/* * dfrig_cyx.c -- DF-2213 verification rig * (sys/dev/disk/nata/chipsets/ata-cyrix.c:98) * * Finding under test: * * ata_cyrix_setmode() programs the Cyrix 5530 PIO timing register * with * * ATA_OUTL(ch->r_io[ATA_BMCMD_PORT].res, * 0x20 + (devno << 3), * piotiming[mode & ATA_MODE_MASK]); <-- ata-cyrix.c:98 * * where piotiming[] has FIVE elements (ata-cyrix.c:67-68) but the * ATA PIO mode constants start at 0x08 (sys/sys/nata.h:203-207: * ATA_PIO0=0x08 .. ATA_PIO4=0x0c) and ATA_MODE_MASK is 0x0f * (sys/sys/nata.h:200). For every real PIO mode the masked index * is therefore 8..12 -- reading 3..7 elements (12..28 bytes) past * the end of the 20-byte table -- and the garbage constant so read * is written to the disk controller PIO timing register. In the * shipped stock kernel the elements at piotiming[8..12] are * dmatiming[2] / a hole / udmatiming[0..2] (see * kernel_rodata.txt), so the standard boot probe (setmode settles * at ATA_PIO4) programs a UDMA2 timing (0x00911030) where a PIO4 * timing (0x00040010) belongs: silent wrong-timing / disk data * corruption class. Every sibling driver indexes the same shape * of table with ata_mode2idx() (ata-pci.c:719-726, the idiom that * subtracts ATA_PIO0: e.g. ata-national.c:102 -- the NatSemi clone * of this very driver). * * Real dispatch chain that reaches the handler (all production cites): * * boot reinit / ioctl(IOCATASMODE) sys/dev/disk/nata/ata-all.c:523-526 * ATA_SETMODE(parent, dev) (newbus method, ata_if.m) * -> ata_pcichannel_setmode() sys/dev/disk/nata/ata-pci.c:855-866 * ctlr->setmode(dev, ATA_PIO_MAX); <-- extracted call site * if (mode >= ATA_DMA) ctlr->setmode(dev, mode); * -> ata_cyrix_setmode() chipsets/ata-cyrix.c:60 * -> line 98: piotiming[mode & 0x0f] with mode>=0x08 => OOB .rodata read * ATA_OUTL(...) writes the OOB-sourced constant into the controller * PIO timing register (0x20 + devno*8 in the BMIO port space). * * The hardware is gated (Cyrix 5530, PCI ID 0x0100780e... actually * ATA_CYRIX_5530 per ata-pci.h), so this rig follows the established * production-handler dispatch class (DF-2210 national, DF-252x trm, * DF-249x nata): * * - the production file chipsets/ata-cyrix.c is #included VERBATIM * from the guest /usr/src tree (build.sh verifies the file sha256 * against the audited sys/ tree). The ONLY textual intervention is * `#define ata_cyrix_ident rig_unused_ata_cyrix_ident`, which renames * the never-called ident() entry point to avoid a duplicate global * against the built-in kernel copy; ata_cyrix_setmode itself is * compiled byte-for-byte as written, static, under its production * name. * * - the RUNNING KERNEL's OWN ata_cyrix_setmode (local symbol, from * `nm /boot/kernel/kernel`, address injected via sysctl) is ALSO * dispatched -- the shipped binary, zero recompilation. Its OOB * reads come from the shipped kernel's own .rodata (whose layout * was recovered by objdump: kernel_handler_disasm.txt / * kernel_rodata.txt), and the rig cross-checks the recorded * register write value against the live kernel memory at * tbl_base + 4*index. * * - the channel/controller/ata-device state is exactly what the * machine presents on a working Cyrix 5530 channel: ctlr->r_res1 * allocated (the guard at ata-cyrix.c:84 