/*
 * DF-2216 / DF-2220 / DF-2223 / DF-2224 verbatim-code rig - TAIL
 * (concatenated after: rig_head.c + kvasprintf_verbatim.c +
 *  the four verbatim production files + the four FIXED variant bodies
 *  extracted from fix.diff-applied scratch copies by build.sh)
 *
 * All kprintf below is tagged so each finding run.sh can extract its own
 * section from the message buffer.
 */

/* ---------------- malloc accounting meter ---------------- */
/*
 * sys/sys/_malloc.h: struct malloc_type.ks_use[] is a per-CPU array of
 * struct kmalloc_use { memuse, inuse, calls, ... }.  kmalloc() bumps the
 * current cpu's slot (kern_slaballoc.c:1135), kfree() decrements it
 * (kern_slaballoc.c:1606), so summing the slots gives the type's live
 * bytes - exactly the aggregation the kernel itself uses
 * (kern_slaballoc.c:451,868).
 *
 * NOTE: ks_loosememuse must NOT be added: it is an up-only limit-check
 * fold of per-cpu loosememuse (kern_slaballoc.c:1136-1140) that is never
 * decremented on free (the first run of this rig double-counted it; the
 * +131104 = 131072-fold + 32 artifact proved it).
 */
static size_t
rig_mt_memuse(struct malloc_type *mt)
{
	size_t sum;
	int i;

	if (mt->ks_use == NULL)
		return (0);
	sum = 0;
	for (i = 0; i < ncpus; i++)
		sum += mt->ks_use[i].memuse;
	return (sum);
}

static uint64_t
rig_mt_calls(struct malloc_type *mt)
{
	uint64_t sum;
	int i;

	if (mt->ks_use == NULL)
		return (0);
	sum = 0;
	for (i = 0; i < ncpus; i++)
		sum += (uint64_t)mt->ks_use[i].calls;
	return (sum);
}

MALLOC_DECLARE(M_KENV);		/* kern/kern_environment.c:65 */

/* ================= DF-2216: dmi_match() kgetenv leak ================= */
#define DF2216_N	16384
#define DF2216_VALLEN	100	/* kgetenv allocates VALLEN+1 = 101 B/call */

static void
df2216_section(void)
{
	char val[DF2216_VALLEN + 1];
	int i, arm;
	size_t mu0, mu1, ctrl_delta, base_delta, fixed_delta;
	uint64_t c0, c1;
	bool rt = false, rf = true;

	memset(val, 'D', DF2216_VALLEN);
	val[DF2216_VALLEN] = 0;

	/* fabricate the dynamic-kenv boundary state dmi_match() reads */
	ksetenv("smbios.system.maker", val);
	ksetenv("smbios.planar.maker", val);
	ksetenv("smbios.system.product", val);
	ksetenv("smbios.planar.product", val);

	kprintf("DF2216 start: N=%d per-call kgetenv alloc=%d bytes "
	    "(kern_environment.c:242)\n", DF2216_N, DF2216_VALLEN + 1);

	/* CONTROL: correctly paired kgetenv/kfreeenv (kern_environment.c:369
	 * kgetenv_string() idiom) - the meter must return to its baseline */
	mu0 = rig_mt_memuse(M_KENV); c0 = rig_mt_calls(M_KENV);
	for (i = 0; i < DF2216_N; i++) {
		char *p = kgetenv("smbios.system.maker");
		if (p != NULL)
			kfreeenv(p);
	}
	mu1 = rig_mt_memuse(M_KENV); c1 = rig_mt_calls(M_KENV);
	ctrl_delta = mu1 - mu0;
	kprintf("DF2216 CONTROL  paired kgetenv+kfreeenv x%d: memuse delta=%zu "
	    "calls delta=%llu (expect ~0 / %d)\n", DF2216_N, ctrl_delta,
	    (unsigned long long)(c1 - c0), DF2216_N);

