⬢ DragonFlyBSD Kernel Audit
DF-4742 / check_arith.py
← back to finding ↓ download raw
#!/usr/bin/env python3
"""DF-4742 arithmetic proof: VCE 2.0 vcpu_bo window layout vs allocation size."""
FW_SIZE = 256 * 1024          # VCE_V2_0_FW_SIZE      (vce_v2_0.c:40)
STACK_SIZE = 64 * 1024        # VCE_V2_0_STACK_SIZE   (vce_v2_0.c:41)
MAX_HANDLES = 16              # AMDGPU_MAX_VCE_HANDLES (amdgpu_vce.h:27)
DATA_SIZE = 23552 * MAX_HANDLES  # VCE_V2_0_DATA_SIZE  (vce_v2_0.c:42)
FW_OFFSET = 256               # AMDGPU_VCE_FIRMWARE_OFFSET (amdgpu_vce.h:28)

bo_size = FW_SIZE + STACK_SIZE + DATA_SIZE            # vce_v2_0.c:424-425
assert DATA_SIZE % 4096 == 0 and bo_size % 4096 == 0  # no page slack

off = FW_OFFSET
end0 = off + FW_SIZE;  off += FW_SIZE    # window 0 vce_v2_0.c:185-188
end1 = off + STACK_SIZE; off += STACK_SIZE  # window 1 vce_v2_0.c:190-193
end2 = off + DATA_SIZE                     # window 2 vce_v2_0.c:195-198

print(f"bo size            = {bo_size} ({bo_size//4096} pages)")
print(f"window0 (fw)   end = {end0}")
print(f"window1 (stack) end = {end1}")
print(f"window2 (DATA)  end = {end2}")
print(f"DATA window overruns bo end by = {end2 - bo_size} bytes")
assert end2 == bo_size + FW_OFFSET
print("CONFIRMED: vce_v2_0 vcpu_bo is AMDGPU_VCE_FIRMWARE_OFFSET (256) bytes short (DF-4524 v3 shape)")