|
|
persistent PSP DoS
Tested the unvalidated RAS entry point on the Navi 31 card. Three results, in order of how much
they change the picture.
The decompilation is confirmed. With a normal window the OPEN build writes exactly the two predicted
words at offsets 4 and 8, and the invalid-command path writes them as well -- status 0xffff000a
returned and both words still modified -- which is the unconditional LABEL_12 writeback observed on
hardware rather than inferred.
The short-buffer scenario I proposed is closed by the loader, not by the TA. LOAD_TA rejects every
cmd_buf_len from 4 through 0xFFF with status 6 and accepts 0x1000 upward, so the floor is a full
page. That is far above both the hardened variant's 0x30 threshold and the largest statically
visible access at offset 8, so for all nonzero lengths the missing check has no consequence through
this path. My original severity framing was wrong and is corrected in the document.
But the loader accepts cmd_buf_len=0, and there the missing check decides everything. HARD builds
reject cleanly and the PSP stays alive: 27.0.0.26 returns 0xffff0006 at invoke, 27.0.0.22_6e11d9d0
fails the load with 0xffff0000. All three OPEN builds tested -- 27.0.0.25, 27.0.0.23 and
27.0.0.22_1cb5cb5b -- hang the sOS ring for the full 10 s timeout and leave the PSP dead, with
subsequent loads failing.
Attribution is clean because version 27.0.0.22 ships both variants: _6e11d9d0 survives and
_1cb5cb5b wedges, same version string, same host sequence, opposite outcome, differing only by the
16 bytes of entry-point checking.
Recovery needs an ATX power cycle. AM_RESET is not enough -- after a wedge the SMU's own mode1_reset
times out, so the usual recovery path is itself gone. That cost two power cycles during this work.
Net: one LOAD_TA with cmd_buf_len=0 plus one INVOKE_CMD gives a persistent PSP denial of service,
reproduced on three builds. The precondition is loading one of the five unvalidated RAS binaries,
which are AMD-signed production images the card accepts, so this is rollback-style rather than a
signing break. Card left healthy and verified.
|