	/* BASELINE: the real, verbatim dmi_match() - alternate the strcmp
	 * match arm (returns true) and the fall-through arm (returns false);
	 * the finding claims BOTH paths leak the kgetenv buffer */
	mu0 = rig_mt_memuse(M_KENV); c0 = rig_mt_calls(M_KENV);
	for (i = 0; i < DF2216_N; i++) {
		if (i & 1)
			rt |= dmi_match(DMI_PRODUCT_NAME, val);
		else
			rf &= dmi_match(DMI_BOARD_NAME, "no-such-board");
	}
	mu1 = rig_mt_memuse(M_KENV); c1 = rig_mt_calls(M_KENV);
	base_delta = mu1 - mu0;
	kprintf("DF2216 BASELINE dmi_match x%d (matchret=%d mismatchret=%d): "
	    "memuse delta=%zu calls delta=%llu leaked-bytes-per-call=%zu\n",
	    DF2216_N, rt, rf, base_delta, (unsigned long long)(c1 - c0),
	    base_delta / DF2216_N);

	/* per-arm single-shot sweep: each of the four kgetenv arms leaks */
	{
		static const struct { enum dmi_field f; const char *n; } arms[] = {
			{ DMI_SYS_VENDOR,	"smbios.system.maker" },
			{ DMI_BOARD_VENDOR,	"smbios.planar.maker" },
			{ DMI_PRODUCT_NAME,	"smbios.system.product" },
			{ DMI_BOARD_NAME,	"smbios.planar.product" },
		};
		for (arm = 0; arm < 4; arm++) {
			mu0 = rig_mt_memuse(M_KENV);
			(void)dmi_match(arms[arm].f, "zzz");
			mu1 = rig_mt_memuse(M_KENV);
			kprintf("DF2216 BASELINE arm %-20s single call: memuse "
			    "delta=%zu\n", arms[arm].n, mu1 - mu0);
		}
	}

	/* FIXED: fix-2216.diff applied - kfreeenv(s) on every path */
	mu0 = rig_mt_memuse(M_KENV); c0 = rig_mt_calls(M_KENV);
	rt = false; rf = true;
	for (i = 0; i < DF2216_N; i++) {
		if (i & 1)
			rt |= dmi_match_fixed(DMI_PRODUCT_NAME, val);
		else
			rf &= dmi_match_fixed(DMI_BOARD_NAME, "no-such-board");
	}
	mu1 = rig_mt_memuse(M_KENV); c1 = rig_mt_calls(M_KENV);
	fixed_delta = mu1 - mu0;
	kprintf("DF2216 FIXED    dmi_match_fixed x%d (matchret=%d mismatchret"
	    "=%d): memuse delta=%zu calls delta=%llu\n", DF2216_N, rt, rf,
	    fixed_delta, (unsigned long long)(c1 - c0));

	kprintf("DF2216 VERDICT: baseline leaked %zu bytes in %d calls "
	    "(control %zu, fixed %zu) -> %s\n", base_delta, DF2216_N,
	    ctrl_delta, fixed_delta,
	    (base_delta >= (size_t)DF2216_N && ctrl_delta < 4096 &&
	     fixed_delta < 4096) ? "LEAK CONFIRMED, FIX VALID" :
	    "UNEXPECTED (inspect)");
}

/* ============= DF-2220: kobject_release() kobj->name leak ============= */
struct rig_kobj {
	struct kobject	kobj;
	uint32_t	magic;
};
#define RIG_KOBJ_MAGIC	0xC0FFEE00u

static uint64_t rig_rel_count;

/* production-shaped release: kfree() the embedding container
 * (exactly what ttm_bo_global_kobj_release & friends do) */
static void
rig_kobj_release(struct kobject *kobj)
{
	struct rig_kobj *rk = container_of(kobj, struct rig_kobj, kobj);

	if (rk->magic != RIG_KOBJ_MAGIC)
		panic("df22x rig: bad container magic in release");
	rig_rel_count++;
	kfree(rk, M_DRM);
}

/* non-freeing release, for the single-shot semantics demonstration */
static void
rig_kobj_release_nofree(struct kobject *kobj)
{
	rig_rel_count++;
}

static struct kobj_type rig_ktype_free = { .release = rig_kobj_release };
static struct kobj_type rig_ktype_nofree = { .release = rig_kobj_release_nofree };

/* mirrors linux/kobject.h kobject_put(), bound to the FIXED release */
static inline void
rig_kobject_put_fixed(struct kobject *kobj)
{
	if (kobj != NULL)
		kref_put(&kobj->kref, kobject_release_fixed);
}

