/* * i915_stolen_harness.c -- DF-4679 logic-level verification * * Verifies, on the DragonFly guest, the u64-wrap chain in * sys/dev/drm/i915/i915_gem_stolen.c * g4x_get_stolen_reserved() (:201-229, *size = stolen_top - *base :228) * bdw_get_stolen_reserved() (:349-366, *size = stolen_top - *base :365) * i915_gem_init_stolen() (:475-503: !reserved_base check, containment * :485, reserved_total = stolen_top - * reserved_base :493, stolen_usable_size * :499-500, drm_mm_init(0, usable) :503) * * The inline helpers are transcribed VERBATIM from * sys/dev/drm/include/linux/pci.h:621-642 (struct linux_resource, * DEFINE_RES_MEM, resource_size, resource_contains) * and the two register masks from sys/dev/drm/i915/i915_reg.h:401,3507. * build.sh grep-verifies every transcribed line against the guest's * /usr/src copy before compiling. * * Register values (CTG/ELK/GEN6_STOLEN_RESERVED) are chipset config * space programmed by the BIOS: garbage / malicious firmware values are * the threat model. A reserved base ABOVE stolen_top makes * "stolen_top - *base" wrap mod 2^64; DEFINE_RES_MEM then computes * dsm_reserved.end = base + wrapped_size - 1 == stolen_top - 1 == dsm.end, * so resource_contains() PASSES even though the reservation starts above * the stolen region -- and stolen_usable_size inflates ABOVE the real * stolen size, so the drm_mm stolen allocator hands out offsets beyond * dsm.end. i915_pages_create_for_stolen() (:516,536) then builds * sg_dma_address = dsm.start + offset pointing OUTSIDE stolen memory * (the GEM_BUG_ON at :516 is a no-op in release: i915_gem.h:38-61), * i.e. the GPU is pointed at arbitrary physical memory it must not touch. */ #include #include #include #include typedef uint64_t resource_size_t; /* linux/types.h:35 */ /* ---- verbatim: sys/dev/drm/include/linux/pci.h:621-642 ---- */ struct linux_resource { resource_size_t start; resource_size_t end; }; #define DEFINE_RES_MEM(_start, _size) \ { \ .start = (_start), \ .end = (_start) + (_size) - 1, \ } static inline resource_size_t resource_size(const struct linux_resource *res) { return res->end - res->start + 1; } static inline bool resource_contains(struct linux_resource *a, struct linux_resource *b) { return a->start <= b->start && a->end >= b->end; } /* ---- transcribed from i915_gem_stolen.c (see build.sh grep checks) ---- */ static struct linux_resource dsm, dsm_reserved; static void g4x_get_stolen_reserved(resource_size_t reg_val, resource_size_t *base, resource_size_t *size) { resource_size_t stolen_top = dsm.end + 1; /* :208 */ *base = (reg_val & 0xFFF0u) << 16; /* G4X_STOLEN_RESERVED_ADDR2_MASK * = (0xFFF << 4), then <<16 :225 */ *size = stolen_top - *base; /* :228 */ } static void bdw_get_stolen_reserved(resource_size_t reg_val, resource_size_t *base, resource_size_t *size) { resource_size_t stolen_top = dsm.end + 1; /* :354 */ *base = reg_val & 0xFFF00000ull; /* GEN6_STOLEN_RESERVED_ADDR_MASK * = (0xFFF << 20) :364 */ *size = stolen_top - *base; /* :365 */ } /* i915_gem_init_stolen() tail, :475-503 (reserved_base != 0 by * construction here). Returns stolen_usable_size passed to * drm_mm_init(&dev_priv->mm.stolen, 0, ...) at :503. */ static resource_size_t init_stolen_tail(resource_size_t reserved_base, resource_size_t reserved_size) { resource_size_t stolen_top = dsm.end + 1; resource_size_t reserved_total; dsm_reserved = (struct linux_resource) DEFINE_RES_MEM(reserved_base, reserved_size); /* :482-483 */ if (!resource_contains(&dsm, &dsm_reserved)) /* :485 */ return 0; /* stolen disabled */ reserved_total = stolen_top - reserved_base; /* :493 */ return resource_size(&dsm) - reserved_total; /* :499-500 */ } /* The fix.diff variant of the same tail: the sanity check at :475 * becomes "if (!reserved_base || reserved_base > stolen_top)" and the * reservation is ignored (existing !reserved_base fallback semantics) * when the BIOS-programmed base sits above stolen_top. */ static resource_size_t