โฌข DragonFlyBSD Kernel Audit
DF-3862 / tdr_race.c
โ† back to finding โ†“ download raw
/*
 * DF-3862 trigger skeleton โ€” race the TDR (GPU reset) against completion
 * of the timed-out job.  Requires amdgpu hardware and
 *   hw.amdgpu.gpu_recovery=1  (loader tunable / module parameter)
 *
 * Strategy: submit alternating (a) a long-running compute IB that provokes
 * the lockup timeout, and (b) short jobs on the same entity that complete
 * just as the TDR fires, so drm_sched_job_timedout() picks a job whose
 * fence is being signaled concurrently โ€” the lifetime race documented in
 * amdgpu_device.c:3414/3417/3438.
 *
 * Not runnable on the audit guest (no AMD GPU, no /dev/dri).
 */
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>

int main(void)
{
	int fd = open("/dev/dri/renderD128", O_RDWR);
	if (fd < 0) {
		printf("open(/dev/dri/renderD128): %s โ€” no AMD GPU on this "
		       "system; TDR path unreachable (see VERDICT.md)\n",
		       strerror(errno));
		return 1;
	}
	/* On hardware:
	 *  1. create compute context (AMDGPU_CTX)
	 *  2. loop: cs_submit of an endless-loop IB (hang > lockup_timeout)
	 *     interleaved with 1-shot IBs, two threads: one submits, one
	 *     immediately amdgpu_cs_wait_fence()es the short jobs to force
	 *     completion racing the TDR.
	 *  3. watch for panic/backtrace referencing
	 *     amdgpu_device_gpu_recover after job free
	 *     (drm_sched_job_finish -> amdgpu_job_free_cb).
	 */
	printf("hardware present: implement CS hang+complete race here\n");
	close(fd);
	return 0;
}