/* * poc_quirkfastpath.c -- DF-5585 rig for sys/bus/pccard/pccard_cis_quirks.c * (pass 2, GLM 5.3). Userland model, no PCMCIA hardware required. * * VERBATIM-BACKED: struct pccard_config_entry / pccard_function / * pccard_card / pccard_cis_quirk are byte-for-byte * sys/bus/pccard/pccardvar.h:87-160,165-184,205-211 (bus types typedef'd), * and pccard_cis_quirk_match() + pccard_check_cis_quirks() are byte-for-byte * sys/bus/pccard/pccard_cis_quirks.c:201-216 and :218-292 with ONLY these * mechanical substitutions (each marked * RIG: * inline): * - device_t dev / PCCARD_SOFTC(dev) -> struct pccard_softc *sc parameter * - device_printf(dev,...)/kprintf -> qlog(...) (macro) * - kmalloc(sz,M_DEVBUF,M_NOWAIT) -> qk_alloc(sz) (macro, failpoint) * - kfree(p,M_DEVBUF) -> qk_free(p) (macro, shadow-copy) * - the quirk table + n_pccard_cis_quirks become runtime-set globals * (see fidelity.diff for the normalized diff against sys/). * * The failpoint allocator snapshots every block at kfree time (kernel kfree * does not scrub; contents survive). After the run, freed blocks are * compared against their snapshots: any difference is a write into freed * memory -- the stale-pf write of the quirks.c:263-270 fast path. * * Scenarios (argv[1]): * negative shipped-table shape, no allocation failure -> clean * shippedfail shipped-table shape (func0,func1), cfe alloc of the 2nd * quirk fails (fail_nth=4) -> clean (today) * repeat 3-entry table re-using the func0 template (the natural * future extension of quirks.c:178-197), same fail_nth=4 * -> STAILQ_INSERT_TAIL writes into the pf kfree'd at * pccard_cis_quirks.c:282 * nulltemplate entry with pf==NULL after a non-empty wipe -> fast path * (pf_last==NULL==q->pf) writes into the pf freed by the * wipe loop (pccard_cis_quirks.c:248-257); empty-list * variant would write to ~address 0 (NULL page) instead * matchmatrix enumerates every card identity the SHIPPED table can * match; proves no identity ever takes the fast path * (no consecutive same-template matches, sets <= 2) * fixed_* same as repeat/nulltemplate but through * pccard_check_cis_quirks_fixed() = verbatim + the * fix.diff guard lines -> no freed-memory writes * all everything in order */ #include #include #include #include #include #include #include #include #include /* macro shims so the verbatim function bodies below compile unchanged; * kmalloc/kfree swap in the failpoint allocator, printf stands in for * device_printf/kprintf (first arg dev discarded, never evaluated) */ #define qlog printf #define kmalloc(sz, type, flags) qk_alloc(sz) #define kfree(p, type) qk_free(p) #define device_printf(dev, ...) printf(__VA_ARGS__) #define kprintf(...) printf(__VA_ARGS__) static int bootverbose = 0; /* ---------------- failpoint allocator ---------------- */ #define QK_NBLOCKS 64 #define QK_BLOCK 512 struct qk_blk { void *p; int freed; size_t serial; /* kmalloc call number that made it */ uint8_t shadow[QK_BLOCK]; /* contents at