DF-5386
TX-abort condition is read and discarded β writes to a non-ACKing slave return SMB_ENOERR success (silent write failure)
Summary
On NACK the DW controller flushes+holds the TX FIFO so TX_NOTFULL stays asserted: every write-path wait passes instantly, bytes are silently flushed, and the done: block reads TX_ABRT_SOURCE into a dead variable - writes to absent slaves return success while reads correctly fail. Configuration/command writes believed delivered when nothing touched the wire. Read-and-surface-the-abort fix.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-5386 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| verdict.json | file | 1.0 KB | view raw |
Fix verification
not_testablebaseline noβ patch + rebuild βpatched clean
per-fix-DF-5386
Confirmed kernel references
Detail
Evidence (decisive lines)
wire-level source proof vs SMBus 2.0 spec + ig4_reg.h documented abort/flush semantics
Verified recommended fix
see finding markdown
Verdict
untested (hardware-gated: no Intel LPSS I2C model in QEMU; pm SMBus is ichsmb, ACPI-injected fakes fail the COMP_VER gate)
No comments yet.