big bs

geohot · Jun 4, 2022 · 3a35d84 · 3a35d84
1 parent 5e27b96
commit 3a35d84
Show file tree

Hide file tree

Showing 2 changed files with 63 additions and 24 deletions.
diff --git a/gpu_driver.cc b/gpu_driver.cc
@@ -134,6 +134,8 @@ void kick(int cb_index) {
   *addr = cb_index;
 }
 
+#define GPU_UUID "\xb4\xe9\x43\xc6\xdc\xb5\x96\x92\x6d\xb1\x04\x69\x18\x65\x8d\x08"
+
 NvHandle alloc_object(int fd_ctl, NvV32 hClass, NvHandle root, NvHandle parent, void *params) {
   NVOS21_PARAMETERS p = {0};
   p.hRoot = root;
@@ -197,24 +199,6 @@ int main(int argc, char *argv[]) {
     void *gpu_mmio_ptr = mmap_object(fd_ctl, root, subdevice, usermode, (void*)0xfbbb0000, 0x10000, NULL, 2);
     assert(gpu_mmio_ptr == (void *)0x13370000);
 
-    NvHandle mem;
-    {
-      NVOS32_PARAMETERS p = {0};
-      auto asz = &p.data.AllocSize;
-      p.hRoot = root;
-      p.hObjectParent = device;
-      p.function = NVOS32_FUNCTION_ALLOC_SIZE;
-      asz->owner = root;
-      //asz->flags = 0x1c101;
-      asz->flags = NVOS32_ALLOC_FLAGS_IGNORE_BANK_PLACEMENT | NVOS32_ALLOC_FLAGS_ALIGNMENT_FORCE | NVOS32_ALLOC_FLAGS_MEMORY_HANDLE_PROVIDED |
-        NVOS32_ALLOC_FLAGS_MAP_NOT_REQUIRED | NVOS32_ALLOC_FLAGS_PERSISTENT_VIDMEM;
-      asz->size = 0x200000;
-      int ret = ioctl(fd_ctl, __NV_IOWR(NV_ESC_RM_VID_HEAP_CONTROL, p), &p);
-      mem = asz->hMemory;
-    }
-    void *local_ptr = mmap_object(fd_ctl, root, subdevice, mem, (void*)0xd2580000, 0x200000, (void*)0x200400000, 0xc0000);
-    assert(local_ptr == (void *)0x200400000);
-
     NV_VASPACE_ALLOCATION_PARAMETERS vap = {0};
     vap.flags = NV_VASPACE_ALLOCATION_FLAGS_ENABLE_PAGE_FAULTING | NV_VASPACE_ALLOCATION_FLAGS_IS_EXTERNALLY_OWNED;
     vap.vaBase = 0x1000;
@@ -223,7 +207,7 @@ int main(int argc, char *argv[]) {
     {
       UVM_REGISTER_GPU_PARAMS p = {0};
       // TODO: where do numbers come from?
-      memcpy(&p.gpu_uuid.uuid, "\xb4\xe9\x43\xc6\xdc\xb5\x96\x92\x6d\xb1\x04\x69\x18\x65\x8d\x08", 0x10);
+      memcpy(&p.gpu_uuid.uuid, GPU_UUID, 0x10);
       p.rmCtrlFd = 0xffffffff;
       int ret = ioctl(fd_uvm, UVM_REGISTER_GPU, &p);
       assert(ret == 0);
@@ -236,7 +220,7 @@ int main(int argc, char *argv[]) {
     {
       UVM_REGISTER_GPU_VASPACE_PARAMS p = {0};
       // TODO: where do numbers come from?
-      memcpy(&p.gpuUuid.uuid, "\xb4\xe9\x43\xc6\xdc\xb5\x96\x92\x6d\xb1\x04\x69\x18\x65\x8d\x08", 0x10);
+      memcpy(&p.gpuUuid.uuid, GPU_UUID, 0x10);
       p.rmCtrlFd = fd_ctl;
       p.hClient = root;
       p.hVaSpace = vaspace;
@@ -252,9 +236,50 @@ int main(int argc, char *argv[]) {
     cap.hVASpace = vaspace;
     cap.flags = 1;
     NvHandle share = alloc_object(fd_ctl, FERMI_CONTEXT_SHARE_A, root, channel_group, &cap);
+
+
+    NvHandle mem;
+    {
+      NVOS32_PARAMETERS p = {0};
+      auto asz = &p.data.AllocSize;
+      p.hRoot = root;
+      p.hObjectParent = device;
+      p.function = NVOS32_FUNCTION_ALLOC_SIZE;
+      asz->owner = root;
+      //asz->flags = 0x1c101;
+      asz->flags = NVOS32_ALLOC_FLAGS_IGNORE_BANK_PLACEMENT | NVOS32_ALLOC_FLAGS_ALIGNMENT_FORCE | NVOS32_ALLOC_FLAGS_MEMORY_HANDLE_PROVIDED |
+        NVOS32_ALLOC_FLAGS_MAP_NOT_REQUIRED | NVOS32_ALLOC_FLAGS_PERSISTENT_VIDMEM;
+      asz->size = 0x200000;
+      int ret = ioctl(fd_ctl, __NV_IOWR(NV_ESC_RM_VID_HEAP_CONTROL, p), &p);
+      mem = asz->hMemory;
+    }
+    void *local_ptr = mmap_object(fd_ctl, root, subdevice, mem, (void*)0xd2580000, 0x200000, (void*)0x200400000, 0xc0000);
+    assert(local_ptr == (void *)0x200400000);
+
+    {
+      UVM_CREATE_EXTERNAL_RANGE_PARAMS p = {0};
+      p.base = (NvU64)local_ptr;
+      p.length = 0x200000;
+      int ret = ioctl(fd_uvm, UVM_CREATE_EXTERNAL_RANGE, &p);
+      assert(ret == 0);
+    }
+    {
+      UVM_MAP_EXTERNAL_ALLOCATION_PARAMS p = {0};
+      p.base = (NvU64)local_ptr;
+      p.length = 0x200000;
+      p.rmCtrlFd = fd_ctl;
+      p.hClient = root;
+      p.hMemory = mem;
+      p.gpuAttributesCount = 1;
+      memcpy(&p.perGpuAttributes[0].gpuUuid, GPU_UUID, 0x10);
+      p.perGpuAttributes[0].gpuMappingType = 1;
+      int ret = ioctl(fd_uvm, UVM_MAP_EXTERNAL_ALLOCATION, &p);
+      assert(ret == 0);
+    }
+
     exit(0);
 