passes -- THIS file guards * its derefs, unlike the National clone of DF-2210), ch->dma present * (alignment/max_iosize get overridden), disk present * (ch->devices = ATA_ATA_MASTER) with per-scenario identify data * driving ata_limit_mode() to the PIO mode under test. The channel * is in the ATA_STALL_QUEUE state with a begin_transaction that * reports the drive accepting SETXFER, so the kernel's own * production ata_controlcmd()/ata_queue_request() (ata-queue.c:100- * 115,158-190) run unmodified. The ATA_OUTL timing writes dispatch * through the real bus_space_write_4() onto a fabricated MEM-space * bus tag + handle: on DragonFly/amd64 bus_space_write_4(tag==MEM) * is `*(volatile u_int32_t *)(handle + offset) = value`, so the * production register writes land in the rig's 128-byte "PCI * register file" (fake_bmio) and get dumped -- the garbage timing * landing in the controller register, captured. * * Tests (sysctl kern.dfrig_cyx.go=N), all on a STOCK kernel: * * 1 THE FINDING, shipped kernel handler: identify PIO4/UDMA2 disk, * mode=ATA_PIO_MAX (exactly the first call of the extracted call * site ata-pci.c:863). Settles at ATA_PIO4 (0x0c) -> index 12 -> * OOB read = udmatiming[2] = 0x00911030 -> regfile[0x20] gets a * UDMA2 timing where piotiming[4]=0x00040010 belongs. * 2 THE FINDING, verbatim rig copy: identical dispatch through the * #included production source (byte-identity of the copy). * 3 RANGE FLOOR: identify PIO0-only disk -> settles ATA_PIO0 (0x08) * -> index 8 -> OOB read = dmatiming[2] = 0x00002020. * 4 FULL extracted call site (ata-pci.c:855-866) with requested * ATA_UDMA2 (a UDMA disk at boot): call 1 = the OOB PIO write * above; call 2 = udmatiming[2] (IN bounds -- the UDMA branch is * correctly indexed) -> contrast: both controller slots end up * holding UDMA timings, the PIO one illegitimately. * 5 CONTROL (correct branch): WDMA2-only identify, request * ATA_WDMA2 -> dmatiming[2] in bounds -> regfile[0x24] = * 0x00002020 -- the WDMA branch indexes correctly; the defect is * specific to the PIO branch (line 98). * * After every dispatch the rig prints: the settled mode, the computed * index (mode & ATA_MODE_MASK), the CORRECT index (kernel-exported * ata_mode2idx()) and the correct value (the five source constants), * the captured register-file slots, and a dump of the live kernel * piotiming[] window [0..13] with in-bounds/OOB annotation so the * recorded write value is attributable to a specific OOB element. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include /* struct bsd_device layout */ #include #include #include "ata-all.h" #include "ata-pci.h" /* ------------------------------------------------------------------ */ /* CHECKER NOTE: the production file below is included VERBATIM. */ /* The single #define renames only the never-called ident() symbol so */ /* this KLD does not collide with the built-in kernel copy; the */ /* setmode function under test keeps its production name and body. */ /* build.sh pins the file by sha256 before compiling. */ /* ------------------------------------------------------------------ */ int rig_unused_ata_cyrix_ident(device_t dev); /* kproto */ #define ata_cyrix_ident rig_unused_ata_cyrix_ident #include "chipsets/ata-cyrix.c" /* <-- UNMODIFIED production code */ #undef ata_cyrix_ident /* the five real PIO timings from the audited source (ata-cyrix.c:67-68), * used to (a) verify the kernel .rodata table was found and (b) show * the CORRECT value the controller should have received */ static const uint32_t rig_piotiming_src[5] = { 0x00009172, 0x00012171, 0x00020080, 0x00032010, 0x00040010 }; /* ------------------------------------------------------------------ */ /* channel HW completion fabrication: with ch->state == ATA_STALL_QUEUE */ /* the PRODUCTION ata_queue_request() (ata-queue.c:100-115) executes */ /* ATA_R_CONTROL requests synchronously via ch->hw.begin_transaction */ /* and returns immediately when it reports ATA_OP_FINISHED -- no */ /* queueing, no tsleep, no interrupt. Our begin_transaction stands */ /* for the drive accepting SET FEATURES / SETXFER. With this in place */ /* even the RUNNING KERNEL's own ata_controlcmd() and */ /* ata_queue_request() run unmodified. */ /* ------------------------------------------------------------------ */ static int rig_cmd_seen; /* begin_transaction dispatches */ static int rig_begin_transaction(struct ata_request *request) { rig_cmd_seen++; request->result = 0; /* drive accepted SETXFER */ request->flags |= ATA_R_COMPLETED; return ATA_OP_FINISHED; } /* ------------------------------------------------------------------ */ /* fabricated controller register file: the production ATA_OUTL at */ /* ata-cyrix.c:89/93/97 expands to bus_space_write_4(res->r_bustag, */ /* res->r_bushandle, offset, value); with r_bustag == */ /* X86_64_BUS_SPACE_MEM that is *(volatile u_int32_t *)(handle+off) */ /* (cpu/x86_64/include/bus_dma.h:404-412), so a MEM tag + kernel */ /* buffer handle turns the production register writes into captures. */ /* ------------------------------------------------------------------ */ #define RIG_BMIO_NREG 32 /* 128 bytes: 0x00..0x7f */ static u_int32_t fake_bmio[RIG_BMIO_NREG]; static struct resource fake_res; /* tag/handle carrier */ /* ------------------------------------------------------------------ */ /* fake device graph -- the exact graph nata hands the chipset driver */ /* when a disk sits on a working Cyrix 5530 channel: */ /* */ /* rig_bus_dev (opaque parent) <- fake_pci_dev (ctlr softc, r_res1) */ /* <- fake_ch_dev (struct ata_channel, dma present) */ /* <- fake_ata_dev (struct ata_device, unit=ATA_MASTER) */ /* ------------------------------------------------------------------ */ static struct bsd_device fake_bus_dev, fake_pci_dev, fake_ch_dev; static struct bsd_device fake_ata_dev; static struct ata_channel fake_ch; static struct ata_device fake_atadev; static struct ata_dma fake_dma; static struct ata_pci_controller fake_ctlr; static unsigned long rig_kern_addr; /* kernel own handler, via nm */ static unsigned long rig_kern_tbl; /* kernel piotiming[] base */ static int rig_armed; static void rig_setup_graph(void) { bzero(&fake_bus_dev, sizeof(fake_bus_dev)); bzero(&fake_pci_dev, sizeof(fake_pci_dev)); bzero(&fake_ch_dev, sizeof(fake_ch_dev)); bzero(&fake_ata_dev, sizeof(fake_ata_dev)); bzero(&fake_ch, sizeof(fake_ch)); bzero(&fake_atadev, sizeof(fake_atadev)); bzero(&fake_ctlr, sizeof(fake_ctlr)); bzero(&fake_bmio, sizeof(fake_bmio)); bzero(&fake_res, sizeof(fake_res)); /* the