/* * DF-4266 PoC rig — inverted RX descriptor-ownership test in wb_rxeof() * (sys/dev/netif/wb/if_wb.c:972-975). * * production loop: rxstat = head->wb_ptr->wb_status; * if ((rxstat & WB_RXSTAT_OWN) == 0) <-- INVERTED * break; * * The W89C840F sets OWN=1 when the DRIVER arms a descriptor (wb_newbuf * arms with WB_RXSTAT = FIRSTFRAG|LASTFRAG|OWN, if_wbreg.h:243) and * clears OWN on write-back when a frame completes. The loop above * therefore (a) BREAKS on completed frames — RX is dead, ipackets stays * 0 forever — and (b) PROCESSES chip-owned descriptors. * * THE REAL PRODUCTION HANDLERS ARE DISPATCHED. The guest kernel is * built with `device wb` (X86_64_GENERIC:246), so the driver's static * wb_rxeof()/wb_init()/wb_stop() exist in the running kernel image * (/boot/kernel/kernel). Their addresses are resolved with nm(1) and * injected into this KLD through sysctls; the rig then calls THE * KERNEL'S OWN CODE — nothing about the handler under test is * recompiled, copied or modified here. (wb_newbuf exists in the image * only as an IPA-SRA clone `wb_newbuf.isra.5' with a compiler-mangled * ABI — deliberately NOT resolved; the ring is armed by dispatching the * kernel's own wb_init(), whose inlined wb_list_rx_init/wb_newbuf build * the exact production post-init state.) * * The rig reconstructs the post-attach driver state: * - struct wb_softc + struct wb_list_data in module .bss (never * freed — no teardown UAF surface; module unload drops them), * - wb_ldata armed by the REAL wb_init(): 64 MGETHDR mbufs hung on * the ring exactly as wb_list_rx_init does, descriptors all * WB_RXSTAT (chip-owned), * - a fake miibus device_t whose softc is a zeroed mii_data (empty * phys list: mii_mediachg/mii_pollstat/mii_tick degenerate to no-ops * — wb_init/wb_reset/wb_fixmedia run their full real bodies safely), * - a real lwkt serializer as ifp->if_serializer (production: wb_intr * runs wb_rxeof under it), * - a scratch page standing in for the MMIO BAR so CSR_* lands * harmlessly (a plain page keeps WB_BUSCTL_RESET latched: wb_reset's * 1000xDELAY(10) poll runs out and prints "reset never completed!" * once per reset — a rig artifact, ~10 ms; real HW clears the bit). * The "NIC" is simulated the only way the driver can observe it: * descriptor status/buffer writes. * * Scenarios (all dispatch the REAL kernel wb_rxeof unless noted): * S1 chip COMPLETED a frame in slot 0 (write-back: OWN=0, RXCMP * set, len 64 incl CRC) -> the loop breaks at once: 0 frames * delivered, ipackets 0, descriptor NOT re-armed, head NOT * advanced. RX is dead. (THE finding.) * S1fix the IDENTICAL state handed to a one-line-fixed comparator * (verbatim transcription of wb_rxeof with only * `if ((rxstat & WB_RXSTAT_OWN) == 0) break;' -> * `if (rxstat & WB_RXSTAT_OWN) break;' — fix.diff): * 1 frame delivered, slot re-armed — proves the state was * processable and only the inverted test blocks it. * S2 armed idle ring (all descriptors OWN=1, exactly what * wb_init/wb_newbuf leave) -> each dispatch PROCESSES a * chip-owned