DF-3810 — skl_calc_wrpll_link() divides by p1 without zero guard (#DE panic)

File

sys/dev/drm/i915/intel_ddi.c:1306-1364 (skl_calc_wrpll_link)

Build / Run / Expected

Not built, not run — guest has no Intel graphics (see env.txt). Hypothetical trigger on SKL/KBL/CFL hardware: DPLL_CFGCR2 programmed with DPLL_CFGCR2_QDIV_MODE(1) set and QDIV_RATIO == 0 (invalid/reserved combo that the driver itself never writes — the state would come from BIOS/firmware leftovers read back during display hw-state sanitize, or a wedged register), then any readback path reaching skl_ddi_clock_get() → skl_calc_wrpll_link() (e.g. intel_ddi_get_config at intel_ddi.c:3467 during boot-time intel_modeset_setup_hw_state or debugfs state dump). Expected: dco_freq / (p0 * p1 * p2 * 5) with p1 == 0 → integer divide exception → kernel panic.

Root cause

p0 = cfgcr2_val & DPLL_CFGCR2_PDIV_MASK;      /* raw field        */
p2 = cfgcr2_val & DPLL_CFGCR2_KDIV_MASK;
if (cfgcr2_val & DPLL_CFGCR2_QDIV_MODE(1))
        p1 = (cfgcr2_val & DPLL_CFGCR2_QDIV_RATIO_MASK) >> 8;   /* 8-bit field, can be 0 */
else
        p1 = 1;
switch (p0) { ... }                            /* encodings 1,2,3,7; 0 maps to PDIV_1 case */
switch (p2) { ... }                            /* all 4 encodings handled */
return dco_freq / (p0 * p1 * p2 * 5);          /* intel_ddi.c:1363 — no zero guard */

The CNL sibling cnl_calc_wrpll_link() has the guard:

if (WARN_ON(p0 == 0 || p1 == 0 || p2 == 0))
        return 0;                              /* intel_ddi.c:1424-1425 */

The HSW sibling missing the same class of guard was filed as DF-1226 (p*r division). The SKL variant's only zero-capable divisor operand is p1 (PDIV 0 maps to PDIV_1; all KDIV encodings map to nonzero; but QDIV_RATIO is a free 8-bit field when QDIV_MODE is set). The driver's own programming path (intel_dpll_mgr.c:1214-1215 qdiv_ratio = p1; qdiv_mode = (qdiv_ratio == 1) ? 0 : 1;) never writes ratio 0, so the trigger requires anomalous register content.

Impact

Kernel #DE panic (local DoS at boot/state-readback on affected config). Severity: Low (anomalous-HW-state dependent).

DF-3810 — VERDICT

status: untested (poc enum) / not testable on this guest — no Intel GPU.

What was verified (source-level)

1. Division at intel_ddi.c:1363 return dco_freq / (p0 * p1 * p2 * 5); with no preceding zero check in skl_calc_wrpll_link (whole function read: intel_ddi.c:1306-1364).
2. p1 is the only operand that can be zero: QDIV_RATIO is an 8-bit field (DPLL_CFGCR2_QDIV_RATIO_MASK (0xff << 8), i915_reg.h:9319) read raw when DPLL_CFGCR2_QDIV_MODE(1) (bit 7) is set; ratio==0 leaves p1==0 and no case remaps it. p0==0 hits case DPLL_CFGCR2_PDIV_1 (encoding 0, i915_reg.h:9330) → p0=1; p2's four encodings (0..3, i915_reg.h:9324-9327) all map nonzero.
3. The CNL sibling guards exactly this (WARN_ON(p0 == 0 || p1 == 0 || p2 == 0), intel_ddi.c:1424), proving the maintainers consider the state reachable enough to guard — SKL was simply missed. HSW sibling = known DF-1226 (excluded from this report); this is the distinct SKL function.
4. Reachability: skl_ddi_clock_get (intel_ddi.c:1609-1656) calls it whenever DPLL_CTRL1_HDMI_MODE(pll_id) is set during config readback (intel_ddi_clock_get ← intel_ddi_get_config ← encoder->get_config), i.e. boot-time hw-state sanitize and CRTC state reads.
5. The driver's own DPLL programming never emits QDIV_MODE=1 with ratio 0 (intel_dpll_mgr.c:1214-1215, 2206-2207), so the divide-by-zero requires firmware/BIOS-leftover or faulted register content — matching the Low/"anomalous state" rating, consistent with how DF-1226 was rated.

Why not run

No Intel display hardware on the guest; a synthetic register value cannot be injected into a real DPLL_CFGCR2 readback without the hardware.

Fix

--- a/sys/dev/drm/i915/intel_ddi.c
+++ b/sys/dev/drm/i915/intel_ddi.c
@@ -1360,6 +1360,10 @@ static int skl_calc_wrpll_link(struct drm_i915_private *dev_priv,
    dco_freq += (((cfgcr1_val & DPLL_CFGCR1_DCO_FRACTION_MASK) >> 9) * 24 *
        1000) / 0x8000;

+   if (WARN_ON(p0 == 0 || p1 == 0 || p2 == 0))
+       return 0;
+
    return dco_freq / (p0 * p1 * p2 * 5);
 }

(Mirrors cnl_calc_wrpll_link's guard at intel_ddi.c:1424.)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)