DF-3703 / trigger_notes.c
/* * DF-3703 trigger documentation (hardware-gated; see README.md). * * 1) VBIOS recipe: ATOM_Vega10_GFXCLK_Dependency_Table.ucNumEntries = 32 (any >8), * entries with attacker-chosen ulClk/ucVddInd/cks fields. OD enabled in pptable * (so hwmgr->od_enabled). SOCCLK/MCLK tables likewise optional. * 2) Fire at driver load: vega10_init_smc_table (:2478-2484, od_enabled && !max_vddc) * -> vega10_odn_initial_default_setting * -> :322-323 smu_get_voltage_dependency_table_ppt_v1(dep, od) * (smu_helper.c:684-695: for (i=0;i<allowed->count;i++) dep->entries[i] = ...) * od = &odn_dpm_table.vdd_dep_on_sclk -> entries[8] fixed => 24 records written * past the array into the rest of struct vega10_hwmgr (heap). * OR as root on such a machine: echo r > /sys/.../pp_od_clock_voltage (:4874) * -> same copy; echo c > ... (:4877) -> check_dpm_table_updated OOB reads; * echo s 3 1600 1150 > ... -> odn_update_soc_table (:4900) writes entries[i]/dpm_levels[i] * for i < socclk dep count past entries[8]/dpm_levels[8] (:4821-4828). */ int df3703_trigger_documentation; |