init_stolen_tail_fixed(resource_size_t reserved_base, resource_size_t reserved_size) { resource_size_t stolen_top = dsm.end + 1; resource_size_t reserved_total; if (!reserved_base || reserved_base > stolen_top) { reserved_base = stolen_top; reserved_size = 0; } dsm_reserved = (struct linux_resource) DEFINE_RES_MEM(reserved_base, reserved_size); if (!resource_contains(&dsm, &dsm_reserved)) return 0; reserved_total = stolen_top - reserved_base; return resource_size(&dsm) - reserved_total; } static int g_fixed; static int case_run(const char *name, struct linux_resource region, void (*get)(resource_size_t, resource_size_t *, resource_size_t *), resource_size_t reg_val, bool expect_inflate) { resource_size_t base = 0, size = 0, usable, real, maxphys; int fail = 0; dsm = region; real = resource_size(&dsm); get(reg_val, &base, &size); usable = g_fixed ? init_stolen_tail_fixed(base, size) : init_stolen_tail(base, size); maxphys = dsm.start + (usable ? usable - 1 : 0); /* :536 worst case */ printf("== %s ==\n", name); printf(" stolen (dsm) : [%#llx..%#llx] (%llu MiB)\n", (unsigned long long)dsm.start, (unsigned long long)dsm.end, (unsigned long long)real >> 20); printf(" reserved base (reg) : %#llx size(raw u64): %#llx\n", (unsigned long long)base, (unsigned long long)size); printf(" resource_contains : %s\n", resource_contains(&dsm, &dsm_reserved) ? "PASS" : "FAIL"); printf(" stolen_usable_size : %llu (%.2fx the real %llu)\n", (unsigned long long)usable, real ? (double)usable / (double)real : 0.0, (unsigned long long)real); printf(" worst-case alloc phys : dsm.start+usable-1 = %#llx " "(dsm.end=%#llx => %s stolen)\n", (unsigned long long)maxphys, (unsigned long long)dsm.end, maxphys > dsm.end ? "OUTSIDE" : "inside"); if (expect_inflate) { bool bypassed = resource_contains(&dsm, &dsm_reserved) && base > dsm.end; bool inflated = usable > real; if (g_fixed) { if (inflated) { printf(" !! FIX FAILED: inflation still occurs\n"); fail = 1; } else { printf(" FIX VERIFIED: no wrap, no containment " "bypass, usable (%llu) <= real (%llu); " "allocations stay inside stolen\n", (unsigned long long)usable, (unsigned long long)real); } } else if (!bypassed || !inflated) { printf(" !! expected containment bypass + usable-size " "inflation, did not occur\n"); fail = 1; } else { printf(" DF-4679 REPRODUCED: reserved base above " "stolen_top wraps u64 size; containment check " "(:485) PASSES via end-wrap; drm_mm initialized " "with %llu bytes (%.2fx real) => allocations " "beyond dsm.end => OOB physical memory\n", (unsigned long long)usable, (double)usable / (double)real); } } else { if (usable == 0 || usable > real) { printf(" !! sane-firmware control case misbehaved\n"); fail = 1; } else { printf(" (control: sane firmware base => usable < " "real; behavior normal)\n"); } } return fail; } int main(int argc, char **argv) { int fail = 0; g_fixed = (argc > 1 && strcmp(argv[1], "fixed") == 0); if (g_fixed) printf(">>> FIXED build (fix.diff guard active) <<<\n"); else printf(">>> BASELINE build (pristine :475 logic) <<<\n"); const unsigned long long MB = 1ull << 20; /* Realistic G4X: 32 MiB stolen at 0x00D00000 (top of low RAM) */ fail |= case_run("G4X garbage reserved base (0xABC -> 0x0ABC0000)", (struct linux_resource) DEFINE_RES_MEM(0x00D00000, 32 * MB), g4x_get_stolen_reserved, 0x0ABC0u /* ADDR2 field 0xABC, EN set */, true); /* Control: same machine, sane BIOS reserving top 1 MiB of stolen * (base 0x2C00000 = reg ADDR2 field 0x2C0) */ fail |= case_run("G4X sane reserved base (top 1 MiB of stolen)", (struct linux_resource) DEFINE_RES_MEM(0x00D00000, 32 * MB), g4x_get_stolen_reserved, 0x002C0u, false); /* BDW: 32 MiB stolen at 0x40000000; ADDR field all-ones 0xFFF */ fail |= case_run("BDW garbage reserved base (0xFFF -> 0xFFF00000)", (struct linux_resource) DEFINE_RES_MEM(0x40000000, 32 * MB), bdw_get_stolen_reserved, 0xFFF00001ull /* ADDR + EN bit */, true); printf(fail ? "\nRESULT: FAIL\n" : "\nRESULT: ALL CASES OK\n"); return fail; }