|
|
fifth hang
Another untried angle, since every buffer so far was a legitimate allocation: whether the
processor checks that the command buffer lies in an allowed aperture. It does not. A null
memory-controller address gives a ten second hang accompanied by a flood of
memory-controller fault interrupts, so the processor dereferences the host-supplied
address repeatedly instead of rejecting it, which is a fifth denial of service trigger and
the clearest evidence that aperture checking is left to the memory controller.
The obvious follow-up was tested rather than assumed: whether the processor writes
anywhere other than the buffer it was pointed at. With two regions, one declared as the
command buffer and the other left pristine, a command that produces output changes only
the declared region. The first attempt at this test was invalid because the request had
been written into both regions, and it was corrected before any conclusion was drawn.
So the missing check produces a hang on an invalid address rather than a write to an
unintended one. A cross-context directed write cannot be demonstrated on a single-tenant
part, and the observed faults show the hardware enforcement that would apply.
|
