โฌข DragonFlyBSD Kernel Audit
DF-4902 / trigger_sketch.c
โ† back to finding โ†“ download raw
/*
 * DF-4902 trigger sketch (NOT runnable โ€” audit guest has no AMD GPU; the
 * wptr source is device-side DMA into adev->wb.wb[adev->irq.ih.wptr_offs]).
 *
 * Setup (iceland_ih_sw_init, iceland_ih.c:300): ring = 64 KiB GTT BO (no
 * slack, amdgpu_ih.c:80-88), ptr_mask = 0xFFFF, IV = 16 bytes, writeback
 * enabled and targeted (iceland_ih_irq_init).
 *
 * Defect 1 โ€” permanent ithread spin (family core):
 *   device DMA writes wptr = 0x0014 (phase 4, no overflow bit).
 *   => amdgpu_ih_process (amdgpu_ih.c:154-157) steps rptr by 16
 *      (iceland_ih.c:266), masked each lap; phase 0 never equals phase 4:
 *      4096 IVs re-dispatched per lap forever, ih->lock held
 *      (amdgpu_ih.c:144), restart_ih re-reads the same wptr โ€” one CPU
 *      pegged, all GPU IRQ delivery dead.
 *
 * Defect 2 โ€” up to 12-byte OOB read past the 64 KiB ring BO:
 *   device DMA writes wptr = 0xFFE4 | RB_OVERFLOW (phase 4).
 *   => recovery (iceland_ih.c:202): rptr = (0xFFE4 + 16) & 0xFFFF = 0xFFF4
 *   => first prescreen/decode (iceland_ih.c:222-225 / 253-256) reads
 *      ring[0x3FFD..0x4000]; worst case wptr'=0xFFEF -> rptr=0xFFFF ->
 *      ring[0x3FFF..0x4002] = bytes 0x10000..0x1000B past the exact-size
 *      ring BO, consumed as an interrupt vector and dispatched.
 *
 * iceland_ih.c is byte-identical to cz_ih.c in get_wptr/prescreen/
 * decode/set_rptr (only OSS 2.4 vs 3.0.1 register headers and the ip-block
 * version differ); TOPAZ parts select it at vi.c:1600.
 */
int df4902_unused_trigger_placeholder;