|
|
Lifts the oldest blocker in this tree. fail0verflow's radeon-tools ships an F32
disassembler written for Sea Islands CP/RLC; it works on gfx11 once containers
are parsed and load bases recovered. Upstream is fetched, not vendored (no
LICENSE in that repo), with our one-hunk fix kept as a patch -- it makes
out-of-range branch targets print as addresses instead of the string "True",
which is what made RLC_G's load base (0x2000) discoverable.
Decode percentage is explicitly not the evidence: an RV64 image scores 78% on
this permissive decoder. ret count and call-target resolution are what
discriminate, and the selftest encodes that with CI-era positive controls.
SDMA, audited end to end with no finding:
* the 52-packet dispatch table is recovered and validated against
navi10_sdma_pkt_open.h
* [HW] SRBM_WRITE writes an arbitrary register, but only with RB_CNTL.RB_PRIV
* [HW] register reads (POLL_REG_WRITE_MEM) are gated the same way
* [HW] PTEPDE is ungated and that is correct -- memory writes are confined by
the queue's VMID page tables, proven by a GCVM L2 fault on a raw physical
address
* TH1 has no packet table; its computed register indices are firmware-bounded
* the F32 register namespace is solved: 4*host_dword_offset + 0x4980,
validated at 31/54 against a null whose maximum over 400 trials is 14
One lead is retracted with its hardware evidence: POLL_MEM_VERIFY appeared to
use its ABI-reserved 12th dword as a register index, which would have been an
unprivileged arbitrary register write. Two bl calls sit between the load and
the store and the screen was not call-clobber aware. The screen was rebuilt
with per-callee clobber sets, which kills the false positive and leaves exactly
one sink in TH0 -- itself gated.
RLC is read but ranked low: r1 is consumed once per blob versus 370 times in
SDMA TH0, so it has no host packet surface and every input is already
privileged. Its namespace is only ~17% mapped, and an attempt to fit per-block
bases produced 21 mutually inconsistent candidates -- recorded as overfitting.
|
