DF-4169 / run.3.log
################ BASELINE (verbatim production code) ################ ===== [BASELINE] MODE layout ===== sizeof(struct pp_power_state) = 120 sizeof(struct smu8_power_state) = 200 offsetof(smu8_power_state, need_dfs_bypass) = 48 (0x30) <- :1051 first NULL write offsetof(smu8_power_state, action) = 64 (0x40) <- :1066 NULL read offsetof(smu8_power_state, levels) = 68 sizeof(struct smu8_power_level) = 16 levels[0xFFFFFFFF] byte offset = 0x1000000034 (64.0GB) <- :1321/:1601 when level==0 sizeof(phm_vce_clock_voltage_dependency_table) = 16, offsetof(entries) = 4, sizeof(record) = 12 vce entries[count-1] with count==0 (uint8_t -> int -1): table + 4 - 12 = table - 8 uvd entries[count-1] likewise: table - 8 load-time guard (:471-474): count=0 <= SMU8_MAX_HARDWARE_POWERLEVELS=8 -> PASSES (0 accepted) smu8_magic = 0x67dcba25 ----- exit=0 ----- ===== [BASELINE] MODE 4169-boot-chain ===== VBIOS power states parsed: 2, Boot-classified: NONE after psm_init_power_table: request_ps magic=0x0 current_ps magic=0x0 calling verbatim smu8_dpm_get_sclk(high): cast returns NULL (magic 0 != 0x67dcba25); :1321 first reads smu8_ps->level at NULL+4, then indexes levels[level-1] (cast result would be 0x800475f30 for a stamped state) !! SIGSEGV (addr=0x4, READ) while: smu8_dpm_get_sclk (sysfs clock query path) => NULL DEREF: READ at NULL+0x4 through a cast that returned NULL (magic mismatch) ----- exit=88 ----- ===== [BASELINE] MODE 4169-boot-chain-control ===== VBIOS power states parsed: 2, Boot-classified: YES (state 1) after psm_init_power_table: request_ps magic=0x67dcba25 current_ps magic=0x67dcba25 smu8_dpm_get_sclk(high) = 60000 (levels[1].engineClock) -- NO fault ----- exit=0 ----- ===== [BASELINE] MODE 4169-null-adjust-rules ===== request_ps magic=0x0 current_ps magic=0x0 (both kzalloc'd zeroed, never Boot-memcpy'd) calling verbatim smu8_apply_state_adjust_rules: :1051 smu8_ps->need_dfs_bypass = true -> write at NULL+0x30 !! SIGSEGV (addr=0x30, WRITE) while: smu8_apply_state_adjust_rules (power-state transition) => NULL DEREF: WRITE at NULL+0x30 through a cast that returned NULL (magic mismatch) ----- exit=88 ----- ===== [BASELINE] MODE 4169-null-get-sclk ===== request_ps magic=0x0; calling smu8_dpm_get_sclk(low): :1319 reads smu8_ps->levels[0].engineClock at NULL+0x44 !! SIGSEGV (addr=0x44, READ) while: smu8_dpm_get_sclk (sysfs clock query path) => NULL DEREF: READ at NULL+0x44 through a cast that returned NULL (magic mismatch) ----- exit=88 ----- ===== [BASELINE] MODE 4169-level0-get-sclk ===== request_ps magic=0x67dcba25 level=0; :1321 reads levels[level-1] = levels[0xFFFFFFFF] at state+0x1000000034 (~64GB away) !! SIGSEGV (addr=0x1800475f64, READ) while: smu8_dpm_get_sclk(high) with level==0 => fault 68719476900 bytes from the state base 0x800475ec0 (~64GB away): WILD levels[0xFFFFFFFF]-STYLE READ (level==0 underflow) ----- exit=88 ----- ===== [BASELINE] MODE 4169-level0-perf-unclamped ===== state magic=0x67dcba25 level=0, allocation = sizeof(pp_ps)+sizeof(smu8_ps) = 120 + 200 :1571 clamp `index > level-1 ? level-1 : index` becomes `9 > 0xFFFFFFFF ? ... : 9` -> level_index=9 (UNCLAMPED) :1572 reads levels[9].engineClock at state+0xd4 -- past the 200B smu8 tail !! SIGSEGV (addr=0x800476004, READ) while: smu8_get_performance_level(index=9) with level==0 => fault 324 bytes PAST THE