DF-4901 / trigger_sketch.c
/* * DF-4901 trigger sketch (NOT runnable โ audit guest has no AMD GPU; the * wptr source is device-side DMA into adev->wb.wb[adev->irq.ih.wptr_offs]). * * Setup (cz_ih_sw_init, cz_ih.c:300): ring = 64 KiB GTT BO (no slack, * amdgpu_ih.c:80-88), ptr_mask = 0xFFFF, IV = 16 bytes, writeback enabled * and targeted at cz_ih.c:133-138. * * Defect 1 โ permanent ithread spin (family core): * device DMA writes wptr = 0x0014 (phase 4, no overflow bit). * => amdgpu_ih_process (amdgpu_ih.c:154-157) steps rptr by 16 * (cz_ih.c:266), masked each lap; phase 0 never equals phase 4: * 4096 IVs re-dispatched per lap forever, ih->lock held * (amdgpu_ih.c:144), restart_ih re-reads the same wptr โ one CPU * pegged, all GPU IRQ delivery dead. * * Defect 2 โ up to 12-byte OOB read past the 64 KiB ring BO: * device DMA writes wptr = 0xFFE4 | RB_OVERFLOW (phase 4). * => recovery (cz_ih.c:202): rptr = (0xFFE4 + 16) & 0xFFFF = 0xFFF4 * => first prescreen/decode (cz_ih.c:222-225 / 253-256) reads * ring[0x3FFD..0x4000]; worst case wptr'=0xFFEF -> rptr=0xFFFF -> * ring[0x3FFF..0x4002] = bytes 0x10000..0x1000B past the exact-size * ring BO, consumed as an interrupt vector and dispatched. * * CZ specifics vs the filed twins: wptr read solely from the writeback * memory (no use_bus_addr ring fallback, no IH doorbell on CZ); recovery * stride +16 like tonga/cik (vega10 uses +32); 16-byte IVs like all. */ int df4901_unused_trigger_placeholder; |