blob: beb4bd89394b3d5cb47c72367c6b0c4122f9d24b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
#!/bin/bash
# SPDX-License-Identifier: BSD-3-Clause
#
# host_gdb_descriptor.sh - dump libcuda's per-engine registration records on
# the HOST (real GPU = golden reference) at the same code path where the
# guest crashes.
#
# The host and guest libcuda builds share the exact instruction sequence of
# the engine-registration helper; the host's copy sits at file vaddr
# 0x454470 in 570.211.01 (guest: 0x453ef0 in 570.144). This script finds the
# pattern anywhere in a given library and runs cdt under gdb with breakpoints
# at the helper entry and the dispatch-hook call, printing the 6-dword engine
# record (rsi) and the hook target.
#
# Usage: scripts/host_gdb_descriptor.sh [binary-to-run]
# env: HOST_LIBCUDA (default /usr/lib/x86_64-linux-gnu/libcuda.so.1)
set -e
BIN="${1:-/tmp/opencode/cdt_host}"
LIBCUDA="${HOST_LIBCUDA:-/usr/lib/x86_64-linux-gnu/libcuda.so.1}"
CUINIT_VADDR=$((16#30cb60)) # cuInit file vaddr (570.211.01)
[ -x "$BIN" ] || { echo "build cdt first: gcc -O1 -o $BIN tools/test/cuda_drv_test.c -ldl"; exit 1; }
python3 - "$LIBCUDA" <<'PY'
import sys
pat = bytes.fromhex("55b8000000004889e5415741564155"
"4989f5415441bc02000000534889fb4883ec18448b36")
dat = open(sys.argv[1], "rb").read()
i = dat.find(pat)
print("helper pattern at vaddr 0x%x" % i if i >= 0 else "pattern NOT FOUND")
PY
gdb -batch \
-ex "set pagination off" \
-ex "set confirm off" \
-ex "set breakpoint pending on" \
-ex "break cuInit" \
-ex "run" \
-ex "python
import gdb
a = int(gdb.parse_and_eval('(unsigned long)cuInit'))
base = a - $CUINIT_VADDR
print('HOST libcuda base=0x%x' % base)
gdb.execute('delete 1')
b = gdb.Breakpoint('*0x%x' % (base+0x454470))
gdb.execute('commands ' + str(b.number) + '\nsilent\nprintf \"HELPER desc=%p obj=%p thread=%d\\n\", \$rsi, \$rdi, \$_thread\nx/6wx \$rsi\ncontinue\nend')
c = gdb.Breakpoint('*0x%x' % (base+0x4544df))
gdb.execute('commands ' + str(c.number) + '\nsilent\nprintf \"HOOKCALL rax=%p hook=%p\\n\", \$rax, *(void**)(\$rax+0x530)\ncontinue\nend')
end" \
-ex "continue" \
"$BIN"
|