#define DF2220_N	16384

static void
df2220_section(void)
{
	int i;
	size_t mu0, mu1, ctrl_delta, base_delta, fixed_delta;
	size_t mu_pre, mu_mid, mu_post;
	uint64_t c0, c1, rel0, rel1;

	kprintf("DF2220 start: N=%d init/release cycles, name via verbatim "
	    "kvasprintf (drm_dragonfly.c:67-84, M_DRM)\n", DF2220_N);

	/* CONTROL: raw kmalloc/kfree of a name-sized M_DRM buffer */
	mu0 = rig_mt_memuse(M_DRM);
	for (i = 0; i < DF2220_N; i++) {
		void *p = kmalloc(32, M_DRM, M_WAITOK);
		kfree(p, M_DRM);
	}
	mu1 = rig_mt_memuse(M_DRM);
	ctrl_delta = mu1 - mu0;
	kprintf("DF2220 CONTROL  paired kmalloc/kfree x%d: memuse delta=%zu "
	    "(expect 0)\n", DF2220_N, ctrl_delta);

	/* BASELINE: verbatim kobject_init_and_add + kobject_put.
	 * kobject_put (linux/kobject.h) -> kref_put -> kobject_release
	 * (linux_kobject.c:45-51) -> rig_kobj_release kfree()s the
	 * container; kobj->name (kvasprintf, linux_kobject.c:39) is never
	 * freed - the pointer dies with the container. */
	rel0 = rig_rel_count;
	mu0 = rig_mt_memuse(M_DRM); c0 = rig_mt_calls(M_DRM);
	for (i = 0; i < DF2220_N; i++) {
		struct rig_kobj *rk = kmalloc(sizeof(*rk), M_DRM,
		    M_WAITOK | M_ZERO);
		rk->magic = RIG_KOBJ_MAGIC;
		if (kobject_init_and_add(&rk->kobj, &rig_ktype_free, NULL,
		    "rig_kobj_%06d_aaaaaaaaaaaaaaaa", i) != 0)
			kprintf("DF2220 note: init_and_add rc!=0\n");
		kobject_put(&rk->kobj);		/* container freed inside */
	}
	mu1 = rig_mt_memuse(M_DRM); c1 = rig_mt_calls(M_DRM);
	rel1 = rig_rel_count;
	base_delta = mu1 - mu0;
	kprintf("DF2220 BASELINE kobject_init_and_add+kobject_put x%d: "
	    "memuse delta=%zu kmalloc-calls delta=%llu releases=%llu "
	    "leaked-bytes-per-cycle=%zu\n", DF2220_N, base_delta,
	    (unsigned long long)(c1 - c0), (unsigned long long)(rel1 - rel0),
	    base_delta / DF2220_N);

	/* single-shot semantics: non-freeing release; after
	 * kobject_release() returns, the name allocation is still alive */
	{
		static struct rig_kobj s_rk;
		const char *namep;
		size_t nm_len;

		memset(&s_rk, 0, sizeof(s_rk));
		mu_pre = rig_mt_memuse(M_DRM);
		if (kobject_init_and_add(&s_rk.kobj, &rig_ktype_nofree, NULL,
		    "leaked_name_probe_0123456789") != 0)
			kprintf("DF2220 note: init_and_add rc!=0\n");
		mu_mid = rig_mt_memuse(M_DRM);
		namep = s_rk.kobj.name;
		nm_len = strlen(namep);
		kobject_put(&s_rk.kobj);	/* release ran, name not freed */
		mu_post = rig_mt_memuse(M_DRM);
		kprintf("DF2220 BASELINE init:+%zu after_release:+%zu name "
		    "ptr still valid, content=[%s] len=%zu (allocation "
		    "SURVIVED release)\n", mu_mid - mu_pre, mu_post - mu_pre,
		    namep, nm_len);

		/* FIXED on the same non-freeing container: fresh name, then
		 * the fixed release must free it - meter returns to base */
		mu_pre = rig_mt_memuse(M_DRM);
		if (kobject_init_and_add(&s_rk.kobj, &rig_ktype_nofree, NULL,
		    "fixed_name_probe_0123456789") != 0)
			kprintf("DF2220 note: init_and_add rc!=0\n");
		mu_mid = rig_mt_memuse(M_DRM);
		rig_kobject_put_fixed(&s_rk.kobj);
		mu_post = rig_mt_memuse(M_DRM);
		kprintf("DF2220 FIXED    init:+%zu after_release_fixed:+%zu "
		    "(name freed by the patch)\n", mu_mid - mu_pre,
		    mu_post - mu_pre);
	}

