/* * DF-4187 / DF-4188 / DF-4189 / DF-4190 — sumo_dpm.c pass-2 verification harness * ============================================================================= * Userspace replica of the vulnerable code paths in * sys/dev/drm/radeon/sumo_dpm.c (DragonFly 6.5-DEVELOPMENT, GLM-5.3 pass 2) * * The kernel functions below are copied VERBATIM from sumo_dpm.c (line numbers * cited in comments). Only the following are stubbed, none of which affect * the pointer/index arithmetic under test: * - le16_to_cpu()/le32_to_cpu() -> identity (little-endian host) * - WREG32/WREG32_P/RREG32 -> no-op counters / constant reads * (a WREG32 call budget detects the num_levels-1 underflow runaway loop * that would otherwise issue 2^32 register writes) * - r600_calculate_u_and_p() -> no-op * - kzalloc()/kfree() -> canary allocator with 64-byte poison * redzones on BOTH sides of every allocation + double-free/invalid-free * detection (replaces the kernel heap; the kernel code calls kzalloc/ * kfree in exactly the same places) * - atom_parse_data_header() -> satisfied by the caller (data_offset) * - the `if (!rdev->pm.power_state[i].clock_info) return -EINVAL;` check at * sumo_dpm.c:1498 references the legacy atombios power_state array, which * is populated before dpm init in the kernel and passes there; omitted. * - ATOM_PPLIB_POWERPLAYTABLE reduced to the three USHORT array offsets the * code actually reads; the VBIOS image is crafted with the same * definition (logic-level replica — see VERDICT.md). * * Modes: * 4187 no-BOOT-classified VBIOS power table -> sumo_dpm_enable() reaches * sumo_update_current_ps(rdev, boot_ps==NULL) -> NULL->ps_priv page * fault (kernel: page-fault panic; harness: SIGSEGV at 0x28) * 4188 kzalloc(struct sumo_ps) failure at state #1 -> parse kfrees * rdev->pm.dpm.ps and leaves it dangling -> (error swallowed per * radeon_pm.c:1448) -> sumo_dpm_fini kfrees it again -> DOUBLE FREE * 4189 power state with ucNumDPMLevels==0 -> ps->num_levels stays 0 -> * levels[num_levels-1] == levels[-1] reads 24 bytes BEFORE the * kzalloc'd struct sumo_ps (canary poison 0xA5); "4189z" uses a * zeroed neighbour to reach 65535*100/high_clk div-by-zero in * sumo_calculate_bsp (SIGFPE == kernel div0 panic) * 4190 power state with nonClockInfoIndex=250 -> nonClockInfo[250] reads * ~6 KB past the NonClockInfoArray / bios image (rps->class/caps * read from canary poison) * * Build: cc -O2 -Wall -std=gnu11 -o harness harness.c * cc -O2 -Wall -std=gnu11 -DFIX_ALL -o harness_fixed harness.c * (FIX_ALL compiles the proposed fixes; harness_fixed must complete every * mode without SIGSEGV/SIGFPE/runaway/double-free/poison reads.) */ #include #include #include #include #include #include #include #include #define ENOMEM 12 #define EINVAL 22 typedef uint8_t UCHAR; typedef uint16_t USHORT; typedef uint32_t ULONG; typedef uint32_t u32; typedef uint16_t u16; typedef uint8_t u8; #define le16_to_cpu(x) (x) #define le32_to_cpu(x) (x) #define DRM_ERROR(fmt, ...) printf("DRM_ERROR: " fmt "\n", ## __VA_ARGS__) /* ------------------------------------------------------------------ */ /* canary allocator: 64-byte poison redzones on both sides */ /* ------------------------------------------------------------------ */ #define POISON 0xA5 #define REDZONE 64 struct alloc_rec { void *obj; size_t sz; int live; }; static struct alloc_rec arec[8192]; static int arec_n; static int kmalloc_calls; static int kmalloc_fail_at = -1; /* 1-based: fail the Nth kzalloc */ static unsigned char poison_byte = POISON; static int canary_violations; static const char *kmalloc_tag; static void *kzalloc(size_t sz, int flags) { void *base; struct alloc_rec *r; size_t total = REDZONE + sz + REDZONE; (void)flags; kmalloc_calls++; if (kmalloc_fail_at == kmalloc_calls) { printf("[%s] kzalloc(#%d, %zu) -> INJECTED FAILURE (ENOMEM)\n", kmalloc_tag ? kmalloc_tag : "?", kmalloc_calls, sz); return NULL; } base = malloc(total); if (!base) return NULL; memset(base, poison_byte, REDZONE); /* front */ memset((char *)base + REDZONE + sz, poison_byte, REDZONE); /* rear */ memset((char *)base + REDZONE, 0, sz); /* zeroed */ r = &arec[arec_n++]; r->obj = (char *)base + REDZONE; r->sz = sz; r->live = 1; return r->obj; } static void kfree(void *p) { int i; if (p == NULL) return; for (i = 0; i < arec_n; i++) if (arec[i].obj == p) break; if (i == arec_n) { printf("*** CANARY ALLOCATOR: kfree(%p) of a pointer that is " "NOT a live allocation base (INVALID FREE / not the pointer " "that was allocated) ***\n", p); canary_violations++; return; } if (!arec[i].live) { printf("*** CANARY ALLOCATOR: DOUBLE FREE of %p (size %zu) " "DETECTED ***\n", p, arec[i].sz); canary_violations++; return; } arec[i].live = 0; /* redzones stay poisoned to catch later UAF reads */ } /* verify [p, p+len) lies inside one live allocation */ static int check_in_object(const char *what, const void *p, size_t len) { int i; for (i = 0; i < arec_n; i++) { char *o = arec[i].obj; if ((const char *)p >= o && (const char *)p + len <= o + arec[i].sz) return 1; /* in-bounds */ } printf("*** CANARY: %s at %p (len %zu) is OUTSIDE every live " "allocation -> heap OOB access ***\n", what, p, len); canary_violations++; return 0; } /* ------------------------------------------------------------------ */ /* minimal struct replicas (field ORDER faithful to the kernel) */ /* ------------------------------------------------------------------ */ #define SUMO_MAX_HARDWARE_POWERLEVELS 5 #define SUMO_MAX_NUMBER_VOLTAGES 4 struct sumo_pl { u32 sclk; u32 vddc_index; u32 ds_divider_index; u32 ss_divider_index; u32 allow_gnb_slow; u32 sclk_dpm_tdp_limit; }; struct sumo_ps { struct sumo_pl levels[SUMO_MAX_HARDWARE_POWERLEVELS]; /* FIRST member! */ u32 num_levels; u32 flags; }; #define SUMO_POWERSTATE_FLAGS_FORCE_NBPS1_STATE (1 << 0) #define SUMO_POWERSTATE_FLAGS_BOOST_STATE (1 << 1) enum radeon_vce_level { RADEON_VCE_LEVEL_NONE = 0 }; /* field order identical to sys/dev/drm/radeon/radeon.h:1342-1356 */ struct radeon_ps { u32 caps; u32 class; u32 class2; u32 vclk; u32 dclk; u32 evclk; u32 ecclk; bool vce_active; enum radeon_vce_level vce_level; void *ps_priv; }; struct radeon_dpm { struct radeon_ps *ps; int num_ps; struct radeon_ps *current_ps; struct radeon_ps *requested_ps; struct radeon_ps *boot_ps; struct radeon_ps *uvd_ps; void *priv; }; struct atom_context { uint8_t *bios; }; struct radeon_mode_info { struct atom_context *atom_context; }; struct radeon_device { struct radeon_mode_info mode_info; struct { struct radeon_dpm dpm; } pm; u16 _atom_data_offset; /* filled by the atom_parse_data_header stub */ }; /* ------------------------------------------------------------------ */ /* ATOM table replicas (packed like the kernel's #pragma pack(1)) */ /* ------------------------------------------------------------------ */ #define ATOM_PPLIB_CLASSIFICATION_BOOT (1<<0) #define ATOM_PPLIB_CLASSIFICATION_UVDSTATE (1<<5) #define ATOM_PPLIB_NONCLOCKINFO_VER1 12 typedef struct _ATOM_PPLIB_NONCLOCK_INFO { /* pptable.h:298 */ USHORT usClassification; UCHAR ucMinTemperature; UCHAR ucMaxTemperature; ULONG ulCapsAndSettings; UCHAR ucRequiredPower; USHORT usClassification2; ULONG ulVCLK; ULONG ulDCLK; UCHAR ucUnused[5]; } __attribute__((packed)) ATOM_PPLIB_NONCLOCK_INFO; typedef struct _ATOM_PPLIB_SUMO_CLOCK_INFO { /* pptable.h:413 */ USHORT usEngineClockLow; UCHAR ucEngineClockHigh; UCHAR vddcIndex; USHORT tdpLimit; USHORT rsv1; ULONG rsv2[2]; } __attribute__((packed)) ATOM_PPLIB_SUMO_CLOCK_INFO; typedef struct _ATOM_PPLIB_STATE_V2 { /* pptable.h:424 */ UCHAR ucNumDPMLevels; UCHAR nonClockInfoIndex; UCHAR clockInfoIndex[1]; } __attribute__((packed)) ATOM_PPLIB_STATE_V2; typedef struct _StateArray { /* pptable.h:438 */ UCHAR ucNumEntries; ATOM_PPLIB_STATE_V2 states[1]; } __attribute__((packed)) StateArray; typedef struct _ClockInfoArray { /* pptable.h:446 */ UCHAR ucNumEntries; UCHAR ucEntrySize; UCHAR clockInfo[1]; } __attribute__((packed)) ClockInfoArray; typedef struct _NonClockInfoArray { /* pptable.h:456 */ UCHAR ucNumEntries; UCHAR ucEntrySize; ATOM_PPLIB_NONCLOCK_INFO nonClockInfo[1]; } __attribute__((packed)) NonClockInfoArray; /* reduced ATOM_PPLIB_POWERPLAYTABLE: the three USHORT array offsets * (sumo_dpm.c reads only these via union power_info.pplib) */ typedef struct { USHORT usStateArrayOffset; USHORT