kfree time */ }; static struct qk_blk qk_pool[QK_NBLOCKS]; static int qk_used; static size_t qk_alloc_calls; static long qk_fail_nth = -1; /* fail the Nth kmalloc (1-based) */ static void *qk_alloc(size_t sz) { void *p; qk_alloc_calls++; if (qk_fail_nth > 0 && (size_t)qk_fail_nth == qk_alloc_calls) { qlog("RIG: kmalloc call #%zu (%zu bytes) -> NULL (failpoint)\n", qk_alloc_calls, sz); return NULL; } if (sz > QK_BLOCK || qk_used == QK_NBLOCKS) { qlog("RIG: pool exhausted\n"); return NULL; } p = calloc(1, QK_BLOCK); /* kernel kmalloc: not zeroed, but a * fresh cfe/pf copies over every * field it reads; calloc keeps the * model deterministic */ qk_pool[qk_used].p = p; qk_pool[qk_used].freed = 0; qk_pool[qk_used].serial = qk_alloc_calls; qk_used++; return p; } static void qk_free(void *p) { int i; if (p == NULL) return; for (i = 0; i < qk_used; i++) { if (qk_pool[i].p == p && !qk_pool[i].freed) { qk_pool[i].freed = 1; memcpy(qk_pool[i].shadow, p, QK_BLOCK); return; } } qlog("RIG: qk_free(%p): not a live pool block!\n", p); } /* writes-into-freed-memory audit */ static int qk_audit(const char *tag) { int i, dirty = 0, off, noff; uint8_t *b; for (i = 0; i < qk_used; i++) { if (!qk_pool[i].freed) continue; b = qk_pool[i].p; noff = 0; for (off = 0; off < QK_BLOCK; off++) { if (b[off] != qk_pool[i].shadow[off]) noff++; } if (noff) { dirty++; for (off = 0; off < QK_BLOCK; off++) { if (b[off] != qk_pool[i].shadow[off]) break; } qlog(" FREED-WRITE[%s]: block %p (kmalloc #%zu) " "modified: first diff at +%d, %d byte(s) changed " "(snapshot 0x%02x -> 0x%02x)\n", tag, qk_pool[i].p, qk_pool[i].serial, off, noff, qk_pool[i].shadow[off], b[off]); } } if (!dirty) qlog(" freed-memory audit[%s]: CLEAN (0 writes into " "kfree'd blocks)\n", tag); return dirty; } /* device_printf/kprintf stand-in */ #define qlog printf /* ---------------- verbatim struct definitions -------------------------- */ /* pccardvar.h:87-112 */ struct pccard_config_entry { int number; uint32_t flags; int iftype; int num_iospace; u_long iomask; struct { u_long length; u_long start; } iospace[4]; uint16_t irqmask; int num_memspace; struct { u_long length; u_long cardaddr; u_long hostaddr; } memspace[2]; int maxtwins; STAILQ_ENTRY(pccard_config_entry) cfe_list; }; /* pccardvar.h:114-126 */ struct pccard_funce_disk { int pfd_interface; }; struct pccard_funce_lan { int pfl_nidlen; uint8_t pfl_nid[8]; }; union pccard_funce { struct pccard_funce_disk pfv_disk; struct pccard_funce_lan pfv_lan; }; struct pccard_softc; /* RIG: fwd, was via bus.h */ /* pccardvar.h:128-160 (bus types typedef'd, field order verbatim) */ struct pccard_function { int number; int function; int last_config_index; uint32_t ccr_base; uint32_t ccr_mask; void *ccr_res; /* RIG: struct resource * */ int ccr_rid; STAILQ_HEAD(, pccard_config_entry) cfe_head; STAILQ_ENTRY(pccard_function) pf_list; struct pccard_softc *sc; struct pccard_config_entry *cfe; struct { /* RIG: pccard_mem_handle */ uint64_t addr, size, realsize, cardaddr; int kind; } pf_pcmh; void *dev; /* RIG: device_t */ uint32_t pf_ccr_offset; int pf_ccr_window; uint64_t pf_mfc_iobase; /* RIG: bus_addr_t */ uint64_t pf_mfc_iomax; /* RIG: bus_addr_t */ int pf_flags; void *intr_handler; /* RIG: driver_intr_t * */ void *intr_handler_arg; void *intr_handler_cookie; union pccard_funce pf_funce; }; /* pccardvar.h:165-184 */ struct pccard_card { int cis1_major; int cis1_minor; char cis1_info_buf[256]; char *cis1_info[4]; int32_t manufacturer; #define PCMCIA_VENDOR_INVALID -1 int32_t product; #define PCMCIA_PRODUCT_INVALID -1 int16_t prodext; uint16_t error; #define PCMCIA_CIS_INVALID { NULL, NULL, NULL, NULL } STAILQ_HEAD(, pccard_function) pf_head; }; struct pccard_softc { /* RIG: pccardvar.h:196-203, card only */ struct pccard_card card; }; /* pccardvar.h:205-211 */ struct pccard_cis_quirk { int32_t manufacturer; int32_t product; char *cis1_info[4]; struct pccard_function *pf; struct pccard_config_entry *cfe; }; /* RIG: the kmalloc/kfree/device_printf/kprintf/bootverbose shims live at * the top of the file; the quirk table + count are runtime-set globals * (scenario scaffolding) so the function bodies below stay verbatim. */ static struct pccard_cis_quirk *pccard_cis_quirks; static int n_pccard_cis_quirks; /* ---------------- VERBATIM pccard_cis_quirks.c:201-216 ----------------- */ static int pccard_cis_quirk_match(struct pccard_softc *sc, struct pccard_cis_quirk *q) { if ((sc->card.manufacturer == q->manufacturer) && (sc->card.product == q->product) && (((sc->card.manufacturer != PCMCIA_VENDOR_INVALID) && (sc->card.product != PCMCIA_PRODUCT_INVALID)) || ((sc->card.manufacturer == PCMCIA_VENDOR_INVALID) && (sc->card.product == PCMCIA_PRODUCT_INVALID) && sc->card.cis1_info[0] && (strcmp(sc->card.cis1_info[0], q->cis1_info[0]) == 0) && sc->card.cis1_info[1] && (strcmp(sc->card.cis1_info[1], q->cis1_info[1]) == 0)))) return (1); return (0); } /* ------------- VERBATIM pccard_cis_quirks.c:218-292 -------------------- */ void pccard_check_cis_quirks(struct pccard_softc *sc) /* RIG: was (device_t dev) */ { /* RIG: struct pccard_softc *sc = PCCARD_SOFTC(dev); -- now a param */ int wiped = 0; int i, j; struct pccard_function *pf, *pf_next, *pf_last; struct pccard_config_entry *cfe, *cfe_next; struct pccard_cis_quirk *q; pf = NULL; pf_last = NULL; for (i=0; i printf; body * verbatim, not reached (bootverbose==0) */ qlog("using CIS quirks for "); for (j = 0; j < 4; j++) { if (sc->card.cis1_info[j] == NULL) break; if (j) kprintf(", "); kprintf("%s", sc->card.cis1_info[j]); } kprintf("\n"); } for (pf = STAILQ_FIRST(&sc->card.pf_head); pf != NULL; pf = pf_next) { for (cfe = STAILQ_FIRST(&pf->cfe_head); cfe != NULL; cfe = cfe_next) { cfe_next = STAILQ_NEXT(cfe, cfe_list); kfree(cfe, M_DEVBUF); } pf_next = STAILQ_NEXT(pf, pf_list); kfree(pf, M_DEVBUF); } STAILQ_INIT(&sc->card.pf_head); wiped = 1; } if (pf_last == q->pf) { cfe = kmalloc(sizeof(*cfe), M_DEVBUF, M_NOWAIT); if (cfe == NULL) { device_printf(dev, "no memory for quirk (1)\n"); continue; } *cfe = *q->cfe; STAILQ_INSERT_TAIL(&pf->cfe_head, cfe, cfe_list); } else { pf = kmalloc(sizeof(*pf), M_DEVBUF, M_NOWAIT); if (pf == NULL) { device_printf(dev, "no memory for pccard function\n"); continue; } *pf = *q->pf; STAILQ_INIT(&pf->cfe_head); cfe = kmalloc(sizeof(*cfe), M_DEVBUF, M_NOWAIT); if (cfe == NULL) { kfree(pf, M_DEVBUF); device_printf(dev, "no memory for quirk (2)\n"); continue; } *cfe = *q->cfe; STAILQ_INSERT_TAIL(&pf->cfe_head, cfe, cfe_list); STAILQ_INSERT_TAIL(&sc->card.pf_head, pf, pf_list); pf_last = q->pf; } } } /* ---- fix.diff variant: verbatim + the two guard lines (marked FIX) ---- */ void pccard_check_cis_quirks_fixed(struct pccard_softc *sc) { int wiped = 0; int i, j; struct pccard_function *pf, *pf_next, *pf_last; struct pccard_config_entry *cfe, *cfe_next; struct pccard_cis_quirk *q; pf = NULL; pf_last = NULL; for (i=0; ipf == NULL || q->cfe == NULL) /* FIX: malformed */ continue; /* FIX: entry */ if (!wiped) { for (pf = STAILQ_FIRST(&sc->card.pf_head); pf != NULL; pf = pf_next) { for (cfe = STAILQ_FIRST(&pf->cfe_head); cfe != NULL; cfe = cfe_next) { cfe_next = STAILQ_NEXT(cfe, cfe_list); kfree(cfe, M_DEVBUF); } pf_next = STAILQ_NEXT(pf, pf_list); kfree(pf, M_DEVBUF); } STAILQ_INIT(&sc->card.pf_head); wiped = 1; } if (pf_last == q->pf) { cfe = kmalloc(sizeof(*cfe), M_DEVBUF, M_NOWAIT); if (cfe == NULL) { device_printf(dev, "no memory for quirk (1)\n"); continue; } *cfe = *q->cfe; STAILQ_INSERT_TAIL(&pf->cfe_head, cfe, cfe_list); } else { pf = kmalloc(sizeof(*pf), M_DEVBUF, M_NOWAIT); if (pf == NULL) { device_printf(dev, "no memory for pccard function\n"); continue; } *pf = *q->pf; STAILQ_INIT(&pf->cfe_head); cfe = kmalloc(sizeof(*cfe), M_DEVBUF, M_NOWAIT); if (cfe == NULL) { kfree(pf, M_DEVBUF); pf_last = NULL; /* FIX: pf no longer * tracks pf_last */ device_printf(dev, "no memory for quirk (2)\n"); continue; } *cfe = *q->cfe; STAILQ_INSERT_TAIL(&pf->cfe_head, cfe, cfe_list); STAILQ_INSERT_TAIL(&sc->card.pf_head, pf, pf_list); pf_last = q->pf; } } } /* ---------------- scenario scaffolding --------------------------------- */ /* shipped templates, pccard_cis_quirks.c:51-176 (values verbatim) */ static struct pccard_function tpl_3cxem556_f0 = { 0, 6 /*PCCARD_FUNCTION_NETWORK*/, 0x07, 0x800, 0x63, }; static struct pccard_config_entry tpl_3cxem556_f0_cfe0 = { 0x07, 0x0010|0x0020|0x0100, 1 /*PCCARD_IFTYPE_IO*/, 1, 4, { { 0x0010, 0 } }, 0xffff, 0, { }, 0, }; static struct pccard_function tpl_3cxem556_f1 = { 1, 2 /*PCCARD_FUNCTION_SERIAL*/, 0x27, 0x900, 0x63, }; static struct pccard_config_entry tpl_3cxem556_f1_cfe0 = { 0x27, 0x0010|0x0100, 3, 1, 3, { { 0x0008, 0 } }, 0xffff, 0, { }, 0, }; /* a "fake CIS" function the wipe loop must free (simulates pccard_read_cis * output present at pccard.c:198 call time) */ static void seed_card_functions(struct pccard_softc *sc, int npf, int ncfe_per_pf) { struct pccard_function *pf; struct pccard_config_entry *cfe; int i, j; STAILQ_INIT(&sc->card.pf_head); for (i = 0; i < npf; i++) { pf = qk_alloc(sizeof(*pf)); memset(pf, 0, sizeof(*pf)); pf->number = i; STAILQ_INIT(&pf->cfe_head); for (j = 0; j < ncfe_per_pf; j++) { cfe = qk_alloc(sizeof(*cfe)); memset(cfe, 0, sizeof(*cfe)); cfe->number = j; STAILQ_INSERT_TAIL(&pf->cfe_head, cfe, cfe_list); } STAILQ_INSERT_TAIL(&sc->card.pf_head, pf, pf_list); } } static void rig_reset(void) { int i; for (i = 0; i < qk_used; i++) free(qk_pool[i].p); memset(qk_pool, 0, sizeof(qk_pool)); qk_used = 0; qk_alloc_calls = 0; qk_fail_nth = -1; pccard_cis_quirks = NULL; n_pccard_cis_quirks = 0; } static int list_card(struct pccard_softc *sc, const char *tag) { struct pccard_function *pf; struct pccard_config_entry *cfe; int n = 0; STAILQ_FOREACH(pf, &sc->card.pf_head, pf_list) { n++; qlog(" %s live pf#%d ccr_base=0x%x cfe:", tag, pf->number, pf->ccr_base); STAILQ_FOREACH(cfe, &pf->cfe_head, cfe_list) qlog(" #%d", cfe->number); qlog("\n"); } return n; } /* ---------------- scenarios -------------------------------------------- */ static int sc_negative(void) { struct pccard_softc s, *sc = &s; struct pccard_cis_quirk tbl[] = { { 0x0101, 0x0035, { NULL, NULL, NULL, NULL }, &tpl_3cxem556_f0, &tpl_3cxem556_f0_cfe0 }, { 0x0101, 0x0035, { NULL, NULL, NULL, NULL }, &tpl_3cxem556_f1, &tpl_3cxem556_f1_cfe0 }, }; rig_reset(); qlog("== negative: shipped-table shape (func0,func1), no alloc failure\n"); memset(sc, 0, sizeof(*sc)); seed_card_functions(sc, 2, 2); /* counts as kmalloc calls 1..6 */ sc->card.manufacturer = 0x0101; sc->card.product = 0x0035; pccard_cis_quirks = tbl; n_pccard_cis_quirks = 2; pccard_check_cis_quirks(sc); list_card(sc, "neg"); return qk_audit("negative"); } static int sc_shippedfail(void) { struct pccard_softc s, *sc = &s; struct pccard_cis_quirk tbl[] = { { 0x0101, 0x0035, { NULL, NULL, NULL, NULL }, &tpl_3cxem556_f0, &tpl_3cxem556_f0_cfe0 }, { 0x0101, 0x0035, { NULL, NULL, NULL, NULL }, &tpl_3cxem556_f1, &tpl_3cxem556_f1_cfe0 }, }; int bad; rig_reset(); qlog("== shippedfail: shipped-table shape, cfe alloc of quirk#2 fails " "(fail_nth=10)\n"); /* seed 6 blocks, then quirk#1 allocates pf(7),cfe(8->would be OK)... * we want quirk#2's cfe: pf(7),cfe(8),pf(9),cfe(10)FAIL -> fail_nth=10 */ memset(sc, 0, sizeof(*sc)); seed_card_functions(sc, 2, 2); sc->card.manufacturer = 0x0101; sc->card.product = 0x0035; pccard_cis_quirks = tbl; n_pccard_cis_quirks = 2; qk_fail_nth = 10; pccard_check_cis_quirks(sc); list_card(sc, "shipped"); bad = qk_audit("shippedfail"); qlog(" (expected: CLEAN -- with the shipped 2-entry shape the loop " "ends after the failure; fast path never runs)\n"); return bad; } static int sc_repeat(int fixed) { struct pccard_softc s, *sc = &s; /* future-maintainer table: a third quirk for the same card re-using * the func0 template (the exact pattern quirks.c:179-186 already * uses to share templates