Since systemtap due to some unclear bugs is not working I went other way.
Here is piece of linux kernel instrumentation
arch/x86/kernel/process_64.h
do_arch_prctl_64
case ARCH_SET_FS: {
/* Not strictly needed for fs, but do it for symmetry
with gs */
unsigned long base;
if (arg2 >= TASK_SIZE_MAX)
return -EPERM;
// instumentation for nvidia spoiled thread context
if( ! strncmp( current->comm, “Xorg.nz”, 7) ) {
rdmsrl(MSR_FS_BASE, base);
if ( base != 0 ) {
printk(“SET_FS_BASE %p old %p pid %d tid %d ptrace %x\n”,(void )arg2,(void)base, task_tgid_vnr(current),task_pid_vnr(current),current->ptrace);
dump_stack();
if ( current->ptrace & PT_PTRACED ) {
printk(“send signal\n”);
send_sig(SIGTRAP,current,0);
}
}
}
// end if instrumentation
cpu = get_cpu();
task->thread.fsindex = 0;
task->thread.fsbase = arg2;
if (doit) {
/* set the selector to 0 to not confuse __switch_to */
loadsegment(fs, 0);
ret = wrmsrl_safe(MSR_FS_BASE, arg2);
}
put_cpu();
break;
gdb --args /usr/libexec/Xorg.nz :8 -config /usr/local/etc/bumblebee/xorg.conf.nvidia -configdir /usr/local/etc/bumblebee/xorg.conf.d -sharevts -nolisten tcp -noreset -verbose 3 -isolateDevice PCI:01:00:0 -modulepath /usr/lib64/xorg/modules/extensions/nvidia,/usr/lib64/xorg/modules,/usr/lib64/modules/extensions,/usr/lib64/xorg/modules/input
Program received signal SIGTRAP, Trace/breakpoint trap.
0x00007ffff21e98ea in _nv006tls () from /lib64/tls/libnvidia-tls.so.384.69
Missing separate debuginfos, use: dnf debuginfo-install audit-libs-2.7.7-1.fc26.x86_64 bzip2-libs-1.0.6-22.fc26.x86_64 dbus-libs-1.11.16-1.fc26.x86_64 freetype-2.7.1-9.fc26.x86_64 libXau-1.0.8-7.fc26.x86_64 libXdmcp-1.1.2-6.fc26.x86_64 libXfont2-2.0.1-3.fc26.x86_64 libbsd-0.8.3-3.fc26.x86_64 libcap-2.25-5.fc26.x86_64 libcap-ng-0.7.8-3.fc26.x86_64 libdrm-2.4.82-1.fc26.x86_64 libfontenc-1.1.3-4.fc26.x86_64 libgcc-7.1.1-3.fc26.x86_64 libgcrypt-1.7.8-1.fc26.x86_64 libgpg-error-1.25-2.fc26.x86_64 libpciaccess-0.13.4-4.fc26.x86_64 libpng-1.6.28-2.fc26.x86_64 libselinux-2.6-7.fc26.x86_64 libunwind-1.2-1.fc26.x86_64 libxshmfence-1.2-4.fc26.x86_64 lz4-libs-1.8.0-1.fc26.x86_64 openssl-libs-1.1.0f-7.fc26.x86_64 pcre-8.41-1.fc26.x86_64 pixman-0.34.0-3.fc26.x86_64 systemd-libs-233-6.fc26.x86_64 xz-libs-5.2.3-2.fc26.x86_64 zlib-1.2.11-2.fc26.x86_64
(gdb) bt
#0 0x00007ffff21e98ea in _nv006tls () from /lib64/tls/libnvidia-tls.so.384.69
#1 0x00007ffff2a4b456 in ?? () from /usr/lib64/xorg/modules/extensions/nvidia/libglx.so
#2 0x00007ffff2d14f05 in ?? () from /usr/lib64/xorg/modules/extensions/nvidia/libglx.so
#3 0x000000000082bb48 in pushToken ()
#4 0x000000000000001c in ?? ()
#5 0x0000000000000200 in ?? ()
#6 0x0000000000000000 in ?? ()
(gdb) disass _nv006tls
Dump of assembler code for function _nv006tls:
0x00007ffff21e9860 <+0>: push %rbx
0x00007ffff21e9861 <+1>: mov %rdx,%rbx
0x00007ffff21e9864 <+4>: mov %edi,%edx
0x00007ffff21e9866 <+6>: sub $0x20,%rsp
0x00007ffff21e986a <+10>: cmpl $0xffffffff,0x2024f7(%rip) # 0x7ffff23ebd68
0x00007ffff21e9871 <+17>: mov %esi,(%rsp)
