⬢ DragonFlyBSD Kernel Audit
DF-2300 / fwohci_harness.h
← back to finding ↓ download raw 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
/*
 * fwohci_harness.h -- shared ioctl definitions for the fwohci.c
 * verification harness (kernel fwohci_harness.c + userland fwpoc).
 *
 * Targets: DF-2300 DF-2301 DF-2302 DF-2303 (sys/bus/firewire/fwohci.c).
 */
#ifndef _FWOHCI_HARNESS_H
#define _FWOHCI_HARNESS_H

#include <sys/ioccom.h>
#include <sys/types.h>

/* ---- emulated MMIO / PHY peek+poke (root only) ---- */
struct fwo_regreq {
	u_int32_t	addr;		/* OHCI register offset */
	u_int32_t	data;		/* value */
	u_int32_t	phy[16];	/* FWOIOC_PHYRD: full PHY reg file out */
};
#define FWOIOC_REGRD	_IOWR('O', 1, struct fwo_regreq)
#define FWOIOC_REGWR	_IOWR('O', 2, struct fwo_regreq)
#define FWOIOC_PHYRD	_IOWR('O', 9, struct fwo_regreq)

/* ---- run the REAL fwohci_init() on the fabricated controller ---- */
struct fwo_initreq {
	u_int32_t	doit;
	u_int32_t	version;	/* value to expose in OHCI_VERSION */
	u_int32_t	itmask;		/* iso channel readback mask */
	u_int32_t	busopt;		/* OHCI_BUS_OPT value */
	u_int32_t	nisodma_out;
	u_int32_t	rc;
};
#define FWOIOC_INIT	_IOWR('O', 3, struct fwo_initreq)

/* ---- (re)init a DMA channel with the REAL fwohci_db_init ---- */
struct fwo_dbdesc {
	u_int32_t	cmd;
	u_int32_t	addr;
	u_int32_t	depend;
	u_int32_t	res;
};
struct fwo_dbinit {
	u_int32_t	ch;		/* 0=atrq 1=atrs 2=arrq 3=arrs */
	u_int32_t	ndesc;		/* 0 => stock fwohci.c:641-650 value */
	u_int32_t	ndb;		/* 0 => stock */
	u_int32_t	psize;		/* 0 => stock */
	u_int32_t	parent;		/* 0 = 32BIT (0xffffffff), 1 = 4MB win */
	/* out: */
	u_int32_t	rc;
	u_int32_t	o_ndesc, o_ndb, o_psize;
	u_int32_t	esize, ssize, nseg;
	u_int64_t	seg0_va, seglast_va;
	u_int64_t	elem_va;	/* KVA of element [elem] db block */
	u_int64_t	elem_bus;	/* bus addr of element [elem] */
	u_int32_t	elem;		/* in: which element */
	u_int32_t	elem2;		/* in: second element to report */
	u_int64_t	elem2_va;
	u_int64_t	elem2_bus;
	u_int32_t	elems_per_seg;
	u_int64_t	past_va;	/* KVA one descriptor block past elem */
};
#define FWOIOC_DBINIT	_IOWR('O', 4, struct fwo_dbinit)

/* ---- fabricate descriptor contents (as driver/hardware would) ---- */
struct fwo_descset {
	u_int32_t	elem;			/* element index */
	u_int32_t	n;			/* #descriptors to set (<=8) */
	struct fwo_dbdesc d[8];
	u_int32_t	canary;			/* 1 = tag elem db[0] as canary */
	u_int32_t	rc;
};
#define FWOIOC_DESCSET	_IOWR('O', 5, struct fwo_descset)

/* ---- fabricate received DMA state + run REAL fwohci_arcv ---- */
#define FWO_ARCV_NATURAL	0	/* packet straddling buffer end */
#define FWO_ARCV_INJECT		1	/* inject impossible buf_offset */
struct fwo_arcvreq {
	u_int32_t	mode;
	u_int32_t	F;		/* natural: hdr bytes in buf0 (1..15) */
	u_int32_t	tcode;		/* 1=WREQB(16B hdr) 2=WRES(12B hdr) */
	u_int32_t	inj_offset;	/* inject: negative buf_offset value */
	u_int32_t	rc;
	u_int32_t	rlen_old_obs;	/* out: psize-|buf_offset| observed */
	u_int32_t	buf_offset_after;
	u_int32_t	pdb_tr_set;	/* out */
};
#define FWOIOC_ARCV	_IOWR('O', 8, struct fwo_arcvreq)
#define FWOIOC_RXEN	_IOWR('O', 12, struct fwo_arcvreq)	/* mode=ch */

/* ---- DF-2302: exhaust sub-4MB bounce window, then REAL db_init ---- */
struct fwo_memeat {
	u_int32_t	free_pages;	/* leave this many pages in the window */
	u_int32_t	ch;		/* channel to db_init */
	u_int32_t	ndesc, ndb, psize;	/* 0 => stock */
	u_int32_t	rc;
	u_int32_t	ate;		/* out: pages eaten */
	u_int32_t	freed;		/* out: pages freed back */
	u_int32_t	survived;	/* out: 1 if db_init returned */
	u_int32_t	mapfail_line;	/* out: diagnostics */
};
#define FWOIOC_MEMEAT	_IOWR('O', 7, struct fwo_memeat)

/* ---- root KVA peek (16 bytes) for OOB attribution ---- */
struct fwo_kread {
	u_int64_t	kaddr;
	u_int32_t	data[4];
};
#define FWOIOC_KREAD	_IOWR('O', 11, struct fwo_kread)

/* ---- dbch state peek ---- */
struct fwo_statereq {
	u_int32_t	ch;
	u_int32_t	flags, ndb, ndesc;
	u_int32_t	buf_offset;
	u_int32_t	pdb_tr_set;
	u_int32_t	top_set;
};
#define FWOIOC_STATE	_IOWR('O', 10, struct fwo_statereq)

#endif /* _FWOHCI_HARNESS_H */