t0 = time.time()
for hit in range(120):
try:
gdb.execute("continue")
except gdb.error as e:
print("CONTINUE_END %s" % e)
break
rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
off = rip - base
if off == 0x2e3e80:
ret = rd(int(gdb.parse_and_eval("$rsp")), 8, "unsigned long")
if ret != CALLER_RET:
continue
rdi = int(gdb.parse_and_eval("$rdi")) & 0xffffffffffffffff
ds = rd(rdi + 0x40, 8, "unsigned long")
print("TERMINATOR FUN_003e3e80 dev=0x%x ds=0x%x t=%.3f" % (rdi, ds or 0, time.time() - t0))
for o in [0xc48, 0xc4c, 0xc50, 0xc54, 0xe94, 0x4354, 0x426c]:
print(" ds+0x%x = 0x%x" % (o, rd(ds + o) or 0))
break
name = dict((o, n) for o, n in SITES).get(off, "?")
rcx = int(gdb.parse_and_eval("$rcx")) & 0xffffffffffffffff
eax = rd("$eax") if False else (int(gdb.parse_and_eval("$eax")) & 0xffffffff)
extra = ""
if off == 0x32c911:
extra = " c4c=0x%x arch=0x%x" % (rd(rcx + 0xc4c) or 0, rd(rcx + 0xc50) or 0)
print("HIT t=%.3f +0x%x %s eax=0x%x rcx=0x%x%s" %
(time.time() - t0, off, name, eax, rcx, extra))
try:
gdb.execute("detach")
except Exception:
pass
|
