⬢ DragonFlyBSD Kernel Audit
DF-3570 / proof.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-3570 mechanical source proof. Run from the repo root. Exits non-zero
# if any link of the chain cannot be re-derived from the current sources.
set -e
F=sys/dev/netif/re/re.c

echo "== [1] MP_ReadOtherFunPciEConfigSpace returns constant 0xffffffff =="
# RetVal is initialized to 0xffffffff at declaration and returned unchanged;
# RE_CSIDR is never read in this function (the write twin at :31148 does use it).
awk 'NR>=31163 && NR<=31192' $F | grep -n 'RetVal' || false
if awk 'NR>=31163 && NR<=31192' $F | grep -q 'RE_CSIDR'; then
	echo "FAIL: CSIDR read present (already fixed?)"; exit 1
fi

echo "== [2] DASH type-3 CMAC mapping is gated on the broken read =="
sed -n '4456,4457p' $F
sed -n '4468,4472p' $F

echo "== [3] MACFG_70-72 unconditionally inherit the NULL handle =="
sed -n '4484,4489p' $F

echo "== [4] re_exit_oob calls Dash2DisableTxRx for MACFG_70-72 at attach =="
sed -n '3588,3596p' $F

echo "== [5] Dash2DisableTx derefs the CMAC handle, !re_dash guard commented out =="
sed -n '3445,3455p' $F

echo "== [6] HwSuppDashVer==3 exactly for MACFG_70/71/72 =="
sed -n '4413,4417p' $F

echo "== [7] DragonFly CMAC macros are raw bus_space calls (no guard) =="
sed -n '43,54p' sys/dev/netif/re/re_dragonfly.h

echo "== [8] x86_64 bus_space_read_1 memory variant = direct pointer deref =="
sed -n '135,141p' sys/cpu/x86_64/include/bus_dma.h

echo "== [9] collateral: live RMW consumers of the broken read =="
grep -n 'MP_ReadPciEConfigSpace' $F | awk -F: '$1>5645 && $1<7163'
sed -n '3891,3893p' $F
sed -n '7414,7414p' $F

echo "== [10] live call-in from the real driver (if_re.c attach) =="
grep -n 'rtl_exit_oob\|rtl_init_software_variable' sys/dev/netif/re/if_re.c | head -4

echo "ALL CHAIN LINKS VERIFIED"