⬢ DragonFlyBSD Kernel Audit
DF-3703 / trigger_notes.c
← back to finding ↓ download raw
/*
 * DF-3703 trigger documentation (hardware-gated; see README.md).
 *
 * 1) VBIOS recipe: ATOM_Vega10_GFXCLK_Dependency_Table.ucNumEntries = 32 (any >8),
 *    entries with attacker-chosen ulClk/ucVddInd/cks fields. OD enabled in pptable
 *    (so hwmgr->od_enabled). SOCCLK/MCLK tables likewise optional.
 * 2) Fire at driver load: vega10_init_smc_table (:2478-2484, od_enabled && !max_vddc)
 *      -> vega10_odn_initial_default_setting
 *      -> :322-323 smu_get_voltage_dependency_table_ppt_v1(dep, od)
 *         (smu_helper.c:684-695: for (i=0;i<allowed->count;i++) dep->entries[i] = ...)
 *         od = &odn_dpm_table.vdd_dep_on_sclk -> entries[8] fixed  => 24 records written
 *         past the array into the rest of struct vega10_hwmgr (heap).
 *    OR as root on such a machine:  echo r > /sys/.../pp_od_clock_voltage  (:4874)
 *      -> same copy;  echo c > ... (:4877) -> check_dpm_table_updated OOB reads;
 *      echo s 3 1600 1150 > ... -> odn_update_soc_table (:4900) writes entries[i]/dpm_levels[i]
 *      for i < socclk dep count past entries[8]/dpm_levels[8] (:4821-4828).
 */
int df3703_trigger_documentation;