DF-5143
GFP_DMA32 <4GiB constraint for I965G/GM internal objects is dead code on DragonFly β shim alloc_pages ignores gfp_mask, so pre-gen6 32-bit GTT PTEs truncate >4GiB physical addresses and the GPU DMAs to aliased physical pages
Summary
The driver sets __GFP_DMA32 because '965gm cannot relocate objects above 4GiB' but the DFly alloc_pages shim ignores gfp_mask entirely (alloc_page DOES honor it - an oversight) and dma_map_sg is a pass-through: on I965G/GM with >4GiB RAM, internal-object pages can land above 4GiB, the 32-bit PTEs alias an unrelated low physical page, and the GPU silently corrupts/discloses arbitrary low physical memory. Vanishing hardware population gates it at Low; mechanism certain. Honor-DMA32-in-the-shim fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5143 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 908 B | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5143
Confirmed kernel references
Detail
Evidence (decisive lines)
source trace in finding markdown
Verified recommended fix
see finding markdown
Verdict
untested (latent kernel-internal API / hardware-gated I965G/GM)
No comments yet.