DF-1272 / tonga_sclk_voltage_offset_overflow.c
/* * DF-1272 trigger note — tonga VBIOS vdd_dep_on_sclk->count Sclk_voltageOffset overflow. * * Bug (sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1620 * tonga_populate_clock_stretcher_data_table): * uint8_t i; * for (i = 0; i < sclk_table->count; i++) { // sclk_table=vdd_dep_on_sclk * ... * smu_data->smc_state_table.Sclk_voltageOffset[i] = volt_offset; // sized [8] * } * smu72_discrete.h:344 Sclk_voltageOffset[8] * sclk_table->count from VBIOS ucNumEntries (u8 1-255; only !=0 check at parse). * i >= 8 -> overflow into ClockStretcherDataTable / CKS_LOOKUPTable / past * DpmTable into the tonga_smumgr power_tune_defaults pointer. * Gated by PHM_PlatformCaps_ClockStretcher capability. * * Reachability on the audit guest: * amdgpu.ko module-only (NOT in base kernel); runs only on AMD Tonga HW whose * VBIOS enables clock stretching. QEMU guest has no AMD GPU; amdgpu.ko not * loaded. Not triggerable here; latent on real Tonga hardware. * * Documentation/no-trigger PoC. See VERDICT.md + fix.diff. */ #include <stdio.h> int main(void) { printf("[DF-1272] tonga sclk_table->count -> Sclk_voltageOffset[8] overflow.\n" "[DF-1272] Sink in loadable amdgpu.ko (module-only); driven by VBIOS on\n" "[DF-1272] AMD Tonga hardware (clock-stretcher cap). Not triggerable on\n" "[DF-1272] this QEMU guest. Bug confirmed in source; see VERDICT.md + fix.diff.\n"); return 0; } |