DF-4768 — psp_cmd_submit_buf ignores resp.status when ucode==NULL: TMR/ASD load failures are reported as success

File: sys/dev/drm/amd/amdgpu/amdgpu_psp.c (pass 2) Info-grade defense-in-depth finding; static (no AMD GPU on audit guest).

Path

psp_cmd_submit_buf() (amdgpu_psp.c:118-150) checks the firmware's response status only when a ucode argument was supplied:

137:  /* the status field must be 0 after FW is loaded */
138:  if (ucode && psp->cmd_buf_mem->resp.status) {
139:      DRM_ERROR("failed loading with status (%d) and ucode id (%d)\n", ...);
141:      return -EINVAL;

The two callers that pass ucode == NULL are psp_tmr_load() (:193, GFX_CMD_ID_SETUP_TMR — establishes the Trusted Memory Region) and psp_asd_load() (:260, GFX_CMD_ID_LOAD_ASD). If PSP firmware rejects the TMR setup or ASD load (resp.status != 0), the function still returns ret (the ring-write status, typically 0), so:

• psp_hw_start() reports success and psp_np_fw_load() proceeds to load all security-sensitive ucode into a TMR the PSP never set up;
• the failure is silent — not even a log line.

Impact is firmware-robustness / security-state confusion (uCode loaded without an established trusted region), not kernel memory corruption; hence Info. No runtime PoC possible on this guest (amdgpu never attaches).

Fix

fix.diff — check resp.status unconditionally.

DF-4768 VERDICT

Status: INCONCLUSIVE-RUNTIME / SOURCE-CONFIRMED (no AMD GPU on the audit guest; DF-1854/DF-1855 precedent).

amdgpu_psp.c:137-142 gates the response-status check on ucode != NULL, so psp_tmr_load (:193, index 1) and psp_asd_load (:260, index 2) — the two ucode==NULL callers — return success even when the PSP reports a nonzero resp.status. psp_hw_start then continues into psp_np_fw_load with no Trusted Memory Region established and no error logged. Kernel memory-safety impact: none (correctness/security-state issue only) ⇒ Info severity, confidence certain on the code, speculative on real-world effect (depends on PSP FW ever rejecting TMR/ASD).

Fix: fix.diff (drop the ucode && guard). Not runtime-validatable on this guest.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.