0x00007ffff21e9874 <+20>: mov %rbx,0x8(%rsp)
0x00007ffff21e9879 <+25>: je 0x7ffff21e9900 <_nv006tls+160>
0x00007ffff21e987f <+31>: test %dl,%dl
0x00007ffff21e9881 <+33>: je 0x7ffff21e98a0 <_nv006tls+64>
0x00007ffff21e9883 <+35>: mov 0x2024df(%rip),%eax # 0x7ffff23ebd68
0x00007ffff21e9889 <+41>: mov $0xffffffffffffffff,%rsi
0x00007ffff21e9890 <+48>: test %eax,%eax
0x00007ffff21e9892 <+50>: je 0x7ffff21e98a0 <_nv006tls+64>
0x00007ffff21e9894 <+52>: mov %rsi,%rdx
0x00007ffff21e9897 <+55>: add $0x20,%rsp
0x00007ffff21e989b <+59>: mov %rdx,%rax
0x00007ffff21e989e <+62>: pop %rbx
0x00007ffff21e989f <+63>: retq
0x00007ffff21e98a0 <+64>: mov $0x300,%esi
0x00007ffff21e98a5 <+69>: mov $0x1,%edi
0x00007ffff21e98aa <+74>: callq 0x7ffff21e9800 calloc@plt
0x00007ffff21e98af <+79>: xor %edx,%edx
0x00007ffff21e98b1 <+81>: test %rax,%rax
0x00007ffff21e98b4 <+84>: je 0x7ffff21e9897 <_nv006tls+55>
0x00007ffff21e98b6 <+86>: mov %rax,%rsi
0x00007ffff21e98b9 <+89>: movq $0x0,0xa0(%rax)
0x00007ffff21e98c4 <+100>: movl $0x0,0xa8(%rax)
0x00007ffff21e98ce <+110>: mov %rax,(%rsi)
0x00007ffff21e98d1 <+113>: mov %ebx,%eax
0x00007ffff21e98d3 <+115>: mov $0x1002,%edi
0x00007ffff21e98d8 <+120>: and $0x3ff,%eax
0x00007ffff21e98dd <+125>: mov %eax,0x2f8(%rsi)
0x00007ffff21e98e3 <+131>: mov $0x9e,%eax
0x00007ffff21e98e8 <+136>: syscall
=> 0x00007ffff21e98ea <+138>: test %eax,%eax
0x00007ffff21e98ec <+140>: jns 0x7ffff21e9894 <_nv006tls+52>
0x00007ffff21e98ee <+142>: mov %rsi,%rdi
0x00007ffff21e98f1 <+145>: callq 0x7ffff21e97f0 free@plt
0x00007ffff21e98f6 <+150>: xor %esi,%esi
0x00007ffff21e98f8 <+152>: jmp 0x7ffff21e9894 <_nv006tls+52>
0x00007ffff21e98fa <+154>: nopw 0x0(%rax,%rax,1)
0x00007ffff21e9900 <+160>: lea 0x18(%rsp),%rsi
0x00007ffff21e9905 <+165>: mov $0x9e,%eax
info thread
Id Target Id Frame
- 1 Thread 0x8f1400 (LWP 2256) “Xorg.nz” 0x00007ffff21e98ea in _nv006tls ()
from /lib64/tls/libnvidia-tls.so.384.69
dmesg
[ 230.768057] SET_FS_BASE 00000000008f1400 old 00007ffff7f0ea40 pid 2256 tid 2256 ptrace 8001f9
[ 230.768061] CPU: 5 PID: 2256 Comm: Xorg.nz Tainted: G O 4.12.9-300.fc26.nz.x86_64 #5
[ 230.768063] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z270 Gaming-ITX/ac, BIOS P2.30 07/14/2017
[ 230.768065] Call Trace:
[ 230.768070] dump_stack+0x8e/0xcd
[ 230.768074] do_arch_prctl_64+0x26a/0x2a0
[ 230.768078] SyS_arch_prctl+0x2a/0x50
[ 230.768082] entry_SYSCALL_64_fastpath+0x1f/0xbe
[ 230.768084] RIP: 0033:0x7ffff21e98ea
[ 230.768086] RSP: 002b:00007fffffffdea0 EFLAGS: 00003246 ORIG_RAX: 000000000000009e
[ 230.768089] RAX: ffffffffffffffda RBX: 00007ffff5842b38 RCX: 00007ffff21e98ea
[ 230.768091] RDX: 0000000000000000 RSI: 00000000008f1400 RDI: 0000000000001002
[ 230.768093] RBP: 00007ffff5842ae0 R08: 00000000008f1400 R09: 00000000000005cb
[ 230.768094] R10: 000000000000002a R11: 0000000000003246 R12: 00007ffff5842b38
[ 230.768096] R13: 0000000000000750 R14: 00007ffff5842b38 R15: 000000000000270e
[ 230.768101] send signal
What the $$$$
libnvidia-tls.so.384.69
changes thread context ???
and doesn’t return it back?