	/* FIXED loop: same production-shape cycles through the patched
	 * kobject_release_fixed */
	rel0 = rig_rel_count;
	mu0 = rig_mt_memuse(M_DRM); c0 = rig_mt_calls(M_DRM);
	for (i = 0; i < DF2220_N; i++) {
		struct rig_kobj *rk = kmalloc(sizeof(*rk), M_DRM,
		    M_WAITOK | M_ZERO);
		rk->magic = RIG_KOBJ_MAGIC;
		if (kobject_init_and_add(&rk->kobj, &rig_ktype_free, NULL,
		    "rig_kobj_%06d_aaaaaaaaaaaaaaaa", i) != 0)
			kprintf("DF2220 note: init_and_add rc!=0\n");
		rig_kobject_put_fixed(&rk->kobj);
	}
	mu1 = rig_mt_memuse(M_DRM); c1 = rig_mt_calls(M_DRM);
	rel1 = rig_rel_count;
	fixed_delta = mu1 - mu0;
	kprintf("DF2220 FIXED    init+release_fixed x%d: memuse delta=%zu "
	    "kmalloc-calls delta=%llu releases=%llu\n", DF2220_N, fixed_delta,
	    (unsigned long long)(c1 - c0), (unsigned long long)(rel1 - rel0));

	kprintf("DF2220 VERDICT: baseline leaked %zu bytes in %d cycles "
	    "(control %zu, fixed %zu) -> %s\n", base_delta, DF2220_N,
	    ctrl_delta, fixed_delta,
	    (base_delta >= (size_t)DF2220_N && ctrl_delta < 4096 &&
	     fixed_delta < 4096) ? "LEAK CONFIRMED, FIX VALID" :
	    "UNEXPECTED (inspect)");
}

/* ======== DF-2223: pcie_capability_read_dword() *dst uninit ======== */
#define DF2223_CANARY	0xA5A5A5A5u

static void
df2223_one_dev(struct pci_dev *fake, const char *tag, int fixed)
{
	u32 dst, ctl, lnkcap;
	int rc, rc_ctl;
	enum pcie_link_width lw;

	/* ---- LNKCAP through the real function ---- */
	dst = DF2223_CANARY;
	if (fixed)
		rc = pcie_capability_read_dword_fixed(fake, PCI_EXP_LNKCAP,
		    &dst);
	else
		rc = pcie_capability_read_dword(fake, PCI_EXP_LNKCAP, &dst);
	kprintf("DF2223 %s %-14s LNKCAP rc=%d dst=0x%08x %s\n", tag,
	    device_get_nameunit(fake->dev.bsddev), rc, dst,
	    (fixed && dst == 0) ? "WRITTEN-0 (upstream contract)" :
	    (!fixed && dst == DF2223_CANARY) ?
	    "UNTOUCHED-CANARY (dst left uninitialized)" : "other");

	/* ---- consumer emulation mirroring the real inline
	 * pcie_get_width_cap() (linux/pci.h:608-617): return value IGNORED,
	 * lnkcap consumed unconditionally -> baseline derives the width from
	 * whatever was on the stack ---- */
	lnkcap = DF2223_CANARY;
	if (fixed)
		(void)pcie_capability_read_dword_fixed(fake, PCI_EXP_LNKCAP,
		    &lnkcap);
	else
		(void)pcie_capability_read_dword(fake, PCI_EXP_LNKCAP,
		    &lnkcap);
	lw = (lnkcap) ? ((lnkcap & PCI_EXP_LNKCAP_MLW) >> 4)
	    : PCIE_LNK_WIDTH_UNKNOWN;
	kprintf("DF2223 %s %-14s pcie_get_width_cap-style consumer: "
	    "lnkcap=0x%08x -> width=0x%x (%s)\n", tag,
	    device_get_nameunit(fake->dev.bsddev), lnkcap, lw,
	    fixed ? "deterministic UNKNOWN" :
	    "derived from UNINITIALIZED stack");