usClockInfoArrayOffset; USHORT usNonClockInfoArrayOffset; } __attribute__((packed)) PPLIB_MIN; union power_info { PPLIB_MIN pplib; }; union pplib_clock_info { ATOM_PPLIB_SUMO_CLOCK_INFO sumo; }; union pplib_power_state { struct { UCHAR ucNumDPMLevels; UCHAR nonClockInfoIndex; UCHAR clockInfoIndex[8]; } v2; }; /* ------------------------------------------------------------------ */ /* sumo private state + register stubs */ /* ------------------------------------------------------------------ */ struct sumo_sys_info { u32 bootup_sclk; u32 min_sclk; u32 bootup_nb_voltage_index; u32 boost_sclk; u32 boost_vid_2bit; u32 sclk_dpm_tdp_limit_boost; int enable_boost; }; struct sumo_power_info { u32 asi, pasi, bsp, bsu, pbsp, pbsu, dsp, psp; struct sumo_sys_info sys_info; struct sumo_pl boot_pl, acpi_pl, boost_pl; bool enable_sclk_ds, enable_dynamic_patch_ps, enable_dpm, enable_boost; bool enable_auto_thermal_throttling; struct radeon_ps current_rps, requested_rps; struct sumo_ps current_ps, requested_ps; }; /* register plumbing stubs (pure no-ops in the harness) */ #define CG_BSP_0 0 #define SCLK_PWRMGT_CNTL 0 #define FIR_RESET 2 #define CG_AT_0 0 #define CG_R(x) (x) #define CG_L(x) (x) #define CG_R_MASK 0xffff #define CG_L_MASK 0xffff #define CG_FFCT_0 0 #define UTC_0(x) (x) #define DTC_0(x) (x) #define UTC_0_MASK 0xff #define DTC_0_MASK 0xff #define CG_SCLK_DPM_CTRL_3 0 #define DPM_SCLK_ENABLE 2 #define SCLK_OVERCLK_DETECT 1 #define TARGET_AND_CURRENT_PROFILE_INDEX 0 #define CURR_SCLK_INDEX_MASK 0xff #define CURR_INDEX_MASK 0xf static long wreg_budget = 1000000; static void wreg_hit(void) { if (--wreg_budget < 0) { printf("*** WREG32 budget exhausted: runaway register-write " "loop (u32 num_levels-1 underflow -> 2^32 iterations in " "the kernel: MMIO hang / watch-dog DoS) ***\n"); canary_violations++; exit(97); } } #define WREG32(r, v) do { (void)(r); (void)(v); wreg_hit(); } while (0) #define WREG32_P(r, v, m) do { (void)(r); (void)(v); (void)(m); wreg_hit(); } while (0) #define RREG32(r) (0) static void r600_calculate_u_and_p(u32 a, u32 b, int c, u32 *p, u32 *u) { (void)a; (void)b; (void)c; *p = 0; *u = 0; } static u32 radeon_get_xclk(struct radeon_device *rdev) { (void)rdev; return 10000; } static const u32 sumo_utc[15] = {0}; static const u32 sumo_dtc[15] = {0}; /* forward decls */ static int sumo_dpm_set_power_state(struct radeon_device *rdev); /* ================================================================== */ /* VERBATIM kernel code below — sys/dev/drm/radeon/sumo_dpm.c */ /* ================================================================== */ /* sumo_dpm.c:77-82 */ static struct sumo_ps *sumo_get_ps(struct radeon_ps *rps) { struct sumo_ps *ps = rps->ps_priv; return ps; } /* sumo_dpm.c:84-89 */ static struct sumo_power_info *sumo_get_pi(struct radeon_device *rdev) { struct sumo_power_info *pi = rdev->pm.dpm.priv; return pi; } /* sumo_dpm.c:317-334 */ static void sumo_calculate_bsp(struct radeon_device *rdev, u32 high_clk) { struct sumo_power_info *pi = sumo_get_pi(rdev); u32 xclk = radeon_get_xclk(rdev); pi->pasi = 65535 * 100 / high_clk; pi->asi = 65535 * 100 / high_clk; r600_calculate_u_and_p(pi->asi, xclk, 16, &pi->bsp, &pi->bsu); r600_calculate_u_and_p(pi->pasi, xclk, 16, &pi->pbsp, &pi->pbsu); pi->dsp = (pi->bsp) | (pi->bsu); pi->psp = (pi->pbsp) | (pi->pbsu); } /* sumo_dpm.c:336-341 */ static void sumo_init_bsp(struct radeon_device *rdev) { struct sumo_power_info *pi = sumo_get_pi(rdev); WREG32(CG_BSP_0, pi->psp); } /* sumo_dpm.c:344-364 */ static void sumo_program_bsp(struct radeon_device *rdev, struct radeon_ps *rps) { struct sumo_power_info *pi = sumo_get_pi(rdev); struct sumo_ps *ps = sumo_get_ps(rps); u32 i; u32 highest_engine_clock = ps->levels[ps->num_levels - 1].sclk; /* :350 */ if (ps->flags & SUMO_POWERSTATE_FLAGS_BOOST_STATE) highest_engine_clock = pi->boost_pl.sclk; sumo_calculate_bsp(rdev, highest_engine_clock); /* :355 */ for (i = 0; i < ps->num_levels - 1; i++) WREG32(CG_BSP_0 + (i * 4), pi->dsp); WREG32(CG_BSP_0 + (i * 4), pi->psp); if (ps->flags & SUMO_POWERSTATE_FLAGS_BOOST_STATE) WREG32(CG_BSP_0 + (7 * 4), pi->psp); } /* sumo_dpm.c:433-453 (register-only) */ static void sumo_program_tp(struct radeon_device *rdev) { int i; for (i = 0; i < 15; i++) { WREG32_P(CG_FFCT_0 + (i * 4), UTC_0(sumo_utc[i]), ~UTC_0_MASK); WREG32_P(CG_FFCT_0 + (i * 4), DTC_0(sumo_dtc[i]), ~DTC_0_MASK); } } /* sumo_dpm.c:918-921 */ static void sumo_reset_am(struct radeon_device *rdev) { WREG32_P(SCLK_PWRMGT_CNTL, FIR_RESET, ~FIR_RESET); } /* sumo_dpm.c:912-916 */ static void sumo_program_bootup_at(struct radeon_device *rdev) { WREG32_P(CG_AT_0, CG_R(0xffff), ~CG_R_MASK); WREG32_P(CG_AT_0, CG_L(0), ~CG_L_MASK); } /* sumo_dpm.c:923-926 */ static void sumo_start_am(struct radeon_device *rdev) { WREG32_P(SCLK_PWRMGT_CNTL, 0, ~FIR_RESET); } /* sumo_dpm.c:602-608 */ static bool sumo_dpm_enabled(struct radeon_device *rdev) { if (RREG32(CG_SCLK_DPM_CTRL_3) & DPM_SCLK_ENABLE) return true; else return false; } /* sumo_dpm.c:610-613 */ static void sumo_start_dpm(struct radeon_device *rdev) { WREG32_P(CG_SCLK_DPM_CTRL_3, DPM_SCLK_ENABLE, ~DPM_SCLK_ENABLE); } /* sumo_dpm.c:640-654 */ static void sumo_wait_for_level_0(struct radeon_device *rdev) { int i; for (i = 0; i < 1000; i++) { if ((RREG32(TARGET_AND_CURRENT_PROFILE_INDEX) & CURR_SCLK_INDEX_MASK) == 0) break; } for (i = 0; i < 1000; i++) { if ((RREG32(TARGET_AND_CURRENT_PROFILE_INDEX) & CURR_INDEX_MASK) == 0) break; } } /* sumo_dpm.c:817-834 (register programming replaced by an observable store * so the OOB loads feeding it cannot be dead-code-eliminated) */ static u32 uvd_stub_sink; static void sumo_setup_uvd_clocks(struct radeon_device *rdev, struct radeon_ps *new_rps, struct radeon_ps *old_rps) { uvd_stub_sink += new_rps->vclk + old_rps->dclk + (uintptr_t)rdev; } /* sumo_dpm.c:836-852 */ static void sumo_set_uvd_clock_before_set_eng_clock(struct radeon_device *rdev, struct radeon_ps *new_rps, struct radeon_ps *old_rps) { struct sumo_ps *new_ps = sumo_get_ps(new_rps); struct sumo_ps *current_ps = sumo_get_ps(old_rps); if ((new_rps->vclk == old_rps->vclk) && (new_rps->dclk == old_rps->dclk)) return; if (new_ps->levels[new_ps->num_levels - 1].sclk >= /* :847 OOB */ current_ps->levels[current_ps->num_levels - 1].sclk) /* :848 OOB */ return; sumo_setup_uvd_clocks(rdev, new_rps, old_rps); } /* sumo_dpm.c:854-870 */ static void sumo_set_uvd_clock_after_set_eng_clock(struct radeon_device *rdev, struct radeon_ps *new_rps, struct radeon_ps *old_rps) { struct sumo_ps *new_ps = sumo_get_ps(new_rps); struct sumo_ps *current_ps = sumo_get_ps(old_rps); if ((new_rps->vclk == old_rps->vclk) && (new_rps->dclk == old_rps->dclk)) return; if (new_ps->levels[new_ps->num_levels - 1].sclk < /* :865 OOB */ current_ps->levels[current_ps->num_levels - 1].sclk) /* :866 OOB */ return; sumo_setup_uvd_clocks(rdev, new_rps, old_rps); } /* sumo_dpm.c:1183-1192 */ static void sumo_update_current_ps(struct radeon_device *rdev, struct radeon_ps *rps) { struct sumo_ps *new_ps = sumo_get_ps(rps); /* :1186 rps==NULL -> fault */ struct sumo_power_info *pi = sumo_get_pi(rdev); pi->current_rps = *rps; /* :1189 */ pi->current_ps = *new_ps; pi->current_rps.ps_priv = &pi->current_ps; } /* sumo_dpm.c:1194-1203 */ static void sumo_update_requested_ps(struct radeon_device *rdev, struct radeon_ps *rps) { struct sumo_ps *new_ps = sumo_get_ps(rps); struct sumo_power_info *pi = sumo_get_pi(rdev); pi->requested_rps = *rps; pi->requested_ps = *new_ps; pi->requested_rps.ps_priv = &pi->requested_ps; } /* sumo_dpm.c:1205-1238 (register-only sub-programming stubbed, call * structure preserved; see header comment) */ static int sumo_dpm_enable(struct radeon_device *rdev) { struct sumo_power_info *pi = sumo_get_pi(rdev); #ifdef FIX_DF4187 /* DF-4187 fix: refuse to enable DPM without a boot power state */ if (rdev->pm.dpm.boot_ps == NULL) { DRM_ERROR("no boot power state, refusing to enable DPM"); return -1; } #endif if (sumo_dpm_enabled(rdev)) return -22; sumo_program_tp(rdev); sumo_init_bsp(rdev); sumo_reset_am(rdev); sumo_program_bootup_at(rdev); sumo_start_am(rdev); if (pi->enable_auto_thermal_throttling) { /* sumo_program_ttp/ttt: register-only, stubbed */ } /* dc_hto / power_level_enter_state / voltage_scaling / sstp / vc / * cnb_override / sclk_ds / boost_timer: register-only, stubbed */ sumo_start_dpm(rdev); sumo_wait_for_level_0(rdev); sumo_update_current_ps(rdev, rdev->pm.dpm.boot_ps); /* :1235 the deref */ return 0; } /* sumo_dpm.c:1260-1281 */ static void sumo_dpm_disable(struct radeon_device *rdev) { if (!sumo_dpm_enabled(rdev)) return; /* register-only teardown stubbed */ sumo_update_current_ps(rdev, rdev->pm.dpm.boot_ps); /* :1280 */ } /* sumo_dpm.c:1299-1333 (forced-mode plumbing stubbed) */ static int sumo_dpm_set_power_state(struct radeon_device *rdev) { struct sumo_power_info *pi = sumo_get_pi(rdev); struct radeon_ps *new_ps = &pi->requested_rps; struct radeon_ps *old_ps = &pi->current_rps; if (pi->enable_dpm) sumo_set_uvd_clock_before_set_eng_clock(rdev, new_ps, old_ps); if (pi->enable_dpm) sumo_program_bsp(rdev, new_ps); /* :1319 */ if (pi->enable_dpm) sumo_set_uvd_clock_after_set_eng_clock(rdev, new_ps, old_ps); return 0; } /* sumo_dpm.c:1395-1403 */ static void sumo_patch_boot_state(struct radeon_device *rdev, struct sumo_ps *ps) { struct sumo_power_info *pi = sumo_get_pi(rdev); ps->num_levels = 1; ps->flags = 0; ps->levels[0] = pi->boot_pl; } /* sumo_dpm.c:1405-1430 */ static void sumo_parse_pplib_non_clock_info(struct radeon_device *rdev, struct radeon_ps *rps, ATOM_PPLIB_NONCLOCK_INFO *non_clock_info, u8 table_rev) { struct sumo_ps *ps = sumo_get_ps(rps); rps->caps = le32_to_cpu(non_clock_info->ulCapsAndSettings); /* :1412 */ rps->class = le16_to_cpu(non_clock_info->usClassification); /* :1413 */ rps->class2 = le16_to_cpu(non_clock_info->usClassification2); /* :1414 */ if (ATOM_PPLIB_NONCLOCKINFO_VER1 < table_rev) { rps->vclk = le32_to_cpu(non_clock_info->ulVCLK); rps->dclk = le32_to_cpu(non_clock_info->ulDCLK); } else { rps->vclk = 0; rps->dclk = 0; } if (rps->class & ATOM_PPLIB_CLASSIFICATION_BOOT) { rdev->pm.dpm.boot_ps = rps; /* :1425 */ sumo_patch_boot_state(rdev, ps); } if (rps->class & ATOM_PPLIB_CLASSIFICATION_UVDSTATE) rdev->pm.dpm.uvd_ps = rps; } /* sumo_dpm.c:1432-1453 */ static void sumo_parse_pplib_clock_info(struct radeon_device *rdev, struct radeon_ps *rps, int index, union pplib_clock_info *clock_info) { struct sumo_power_info *pi = sumo_get_pi(rdev); struct sumo_ps *ps = sumo_get_ps(rps); struct sumo_pl *pl = &ps->levels[index]; u32 sclk; sclk = le16_to_cpu(clock_info->sumo.usEngineClockLow); sclk |= clock_info->sumo.ucEngineClockHigh << 16; pl->sclk = sclk; pl->vddc_index = clock_info->sumo.vddcIndex; pl->sclk_dpm_tdp_limit = clock_info->sumo.tdpLimit; ps->num_levels = index + 1; /* :1447 */ if (pi->enable_sclk_ds) { pl->ds_divider_index = 5; pl->ss_divider_index = 4; } } /* sumo_dpm.c:1455-1528 (atom_parse_data_header satisfied by caller) */ static int sumo_parse_power_table(struct radeon_device *rdev) { struct radeon_mode_info *mode_info = &rdev->mode_info; ATOM_PPLIB_NONCLOCK_INFO *non_clock_info; union pplib_power_state *power_state; int i, j, k, non_clock_array_index, clock_array_index; union pplib_clock_info *clock_info; StateArray *state_array; ClockInfoArray *clock_info_array; NonClockInfoArray *non_clock_info_array; union power_info *power_info; u16 data_offset = rdev->_atom_data_offset; u8 *power_state_offset; struct sumo_ps *ps; power_info = (union power_info *)(mode_info->atom_context->bios + data_offset); state_array = (StateArray *) (mode_info->atom_context->bios + data_offset + le16_to_cpu(power_info->pplib.usStateArrayOffset)); clock_info_array = (ClockInfoArray *) (mode_info->atom_context->bios + data_offset + le16_to_cpu(power_info->pplib.usClockInfoArrayOffset)); non_clock_info_array = (NonClockInfoArray *) (mode_info->atom_context->bios + data_offset + le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset)); rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) * state_array->ucNumEntries, 0); if (!rdev->pm.dpm.ps) return -ENOMEM; power_state_offset = (u8 *)state_array->states; for (i = 0; i < state_array->ucNumEntries; i++) { u8 *idx; power_state = (union pplib_power_state *)power_state_offset; non_clock_array_index = power_state->v2.nonClockInfoIndex; /* :1495 */ #ifdef FIX_DF4190 if (non_clock_array_index >= non_clock_info_array->ucNumEntries) { DRM_ERROR("invalid nonClockInfoIndex %d", non_clock_array_index); kfree(rdev->pm.dpm.ps); rdev->pm.dpm.ps = NULL; return -22; } #endif non_clock_info = (ATOM_PPLIB_NONCLOCK_INFO *) &non_clock_info_array->nonClockInfo[non_clock_array_index]; /* :1496-1497 */ ps = kzalloc(sizeof(struct sumo_ps), 0); /* :1500 */ if (ps == NULL) { #ifdef FIX_DF4188 { int x; for (x = i - 1; x >= 0; x--) kfree(rdev->pm.dpm.ps[x].ps_priv); } kfree(rdev->pm.dpm.ps); rdev->pm.dpm.ps = NULL; /* no dangling */ return -ENOMEM; #else kfree(rdev->pm.dpm.ps); /* :1502 dangling! */ return -ENOMEM; #endif } rdev->pm.dpm.ps[i].ps_priv = ps; k = 0; idx = (u8 *)&power_state->v2.clockInfoIndex[0]; for (j = 0; j < power_state->v2.ucNumDPMLevels; j++) { /* :1508 */ clock_array_index = idx[j]; if (k >= SUMO_MAX_HARDWARE_POWERLEVELS) break; clock_info = (union pplib_clock_info *) ((u8 *)&clock_info_array->clockInfo[0] + (clock_array_index * clock_info_array->ucEntrySize)); sumo_parse_pplib_clock_info(rdev, &rdev->pm.dpm.ps[i], k, clock_info); k++; } #ifdef FIX_DF4189 if (k == 0) { /* DF-4189 fix: a pplib state with zero DPM levels would * leave num_levels==0 -> levels[-1] everywhere */ DRM_ERROR("power state %d has no DPM levels", i); kfree(ps); rdev->pm.dpm.ps[i].ps_priv = NULL; kfree(rdev->pm.dpm.ps); rdev->pm.dpm.ps = NULL; return -22; } #endif sumo_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i], non_clock_info, non_clock_info_array->ucEntrySize); power_state_offset += 2 + power_state->v2.ucNumDPMLevels; /* :1524 */ } rdev->pm.dpm.num_ps = state_array->ucNumEntries; /* :1526 */ return 0; } /* sumo_dpm.c:1870-1881 */ static void sumo_dpm_fini(struct radeon_device *rdev) { int i; for (i = 0; i < rdev->pm.dpm.num_ps; i++) { kfree(rdev->pm.dpm.ps[i].ps_priv); /* :1877 */ } kfree(rdev->pm.dpm.ps); /* :1879 */ kfree(rdev->pm.dpm.priv); } /* sumo_dpm.c:1883-1892 */ static u32 sumo_dpm_get_sclk(struct radeon_device *rdev, bool low) { struct sumo_power_info *pi = sumo_get_pi(rdev); struct sumo_ps *requested_state = sumo_get_ps(&pi->requested_rps); if (low) return requested_state->levels[0].sclk; else return requested_state->levels[requested_state->num_levels - 1].sclk; /* :1891 */ } /* ================================================================== */ /* VBIOS image crafting */ /* ================================================================== */ #define BIOS_SZ 16384 #define DATA_OFF 64 /* atom data_offset of the PowerPlayInfo table */ #define OFF_STATES 16 #define OFF_CLOCKS 2048 #define OFF_NONCLOCK (BIOS_SZ - DATA_OFF - 512) /* near the image end */ static struct radeon_device RDEV; static struct sumo_power_info *PI; static void bios_init(uint8_t *bios) { PPLIB_MIN *p; memset(bios, 0, BIOS_SZ); RDEV.mode_info.atom_context->bios = bios; RDEV._atom_data_offset = DATA_OFF; p = (PPLIB_MIN *)(bios + DATA_OFF); p->usStateArrayOffset = OFF_STATES; p->usClockInfoArrayOffset = OFF_CLOCKS; p->usNonClockInfoArrayOffset = OFF_NONCLOCK; } static void bios_add_state(uint8_t *bios, int n, int num_dpm_levels, int nonclock_index) { StateArray *sa = (StateArray *)(bios + DATA_OFF + OFF_STATES); uint8_t *soff = (uint8_t *)sa->states; ATOM_PPLIB_STATE_V2 *st; int i; sa->ucNumEntries = n + 1; for (i = 0; i < n; i++) soff += 2 + soff[0]; /* skip previous states */ st = (ATOM_PPLIB_STATE_V2 *)soff; st->ucNumDPMLevels = num_dpm_levels; st->nonClockInfoIndex = nonclock_index; for (i = 0; i < num_dpm_levels && i < 8; i++) st->clockInfoIndex[i] = i; } static void bios_add_clock(uint8_t *bios, int n, u32 sclk10k, u8 vddc) { ClockInfoArray *ca = (ClockInfoArray *)(bios + DATA_OFF + OFF_CLOCKS); ATOM_PPLIB_SUMO_CLOCK_INFO *ci; if (n == 0) ca->ucEntrySize = sizeof(ATOM_PPLIB_SUMO_CLOCK_INFO); ca->ucNumEntries = n + 1; ci = (ATOM_PPLIB_SUMO_CLOCK_INFO *)((uint8_t *)&ca->clockInfo[0] + n * ca->ucEntrySize); ci->usEngineClockLow = sclk10k & 0xffff; ci->ucEngineClockHigh = sclk10k >> 16; ci->vddcIndex = vddc; ci->tdpLimit = 0; } static void bios_add_nonclock(uint8_t *bios, int n, u16 class, u32 vclk) { NonClockInfoArray *na = (NonClockInfoArray *)(bios + DATA_OFF + OFF_NONCLOCK); ATOM_PPLIB_NONCLOCK_INFO *ni; if (n == 0) na->ucEntrySize = sizeof(ATOM_PPLIB_NONCLOCK_INFO); na->ucNumEntries = n + 1; ni = (ATOM_PPLIB_NONCLOCK_INFO *)((uint8_t *)&na->nonClockInfo[0] + n * na->ucEntrySize); memset(ni, 0, sizeof(*ni)); ni->usClassification = class; ni->ulVCLK = vclk; ni->ulDCLK = vclk; } static void common_setup(void) { memset(&RDEV, 0, sizeof(RDEV)); RDEV.mode_info.atom_context = kzalloc(sizeof(struct atom_context), 0); PI = kzalloc(sizeof(struct sumo_power_info), 0); RDEV.pm.dpm.priv = PI; PI->enable_sclk_ds = true; PI->enable_dynamic_patch_ps = true; PI->enable_dpm = true; PI->enable_auto_thermal_throttling = true; PI->sys_info.bootup_sclk = 8000; /* 80 MHz in 10 kHz units */ PI->sys_info.min_sclk = 800; PI->boot_pl.sclk = PI->sys_info.bootup_sclk; PI->boot_pl.vddc_index = 1; } /* ================================================================== */ /* scenarios */ /* ================================================================== */ static void mode_4187(void) { uint8_t *bios; int ret; printf("== DF-4187: sumo_dpm_enable NULL boot_ps ==\n"); printf("offsetof(struct radeon_ps, ps_priv) = %zu (kernel layout: 40)\n", offsetof(struct radeon_ps, ps_priv)); common_setup(); bios = kzalloc(BIOS_SZ, 0); bios_init(bios); /* state 0: 2 DPM levels, classified PERFORMANCE (no BOOT bit) */ bios_add_clock(bios, 0, 30000, 1); bios_add_clock(bios, 1, 50000, 2); bios_add_nonclock(bios, 0, 0x0002, 0); bios_add_state(bios, 0, 2, 0); ret = sumo_parse_power_table(&RDEV); printf("sumo_parse_power_table() = %d num_ps=%d boot_ps=%p\n", ret, RDEV.pm.dpm.num_ps, (void *)RDEV.pm.dpm.boot_ps); if (RDEV.pm.dpm.boot_ps != NULL) { printf("PRECONDITION FAILED (boot_ps set) - bad scenario\n"); exit(2); } /* radeon_pm.c:1448 swallows sumo_dpm_init() errors; :1453 enables */ printf("calling sumo_dpm_enable() with boot_ps == NULL ...\n"); fflush(stdout); ret = sumo_dpm_enable(&RDEV); /* :1235 derefs NULL->ps_priv */ printf("sumo_dpm_enable() returned %d - NO CRASH%s\n", ret, #ifdef FIX_DF4187 " (fix active)" #else " - UNEXPECTED (expected SIGSEGV at 0x28)" #endif ); } static void mode_4188(void) { uint8_t *bios; int ret; printf("== DF-4188: dangling dpm.ps double free in sumo_dpm_fini ==\n"); common_setup(); bios = kzalloc(BIOS_SZ, 0); bios_init(bios); bios_add_clock(bios, 0, 30000, 1); bios_add_clock(bios, 1, 50000, 2); bios_add_nonclock(bios, 0, 0x0001 /* BOOT */, 0); bios_add_nonclock(bios, 1, 0x0002, 0); bios_add_state(bios, 0, 1, 0); bios_add_state(bios, 1, 1, 1); /* fail the kzalloc(struct sumo_ps) of the SECOND state: * kzalloc order: atom_ctx(1) pi(2) bios(3) dpm.ps(4) ps#0(5) ps#1(6) */ kmalloc_fail_at = 6; kmalloc_tag = "sumo_ps#1"; ret = sumo_parse_power_table(&RDEV); printf("sumo_parse_power_table() = %d (ENOMEM injected at state 1)\n", ret); printf("rdev->pm.dpm.ps is %sNULL after the failed parse\n", RDEV.pm.dpm.ps == NULL ? "" : "NOT (dangling pointer kept)"); fflush(stdout); /* radeon_pm.c:1448 discards the error; the driver loads anyway */ printf("driver unload -> radeon_pm_fini -> sumo_dpm_fini ...\n"); fflush(stdout); sumo_dpm_fini(&RDEV); /* :1879 kfree(dangling) */ printf("sumo_dpm_fini() returned; canary_violations so far = %d%s\n", canary_violations, #ifdef FIX_DF4188 " (fix active: pointer NULLed after cleanup, no double free)" #else canary_violations ? " (DOUBLE FREE detected above)" : " - UNEXPECTED (expected double-free detection)" #endif ); } static void mode_4189(int variant) { uint8_t *bios; int ret; struct sumo_ps *ps0; unsigned long long wild; printf("== DF-4189: ucNumDPMLevels==0 -> num_levels==0 -> " "levels[0xFFFFFFFF] wild read ==\n"); printf("variant note: num_levels is u32; num_levels-1 == 0xFFFFFFFF, " "so the index is levels[0xFFFFFFFF] = object + 0xFFFFFFFF*24 " "(~96 GB past the kzalloc'd sumo_ps)\n"); poison_byte = variant ? 