⬢ DragonFlyBSD Kernel Audit
DF-2303 / run_fixed.sh
← back to finding ↓ download raw
#!/bin/sh
# run_fixed.sh -- A/B validation of the combined fix.diff on the FIXED
# kernel (FWO #4).  Baseline counterparts: run2300/2301/2302/2303[ b ].sh.
FW=/root/fwo/fwpoc
echo "=== uname ==="; uname -v

echo "=== DF-2300 A/B: opuser register writes must NOT land anymore ==="
/root/fwo/fwpoc ctl regwr 0x88 0x0           # clean slate for 0x88
su -m opuser -c '/home/opuser/fwpoc wr 0x18c 0xcafe0001'
su -m opuser -c '/home/opuser/fwpoc wr 0x88   0xcafe0002'
su -m opuser -c '/home/opuser/fwpoc rd 0x88'
su -m opuser -c '/home/opuser/fwpoc phyw 1 0x41'
su -m opuser -c '/home/opuser/fwpoc phyr 1'
echo "--- root cross-check: register file must hold pre-test values ---"
/root/fwo/fwpoc ctl regrd 0x18c
/root/fwo/fwpoc ctl regrd 0x88
/root/fwo/fwpoc ctl phyrd
echo "--- root via /dev/fw0.0 must still work (priv passes) ---"
/root/fwo/fwpoc wr 0x88 0x600d0001
/root/fwo/fwpoc rd 0x88
/root/fwo/fwpoc ctl regrd 0x88

echo "=== DF-2301 A/B: DUMPDMA rows bounded to ndesc ==="
$FW ctl dbinit 0 8 64 0 0 5 63 > /tmp/dbi.txt; cat /tmp/dbi.txt
BUS5=$( sed -n 's/.* bus=0x\([0-9a-f]*\).*/\1/p' /tmp/dbi.txt )
BUS63=$(sed -n 's/.*bus2=0x\([0-9a-f]*\).*/\1/p' /tmp/dbi.txt )
$FW ctl descset 5 1
$FW ctl descset 63 0
dmesg -c >/dev/null
$FW ctl regwr 0x18c 0x$BUS5
su -m opuser -c '/home/opuser/fwpoc dumpdma 0' ; echo "opuser rc above (gate blocks)"
$FW ctl regwr 0x18c 0x$BUS63
/root/fwo/fwpoc dumpdma 0
echo "--- rows ---"
dmesg | tail -40

echo "=== DF-2303 A/B: injected impossible state must survive ==="
$FW ctl dbinit 2 0 0 0 0 0 0
$FW ctl rxen 2
dmesg -c >/dev/null
$FW ctl arcv 1 0 0 4072
echo "=== survived injection; guest: $(uptime) ==="
dmesg | grep -E 'oversized header|why rlen' | head -3

echo "=== DF-2302 A/B: window-exhaustion rounds must not panic ==="
i=0; while [ $i -lt 20 ]; do i=$((i+1)); echo "round $i"; /root/fwo/fwpoc ctl memeat 2 3 || echo ioctl_err; done
echo "=== 20 rounds done; guest: $(uptime) ==="
echo "=== run_fixed done ==="