DF-1141 / run.sh
#!/bin/sh # DF-1141 runtime trigger is NOT exercisable on this guest. # # The vulnerable code (ci_setup_default_dpm_tables in amdgpu ci_dpm.c) runs # only when the amdgpu driver attaches to a Sea Islands (Bonaire/Hawaii) # AMD GPU and parses its VBIOS PowerPlay tables at DPM init. This QEMU/KVM # guest has no AMD GPU (only QEMU std VGA 0x1234:0x1111), and amdgpu is not # in the GENERIC kernel, so the path is unreachable here. # # Realistic threat model (physical HW / VFIO passthrough / reflashed VBIOS): # A malicious/reflashed VBIOS with ucNumEntries > 8 in the # vddc_dependency_on_sclk / mclk / vddci / mvdd dependency tables drives # the loops at ci_dpm.c:3621/3634/3646/3657/3667 past the fixed # dpm_levels[MAX_REGULAR_DPM_NUMBER=8] arrays, corrupting adjacent # ci_power_info fields (golden_dpm_table, voltage_control, SMC offsets). # # What WAS validated here: source-trace of the unbounded loops (see # VERDICT.md) and that fix.diff applies + compiles (see build.log). echo "DF-1141: runtime trigger requires AMD Sea Islands GPU + malicious VBIOS." echo " Not exercisable on this QEMU/KVM guest (no AMD GPU)." echo " See VERDICT.md for the source-level confirmation + fix." exit 0 |