0x00 : POISON; /* irrelevant: the wild read faults */ common_setup(); bios = kzalloc(BIOS_SZ, 0); bios_init(bios); /* state 0: ZERO DPM levels, non-BOOT, vclk != current (force UVD path) */ bios_add_nonclock(bios, 0, 0x0002, 6789); bios_add_state(bios, 0, 0, 0); /* state 1: BOOT state with 1 level (parse succeeds, boot_ps set) */ bios_add_clock(bios, 0, 40000, 1); bios_add_nonclock(bios, 1, 0x0001, 0); bios_add_state(bios, 1, 1, 1); ret = sumo_parse_power_table(&RDEV); printf("sumo_parse_power_table() = %d num_ps=%d\n", ret, RDEV.pm.dpm.num_ps); if (ret == 0) { ps0 = RDEV.pm.dpm.ps[0].ps_priv; wild = (unsigned long long)(uintptr_t)ps0 + 0xFFFFFFFFULL * sizeof(struct sumo_pl); printf("state0 ps_priv=%p levels=%p num_levels=%u (kzalloc'd, " "all zero)\n", (void *)ps0, (void *)ps0->levels, ps0->num_levels); printf("expected fault address for levels[num_levels-1].sclk " "~= 0x%llx (object + ~%llu GB)\n", wild, 0xFFFFFFFFULL * sizeof(struct sumo_pl) >> 30); /* radeon_dpm_pick_power_state selects state 0; pre_set copies */ sumo_update_requested_ps(&RDEV, &RDEV.pm.dpm.ps[0]); sumo_update_current_ps(&RDEV, RDEV.pm.dpm.boot_ps); printf("calling sumo_set_uvd_clock_before_set_eng_clock " "(sumo_dpm.c:847 levels[num_levels-1]) ...\n"); fflush(stdout); sumo_set_uvd_clock_before_set_eng_clock(&RDEV, &PI->requested_rps, &PI->current_rps); printf("survived uvd_before; calling sumo_dpm_set_power_state " "(program_bsp :350, get_sclk :1891 same index) ...\n"); fflush(stdout); sumo_dpm_set_power_state(&RDEV); printf("returned - no crash%s\n", #ifdef FIX_DF4189 " (fix active)" #else " - UNEXPECTED (expected SIGSEGV ~96 GB past the object)" #endif ); } else { printf("sumo_parse_power_table() rejected the crafted table%s\n", #ifdef FIX_DF4189 " (fix active: zero-level state rejected)" #else " - UNEXPECTED" #endif ); } } static void mode_4190(void) { uint8_t *bios; int ret; NonClockInfoArray *na; ATOM_PPLIB_NONCLOCK_INFO *oob; printf("== DF-4190: unchecked nonClockInfoIndex -> OOB read ==\n"); common_setup(); bios = kzalloc(BIOS_SZ, 0); bios_init(bios); bios_add_clock(bios, 0, 40000, 1); bios_add_nonclock(bios, 0, 0x0001 /* BOOT */, 0); /* crafted state: nonClockInfoIndex = 250 (u8, never bounds-checked) */ bios_add_state(bios, 0, 1, 250); na = (NonClockInfoArray *)(bios + DATA_OFF + OFF_NONCLOCK); oob = &na->nonClockInfo[250]; #ifndef FIX_DF4190 check_in_object("nonClockInfo[250] (bios-relative OOB read)", oob, sizeof(*oob)); printf("bios image: %d bytes at %p; nonClockInfo[250] lands at bios+%td " "(%td bytes PAST the end of the image)\n", BIOS_SZ, (void *)bios, (char *)oob - (char *)bios, (char *)oob - ((char *)bios + BIOS_SZ)); fflush(stdout); #endif ret = sumo_parse_power_table(&RDEV); printf("sumo_parse_power_table() = %d\n", ret); #ifdef FIX_DF4190 if (ret != 0) printf("crafted table rejected (fix active)\n"); #else if (ret == 0) { printf("rps[0].class = 0x%04x %s\n", RDEV.pm.dpm.ps[0].class, RDEV.pm.dpm.ps[0].class == 0xA5A5 ? "(== canary poison: OOB READ CONFIRMED)" : ""); printf("rps[0].caps = 0x%08x %s\n", RDEV.pm.dpm.ps[0].caps, RDEV.pm.dpm.ps[0].caps == 0xA5A5A5A5 ? "(== canary poison)" : ""); printf("rps[0].vclk = 0x%08x %s\n", RDEV.pm.dpm.ps[0].vclk, RDEV.pm.dpm.ps[0].vclk == 0xA5A5A5A5 ? "(== canary poison)" : ""); } #endif } static void sig_handler(int sig, siginfo_t *si, void *uc) { (void)uc; fflush(stdout); printf("\n*** SIGNAL %d at address %p: %s ***\n", sig, si->si_addr, sig == SIGSEGV ? "SIGSEGV - wild/NULL pointer dereference " "(kernel: page-fault PANIC)" : sig == SIGFPE ? "SIGFPE - divide by zero " "(kernel: div0 PANIC in sumo_calculate_bsp, sumo_dpm.c:323-324)" : "abort"); fflush(stdout); _exit(99); } int main(int argc, char **argv) { struct sigaction sa; const char *mode = argc > 1 ? argv[1] : "4187"; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = sig_handler; sa.sa_flags = SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGFPE, &sa, NULL); sigaction(SIGABRT, &sa, NULL); if (!strcmp(mode, "4187")) mode_4187(); else if (!strcmp(mode, "4188")) mode_4188(); else if (!strcmp(mode, "4189")) mode_4189(0); else if (!strcmp(mode, "4189z")) mode_4189(1); else if (!strcmp(mode, "4190")) mode_4190(); else { printf("unknown mode %s\n", mode); return 2; } printf("canary_violations = %d\n", canary_violations); return canary_violations ? 98 : 0; } /* keep sumo_dpm_disable referenced (part of the DF-4187 family analysis) */ static void (*const sumo_disable_ref)(struct radeon_device *) = sumo_dpm_disable; __attribute__((unused)) static void (*const sumo_keep)(struct radeon_device *) = sumo_disable_ref;