# DF-4815 VERDICT — mmhub_v1_0_init_cache_regs never programs mmVM_L2_CNTL3

**Bottom line.** In `mmhub_v1_0_init_cache_regs()` (called from
`mmhub_v1_0_gart_enable()` at every GMC/GART initialization on Vega10/12/20
and Raven), the MMHUB L2-TLB geometry registers `VM_L2_CNTL3.BANK_SELECT` /
`VM_L2_CNTL3.L2_CACHE_BIGK_FRAGMENT_SIZE` are *computed into a stale local*
and **never written to hardware**: after `tmp` was last assigned from
`mmVM_L2_CNTL2` (line 166) and written (line 169), lines 171-179 apply
`VM_L2_CNTL3` field macros to that stale CNTL2 value — and the result is
dropped on the floor, because line 181 overwrites `tmp` with
`mmVM_L2_CNTL4_DEFAULT` and the only remaining write is to CNTL4 (line 184).
There is no `RREG32/WREG32` of `mmVM_L2_CNTL3` anywhere in the function.

Consequences:
1. The intended L2 TLB bank-select / bigk-fragment configuration never lands;
   MMHUB L2 runs on hardware reset defaults.
2. On Raven/Raven2 with `gmc.translate_further` (the 128TB+512GB VM layout
   selected in gmc_v9_0.c:943-945), BANK_SELECT must be 12 — it stays at the
   default, i.e. the TLB geometry silently disagrees with the programmed
   page-table depth/block size (mmhub_v1_0_setup_vmid_config), a functional
   misconfiguration of the GPU MMU (VM-fault / hang class).
3. The dead computation is a trap for future edits (garbage CNTL2-derived
   base would be used if a write were ever added naively — exactly what
   upstream v5.2 shipped: it added the write but kept the missing re-read).

## Provenance (why this is a real divergence, verified against tags)

- Upstream **v4.18** (AMDGPU import era) has the same missing write
  (evidence/comparison.txt) — the bug was upstream too, then.
- Upstream **v5.2** has `WREG32_SOC15(MMHUB, 0, mmVM_L2_CNTL3, tmp);`
  (evidence/upstream_v5.2_mmhub_v1_0.c:185) — fixed upstream between 4.18
  and 5.2.
- The DF file is otherwise **v5.2-vintage**: `mmhub_v1_0_setup_vmid_config`
  is byte-identical to v5.2 except one deliberately-backported later line
  (RETRY_PERMISSION_OR_INVALID_PAGE_FAULT 0, the no-retry XNACK change), and
  init_gart_aperture/system_aperture (fb_start/fb_end, AGP BAR, Raven2
  rev_id>=0x8 workaround, amdgpu_gmc_pd_addr) all match the v5.2-era code.
  ⇒ the DF vendor-sync dropped the single `WREG32_SOC15(... mmVM_L2_CNTL3,
  tmp);` line that its own source vintage carries.

## Security assessment (honest)

No attacker-controlled input reaches this path (driver-internal constants at
hardware init). The impact ceiling is *misconfiguration of the GPU VM's L2
TLB*: no demonstrated isolation breach (page tables still enforced), but
TLB-geometry mismatch on translate_further parts can produce VM faults /
GPU hangs (availability), and on any future part whose reset default differs
from the driver's assumption the L2 behaves differently than validated.
Filed as **Low / hardening-correctness**, CWE-561 (dead code) +
CWE-754-style improper initialization.

## Verification performed

- **Guest kernel runtime: NOT possible.** The audit guest has no AMD GPU at
  all (see env.txt; only QEMU std-VGA). `mmhub_v1_0_gart_enable` is executed
  only during amdgpu GMC init on Vega10-class ASICs. Status `untested`
  (device absent). Nothing else on the guest exercises this file.
- **Static verification: decisive.** evidence/comparison.txt shows
  side-by-side: DF (no CNTL3 write) / upstream v4.18 (no write) / upstream
  v5.2 (write present), plus the vintage proof (setup_vmid_config identity).
  A grep for `mmVM_L2_CNTL3` over the whole DF tree shows the only MMHUB
  programming site is this function (gfxhub_v1_0.c has its own separate
  GFX-side CNTL3 handling) — nothing else compensates for the dropped write.

## Fix

Read, set, write — restores upstream v5.2 behavior (and adds the re-read
upstream still lacks). See fix.diff; `git apply --check` passes against
sys/dev/drm/amd/amdgpu/mmhub_v1_0.c.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.