	/* ---- CONTROL: PCI_EXP_FLAGS_TYPE would be unconditionally
	 * implemented on a PCIe device (linux/pci.h:476-477) and exercise
	 * the real pci_read_config_dword() config-space read; on this
	 * i440fx guest every device is classic PCI, so the predicate's
	 * FIRST check (pci_is_pcie, linux/pci.h:475) is false for every
	 * register - the read path is not reachable on this hardware ---- */
	ctl = DF2223_CANARY;
	rc_ctl = pcie_capability_read_dword(fake, PCI_EXP_FLAGS_TYPE, &ctl);
	kprintf("DF2223 %s %-14s CONTROL FLAGS_TYPE rc=%d dst=0x%08x "
	    "(non-PCIe guest: predicate false for every reg)\n",
	    tag, device_get_nameunit(fake->dev.bsddev), rc_ctl, ctl);
}

static void
df2223_section(void)
{
	devclass_t dc;
	device_t *buses, *ch;
	struct pci_dev *fake;
	int nb = 0, nc = 0, b, j, ndev = 0;

	kprintf("DF2223 start: real guest PCI devices drive the real "
	    "pcie_capability_read_dword (linux_pci.c:30-39) with the real "
	    "predicate chain (linux/pci.h:473-495, pci_is_pcie, real config "
	    "reads)\n");

	dc = devclass_find("pci");
	if (dc == NULL) {
		kprintf("DF2223 no pci devclass\n");
		return;
	}
	if (devclass_get_devices(dc, &buses, &nb) != 0 || nb == 0) {
		kprintf("DF2223 no pci buses\n");
		return;
	}
	fake = kmalloc(sizeof(*fake), M_TEMP, M_WAITOK | M_ZERO);
	for (b = 0; b < nb; b++) {
		if (device_get_children(buses[b], &ch, &nc) != 0)
			continue;
		for (j = 0; j < nc; j++) {
			memset(fake, 0, sizeof(*fake));
			fake->dev.bsddev = ch[j];	/* REAL device */
			df2223_one_dev(fake, "BASELINE", 0);
			df2223_one_dev(fake, "FIXED   ", 1);
			ndev++;
		}
		kfree(ch, M_TEMP);
	}
	kfree(fake, M_TEMP);
	kfree(buses, M_TEMP);
	kprintf("DF2223 VERDICT: %d devices exercised; baseline left *dst "
	    "untouched (canary intact) on every not-implemented read while "
	    "FIXED zeroes it (upstream Linux contract: *val = 0)\n", ndev);
}

/* ======== DF-2224: seq_printf() __va_list misforwarding ======== */
#define DF2224_BUFSZ	64
#define DF2224_GUARD	32

static int
df2224_canaries_ok(char *zone)
{
	int i;

	for (i = 0; i < DF2224_GUARD; i++)
		if ((unsigned char)zone[i] != 0xCC ||
		    (unsigned char)zone[DF2224_GUARD + DF2224_BUFSZ + i] != 0xCC)
			return (0);
	return (1);
}

static void
df2224_dump(const char *variant, const char *desc, char *zone)
{
	char *buf = zone + DF2224_GUARD;
	int i;

	kprintf("DF2224 %-8s [%s] buf=[%s] canaries=%s first16=", variant,
	    desc, buf, df2224_canaries_ok(zone) ? "INTACT" : "CLOBBERED");
	for (i = 0; i < 16; i++)
		kprintf("%02x", (unsigned char)buf[i]);
	kprintf("\n");
}

/*
 * Each case calls the BASELINE (verbatim) and FIXED (patched) functions
 * back to back with IDENTICAL variadic arguments, each into its own
 * canary-bracketed buffer - exactly how production callers invoke
 * seq_printf(m, fmt, args...).
 */
static void
df2224_section(void)
{
	static char zone_b[DF2224_GUARD + DF2224_BUFSZ + DF2224_GUARD];
	static char zone_f[DF2224_GUARD + DF2224_BUFSZ + DF2224_GUARD];
	struct seq_file mb, mf;
	char stackref;

	kprintf("DF2224 start: verbatim seq_printf (linux_printf.c:31-39) vs "
	    "fix-2224 (kvsnprintf) with identical variadic args\n");