-    NvHandle mem_error;
+    /*NvHandle mem_error;
     {
       NVOS32_PARAMETERS p = {0};
       auto asz = &p.data.AllocSize;
@@ -269,10 +294,10 @@ int main(int argc, char *argv[]) {
     }
     void *local_err_ptr = mmap_object(fd_ctl, root, subdevice, mem_error, (void*)0, 0x1000, (void*)0x200800000, 0xc0000);
     assert(local_err_ptr == (void *)0x200800000);
-    memset(local_err_ptr, 0, 0x1000);
+    memset(local_err_ptr, 0, 0x1000);*/
 
     NV_CHANNELGPFIFO_ALLOCATION_PARAMETERS fifoap = {0};
-    fifoap.hObjectError = mem_error; // wrong
+    //fifoap.hObjectError = mem_error; // wrong
     fifoap.hObjectBuffer = mem;
     fifoap.gpFifoOffset = 0x200400000;
     fifoap.gpFifoEntries = 0x400;

diff --git a/sniff.cc b/sniff.cc
@@ -454,7 +454,21 @@ int ioctl(int filedes, unsigned long request, void *argp) {
         }
         case UVM_MAP_EXTERNAL_ALLOCATION: {
           UVM_MAP_EXTERNAL_ALLOCATION_PARAMS *p = (UVM_MAP_EXTERNAL_ALLOCATION_PARAMS *)argp;
-          printf("UVM_MAP_EXTERNAL_ALLOCATION base:%llx length:%llx\n", p->base, p->length);
+          printf("UVM_MAP_EXTERNAL_ALLOCATION base:%llx length:%llx offset:%llx gpuAttributesCount: %d rmCtrlFd: %x hClient: %x hMemory: %x rmStatus:%x\n",
+            p->base, p->length, p->offset,
+            p->gpuAttributesCount,
+            p->rmCtrlFd,
+            p->hClient, p->hMemory,
+            p->rmStatus);
+          for (int i =0; i < p->gpuAttributesCount; i++) {
+            printf("  UVM(%d) gpuMappingType:%x gpuCachingType:%x gpuFormatType: %x gpuElementBits: %x gpuCompressionType: %x\n", i,
+              p->perGpuAttributes[i].gpuMappingType,
+              p->perGpuAttributes[i].gpuCachingType,
+              p->perGpuAttributes[i].gpuFormatType,
+              p->perGpuAttributes[i].gpuElementBits,
+              p->perGpuAttributes[i].gpuCompressionType
+            );
+          }
           break;
         }
         case UVM_REGISTER_GPU_VASPACE: {