DF-4902 / trigger_sketch.c
/* * DF-4902 trigger sketch (NOT runnable โ audit guest has no AMD GPU; the * wptr source is device-side DMA into adev->wb.wb[adev->irq.ih.wptr_offs]). * * Setup (iceland_ih_sw_init, iceland_ih.c:300): ring = 64 KiB GTT BO (no * slack, amdgpu_ih.c:80-88), ptr_mask = 0xFFFF, IV = 16 bytes, writeback * enabled and targeted (iceland_ih_irq_init). * * Defect 1 โ permanent ithread spin (family core): * device DMA writes wptr = 0x0014 (phase 4, no overflow bit). * => amdgpu_ih_process (amdgpu_ih.c:154-157) steps rptr by 16 * (iceland_ih.c:266), masked each lap; phase 0 never equals phase 4: * 4096 IVs re-dispatched per lap forever, ih->lock held * (amdgpu_ih.c:144), restart_ih re-reads the same wptr โ one CPU * pegged, all GPU IRQ delivery dead. * * Defect 2 โ up to 12-byte OOB read past the 64 KiB ring BO: * device DMA writes wptr = 0xFFE4 | RB_OVERFLOW (phase 4). * => recovery (iceland_ih.c:202): rptr = (0xFFE4 + 16) & 0xFFFF = 0xFFF4 * => first prescreen/decode (iceland_ih.c:222-225 / 253-256) reads * ring[0x3FFD..0x4000]; worst case wptr'=0xFFEF -> rptr=0xFFFF -> * ring[0x3FFF..0x4002] = bytes 0x10000..0x1000B past the exact-size * ring BO, consumed as an interrupt vector and dispatched. * * iceland_ih.c is byte-identical to cz_ih.c in get_wptr/prescreen/ * decode/set_rptr (only OSS 2.4 vs 3.0.1 register headers and the ip-block * version differ); TOPAZ parts select it at vi.c:1600. */ int df4902_unused_trigger_placeholder; |