/* * DF-4864 — amdgpu VM-clear IB overflow harness (userspace replica) * ================================================================ * * Bug: amdgpu_vm_clear_bo() (sys/dev/drm/amd/amdgpu/amdgpu_vm.c) allocates a * 64-byte (16-dword) SA sub-allocation for the clear-IB: * * r = amdgpu_job_alloc_with_ib(adev, 64, &job); [amdgpu_vm.c:855] * * but on CHIP_RAVEN (the only ASIC with pte_support_ats, amdgpu_vm.c:3172) * the ROOT page-directory clear (amdgpu_vm_init -> amdgpu_vm_clear_bo with * level == root_level) takes BOTH branches: * * if (ats_entries) amdgpu_vm_set_pte_pde(... ats_entries ...); (10 dw) * if (entries) amdgpu_vm_set_pte_pde(... entries ...); (10 dw) * * amdgpu_vm_set_pte_pde is a macro (amdgpu_vm.h:293) into * sdma_v4_0_vm_set_pte_pde (sdma_v4_0.c:1184-1200) which emits exactly * TEN dwords per call, writing through ib->ptr[ib->length_dw++] with no * bound of any kind. 2 x 10 = 20 dwords are written into 16 dwords, and * amdgpu_ring_pad_ib() then appends another 4 NOP dwords * ((8 - (20 & 7)) % 8), for 24 dwords = 96 bytes into a 64-byte kernel * SA sub-allocation: a deterministic 32-byte kernel heap OOB write on * every VM create on Raven. * * Trigger numbers (Raven rev0/1, gmc_v9_0.c:941: vm 256TB, block 9, 3 levels): * root_level = PDB2 (amdgpu_vm.c:2986), root PD = 512 entries * (amdgpu_vm_num_entries: round_up(2^36, 2^27) >> 27 = 512) * ats_entries = AMDGPU_GMC_HOLE_START(2^47) >> (27 + 12) = 256 * entries = 512 - 256 = 256 -> BOTH branches taken. * * (Raven rev>=2, gmc_v9_0.c:945: 128TB+512GB -> 257-entry root PD, * ats_entries = 256, entries = 1 -> both branches too.) * * This harness reproduces the EXACT emit/pad sequence (code copied verbatim * from sdma_v4_0.c) against a canaried 64-byte buffer, and probes whether the * running host actually has AMD graphics hardware (the kernel path itself * needs a Raven APU, which this QEMU guest does not have). * * Build: cc -O2 -Wall -o df4864_trigger df4864_trigger.c * Run: ./df4864_trigger */ #include #include #include #include #include #include #include /* ---- verbatim packet macros: vega10_sdma_pkt_open.h / sdma_v4_0.c ---- */ #define SDMA_OP_NOP 0 #define SDMA_OP_PTEPDE 12 #define SDMA_PKT_HEADER_OP(x) (((uint32_t)(x) & 0xff) << 0) #define lower_32_bits(n) ((uint32_t)(uint64_t)(n)) #define upper_32_bits(n) ((uint32_t)(((uint64_t)(n)) >> 32)) struct amdgpu_ib_replica { uint32_t *ptr; uint32_t length_dw; }; /* verbatim: sys/dev/drm/amd/amdgpu/sdma_v4_0.c:1184-1200 * sdma_v4_0_vm_set_pte_pde() — 10 dwords, unbounded */ static void sdma_v4_0_vm_set_pte_pde(struct amdgpu_ib_replica *ib, uint64_t pe, uint64_t addr, unsigned count, uint32_t incr, uint64_t flags) { ib->ptr[ib->length_dw++] = SDMA_PKT_HEADER_OP(SDMA_OP_PTEPDE); ib->ptr[ib->length_dw++] = lower_32_bits(pe); /* dst addr */ ib->ptr[ib->length_dw++] = upper_32_bits(pe); ib->ptr[ib->length_dw++] = lower_32_bits(flags);/* mask */ ib->ptr[ib->length_dw++] = upper_32_bits(flags); ib->ptr[ib->length_dw++] = lower_32_bits(addr); /* value */ ib->ptr[ib->length_dw++] = upper_32_bits(addr); ib->ptr[ib->length_dw++] = incr; /* increment size */ ib->ptr[ib->length_dw++] = 0; ib->ptr[ib->length_dw++] = count - 1; /* number of entries */ } /* verbatim math: sys/dev/drm/amd/amdgpu/sdma_v4_0.c:1208-1222 * sdma_v4_0_ring_pad_ib() — pads length_dw up to a multiple of 8 dwords */ static void sdma_v4_0_ring_pad_ib(struct amdgpu_ib_replica *ib) { /* kernel variant consults a per-SDMA burst_nop flag; default path below */ uint32_t pad_count = (8 - (ib->length_dw & 0x7)) % 8; uint32_t i; for (i = 0; i < pad_count; i++) ib->ptr[ib->length_dw++] = SDMA_PKT_HEADER_OP(SDMA_OP_NOP); } #define CANARY 0xAA /* Replicates amdgpu_vm_clear_bo()'s IB usage against a canaried pool. */ static int run_clear_bo_case(const char *name, int dual, uint64_t pt_gpu_addr, unsigned ats_entries, unsigned entries) { /* the kernel's SA sub-allocation is 64 bytes (amdgpu_ib_get -> * amdgpu_sa_bo_new(..., size=64, align=256)); we place it inside a * larger canaried region so the overrun is visible, exactly like the * real overrun lands in whatever follows the 64-byte SA hole. */ static uint8_t region[256 /*before*/ + 64 /*the IB*/ + 256 /*after*/]; struct amdgpu_ib_replica ib; uint32_t over_dwords; int i, damaged = 0; memset(region, CANARY, sizeof(region)); ib.ptr = (uint32_t *)(region + 256); ib.length_dw = 0; printf("[%s] amdgpu_job_alloc_with_ib(adev, 64, &job): ib buffer = 16 dwords (64 bytes)\n", name); /* amdgpu_vm.c:867-874 — the emit sequence */ if (ats_entries) { uint64_t ats_value = 0x00007fe0ULL /* AMDGPU_PTE_DEFAULT_ATC|PDE_PTE, illustrative */; sdma_v4_0_vm_set_pte_pde(&ib, pt_gpu_addr, 0, ats_entries, 0, ats_value); printf("[%s] after set_pte_pde(ats_entries=%u): length_dw=%u\n", name, ats_entries, ib.length_dw); } if (entries) { sdma_v4_0_vm_set_pte_pde(&ib, pt_gpu_addr + (uint64_t)ats_entries * 8, 0, entries, 0, 0); printf("[%s] after set_pte_pde(entries=%u): length_dw=%u\n", name, entries, ib.length_dw); } sdma_v4_0_ring_pad_ib(&ib); printf("[%s] after amdgpu_ring_pad_ib(): length_dw=%u\n", name, ib.length_dw); over_dwords = ib.length_dw > 16 ? ib.length_dw - 16 : 0; printf("[%s] WARN_ON(length_dw > 64) in kernel: %s (bound is the BYTE size — never trips)\n", name, ib.length_dw > 64 ? "would fire" : "silent"); for (i = 0; i < 256; i++) if (region[256 + 64 + i] != CANARY) damaged++; if (over_dwords) { printf("[%s] *** OOB WRITE: %u dwords (%u bytes) past the 64-byte SA sub-allocation ***\n", name, over_dwords, over_dwords * 4); printf("[%s] *** %d/256 canary bytes after the IB destroyed; first OOB dwords: ", name, damaged); for (i = 0; i < (int)over_dwords && i < 8; i++) printf("0x%08x ", ib.ptr[16 + i]); printf("***\n"); } else { printf("[%s] fits exactly (no overrun) — this is the non-ATS / non-root case\n", name); } printf("\n"); return over_dwords ? 1 : 0; } static void probe_hw(void) { char buf[4096]; FILE *f; int fd; printf("== hardware probe (kernel-path reachability on THIS host) ==\n"); fd = open("/dev/dri/0", O_RDWR); if (fd >= 0) { printf(" /dev/dri/0: OPEN — a DRM device is present\n"); close(fd); } else { printf(" /dev/dri/0: %s (no DRM node usable)\n", strerror(errno)); } fd = open("/dev/drm/0", O_RDWR); /* DragonFly drm node name */ if (fd >= 0) { printf(" /dev/drm/0: OPEN\n"); close(fd); } else { printf(" /dev/drm/0: %s\n", strerror(errno)); } f = popen("pciconf -l 2>/dev/null", "r"); if (f) { int amd_vga = 0; while (fgets(buf, sizeof(buf), f)) { if (strstr(buf, "vgapci") || strstr(buf, "display")) printf(" pci: %s", buf); if (strstr(buf, "vgapci") && (strstr(buf, "chip=0x") && strstr(buf, "0x1002"))) amd_vga = 1; } pclose(f); printf(" AMD (0x1002) VGA device: %s\n", amd_vga ? "PRESENT" : "absent"); printf(" -> amdgpu(4) can attach on this host: %s\n", amd_vga ? "YES" : "NO"); } printf("\n"); } int main(void) { int rc = 0; printf("DF-4864 harness: amdgpu_vm_clear_bo() 64-byte IB vs 2x10-dw set_pte_pde + SDMA pad\n"); printf("kernel refs: amdgpu_vm.c:855 alloc(64) / :867-874 dual emit / sdma_v4_0.c:1184-1200 emit\n"); printf(" sdma_v4_0.c:1208-1222 pad / amdgpu_ib.c:61-81 SA(64,align 256)\n\n"); probe_hw(); /* Case 1 — CHIP_RAVEN root PD clear (the bug): 512-entry root PD, * hole split 256/256 (rev0/1). Dual set_pte_pde. */ rc |= run_clear_bo_case("Raven-root-512", 1, 0x8000000000000000ULL - 0x4000, 256, 256); /* Case 2 — Raven2 root PD (rev>=2): 257 entries, ats=256, entries=1 */ rc |= run_clear_bo_case("Raven2-root-257", 1, 0x8000000000000000ULL - 0x4000, 256, 1); /* Case 3 — non-ATS / non-root single call (boundary: exactly fits) */ rc |= run_clear_bo_case("non-ATS-single", 0, 0x123450000ULL, 0, 512); printf("== summary ==\n"); printf(" cases with OOB write: %s\n", rc ? "YES — 32-byte (24dw) overrun into 16dw buffer" : "no"); return 0; }