⬢ DragonFlyBSD Kernel Audit
DF-4270 / kld_run.sh
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
#!/bin/sh
# dfwb3 — run a scenario against the REAL kernel handler symbols.
#   kld_run.sh 4267        : RX ring collapse (deterministic)
#   kld_run.sh 4268        : double-fetch race vs PRODUCTION wb_rxeof
#   kld_run.sh 4268ctl     : double-fetch race vs exact-semantics control
#   kld_run.sh 4270        : wb_start ignored-failure (cluster drain)
#   kld_run.sh disasm      : static evidence — objdump the fetch pattern
# Usage (host): vm.sh run_root 'sh /root/dfwb3/kld_run.sh <scenario>'
set -e
cd /root/dfwb3
S="${1:?scenario}"

K=/boot/kernel/kernel
A_RXEOF=$(nm $K | awk '/ t wb_rxeof$/{print $1; exit}')
A_INIT=$(nm $K | awk '/ t wb_init$/{print $1; exit}')
A_STOP=$(nm $K | awk '/ t wb_stop$/{print $1; exit}')
A_START=$(nm $K | awk '/ t wb_start$/{print $1; exit}')
A_TXEOF=$(nm $K | awk '/ t wb_txeof.part.4$/{print $1; exit}')
A_WDOG=$(nm $K | awk '/ t wb_watchdog$/{print $1; exit}')
A_MBSTAT=$(nm $K | awk '/ b mbstat$/{print $1; exit}')
A_MBTYPES=$(nm $K | awk '/ b mbtypes$/{print $1; exit}')
echo "wb_rxeof=0x$A_RXEOF wb_init=0x$A_INIT wb_stop=0x$A_STOP wb_start=0x$A_START wb_txeof.part.4=0x$A_TXEOF wb_watchdog=0x$A_WDOG mbstat=0x$A_MBSTAT mbtypes=0x$A_MBTYPES"
test -n "$A_RXEOF" -a -n "$A_INIT" -a -n "$A_STOP"

if [ "$S" = disasm ]; then
    # static evidence for DF-4268: the production fetch pattern.
    # Each 'and $0x3fff' is one WB_RXBYTES() evaluation in machine code.
    echo "=== wb_rxeof disassembly: loads of wb_status + WB_RXBYTES masks ==="
    objdump -d --start-address=0x$A_RXEOF \
        --stop-address=$((0x$A_RXEOF + 0x220)) $K | \
        grep -E 'mov +\(%r|and +\$0x3fff|shr +\$0x10|callq.*m_devget'
    exit 0
fi

kldload ./dfwb3_rig.ko
trap 'kldunload dfwb3_rig 2>/dev/null || true' EXIT
sysctl -w kern.dfwb3.rxeof=$A_RXEOF
sysctl -w kern.dfwb3.init=$A_INIT
sysctl -w kern.dfwb3.stop=$A_STOP
if [ -n "$A_START" ];   then sysctl -w kern.dfwb3.start=$A_START; fi
if [ -n "$A_TXEOF" ];   then sysctl -w kern.dfwb3.txeof=$A_TXEOF; fi
if [ -n "$A_WDOG" ];    then sysctl -w kern.dfwb3.watchdog=$A_WDOG; fi
if [ -n "$A_MBSTAT" ];  then sysctl -w kern.dfwb3.mbstat=$A_MBSTAT; fi
if [ -n "$A_MBTYPES" ]; then sysctl -w kern.dfwb3.mbtypes=$A_MBTYPES; fi

case "$S" in
4267)    echo "=== go4267: ring built by REAL wb_init (DF-4267) ==="
         sysctl -w kern.dfwb3.go4267=1 ;;
4268)    echo "=== go4268: race the PRODUCTION wb_rxeof (DF-4268) ==="
         sysctl -w kern.dfwb3.go4268=1 ;;
4268ctl) echo "=== go4268ctl: race the exact-semantics control (DF-4268) ==="
         sysctl -w kern.dfwb3.go4268ctl=1 ;;
4270)    echo "=== go4270: REAL wb_start under cluster exhaustion (DF-4270) ==="
         sysctl -w kern.dfwb3.go4270=1 ;;
*)       echo "unknown scenario $S" >&2; exit 2 ;;
esac
echo "GO_RC=$?"
echo "=== marker summary ==="
dmesg | grep 'dfwb3:' | grep -E 'CONFIRMED|OVERSIZED|WON|A/B|exhausted|SURVIVED|WEDGE|marker' || true