descriptor: head popped, ierrors++, "receiver * babbling", wb_fixmedia + wb_reset + wb_init (full 64-mbuf * ring teardown/re-init) PER dispatch. In production every * RX_NOBUF/RX_OK interrupt pays this (wb_intr:1137-1144,1146): * unauthenticated adjacent-frame-triggered permanent reset * storm with 100% RX loss. * S3 descriptor STILL chip-owned (OWN=1) but looking complete — * the mid-write-back transient the inverted loop wrongly * accepts -> frame ACCEPTED from a chip-owned descriptor and * the descriptor RE-ARMED (status/data rewritten) under the * chip: ownership protocol broken end-to-end. * * Usage (root): * kldload ./df4266_wb_poc.ko * sysctl -w kern.df4266.rxeof=0x$(nm /boot/kernel/kernel | awk '/ t wb_rxeof$/{print $1}') * sysctl -w kern.df4266.init=0x$(nm /boot/kernel/kernel | awk '/ t wb_init$/{print $1}') * sysctl -w kern.df4266.stop=0x$(nm /boot/kernel/kernel | awk '/ t wb_stop$/{print $1}') * sysctl -w kern.df4266.go=1 * * Expected on stock /usr/src: "S1 BUG CONFIRMED", "S1fix ... 1 FRAME * DELIVERED", "S2 BUG CONFIRMED" (3x babbling + per-dispatch ring * re-init), "S3 BUG CONFIRMED", SURVIVED. * Expected on fix.diff-patched kernel (fix validation run): S1 delivers * via the REAL handler; S2/S3 break on OWN-set descriptors; no bug * markers. */ #include #include #include #include #include #include #include #include #include #include #include #include #include /* struct bsd_device: fake miibus stand-in */ #include /* X86_64_BUS_SPACE_MEM */ #include #include /* vtophys */ #include #include #include #include #include #include #include #include #include /* ------------------------------------------------------------------ */ /* REAL kernel handlers, resolved from /boot/kernel/kernel via nm(1) */ /* ------------------------------------------------------------------ */ static void (*p_wb_rxeof)(struct wb_softc *); static void (*p_wb_init)(void *); static void (*p_wb_stop)(struct wb_softc *); static int df_ran; SYSCTL_NODE(_kern, OID_AUTO, df4266, CTLFLAG_RW, 0, "DF-4266 PoC rig"); /* * Address-injection sysctls take hex STRINGS ("ffffffff808dae30"): * sysctl_handle_int/long clamp values above INT64_MAX, which is where * every static-kernel address lives on x86_64. */ static int df_sysctl_addr(SYSCTL_HANDLER_ARGS, void **target) { char buf[32]; const char *s; int error, len; ksnprintf(buf, sizeof(buf), "0x%016llx", (unsigned long long)(uintptr_t)*target); error = SYSCTL_OUT(req, buf, strlen(buf) + 1); if (error || req->newptr == NULL) return (error); len = req->newlen - req->newidx; if (len >= (int)sizeof(buf)) return (EINVAL); error = SYSCTL_IN(req, buf, len); if (error) return (error); buf[len] = '\0'; s = buf; if (s[0] == '0' && (s[1] == 'x' || s[1] == 'X')) s += 2; *target = (void *)(uintptr_t)strtoul(s, NULL, 16); return (0); } #define DF_ADDR_SYSCTL(name, var, descr) \ static int \ df_sysctl_##name(SYSCTL_HANDLER_ARGS) \ { \ return (df_sysctl_addr(oidp, arg1, arg2, req, (void **)&var)); \ } \ SYSCTL_PROC(_kern_df4266, OID_AUTO, name, \ CTLTYPE_STRING | CTLFLAG_RW, NULL, 