⬢ DragonFlyBSD Kernel Audit
DF-3705 / trigger_notes.c
← back to finding ↓ download raw
/*
 * DF-3705 trigger documentation (hardware-gated).
 * VBIOS recipe: ATOM_Vega10_GFXCLK_Dependency_Table.ucNumEntries = 32, entries with
 *   ucCksEnable/ucCksVoffset set; PP_CLOCK_STRETCH_MASK set in feature mask so
 *   registry_data.clock_stretcher_support is true (vega10_set_default_registry_data :121).
 * Driver load: vega10_enable_dpm_tasks :2911 -> vega10_init_smc_table :2550-2554 ->
 *   vega10_populate_clock_stretcher_table :2060:
 *     for (i = 0; i < 32; i++) pp_table->CksEnable[i] = ...;   // CksEnable[8]!
 *   => 24 attacker-influenced bytes past CksEnable/CksVidOffset into PPTable_t +
 *   adjacent vega10_hwmgr state; same shape for StaticVoltageOffsetVid (:2143, AVFS on),
 *   UvdDpmVoltageIndex (:2030, MM dep ucNumEntries=16) and SocVid (:1700, lookup count>8).
 */
int df3705_trigger_documentation;