⬢ DragonFlyBSD Kernel Audit
DF-2269 / df_pre.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
/*
 * DF-2269 verification harness -- PREAMBLE.
 *
 * This file is concatenated (gen.sh) BEFORE a verbatim copy of
 * sys/bus/cam/scsi/scsi_cd.c and AFTER it df_post.c is appended, and
 * the result is compiled into the kernel
 * (bus/cam/scsi/df2269_harness.c, conf/files entry "standard").
 *
 * The ONLY thing this preamble does is interpose, via the C
 * preprocessor, the EXTERNAL (non-static) functions that the real
 * scsi_cd.c code calls on the path under test (cdioctl ->
 * DVDIOCREADSTRUCTURE -> cdreaddvdstructure default case), so the
 * harness can fabricate CAM/CD state without any SCSI hardware:
 *
 *	xpt_path_periph	cdrunccb derives the periph from the CCB path
 *	cam_periph_getccb	ccb allocation in cdgetccb
 *	cam_periph_runccb	the CCB "transport" (fake malicious drive)
 *	xpt_release_ccb	ccb release at cdreaddvdstructure bailout
 *
 * Everything else that executes is the REAL kernel code: cdioctl,
 * cam_periph_hold/unhold, cam_periph_lock/unlock, cam_periph_acquire/
 * release, cam_fill_csio, scsi_read_dvd_structure, cdgetccb, cdrunccb,
 * cdreaddvdstructure (static, called via the real cdioctl dispatch),
 * kmalloc/kfree (M_DEVBUF) and the buggy default-case arithmetic and
 * bcopy at scsi_cd.c:4283-4298.
 */

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/kernel.h>
#include <sys/types.h>
#include <sys/queue.h>
#include <sys/malloc.h>
#include <sys/conf.h>
#include <sys/device.h>
#include <sys/dvdio.h>
#include <sys/buf.h>
#include <sys/buf2.h>
#include <sys/lock.h>
#include <sys/proc.h>
#include <sys/sysctl.h>
#include <sys/time.h>
#include <machine/limits.h>

#include "../cam.h"
#include "../cam_ccb.h"
#include "../cam_extend.h"
#include "../cam_periph.h"
#include "../cam_queue.h"
#include "../cam_sim.h"
#include "../cam_xpt.h"
#include "../cam_xpt_periph.h"
#include "scsi_message.h"
#include "scsi_all.h"
#include "scsi_cd.h"

#include <sys/devicestat.h>

/* ---- interposition of external symbols (see header comment) ---- */
#define xpt_path_periph		dfh_xpt_path_periph
#define cam_periph_getccb	dfh_cam_periph_getccb
#define cam_periph_runccb	dfh_cam_periph_runccb
#define xpt_release_ccb		dfh_xpt_release_ccb

/* shim prototypes (implemented in df_post.c; every call site inside
 * the verbatim scsi_cd.c that follows resolves to these) */
static struct cam_periph *dfh_xpt_path_periph (struct cam_path *);
static union ccb *dfh_cam_periph_getccb (struct cam_periph *,
					  u_int32_t);
static int	dfh_cam_periph_runccb (union ccb *,
				   int (*)(union ccb *, cam_flags,
				       u_int32_t),
				   cam_flags, u_int32_t, struct devstat *);
static void	dfh_xpt_release_ccb (union ccb *);

/*
 * NOTE: gen.sh comments out "device cd" in the guest's kernel config
 * so the kernel no longer compiles scsi_cd.c separately (scsi_cd.o);
 * the verbatim copy inside this TU is then the only one.  Nothing is
 * renamed; all driver code below is byte-for-byte the source file
 * (sha256-gated by build.sh against the audit tree).
 */

/*
 * ==================== VERBATIM scsi_cd.c FOLLOWS ====================
 */