END of the 320B object: OUT-OF-BOUNDS READ past the allocation (unclamped levels[index]) ----- exit=88 ----- ===== [BASELINE] MODE 4169-level0-shallow-sleep ===== state magic=0x67dcba25 level=0; :1601 reads levels[ps->level - 1] = levels[0xFFFFFFFF] (~64GB away) !! SIGSEGV (addr=0x1800475f6a, READ) while: smu8_get_current_shallow_sleep_clocks with level==0 => fault 68719476906 bytes from the state base 0x800475ec0 (~64GB away): WILD levels[0xFFFFFFFF]-STYLE READ (level==0 underflow) ----- exit=88 ----- ===== [BASELINE] MODE 4171-vce-count0 ===== vce table=0x800476000 count=0 (raw u8 numEntries from VBIOS; 0 <= 8 passes the :473 load-time guard) :1261 reads entries[count-1].ecclk = entries[-1] at 0x800475ff8 (table-8, in the leading guard page) !! SIGSEGV (addr=0x800475ff8, READ) while: smu8_dpm_update_vce_dpm, VCE table count==0, StablePState cap => fault 8 bytes BEFORE the start of the 8B table object: NEGATIVE-INDEX UNDERFLOW READ (entries[count-1] with count==0) ----- exit=88 ----- ===== [BASELINE] MODE 4171-uvd-count0-en-umd ===== uvd table=0x800476000 count=0; en_umd_pstate=true (no StablePState cap needed -- the user sysfs route) :1857 reads entries[count-1].vclk = entries[-1] at table-8 (leading guard page) !! SIGSEGV (addr=0x800475ff8, READ) while: smu8_dpm_update_uvd_dpm(bgate=false), UVD table count==0, en_umd_pstate (sysfs profile_*) => fault 8 bytes BEFORE the start of the 8B table object: NEGATIVE-INDEX UNDERFLOW READ (entries[count-1] with count==0) ----- exit=88 ----- ===== [BASELINE] MODE clean-valid ===== apply_state_adjust_rules rc=0 need_dfs_bypass=1 action=1 battery=0 get_sclk low=30000 high=60000 perf_level(Activity,1) rc=0 core=60000 mem=66600 vddc=1525 perf_level(PowerContainment,0) rc=0 core=60000 (threshold 50000 -> picks levels[1]) shallow_sleep rc=0 min=15000 max=15000 update_vce_dpm rc=0 hard_min_clk=300000 msgs: [0x20,0x1] update_uvd_dpm(bgate=false) rc=0 hard_min_clk=133300 msgs: [0x1c,0x1] uvdgate_calls=1 clean-valid: PASS (no fault, all values as computed) ----- exit=0 ----- ################ FIXED (same functions + this pack's fix.diff) ################ ===== [FIXED] MODE layout ===== sizeof(struct pp_power_state) = 120 sizeof(struct smu8_power_state) = 200 offsetof(smu8_power_state, need_dfs_bypass) = 48 (0x30) <- :1051 first NULL write offsetof(smu8_power_state, action) = 64 (0x40) <- :1066 NULL read offsetof(smu8_power_state, levels) = 68 sizeof(struct smu8_power_level) = 16 levels[0xFFFFFFFF] byte offset = 0x1000000034 (64.0GB) <- :1321/:1601 when level==0 sizeof(phm_vce_clock_voltage_dependency_table) = 16, offsetof(entries) = 4, sizeof(record) = 12 vce entries[count-1] with count==0 (uint8_t -> int -1): table + 4 - 12 = table - 8 uvd entries[count-1] likewise: table - 8 load-time guard (:471-474): count=0 <= SMU8_MAX_HARDWARE_POWERLEVELS=8 -> PASSES (0 accepted) smu8_magic = 0x67dcba25 ----- exit=0 ----- ===== [FIXED] MODE 4169-boot-chain ===== VBIOS power states parsed: 2, Boot-classified: NONE after psm_init_power_table: request_ps magic=0x0 current_ps magic=0x0 calling verbatim smu8_dpm_get_sclk(high): cast returns NULL (magic 0 != 0x67dcba25); :1321 first reads smu8_ps->level at NULL+4, then indexes levels[level-1] (cast result would be 0x800475f30 for a stamped state) smu8_dpm_get_sclk returned 4294967274 returned WITHOUT faulting (guard