⬢ DragonFlyBSD Kernel Audit
DF-3614 / run.log
← back to finding ↓ download raw
== DF-3614 harness: VDDCI SVI2 dependency table count=255 (no trim) ==

sizeof(SISLANDS_SMC_HW_PERFORMANCE_LEVEL) = 148
sizeof(SISLANDS_SMC_SWSTATE)              = 152
sizeof(SISLANDS_SMC_STATETABLE)           = 3012
offsetof(lowSMIO) = 4, lowSMIO spans 4..132 (32 entries x 4)
last byte touched by buggy loop: lowSMIO[254] at offset 1020 (STATETABLE size 3012)

[A] Buggy loop (si_dpm.c:4046-4047, count=255):
    lowSMIO[0]=0xa5a55a5a  lowSMIO[31]=0xa5a55a5a  lowSMIO[32]=0xa5a55a5a (OOB start)
    voltageMaskTable.lowMask[0] (VDDC mask) = 0xa5a55a5a  CORRUPTED
    phaseMaskTable.lowMask[0]                = 0xa5a55a5a  CORRUPTED
    dpm2Params.TDPLimit                      = 0xa5a55a5a  CORRUPTED
    initialState.levels[0].sclk.sclk_value   = 0xa5a55a5a  CORRUPTED
    driverState.flags/levelCount: before 0x5a/0x5a -> after 0x5a/0x5a
    papm_parm.NearTDPLimitTherm (past STATETABLE, still in si_power_info) = 0x00000000
    first corrupted byte at allocation offset 68; last touched offset 1087 (all inside one kzalloc'd si_power_info: contained corruption of SMC-bound config)
    >>> In kernel: corrupted voltageMaskTable/dpm2Params/state levels are
        copied to the GPU SMC (si_dpm.c:4779-4781) -> wrong voltage masks /
        TDP limits / state clocks programmed on the GPU <<<

[B] Fixed loop (fix.diff: `i < count && i < SISLANDS_MAX_NO_VREG_STEPS`):
    lowSMIO[0]=0xa5a55a5a lowSMIO[31]=0xa5a55a5a lowSMIO[32]=0x00000000 (untouched)
    voltageMaskTable.lowMask[0]=0x00000000 dpm2Params.TDPLimit=0x00000000 (intact)
RUN_RC=0