DF-3770 — DFly port dropped the upstream pre-B3 ValleyView PPGTT disable

Finding

intel_sanitize_enable_ppgtt() (sys/dev/drm/i915/i915_gem_gtt.c:136-183) is missing a block present in upstream Linux v4.19 (and earlier, since 3.14):

    /* Early VLV doesn't have this */
    if (IS_VALLEYVIEW(dev_priv) && dev_priv->drm.pdev->revision < 0xb) {
        DRM_DEBUG_DRIVER("disabling PPGTT on pre-B3 step VLV\n");
        return 0;
    }

(verified by direct diff against raw.githubusercontent.com/torvalds/linux/v4.19 — see upstream_v419_diff.txt).

Effect: on ValleyView (Atom Z-series SoC GPU) pre-B3 silicon the DragonFly driver enables PPGTT (aliasing and/or full) where upstream considers it unsupported. Consequence on that hardware is GPU page faults / GPU hangs when PPGTT-addressed batches execute — an unprivileged local user with render-node access can wedge the GPU (recovered only by the reset machinery). Modern VLV steppings (C0+) are unaffected; all other platforms are unaffected. No memory-safety consequence: the PPGTT walkers themselves are bounds-correct; this is an enable-bit divergence only.

Filed as Info (upstream-divergence record): the removal appears to be an accidental trim during the port rather than a deliberate decision (no commit message rationale; the block is silent in the DFly diff).

Fix

Restore the upstream block — see fix.diff.

Reproduction

Requires an actual pre-B3 ValleyView part; the audit guest is virtio-only (no Intel GPU at all — pciconf shows 0x1111:1234; no i915kms.ko). Runtime verification skipped per contract.

DF-3770 — VERDICT

Status: untested (runtime) — Info divergence record; PoC phase skipped per contract and impossible on this guest (virtio-only, no i915).

Evidence

• Direct diff of sys/dev/drm/i915/i915_gem_gtt.c against Linux v4.19 drivers/gpu/drm/i915/i915_gem_gtt.c shows the DFly tree deleted the IS_VALLEYVIEW(dev_priv) && revision < 0xb → return 0 early-out from intel_sanitize_enable_ppgtt (v4.19 lines ~176-181; DFly file i915_gem_gtt.c:136-183 has no equivalent). Captured in upstream_v419_diff.txt.
• Everything else in the function matches v4.19 modulo renames, so the deletion is a local divergence, not part of a larger rework.

Impact assessment

• Hardware gate: ValleyView + pdev->revision < 0xb (2013 Atom SoCs, B0/B2 steppings). On those parts PPGTT gets enabled where upstream disables it → GPU faults/hangs under render load; local DoS on that hardware only. GPU reset machinery recovers; no corruption of kernel memory results from this divergence (the walkers in this file are bounds-correct independent of the enable bit).
• Info severity per rubric: hardening/divergence record, no demonstrated impact on current hardware.

Fix

fix.diff restores the upstream block verbatim (adapted types).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.