active in fixed build) ----- exit=0 ----- ===== [FIXED] MODE 4169-boot-chain-control ===== VBIOS power states parsed: 2, Boot-classified: YES (state 1) after psm_init_power_table: request_ps magic=0x67dcba25 current_ps magic=0x67dcba25 smu8_dpm_get_sclk(high) = 60000 (levels[1].engineClock) -- NO fault ----- exit=0 ----- ===== [FIXED] MODE 4169-null-adjust-rules ===== request_ps magic=0x0 current_ps magic=0x0 (both kzalloc'd zeroed, never Boot-memcpy'd) calling verbatim smu8_apply_state_adjust_rules: :1051 smu8_ps->need_dfs_bypass = true -> write at NULL+0x30 rc=-22 returned WITHOUT faulting (guard active in fixed build) ----- exit=0 ----- ===== [FIXED] MODE 4169-null-get-sclk ===== request_ps magic=0x0; calling smu8_dpm_get_sclk(low): :1319 reads smu8_ps->levels[0].engineClock at NULL+0x44 returned 4294967274 returned WITHOUT faulting (guard active in fixed build) ----- exit=0 ----- ===== [FIXED] MODE 4169-level0-get-sclk ===== request_ps magic=0x67dcba25 level=0; :1321 reads levels[level-1] = levels[0xFFFFFFFF] at state+0x1000000034 (~64GB away) returned 4294967274 returned WITHOUT faulting (guard active in fixed build) ----- exit=0 ----- ===== [FIXED] MODE 4169-level0-perf-unclamped ===== state magic=0x67dcba25 level=0, allocation = sizeof(pp_ps)+sizeof(smu8_ps) = 120 + 200 :1571 clamp `index > level-1 ? level-1 : index` becomes `9 > 0xFFFFFFFF ? ... : 9` -> level_index=9 (UNCLAMPED) :1572 reads levels[9].engineClock at state+0xd4 -- past the 200B smu8 tail rc=-22 coreClock=0 -- returned WITHOUT faulting (guard active in fixed build) ----- exit=0 ----- ===== [FIXED] MODE 4169-level0-shallow-sleep ===== state magic=0x67dcba25 level=0; :1601 reads levels[ps->level - 1] = levels[0xFFFFFFFF] (~64GB away) returned WITHOUT faulting (guard active in fixed build) (min=0 max=0) ----- exit=0 ----- ===== [FIXED] MODE 4171-vce-count0 ===== vce table=0x800476000 count=0 (raw u8 numEntries from VBIOS; 0 <= 8 passes the :473 load-time guard) :1261 reads entries[count-1].ecclk = entries[-1] at 0x800475ff8 (table-8, in the leading guard page) !! SIGSEGV (addr=0x800475ff8, READ) while: smu8_dpm_update_vce_dpm, VCE table count==0, StablePState cap => fault 8 bytes BEFORE the start of the 8B table object: NEGATIVE-INDEX UNDERFLOW READ (entries[count-1] with count==0) ----- exit=88 ----- ===== [FIXED] MODE 4171-uvd-count0-en-umd ===== uvd table=0x800476000 count=0; en_umd_pstate=true (no StablePState cap needed -- the user sysfs route) :1857 reads entries[count-1].vclk = entries[-1] at table-8 (leading guard page) !! SIGSEGV (addr=0x800475ff8, READ) while: smu8_dpm_update_uvd_dpm(bgate=false), UVD table count==0, en_umd_pstate (sysfs profile_*) => fault 8 bytes BEFORE the start of the 8B table object: NEGATIVE-INDEX UNDERFLOW READ (entries[count-1] with count==0) ----- exit=88 ----- ===== [FIXED] MODE clean-valid ===== apply_state_adjust_rules rc=0 need_dfs_bypass=1 action=1 battery=0 get_sclk low=30000 high=60000 perf_level(Activity,1) rc=0 core=60000 mem=66600 vddc=1525 perf_level(PowerContainment,0) rc=0 core=60000 (threshold 50000 -> picks levels[1]) shallow_sleep rc=0 min=15000 max=15000 update_vce_dpm rc=0 hard_min_clk=300000 msgs: [0x20,0x1] update_uvd_dpm(bgate=false) rc=0 hard_min_clk=133300 msgs: [0x1c,0x1] uvdgate_calls=1 clean-valid: PASS (no fault, all values as computed) ----- exit=0 -----