BMIO resource: MEM-space tag, handle = register file */ fake_res.r_bustag = 1; /* X86_64_BUS_SPACE_MEM */ fake_res.r_bushandle = (bus_space_handle_t)fake_bmio; /* pci <- channel <- ata device, exactly as GRANDPARENT walks it */ fake_pci_dev.parent = &fake_bus_dev; fake_pci_dev.softc = &fake_ctlr; fake_ch_dev.parent = &fake_pci_dev; fake_ch_dev.softc = &fake_ch; fake_ata_dev.parent = &fake_ch_dev; fake_ata_dev.softc = &fake_atadev; /* controller: BMIO resource allocated -- the ata-cyrix.c:84 guard * passes (this file guards its derefs, unlike DF-2210 national) */ fake_ctlr.r_res1 = &fake_res; /* channel: working DMA, disk present, sync CONTROL completion */ fake_ch.dev = &fake_ch_dev; fake_ch.unit = 0; fake_ch.devices = ATA_ATA_MASTER; fake_ch.state = ATA_STALL_QUEUE; fake_ch.hw.begin_transaction = rig_begin_transaction; fake_ch.r_io[ATA_BMCMD_PORT].res = &fake_res; fake_ch.r_io[ATA_BMCMD_PORT].offset = 0; lockinit(&fake_ch.state_mtx, "dfrig_cyx_st", 0, LK_CANRECURSE); lockinit(&fake_ch.queue_mtx, "dfrig_cyx_q", 0, LK_CANRECURSE); /* ata device: master; identify data set per scenario */ fake_atadev.dev = &fake_ata_dev; fake_atadev.unit = ATA_MASTER; fake_atadev.mode = 0xff; } /* identify-data presets driving ata_limit_mode() to the mode under * test (ata-all.c ata_pmode/ata_wmode/ata_umode) */ static void rig_identify_pio4_udma2(void) { fake_atadev.param.atavalid = ATA_FLAG_64_70 | ATA_FLAG_88; fake_atadev.param.apiomodes = 0x02; /* PIO4 (ata_pmode -> 0x0c) */ fake_atadev.param.udmamodes = 0x04; /* UDMA2 (ata_umode -> 0x42) */ fake_atadev.param.mwdmamodes = 0x00; fake_atadev.param.retired_piomode = 0; } static void rig_identify_pio0_only(void) { /* no valid words 64-70/88, no mwdma, retired_piomode==0: * ata_pmode() -> ATA_PIO0 (0x08), ata_umode() -> -1 */ fake_atadev.param.atavalid = 0; fake_atadev.param.apiomodes = 0x00; fake_atadev.param.udmamodes = 0x00; fake_atadev.param.mwdmamodes = 0x00; fake_atadev.param.retired_piomode = 0; } static void rig_identify_wdma2_only(void) { fake_atadev.param.atavalid = 0; fake_atadev.param.apiomodes = 0x00; fake_atadev.param.udmamodes = 0x00; fake_atadev.param.mwdmamodes = 0x04; /* WDMA2 (ata_wmode -> 0x22) */ fake_atadev.param.retired_piomode = 0; } /* print the live kernel piotiming[] window with annotation */ static void rig_dump_kernel_table(void) { volatile u_int32_t *tbl = (volatile u_int32_t *)rig_kern_tbl; int i; if (rig_kern_tbl == 0) return; if (tbl[0] != rig_piotiming_src[0] || tbl[1] != rig_piotiming_src[1] || tbl[2] != rig_piotiming_src[2] || tbl[3] != rig_piotiming_src[3] || tbl[4] != rig_piotiming_src[4]) { kprintf("dfrig_cyx: TABLE-CHECK FAILED at 0x%lx: [0..4] != " "source constants\n", rig_kern_tbl); return; } kprintf("dfrig_cyx: kernel .rodata piotiming[] @ 0x%lx " "(verified: [0..4] == source constants):\n", rig_kern_tbl); for (i = 0; i < 14; i++) { const char *what; switch (i) { case 0: case 1: case 2: case 3: case 4: what = "IN BOUNDS (piotiming[i])"; break; case 5: what = "OOB: pad hole"; break; case 6: what = "OOB: dmatiming[0]"; break; case 7: what = "OOB: dmatiming[1]"; break; case 8: what = "OOB: dmatiming[2] <-- PIO0 (0x08) lands here"; break; case 9: what = "OOB: pad hole <-- PIO1 (0x09) lands here"; break; case 10: what = "OOB: udmatiming[0] <-- PIO2 (0x0a) lands here"; break; case 11: what = "OOB: udmatiming[1] <-- PIO3 (0x0b) lands here"; break; case 12: what = "OOB: udmatiming[2] <-- PIO4 (0x0c) lands here"; break; default: what = "OOB: unrelated driver constant"; break; } kprintf("dfrig_cyx: [%2d] @+0x%02x = 0x%08x %s\n", i, i * 4, tbl[i], what); } } /* post-dispatch report: index used vs correct, register file dump */ static void rig_report(const char *tag, int requested) { int settled = fake_atadev.mode; int idx = settled & ATA_MODE_MASK; int cidx = (settled >= 0) ? ata_mode2idx(settled) : -1; u_int32_t pio_slot = fake_bmio[0x20 / 4]; u_int32_t dma_slot = fake_bmio[0x24 / 4]; u_int32_t oob_src = 0; kprintf("dfrig_cyx[%s]: requested mode=0x%02x settled mode=0x%02x " "controlcmd_seen=%d\n", tag, requested, settled, rig_cmd_seen); kprintf("dfrig_cyx[%s]: INDEX USED = mode & ATA_MODE_MASK = 0x%02x & " "0x0f = %d (piotiming[] has 5 elements: 0..4)%s\n", tag, settled, idx, (idx >= 5 && settled < ATA_WDMA0) ? " <<< OUT OF BOUNDS" : ""); if (settled < ATA_WDMA0) { kprintf("dfrig_cyx[%s]: INDEX RIGHT = ata_mode2idx(mode) = " "%d (the idiom every sibling uses)\n", tag, cidx); if (cidx >= 0 && cidx <= 4) kprintf("dfrig_cyx[%s]: CORRECT VALUE piotiming[%d] = " "0x%08x (source constant)\n", tag, cidx, rig_piotiming_src[cidx]); } kprintf("dfrig_cyx[%s]: controller register file (fabricated BMIO " "MEM space):\n", tag); kprintf("dfrig_cyx[%s]: reg 0x20 (PIO timing, devno 0) = 0x%08x\n", tag, pio_slot); kprintf("dfrig_cyx[%s]: reg 0x24 (DMA timing, devno 0) = 0x%08x\n", tag, dma_slot); if (rig_kern_tbl && settled < ATA_WDMA0 && idx >= 5) { oob_src = ((volatile u_int32_t *)rig_kern_tbl)[idx]; kprintf("dfrig_cyx[%s]: OOB SOURCE kernel_mem[piotiming+%d*4] = " "0x%08x%s\n", tag, idx, oob_src, (oob_src == pio_slot) ? " == reg 0x20 write (OOB read CONFIRMED)" : " (MISMATCH vs reg 0x20?!)"); } } /* one direct dispatch of the handler under test */ static void rig_dispatch(int via_kernel, int identify, int mode, const char *tag) { /* production ata-dmainit defaults (ata-dma.c:75-83) so the run * shows the chipset OVERRIDING them, as on real hardware */ bzero(&fake_dma, sizeof(fake_dma)); fake_dma.alignment = 2; fake_dma.max_iosize = 128 * DEV_BSIZE; fake_ch.dma = &fake_dma; fake_atadev.mode = 0xff; bzero(&fake_atadev.param, sizeof(fake_atadev.param)); rig_cmd_seen = 0; bzero(fake_bmio, sizeof(fake_bmio)); if (identify == 0) rig_identify_pio4_udma2(); else if (identify == 1) rig_identify_pio0_only(); else rig_identify_wdma2_only(); kprintf("dfrig_cyx[%s]: BEFORE dispatch: ch->dma=%p ctlr->r_res1=%p " "(guard ata-cyrix.c:84 passes) atadev->unit=%d\n", tag, fake_ch.dma, fake_ctlr.r_res1, fake_atadev.unit); kprintf("dfrig_cyx[%s]: dispatching production ata_cyrix_setmode" "(dev, 0x%02x) %s\n", tag, mode, via_kernel ? "(RUNNING KERNEL own copy)" : "(verbatim #included copy)"); if (via_kernel) ((void (*)(device_t, int))rig_kern_addr)(&fake_ata_dev, mode); else ata_cyrix_setmode(&fake_ata_dev, mode); kprintf("dfrig_cyx[%s]: RETURNED: ch->dma->alignment=%u " "max_iosize=%u\n", tag, fake_dma.alignment, fake_dma.max_iosize); rig_report(tag, mode); } /* extracted call site: ata_pcichannel_setmode(), ata-pci.c:855-866, * verbatim extraction (static in the kernel, cannot be linked) */ static void rig_extracted_callsite(device_t dev, int mode) { struct ata_pci_controller *ctlr = device_get_softc(GRANDPARENT(dev)); ctlr->setmode(dev, ATA_PIO_MAX); if (mode >= ATA_DMA) ctlr->setmode(dev, mode); } /* full-call-site scenario: two ctlr->setmode dispatches as at boot */ static void rig_dispatch_full(int via_kernel, const char *tag) { bzero(&fake_dma, sizeof(fake_dma)); fake_dma.alignment = 2; fake_dma.max_iosize = 128 * DEV_BSIZE; fake_ch.dma = &fake_dma; fake_atadev.mode = ATA_UDMA2; /* requested mode, as at boot */ bzero(&fake_atadev.param, sizeof(fake_atadev.param)); rig_identify_pio4_udma2(); rig_cmd_seen = 0; bzero(fake_bmio, sizeof(fake_bmio)); fake_ctlr.setmode = via_kernel ? (void (*)(device_t, int))rig_kern_addr : ata_cyrix_setmode; kprintf("dfrig_cyx[%s]: BEFORE: requested mode=ATA_UDMA2 -- full " "extracted call site ata-pci.c:855-866 " "(call1 = ctlr->setmode(dev, ATA_PIO_MAX), " "call2 = ctlr->setmode(dev, 0x42))\n", tag); rig_extracted_callsite(&fake_ata_dev, fake_atadev.mode); kprintf("dfrig_cyx[%s]: RETURNED: alignment=%u max_iosize=%u " "controlcmd_seen=%d (2 SETXFER = normal)\n", tag, fake_dma.alignment, fake_dma.max_iosize, rig_cmd_seen); rig_report(tag, ATA_UDMA2); } /* ------------------------------------------------------------------ */ /* sysctl plumbing */ /* ------------------------------------------------------------------ */ static int rig_go_sysctl(SYSCTL_HANDLER_ARGS) { int val = 0, error; error = sysctl_handle_int(oidp, &val, 0, req); if (error || !req->newptr) return error; rig_armed = 1; rig_dump_kernel_table(); switch (val) { case 1: rig_dispatch(1, 0, ATA_PIO_MAX, "go1"); break; case 2: rig_dispatch(0, 0, ATA_PIO_MAX, "go2"); break; case 3: rig_dispatch(1, 1, ATA_PIO_MAX, "go3"); break; case 4: rig_dispatch_full(1, "go4"); break; case 5: rig_dispatch(1, 2, ATA_WDMA2, "go5"); break; default: return EINVAL; } return 0; } static SYSCTL_NODE(_kern, OID_AUTO, dfrig_cyx, CTLFLAG_RW, 0, "DF-2213 ata-cyrix rig"); SYSCTL_ULONG(_kern_dfrig_cyx, OID_AUTO, addr, CTLFLAG_RW, &rig_kern_addr, 0, "address of the kernel own ata_cyrix_setmode (from nm)"); SYSCTL_ULONG(_kern_dfrig_cyx, OID_AUTO, tbl, CTLFLAG_RW, &rig_kern_tbl, 0, "address of the kernel .rodata piotiming[] table " "(from objdump of the shipped handler)"); SYSCTL_PROC(_kern_dfrig_cyx, OID_AUTO, go, CTLTYPE_INT | CTLFLAG_RW, 0, 0, rig_go_sysctl, "I", "fire a scenario"); /* ------------------------------------------------------------------ */ /* module */ /* ------------------------------------------------------------------ */ static int dfrig_cyx_load(module_t mod, int what, void *arg) { switch (what) { case MOD_LOAD: rig_setup_graph(); kprintf("dfrig_cyx: DF-2213 rig loaded " "(production chipsets/ata-cyrix.c:98 included " "verbatim; kernel handler addr=0x%lx tbl=0x%lx)\n", rig_kern_addr, rig_kern_tbl); return 0; case MOD_UNLOAD: if (rig_armed) return EBUSY; lockuninit(&fake_ch.state_mtx); lockuninit(&fake_ch.queue_mtx); return 0; default: return 0; } } static moduledata_t dfrig_cyx_mod = { "dfrig_cyx", dfrig_cyx_load, 0 }; DECLARE_MODULE(dfrig_cyx, dfrig_cyx_mod, SI_SUB_DRIVERS, SI_ORDER_ANY);