/* * DF-5082 mechanism harness for * sys/dev/raid/hptrr/hptrr_os_bsd.c (DragonFly 6.5-DEVELOPMENT guest). * * Defect: os_map_pci_bar() (hptrr_os_bsd.c:85-106) never checks the * return of bus_alloc_resource_any() (hptrr_os_bsd.c:101). When the * BAR allocation fails, rman_get_virtual(NULL) (hptrr_os_bsd.c:104) * dereferences NULL: rman_get_virtual(r) is ((r)->r_virtual) * (sys/sys/rman.h:149) and offsetof(struct resource, r_virtual)==0x40 * on amd64 -> "Fatal trap 12: page fault", fault VA 0x40, at device * attach time. Twin of DF-5039 (hpt27xx_os_bsd.c:113). * * This harness embeds a VERBATIM copy of hptrr_os_bsd.c:85-106 * (rename-only: df5082_os_map_pci_bar_copy) plus the same function * with the proposed fix.diff guard applied * (df5082_os_map_pci_bar_fixed). The HBA/pcibar types come from the * REAL driver header , so the * hba->pcibar[index] accesses have the production layout; CTASSERTs * prove it. * * The allocation failure is produced through the real newbus/pci/rman * stack, exactly as in production: the victim is a REAL PCI device * whose chosen BAR register reads 0 (unimplemented/unassigned BAR). * For such a BAR pci_add_map() (sys/bus/pci/pci.c:2525) returns * without resource_list_add(), so resource_list_alloc() takes its * "!rle -> return 0" path (sys/kern/subr_bus.c:2673) and * bus_alloc_resource_any() returns NULL. * * sysctl df5082.trigger: * 2 = fixed variant -> expected: "guarded, no panic", guest survives * 1 = verbatim copy -> expected: Fatal trap 12, fault VA 0x40 */ #include #include #include #include #include #include #include #include #include #include #include #include #include /*-------------------------------------------------------------------- * Layout proof (real header, amd64). If any of these fire the static * analysis is wrong and the finding must be withdrawn. *------------------------------------------------------------------*/ CTASSERT(sizeof(HBA) > 0); CTASSERT(offsetof(HBA, pcidev) + sizeof(device_t) <= sizeof(HBA)); CTASSERT(offsetof(HBA, pcibar) + 6 * sizeof(((PHBA)0)->pcibar[0]) <= sizeof(HBA)); CTASSERT(sizeof(((PHBA)0)->pcibar[0]) == sizeof(struct { struct resource *res; int type; int rid; void *base; })); /*-------------------------------------------------------------------- * VERBATIM hptrr_os_bsd.c:85-106 (rename only). *------------------------------------------------------------------*/ static void * df5082_os_map_pci_bar_copy(void *osext, int index, HPT_U32 offset, HPT_U32 length) { PHBA hba = (PHBA)osext; hba->pcibar[index].rid = 0x10 + index * 4; if (pci_read_config(hba->pcidev, hba->pcibar[index].rid, 4) & 1) hba->pcibar[index].type = SYS_RES_IOPORT; else hba->pcibar[index].type = SYS_RES_MEMORY; hba->pcibar[index].res = bus_alloc_resource_any(hba->pcidev, hba->pcibar[index].type, &hba->pcibar[index].rid, RF_ACTIVE); hba->pcibar[index].base = (char *)rman_get_virtual(hba->pcibar[index].res) + offset; return hba->pcibar[index].base; } /*-------------------------------------------------------------------- * Same function with fix.diff applied (NULL guard + safe return). *------------------------------------------------------------------*/ static void * df5082_os_map_pci_bar_fixed(void *osext, int index, HPT_U32 offset, HPT_U32 length) { PHBA hba = (PHBA)osext; hba->pcibar[index].rid = 0x10 + index * 4; if (pci_read_config(hba->pcidev, hba->pcibar[index].rid, 4) & 1) hba->pcibar[index].type = SYS_RES_IOPORT; else hba->pcibar[index].type = SYS_RES_MEMORY; hba->pcibar[index].res = bus_alloc_resource_any(hba->pcidev, hba->pcibar[index].type, &hba->pcibar[index].rid, RF_ACTIVE); if (hba->pcibar[index].res == NULL) { /* fix.diff */ kprintf("DF5082-fixed: bus_alloc_resource_any(rid 0x%02x) " "returned NULL; guarded, no panic\n", hba->pcibar[index].rid); hba->pcibar[index].base = NULL; return NULL; } hba->pcibar[index].base = (char *)rman_get_virtual(hba->pcibar[index].res) + offset; return hba->pcibar[index].base; } /*-------------------------------------------------------------------- * Victim: first PCI child with a BAR register that reads 0. * Such a BAR never got a resource_list entry (pci_add_map returns * early), so bus_alloc_resource_any() fails -- the production shape * of "BAR could not be assigned". *------------------------------------------------------------------*/ static device_t df5082_find_victim(int *indexp) { devclass_t dc = devclass_find("pci"); int nunits, u; if (dc == NULL) return NULL; nunits = devclass_get_maxunit(dc); for (u = 0; u < nunits; u++) { device_t bus = devclass_get_device(dc, u); device_t *ch; int nch, c, idx; if (bus == NULL) continue; if (device_get_children(bus, &ch, &nch) != 0) continue; for (c = 0; c < nch; c++) { for (idx = 0; idx < 6; idx++) { int rid = 0x10 + idx * 4; if (pci_read_config(ch[c], rid, 4) == 0) { device_t victim = ch[c]; *indexp = idx; kfree(ch, M_TEMP); return victim; } } } kfree(ch, M_TEMP); } return NULL; } static int df5082_trigger(SYSCTL_HANDLER_ARGS) { int error, t = 0, idx = -1; device_t victim; HBA hba; void *r; error = sysctl_handle_int(oidp, &t, 0, req); if (error || req->newptr == NULL) return error; victim = df5082_find_victim(&idx); if (victim == NULL) { kprintf("DF5082: no victim with an unimplemented BAR found\n"); return 0; } memset(&hba, 0, sizeof(hba)); hba.ext_type = EXT_TYPE_HBA; hba.pcidev = victim; kprintf("DF5082: victim %s rid 0x%02x (BAR reads 0 -> " "bus_alloc_resource_any will fail)\n", device_get_nameunit(victim), 0x10 + idx * 4); if (t == 2) { r = df5082_os_map_pci_bar_fixed(&hba, idx, 0, 0x100); kprintf("DF5082: fixed variant returned %p; guest still alive\n", r); } else { kprintf("DF5082: calling VERBATIM os_map_pci_bar ...\n"); r = df5082_os_map_pci_bar_copy(&hba, idx, 0, 0x100); kprintf("DF5082: UNREACHABLE verbatim returned %p\n", r); } return 0; } SYSCTL_NODE(, OID_AUTO, df5082, CTLFLAG_RW, 0, "DF-5082 harness"); SYSCTL_PROC(_df5082, OID_AUTO, trigger, CTLTYPE_INT | CTLFLAG_RW, 0, 0, df5082_trigger, "I", "2=fixed variant (no panic), 1=verbatim copy (expect Fatal trap 12)"); static int df5082_modevent(module_t mod, int type, void *data) { switch (type) { case MOD_LOAD: kprintf("DF5082 harness loaded (sysctl df5082.trigger=N)\n"); return 0; default: return 0; } } static moduledata_t df5082_mod = { "df5082", df5082_modevent, 0 }; DECLARE_MODULE(df5082, df5082_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE);