⬢ DragonFlyBSD Kernel Audit
DF-2310 / rigup.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-2310/2311/2312 rig bring-up (guest, root):
# applies the two disclosed setup patches (DF-5559 read_ivar, DF-5560
# sc_dev store -- WITHOUT them /dev/iic0 is dead/panics; the I2C logic
# under test stays STOCK), builds + loads the production iic stack on the
# fakebb harness (extended with a slave RX-capture sysctl), builds the
# groom KLD, and compiles the three PoCs.
set -e
mkdir -p /root/iicx && cd /root/iicx
[ -f iicbb_harness3.c ] || { cd /tmp && tar xzf iicx.tgz && cp iicx/* /root/iicx/ && cd /root/iicx; }

# 1. setup patches (marker-guarded: DF patch(1) assumes -R on applied)
grep -q iicbus_read_ivar /usr/src/sys/bus/iicbus/iicbus.c || \
  ( cd /usr/src && patch -p1 --fuzz=2 < /root/iicx/fix5559.diff )
grep -q "sc->sc_dev = dev;" /usr/src/sys/bus/iicbus/iic.c || \
  ( cd /usr/src && patch -p1 --fuzz=2 < /root/iicx/fix5560.diff )

# 2. clean-build production modules
( cd /usr/src/sys/bus/iicbus/iicbus && make clean >/dev/null && make ) > iicbus.build.log 2>&1
( cd /usr/src/sys/bus/iicbus/iic && make clean >/dev/null && make ) > iic.build.log 2>&1
objdump -d --disassemble=iic_attach /usr/src/sys/bus/iicbus/iic/iic.ko > setup.disasm
grep -qE "mov\s+%rbx,\(%rax\)" setup.disasm || { echo "DF-5560 setup missing"; exit 1; }
nm /usr/src/sys/bus/iicbus/iicbus/iicbus.ko | grep -q iicbus_read_ivar || { echo "DF-5559 setup missing"; exit 1; }
echo "setup fixes verified"

# 3. harness klds (spray off)
rm -rf build_reg build_h
mkdir -p build_reg build_h
cp iicbb_reg.c build_reg/ && cp Makefile.reg build_reg/Makefile
( cd build_reg && make SYSDIR=/usr/src/sys obj >/dev/null && make SYSDIR=/usr/src/sys ) > reg.build.log 2>&1
cp iicbb_harness3.c build_h/iicbb_harness.c && cp Makefile build_h/Makefile
printf '#define SPRAY_BYTE\t0x00\n#define SPRAY_ENABLE\t0\n' > build_h/spray_conf.h
cp /usr/src/sys/bus/iicbus/iicbb_if.m build_h/
( cd build_h && make SYSDIR=/usr/src/sys obj >/dev/null && make SYSDIR=/usr/src/sys ) > h.build.log 2>&1

# 4. groom kld
rm -rf build_g && mkdir build_g
cp groom5558.c build_g/ && cp Makefile.groom build_g/Makefile
cp /usr/src/sys/bus/iicbus/iicbus_if.m build_g/
( cd build_g && make SYSDIR=/usr/src/sys obj >/dev/null && make SYSDIR=/usr/src/sys ) > g.build.log 2>&1

# 5. PoCs
cc -O -Wall -o poc2310 poc2310.c
cc -O -Wall -o poc2311 poc2311.c
cc -O -Wall -o poc2312 poc2312.c

# 6. load the stack
kldload /usr/src/sys/bus/iicbus/iicbus/iicbus.ko
kldload /boot/kernel/iicbb.ko
kldload /root/iicx/build_reg/iicbb_reg.ko
kldload /root/iicx/build_h/iicbb_harness.ko
kldload /usr/src/sys/bus/iicbus/iic/iic.ko
sleep 1
kldload /root/iicx/build_g/groom5558.ko
sleep 1
ls -l /dev/iic0
dmesg | grep -aE "fakebb|iic" | tail -12
echo RIG_UP