1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
# gdb script: at the membar-WAR hook failure, read the device arch/impl and
# test the FUN_0035a4d0(0x13, arch, rev) descriptor lookup in-process.
#
# Run #5: hook idx=3 (FUN_005d7e70) returned 0x3e7; its only 999 source is
# `FUN_0035a4d0(0x13, *(u32*)(dev+0xc50), *(u32*)(dev+0xc54)) == 0` or the
# ucode load failing. Break on the hook return; when the status is non-zero,
# eval the lookup with the live values and scan nearby (arch, rev) pairs.
#
# Run: sudo gdb -p <cdt-pid> -batch -x /tmp/bpz6.py
import gdb
import time
out = gdb.execute("info proc mappings", to_string=True)
base = None
for line in out.splitlines():
if "libcuda" in line and "r-xp" in line:
f = line.split()
base = int(f[0], 16) - int(f[3], 16)
break
print("BASE=0x%x" % (base or 0))
if base is None:
raise SystemExit
gdb.execute("set pagination off")
gdb.execute("set confirm off")
for off in (0x4d20fe, 0x4d2101):
gdb.execute("break *0x%x" % (base + off))
f = base + 0x35a4d0
def r64(a):
try:
return int(gdb.parse_and_eval("*(unsigned long *)0x%x" % a)) & 0xffffffffffffffff
except Exception:
return None
def r32(a):
try:
return int(gdb.parse_and_eval("*(unsigned int *)0x%x" % a)) & 0xffffffff
except Exception:
return None
def lookup(chip, rev):
try:
return int(gdb.parse_and_eval(
"((void*(*)(long,int,int))0x%x)(0x13,%d,%d)" % (f, chip, rev))) & 0xffffffffffffffff
except Exception as e:
print(" call_fail chip=0x%x rev=0x%x: %s" % (chip, rev, e))
return None
t0 = time.time()
for hit in range(40):
try:
gdb.execute("continue")
except gdb.error as e:
print("CONTINUE_END %s" % e)
break
rip = int(gdb.parse_and_eval("$rip")) & 0xffffffffffffffff
off = rip - base
if off == 0x4d20fe:
try:
rax = int(gdb.parse_and_eval("$rax")) & 0xffffffffffffffff
print("CALL t=%.3f target_off=0x%x" %
(time.time() - t0, (int(gdb.parse_and_eval(
"*(unsigned long *)0x%x" % (rax + 8))) - base) & 0xffffffffffffffff))
except Exception as e:
print("call_dump_fail %s" % e)
continue
rax = int(gdb.parse_and_eval("$rax")) & 0xffffffffffffffff
print("RET t=%.3f eax=0x%x" % (time.time() - t0, rax & 0xffffffff))
if (rax & 0xffffffff) == 0:
continue
try:
ctx = int(gdb.parse_and_eval("$rbx")) & 0xffffffffffffffff
st = r64(ctx + 0x40)
chip = r32(st + 0xc50)
rev = r32(st + 0xc54)
print("ctx=0x%x state=0x%x state+0xc50=0x%x (arch=0x%x) +0xc54=0x%x" %
(ctx, st or 0, r64(st + 0xc50) or 0, chip or 0, rev or 0))
v = lookup(chip, rev)
print("lookup(0x13,0x%x,0x%x) = 0x%x" % (chip, rev, v or 0))
if v:
print(" desc+0x10=0x%x desc+0x18=0x%x" %
(r64(v + 0x10) or 0, r64(v + 0x18) or 0))
print("scan:")
for c in (0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0x160, 0x170):
for rv in range(0, 4):
vv = lookup(c, rv)
if vv:
print(" chip=0x%x rev=0x%x -> 0x%x size=0x%x" %
(c, rv, vv, r64(vv + 0x18) or 0))
except Exception as e:
print("live_probe_fail %s" % e)
break
try:
gdb.execute("detach")
except Exception:
pass
|
