โฌข DragonFlyBSD Kernel Audit
DF-4901 / trigger_sketch.c
โ† back to finding โ†“ download raw
/*
 * DF-4901 trigger sketch (NOT runnable โ€” audit guest has no AMD GPU; the
 * wptr source is device-side DMA into adev->wb.wb[adev->irq.ih.wptr_offs]).
 *
 * Setup (cz_ih_sw_init, cz_ih.c:300): ring = 64 KiB GTT BO (no slack,
 * amdgpu_ih.c:80-88), ptr_mask = 0xFFFF, IV = 16 bytes, writeback enabled
 * and targeted at cz_ih.c:133-138.
 *
 * Defect 1 โ€” permanent ithread spin (family core):
 *   device DMA writes wptr = 0x0014 (phase 4, no overflow bit).
 *   => amdgpu_ih_process (amdgpu_ih.c:154-157) steps rptr by 16
 *      (cz_ih.c:266), masked each lap; phase 0 never equals phase 4:
 *      4096 IVs re-dispatched per lap forever, ih->lock held
 *      (amdgpu_ih.c:144), restart_ih re-reads the same wptr โ€” one CPU
 *      pegged, all GPU IRQ delivery dead.
 *
 * Defect 2 โ€” up to 12-byte OOB read past the 64 KiB ring BO:
 *   device DMA writes wptr = 0xFFE4 | RB_OVERFLOW (phase 4).
 *   => recovery (cz_ih.c:202): rptr = (0xFFE4 + 16) & 0xFFFF = 0xFFF4
 *   => first prescreen/decode (cz_ih.c:222-225 / 253-256) reads
 *      ring[0x3FFD..0x4000]; worst case wptr'=0xFFEF -> rptr=0xFFFF ->
 *      ring[0x3FFF..0x4002] = bytes 0x10000..0x1000B past the exact-size
 *      ring BO, consumed as an interrupt vector and dispatched.
 *
 * CZ specifics vs the filed twins: wptr read solely from the writeback
 * memory (no use_bus_addr ring fallback, no IH doorbell on CZ); recovery
 * stride +16 like tonga/cik (vega10 uses +32); 16-byte IVs like all.
 */
int df4901_unused_trigger_placeholder;