0, df_sysctl_##name, "A", descr); DF_ADDR_SYSCTL(rxeof, p_wb_rxeof, "kernel address of static wb_rxeof() (hex)") DF_ADDR_SYSCTL(init, p_wb_init, "kernel address of static wb_init() (hex)") DF_ADDR_SYSCTL(stop, p_wb_stop, "kernel address of static wb_stop() (hex)") /* ------------------------------------------------------------------ */ /* Static rig state — module .bss, never freed (no teardown UAF) */ /* ------------------------------------------------------------------ */ static struct wb_softc df_sc; static struct wb_list_data df_ldata; static struct mii_data df_mii; /* zeroed: empty phys list */ static struct bsd_device df_miibus_dev; /* .softc = &df_mii */ static uint32_t df_mmio[PAGE_SIZE / 4] __attribute__((__aligned__(PAGE_SIZE))); /* MMIO BAR stand-in */ static struct lwkt_serialize df_ser; static struct ifdata_pcpu df_ifdata[64]; static struct ifaltq_subque df_subq __attribute__((__aligned__(64))); static int df_delivered; /* if_input sink counter */ static u_long df_stat(size_t off) { u_long v = 0; int i; for (i = 0; i < 64; i++) v += *(u_long *)((char *)&df_ifdata[i] + off); return (v); } #define DF_STAT(f) df_stat(__offsetof(struct ifdata_pcpu, f)) /* * Production if_input stand-in (ether_input/netisr in the real stack): * record and describe the delivered chain, then consume it exactly as * the network stack eventually would. */ static void df_input(struct ifnet *ifp, struct mbuf *m, const struct pktinfo *pi, int cpuid) { uint8_t *p = mtod(m, uint8_t *); if (m->m_len >= 18) { kprintf("df4266: if_input: m=%p m_len=%d " "dst=%02x:%02x:%02x:%02x:%02x:%02x " "src=%02x:%02x:%02x:%02x:%02x:%02x type=%02x%02x " "pay=%02x %02x %02x %02x\n", m, m->m_len, p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7], p[8], p[9], p[10], p[11], p[12], p[13], p[14], p[15], p[16], p[17]); } else { kprintf("df4266: if_input: m=%p m_len=%d\n", m, m->m_len); } df_delivered++; m_freem(m); } /* ================================================================== */ /* ONE-LINE-FIXED COMPARATOR — verbatim transcription of the guest's */ /* /usr/src/sys/dev/netif/wb/if_wb.c wb_rxeof()/wb_newbuf()/wb_bfree */ /* with EXACTLY ONE change (the fix.diff line, marked FIX below). */ /* This is NOT the code under test — it is the counterfactual. */ /* ================================================================== */ static void df_wb_bfree(void *arg) { } static int df_wb_newbuf(struct wb_softc *sc, struct wb_chain_onefrag *c, struct mbuf *m) { struct mbuf *m_new = NULL; if (m == NULL) { MGETHDR(m_new, M_NOWAIT, MT_DATA); if (m_new == NULL) return(ENOBUFS); m_new->m_data = m_new->m_ext.ext_buf = c->wb_buf; m_new->m_flags |= M_EXT; m_new->m_ext.ext_size = m_new->m_pkthdr.len = m_new->m_len = WB_BUFBYTES; m_new->m_ext.ext_free = df_wb_bfree; m_new->m_ext.ext_ref = df_wb_bfree; } else { m_new = m; m_new->m_len = m_new->m_pkthdr.len = WB_BUFBYTES; m_new->m_data = m_new->m_ext.ext_buf; } m_adj(m_new, sizeof(uint64_t)); c->wb_mbuf = m_new; c->wb_ptr->wb_data = vtophys(mtod(m_new, caddr_t)); c->wb_ptr->wb_ctl = WB_RXCTL_RLINK | 1536; c->wb_ptr->wb_status = WB_RXSTAT; return(0); } static void df_wb_rxeof_fixed(struct wb_softc *sc) { struct ifnet *ifp = &sc->arpcom.ac_if; struct mbuf *m, *m0; struct wb_chain_onefrag *cur_rx; int total_len = 0; uint32_t rxstat; for (;;) { rxstat = sc->wb_cdata.wb_rx_head->wb_ptr->wb_status; if (rxstat & WB_RXSTAT_OWN) /* <-- FIX (fix.diff) */ break; /* was: == 0 */ cur_rx = sc->wb_cdata.wb_rx_head; sc->wb_cdata.wb_rx_head = cur_rx->wb_nextdesc; m = cur_rx->wb_mbuf; if ((rxstat & WB_RXSTAT_MIIERR) || (WB_RXBYTES(cur_rx->wb_ptr->wb_status) < WB_MIN_FRAMELEN) || (WB_RXBYTES(cur_rx->wb_ptr->wb_status) > 1536) || (rxstat & WB_RXSTAT_LASTFRAG) == 0|| (rxstat & WB_RXSTAT_RXCMP) == 0) { IFNET_STAT_INC(ifp, ierrors, 1); df_wb_newbuf(sc, cur_rx, m); if_printf(ifp, "receiver babbling: possible chip " "bug, forcing reset\n"); return; } if (rxstat & WB_RXSTAT_RXERR) { IFNET_STAT_INC(ifp, ierrors, 1); df_wb_newbuf(sc, cur_rx, m); break; } /* No errors; receive the packet. */ total_len = WB_RXBYTES(cur_rx->wb_ptr->wb_status); total_len -= ETHER_CRC_LEN; m0 = m_devget(mtod(m, char *) - ETHER_ALIGN, total_len + ETHER_ALIGN, 0, ifp); df_wb_newbuf(sc, cur_rx, m); if (m0 == NULL) { IFNET_STAT_INC(ifp, ierrors, 1); break; } m_adj(m0, ETHER_ALIGN); m = m0; IFNET_STAT_INC(ifp, ipackets, 1); ifp->if_input(ifp, m, NULL, -1); } } /* ================== end of fixed comparator ======================= */ static void df_ring_probe(const char *tag) { struct wb_chain_onefrag *c0 = &df_sc.wb_cdata.wb_rx_chain[0]; uint32_t st = c0->wb_ptr->wb_status; kprintf("df4266: [%s] head==chain0:%d slot0.status=%#010x OWN:%d " "RXLEN:%u mbuf=%p wb_data=%#010x\n", tag, df_sc.wb_cdata.wb_rx_head == c0, st, !!(st & WB_RXSTAT_OWN), WB_RXBYTES(st), c0->wb_mbuf, c0->wb_ptr->wb_data); } /* 64-byte "received frame" (60 payload + 4 faux CRC), iota payload */ static uint8_t df_frame[64]; static void df_craft_frame(void) { struct mbuf *m = df_sc.wb_cdata.wb_rx_chain[0].wb_mbuf; int i; for (i = 0; i < ETHER_ADDR_LEN; i++) df_frame[i] = 0xFF; /* broadcast dst */ df_frame[6] = 0x00; df_frame[7] = 0xDF; df_frame[8] = 0x42; df_frame[9] = 0x66; df_frame[10] = 0x00; df_frame[11] = 0x01; df_frame[12] = 0xDF; df_frame[13] = 0x42; /* ethertype */ for (i = 14; i < 60; i++) df_frame[i] = (uint8_t)i; df_frame[60] = 0xDE; df_frame[61] = 0xAD; /* faux CRC */ df_frame[62] = 0xBE; df_frame[63] = 0xEF; /* the chip DMAs the frame into the buffer wb_newbuf armed */ bcopy(df_frame, mtod(m, uint8_t *), sizeof(df_frame)); } static int df_setup(void) { struct ifnet *ifp = &df_sc.arpcom.ac_if; bzero(df_mmio, sizeof(df_mmio)); bzero(df_ifdata, sizeof(df_ifdata)); callout_init(&df_sc.wb_stat_timer); lwkt_serialize_init(&df_ser); df_miibus_dev.softc = &df_mii; /* device_get_softc() -> mii */ /* post-wb_attach softc fields the dispatched code touches */ df_sc.wb_miibus = &df_miibus_dev; df_sc.wb_ldata = &df_ldata; df_sc.wb_cachesize = 0; df_sc.wb_btag = (bus_space_tag_t)X86_64_BUS_SPACE_MEM; df_sc.wb_bhandle = (bus_space_handle_t)(uintptr_t)df_mmio; /* post-ether_ifattach ifnet state (wb_attach:768-797 + if_attach * if_snd/subqueue setup, net/if.c:592-640 — wb_stop/wb_init reach * ifq_clr_oactive -> ifsq->ifsq_hw_oactive, so altq_subq must be * a real subqueue, not NULL) */ strlcpy(ifp->if_xname, "dfwb0", sizeof(ifp->if_xname)); ifp->if_softc = &df_sc; ifp->if_serializer = &df_ser; ifp->if_input = df_input; ifp->if_data_pcpu = df_ifdata; ifp->if_flags = IFF_UP | IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST | IFF_RUNNING; ifp->if_snd.altq_subq_cnt = 1; ifp->if_snd.altq_subq = &df_subq; ifp->if_snd.altq_ifp = ifp; ifp->if_snd.altq_maxlen = WB_TX_LIST_CNT - 1; lwkt_serialize_init(&df_subq.ifsq_lock); df_subq.ifsq_index = 0; df_subq.ifsq_altq = &ifp->if_snd; df_subq.ifsq_ifp = ifp; df_subq.ifsq_maxlen = ifp->if_snd.altq_maxlen; df_subq.ifsq_maxbcnt = df_subq.ifsq_maxlen * MCLBYTES; df_subq.ifsq_enqueue = ifsq_classic_enqueue; df_subq.ifsq_dequeue = ifsq_classic_dequeue; df_subq.ifsq_request = ifsq_classic_request; ifq_set_ready(&ifp->if_snd); /* layout cross-check vs the running kernel's compiled offsets * (wb_stop disasm: if_timer=+0x6a wb_bhandle=+0x3c0 wb_btag=+0x3c8 * wb_ldata=+0x400 wb_rx_chain[0]=+0x450 wb_stat_timer=+0x1e68 * if_snd.altq_subq=+0x210) */ kprintf("df4266: layout: sizeof(wb_softc)=%#zx if_timer=%#zx " "bhandle=%#zx btag=%#zx ldata=%#zx rx_chain0=%#zx " "stat_timer=%#zx snd.altq_subq=%#zx\n", sizeof(struct wb_softc), __offsetof(struct wb_softc, arpcom.ac_if.if_timer), __offsetof(struct wb_softc, wb_bhandle), __offsetof(struct wb_softc, wb_btag), __offsetof(struct wb_softc, wb_ldata), __offsetof(struct wb_softc, wb_cdata.wb_rx_chain[0]), __offsetof(struct wb_softc, wb_stat_timer), __offsetof(struct wb_softc, arpcom.ac_if.if_snd.altq_subq)); return (0); } /* Phase 0: arm the ring with the kernel's OWN wb_init */ static int df_phase0(void) { kprintf("df4266: === Phase 0: fabricate post-attach softc; dispatch " "REAL wb_init (its inlined wb_list_rx_init arms the ring) ===\n"); p_wb_init(&df_sc); df_ring_probe("P0-after-REAL-wb_init"); if (df_sc.wb_cdata.wb_rx_head != &df_sc.wb_cdata.wb_rx_chain[0] || df_sc.wb_cdata.wb_rx_chain[0].wb_mbuf == NULL) { kprintf("df4266: P0: ring unexpectedly not armed\n"); return (-1); } kprintf("df4266: P0: ring armed by the kernel's own code: 64 mbufs, " "descriptors WB_RXSTAT=%#x (FIRSTFRAG|LASTFRAG|OWN — chip-owned)\n", WB_RXSTAT); kprintf("df4266: P0: NOTE (known finding DF-4267): wb_rx_chain[0]." "wb_nextdesc == &wb_rx_chain[0]: %d — production collapsed-ring " "state, kept as-is\n", df_sc.wb_cdata.wb_rx_chain[0].wb_nextdesc == &df_sc.wb_cdata.wb_rx_chain[0]); return (0); } /* S1: chip completed a frame (write-back: OWN cleared) — THE bug */ static void df_phase_s1(void) { struct wb_chain_onefrag *c0 = &df_sc.wb_cdata.wb_rx_chain[0]; uint32_t crafted; u_long ip, ie; int deliv0 = df_delivered; kprintf("df4266: === S1: chip COMPLETED a frame in slot 0 " "(write-back: OWN=0, RXCMP|LASTFRAG|FIRSTFRAG set, len 64) " "===\n"); bzero(df_ifdata, sizeof(df_ifdata)); df_craft_frame(); crafted = WB_RXSTAT_RXCMP | WB_RXSTAT_LASTFRAG | WB_RXSTAT_FIRSTFRAG | (64 << 16); /* OWN == 0 */ df_ldata.wb_rx_list[0].wb_status = crafted; df_ring_probe("S1-crafted"); p_wb_rxeof(&df_sc); /* REAL handler */ ip = DF_STAT(ifd_ipackets); ie = DF_STAT(ifd_ierrors); df_ring_probe("S1-after-REAL-wb_rxeof"); kprintf("df4266: S1: delivered=%d ipackets=%lu ierrors=%lu " "slot0 re-armed:%s head advanced:%s\n", df_delivered - deliv0, ip, ie, df_ldata.wb_rx_list[0].wb_status != crafted ? "YES" : "no", df_sc.wb_cdata.wb_rx_head != c0 ? "YES" : "no"); if (df_delivered == deliv0 && ip == 0 && ie == 0 && df_ldata.wb_rx_list[0].wb_status == crafted && df_sc.wb_cdata.wb_rx_head == c0) kprintf("df4266: *** S1 BUG CONFIRMED: the REAL wb_rxeof " "broke immediately on the chip-COMPLETED descriptor " "(OWN=0, if_wb.c:974-975): frame DROPPED, descriptor " "never recycled, ipackets permanently 0 — RX dead ***\n"); else kprintf("df4266: S1: UNEXPECTED outcome — inspect markers\n"); } /* S1fix: identical state, one-line-fixed comparator (counterfactual) */ static void df_phase_s1fix(void) { u_long ip; int deliv0 = df_delivered; kprintf("df4266: === S1fix: IDENTICAL state, one-line-FIXED " "comparator (verbatim wb_rxeof; loop condition per fix.diff) " "===\n"); df_wb_rxeof_fixed(&df_sc); ip = DF_STAT(ifd_ipackets); df_ring_probe("S1fix-after-fixed-comparator"); kprintf("df4266: S1fix: delivered=%d ipackets=%lu slot0.status=" "%#010x (re-armed to WB_RXSTAT: %s)\n", df_delivered - deliv0, ip, df_ldata.wb_rx_list[0].wb_status, df_ldata.wb_rx_list[0].wb_status == WB_RXSTAT ? "YES" : "no"); if (df_delivered == deliv0 + 1) kprintf("df4266: *** S1fix: the SAME descriptor state IS " "deliverable — only the inverted OWN test at if_wb.c:974 " "blocks the production handler ***\n"); else kprintf("df4266: S1fix: UNEXPECTED outcome\n"); } /* S2: armed idle ring — chip-owned descriptors PROCESSED + reset storm */ static void df_phase_s2(void) { int i; struct mbuf *m_before; struct timeval a, b; long us; kprintf("df4266: === S2: armed idle ring (all OWN=1, exactly what " "wb_init leaves) — per-dispatch cost of the inverted loop " "===\n"); bzero(df_mmio, sizeof(df_mmio)); bzero(df_ifdata, sizeof(df_ifdata)); p_wb_init(&df_sc); /* re-arm: production state */ df_delivered = 0; df_ring_probe("S2-armed"); for (i = 0; i < 3; i++) { u_long ip, ie; m_before = df_sc.wb_cdata.wb_rx_chain[0].wb_mbuf; microuptime(&a); p_wb_rxeof(&df_sc); /* REAL handler */ microuptime(&b); us = (b.tv_sec - a.tv_sec) * 1000000 + b.tv_usec - a.tv_usec; ip = DF_STAT(ifd_ipackets); ie = DF_STAT(ifd_ierrors); kprintf("df4266: S2: dispatch %d: ipackets=%lu ierrors=%lu " "delivered=%d mbuf0 %p->%p (ring re-inited: %s) " "elapsed=%ld us\n", i, ip, ie, df_delivered, m_before, df_sc.wb_cdata.wb_rx_chain[0].wb_mbuf, df_sc.wb_cdata.wb_rx_chain[0].wb_mbuf != m_before ? "YES" : "no", us); } kprintf("df4266: *** S2 BUG CONFIRMED: every dispatch PROCESSED a " "chip-OWNED descriptor: head popped, ierrors++, 'receiver " "babbling', wb_fixmedia+wb_reset+wb_init = full 64-mbuf ring " "teardown/re-init PER INTERRUPT-equivalent (production: " "wb_intr:1137-1147 pays this for every arriving frame) while " "zero frames are delivered ***\n"); } /* S3: chip-owned descriptor that looks complete (mid-write-back) */ static void df_phase_s3(void) { u_long ip, ie; uint32_t crafted; kprintf("df4266: === S3: descriptor STILL chip-owned (OWN=1) but " "looking complete — the mid-write-back transient the inverted " "loop wrongly accepts ===\n"); bzero(df_mmio, sizeof(df_mmio)); bzero(df_ifdata, sizeof(df_ifdata)); p_wb_init(&df_sc); df_delivered = 0; df_craft_frame(); crafted = WB_RXSTAT_OWN | WB_RXSTAT_RXCMP | WB_RXSTAT_LASTFRAG | WB_RXSTAT_FIRSTFRAG | (64 << 16); /* OWN STILL SET */ df_ldata.wb_rx_list[0].wb_status = crafted; df_ring_probe("S3-crafted"); p_wb_rxeof(&df_sc); /* REAL handler */ ip = DF_STAT(ifd_ipackets); ie = DF_STAT(ifd_ierrors); df_ring_probe("S3-after-REAL-wb_rxeof"); kprintf("df4266: S3: delivered=%d ipackets=%lu ierrors=%lu " "slot0.status=%#010x (crafted %#010x; re-armed under the chip: " "%s)\n", df_delivered, ip, ie, df_ldata.wb_rx_list[0].wb_status, crafted, df_ldata.wb_rx_list[0].wb_status == WB_RXSTAT ? "YES" : "no"); if (df_delivered >= 1 && ip >= 1) kprintf("df4266: *** S3 BUG CONFIRMED: frame ACCEPTED from a " "descriptor with OWN=1 (chip still owns it) and the " "descriptor RE-ARMED (status rewritten to WB_RXSTAT) " "under the chip — driver and hardware now disagree about " "who owns descriptor 0 and its mbuf ***\n"); else kprintf("df4266: S3: UNEXPECTED outcome\n"); } static int df_sysctl_go(SYSCTL_HANDLER_ARGS) { int error, go = 0; error = sysctl_handle_int(oidp, &go, 0, req); if (error || req->newptr == NULL) return (error); if (go != 1 || df_ran) return (EPERM); df_ran = 1; if (p_wb_rxeof == NULL || p_wb_init == NULL || p_wb_stop == NULL) { kprintf("df4266: kernel addresses not set — use " "kern.df4266.{rxeof,init,stop}\n"); return (EINVAL); } kprintf("df4266: dispatching REAL kernel handlers (built-in " "'device wb'): wb_rxeof=%p wb_init=%p wb_stop=%p\n", p_wb_rxeof, p_wb_init, p_wb_stop); df_setup(); lwkt_serialize_enter(&df_ser); /* as wb_intr would */ if (df_phase0() == 0) { df_phase_s1(); df_phase_s1fix(); df_phase_s2(); df_phase_s3(); } p_wb_stop(&df_sc); /* frees ring mbufs */ callout_stop(&df_sc.wb_stat_timer); /* defuse wb_tick */ lwkt_serialize_exit(&df_ser); kprintf("df4266: SURVIVED — see markers above; guest stays up\n"); return (0); } SYSCTL_PROC(_kern_df4266, OID_AUTO, go, CTLTYPE_INT | CTLFLAG_RW, NULL, 0, df_sysctl_go, "I", "run the DF-4266 scenarios (needs rxeof/init/stop set)"); static int df_modevent(module_t mod, int type, void *arg) { switch (type) { case MOD_LOAD: return (0); case MOD_UNLOAD: /* state is static module memory; just defuse the callout */ if (df_ran) callout_stop(&df_sc.wb_stat_timer); return (0); default: return (0); } } static moduledata_t df_mod = { "df4266_wb_poc", df_modevent, NULL }; DECLARE_MODULE(df4266_wb_poc, df_mod, SI_SUB_DRIVERS, SI_ORDER_ANY);