⬢ DragonFlyBSD Kernel Audit
DF-5055 / run.log
← back to finding ↓ download raw 
=== baseline ===
== DF-5055 replica: dce80 vupdate (no .src_id) -> dce110_vblank_set pipe_ctx[178] OOB ==
mode: BASELINE (verbatim)

enum: VUPDATE1=72 VUPDATE6=77 VBLANK1=78 VBLANK6=83 IRQ_TYPE_VBLANK=78 MAX_PIPES=6
table: vupdate1 src_id=0 ext_id=0 | vblank1 src_id=19 (19..24)

control VBLANK1 set:      arm_vert_intr(tg->pipe_idx=0, id=2)
control VBLANK2 set:      arm_vert_intr(tg->pipe_idx=1, id=2)
control VBLANK3 set:      arm_vert_intr(tg->pipe_idx=2, id=2)
control VBLANK4 set:      arm_vert_intr(tg->pipe_idx=3, id=2)
control VBLANK5 set:      arm_vert_intr(tg->pipe_idx=4, id=2)
control VBLANK6 set:      arm_vert_intr(tg->pipe_idx=5, id=2)
controls ok (vblank path arms pipes 0..5)

trigger: dal_irq_service_set(DC_IRQ_SOURCE_VUPDATE1=72)
   -> dce110_vblank_set: dal_irq_src=INVALID(0), pipe_offset = (uint8_t)(0-78) = 178
   -> core_dc->current_state->res_ctx.pipe_ctx[178] on a 6-entry array ...
baseline exit=138

=== fixed ===
Bus error (core dumped)
== DF-5055 replica: dce80 vupdate (no .src_id) -> dce110_vblank_set pipe_ctx[178] OOB ==
mode: FIXED (pipe_offset derived from table index)

enum: VUPDATE1=72 VUPDATE6=77 VBLANK1=78 VBLANK6=83 IRQ_TYPE_VBLANK=78 MAX_PIPES=6
table: vupdate1 src_id=0 ext_id=0 | vblank1 src_id=19 (19..24)

control VBLANK1 set:      arm_vert_intr(tg->pipe_idx=0, id=2)
control VBLANK2 set:      arm_vert_intr(tg->pipe_idx=1, id=2)
control VBLANK3 set:      arm_vert_intr(tg->pipe_idx=2, id=2)
control VBLANK4 set:      arm_vert_intr(tg->pipe_idx=3, id=2)
control VBLANK5 set:      arm_vert_intr(tg->pipe_idx=4, id=2)
control VBLANK6 set:      arm_vert_intr(tg->pipe_idx=5, id=2)
controls ok (vblank path arms pipes 0..5)

trigger: dal_irq_service_set(DC_IRQ_SOURCE_VUPDATE1=72)
   -> dce110_vblank_set: dal_irq_src=INVALID(0), pipe_offset = (uint8_t)(0-78) = 178
   -> core_dc->current_state->res_ctx.pipe_ctx[178] on a 6-entry array ...
      arm_vert_intr(tg->pipe_idx=0, id=2)

[fixed] VUPDATE1 -> pipe 0 armed via index-derived offset; exit 0
fixed exit=0
---- SECOND BASELINE RUN ----
== DF-5055 replica: dce80 vupdate (no .src_id) -> dce110_vblank_set pipe_ctx[178] OOB ==
mode: BASELINE (verbatim)

enum: VUPDATE1=72 VUPDATE6=77 VBLANK1=78 VBLANK6=83 IRQ_TYPE_VBLANK=78 MAX_PIPES=6
table: vupdate1 src_id=0 ext_id=0 | vblank1 src_id=19 (19..24)

control VBLANK1 set:      arm_vert_intr(tg->pipe_idx=0, id=2)
control VBLANK2 set:      arm_vert_intr(tg->pipe_idx=1, id=2)
control VBLANK3 set:      arm_vert_intr(tg->pipe_idx=2, id=2)
control VBLANK4 set:      arm_vert_intr(tg->pipe_idx=3, id=2)
control VBLANK5 set:      arm_vert_intr(tg->pipe_idx=4, id=2)
control VBLANK6 set:      arm_vert_intr(tg->pipe_idx=5, id=2)
controls ok (vblank path arms pipes 0..5)

trigger: dal_irq_service_set(DC_IRQ_SOURCE_VUPDATE1=72)
   -> dce110_vblank_set: dal_irq_src=INVALID(0), pipe_offset = (uint8_t)(0-78) = 178
   -> core_dc->current_state->res_ctx.pipe_ctx[178] on a 6-entry array ...
second=138
Bus error (core dumped)