	/* ABI note (x86-64 SysV): seq_printf's __va_list ap is an array of
	 * one struct decaying to a pointer; passing it as ksnprintf's 4th
	 * C argument lands THE POINTER ITSELF in ksnprintf's first variadic
	 * slot (rcx), so ksnprintf's %conversions consume: #1 = &ap (a
	 * kernel stack address), #2+ = stale registers - the caller's real
	 * arguments never arrive. */

	/* case 1: integers - fixed output is exactly predictable */
	memset(zone_b, 0xCC, sizeof(zone_b));
	memset(zone_f, 0xCC, sizeof(zone_f));
	mb.buf = zone_b + DF2224_GUARD; mb.size = DF2224_BUFSZ;
	mf.buf = zone_f + DF2224_GUARD; mf.size = DF2224_BUFSZ;
	seq_printf(&mb, "%d/%lu/%x", 111, 222222UL, 48879);
	seq_printf_fixed(&mf, "%d/%lu/%x", 111, 222222UL, 48879);
	df2224_dump("BASELINE", "int fmt %d/%lu/%x (want 111/222222/beef)",
	    zone_b);
	df2224_dump("FIXED", "int fmt %d/%lu/%x (want 111/222222/beef)",
	    zone_f);

	/* case 2: %p - baseline must print the &ap KERNEL STACK ADDRESS
	 * (not the 0xdeadbeef argument); fixed prints 0xdeadbeef */
	memset(zone_b, 0xCC, sizeof(zone_b));
	memset(zone_f, 0xCC, sizeof(zone_f));
	seq_printf(&mb, "ptr=%p", (void *)0xdeadbeefUL);
	seq_printf_fixed(&mf, "ptr=%p", (void *)0xdeadbeefUL);
	df2224_dump("BASELINE", "%%p of 0xdeadbeef (leak flavor)", zone_b);
	df2224_dump("FIXED", "%%p of 0xdeadbeef", zone_f);
	kprintf("DF2224 witness: rig kernel stack address for comparison: "
	    "%p (baseline buf above should hold an address of this shape, "
	    "not 0xdeadbeef)\n", (void *)&stackref);

	/* case 3: %s - baseline consumes &ap as char*; the va_list struct
	 * begins with gp_offset=0x00000000, so it prints the empty string
	 * (the real argument \"hi\" never arrives); fixed prints hi */
	memset(zone_b, 0xCC, sizeof(zone_b));
	memset(zone_f, 0xCC, sizeof(zone_f));
	seq_printf(&mb, "s=[%s]", "hi");
	seq_printf_fixed(&mf, "s=[%s]", "hi");
	df2224_dump("BASELINE", "%s of hi", zone_b);
	df2224_dump("FIXED", "%s of hi", zone_f);

	kprintf("DF2224 VERDICT: baseline garbles every conversion and can "
	    "print a kernel stack address (%%p) into the seq buffer; fixed "
	    "forwards the real arguments; canaries prove no overflow\n");
}

/* ======================= rig driver ======================= */
static void
df22x_run_all(void)
{
	kprintf("DF22X RIG start =========================================\n");
	df2216_section();
	kprintf("DF22X ----\n");
	df2220_section();
	kprintf("DF22X ----\n");
	df2223_section();
	kprintf("DF22X ----\n");
	df2224_section();
	kprintf("DF22X RIG done ==========================================\n");
}

static int
df22x_run_sysctl(SYSCTL_HANDLER_ARGS)
{
	int error, t = 0;

	error = SYSCTL_OUT(req, &t, sizeof(t));
	if (error != 0 || req->newptr == NULL)
		return (error);
	error = SYSCTL_IN(req, &t, sizeof(t));
	if (error != 0)
		return (error);
	df22x_run_all();
	return (0);
}

SYSCTL_PROC(_kern, OID_AUTO, df22x_run, (CTLTYPE_INT | CTLFLAG_RW),
    0, 0, df22x_run_sysctl, "I",
    "run DF-2216/2220/2223/2224 verification rig");

static void
df22x_banner(void *arg)
{
	kprintf("DF22X rig compiled in (DF-2216/2220/2223/2224); "
	    "trigger: sysctl kern.df22x_run=1\n");
}
SYSINIT(df22x_banner, SI_SUB_CONFIGURE, SI_ORDER_ANY, df22x_banner, NULL);