across two product ids) */ struct pccard_cis_quirk tbl[] = { { 0x0101, 0x0035, { NULL, NULL, NULL, NULL }, &tpl_3cxem556_f0, &tpl_3cxem556_f0_cfe0 }, { 0x0101, 0x0035, { NULL, NULL, NULL, NULL }, &tpl_3cxem556_f1, &tpl_3cxem556_f1_cfe0 }, { 0x0101, 0x0035, { NULL, NULL, NULL, NULL }, &tpl_3cxem556_f0, &tpl_3cxem556_f0_cfe0 }, }; int bad; rig_reset(); qlog("== %srepeat: 3-entry table re-using func0 template, quirk#2 cfe " "alloc fails (fail_nth=10)\n", fixed ? "fixed_" : ""); memset(sc, 0, sizeof(*sc)); seed_card_functions(sc, 2, 2); sc->card.manufacturer = 0x0101; sc->card.product = 0x0035; pccard_cis_quirks = tbl; n_pccard_cis_quirks = 3; qk_fail_nth = 10; if (fixed) pccard_check_cis_quirks_fixed(sc); else pccard_check_cis_quirks(sc); list_card(sc, fixed ? "fixed" : "repeat"); bad = qk_audit(fixed ? "fixed_repeat" : "repeat"); qlog(" offsetof(struct pccard_function, cfe_head) = %zu " "(STAILQ_INSERT_TAIL writes sqh_first at +0 and sqh_last at +8 " "of cfe_head)\n", offsetof(struct pccard_function, cfe_head)); if (!fixed && bad) qlog("RESULT: DF-5585 repeat: quirk#3 fast path " "(pf_last==q->pf) STAILQ_INSERT_TAIL'd a cfe into the pf " "kfree'd at pccard_cis_quirks.c:282 -> write-after-free\n"); if (fixed && !bad) qlog("RESULT: DF-5585 fixed_repeat: pf_last=NULL guard keeps " "the invariant; no freed-memory writes\n"); return bad; } static int sc_nulltemplate(int fixed) { struct pccard_softc s, *sc = &s; struct pccard_cis_quirk tbl[] = { { 0x0101, 0x0035, { NULL, NULL, NULL, NULL }, NULL, &tpl_3cxem556_f0_cfe0 }, /* pf == NULL */ }; int bad, st; pid_t pid; rig_reset(); qlog("== %snulltemplate: entry with pf==NULL; the wipe loop " "(:248-257) always exits with pf==NULL (it is the loop " "variable), so pf_last==NULL==q->pf takes the fast path and " "INSERT_TAIL dereferences &pf->cfe_head == 0x28\n", fixed ? "fixed_" : ""); if (!fixed) { /* the unfixed run writes to the NULL page: run it in a child * so the rig can report the fault instead of dying */ fflush(stdout); pid = fork(); if (pid == 0) { memset(sc, 0, sizeof(*sc)); seed_card_functions(sc, 2, 2); sc->card.manufacturer = 0x0101; sc->card.product = 0x0035; pccard_cis_quirks = tbl; n_pccard_cis_quirks = 1; pccard_check_cis_quirks(sc); _exit(0); /* not reached if it faults */ } waitpid(pid, &st, 0); if (WIFSIGNALED(st) && WTERMSIG(st) == 11) { qlog(" child died on SIGSEGV writing near address " "0x28/0x30 -- the kernel equivalent is a NULL-" "page write (deterministic panic)\n"); qlog("RESULT: DF-5585 nulltemplate: NULL pf template " "+ pf_last(NULL)==q->pf fast path -> " "&pf->cfe_head deref at offset 40 of NULL\n"); return 1; } qlog(" child exited status=%d (unexpected)\n", st); return 0; } memset(sc, 0, sizeof(*sc)); seed_card_functions(sc, 2, 2); sc->card.manufacturer = 0x0101; sc->card.product = 0x0035; pccard_cis_quirks = tbl; n_pccard_cis_quirks = 1; pccard_check_cis_quirks_fixed(sc); list_card(sc, "fixed"); bad = qk_audit("fixed_nulltemplate"); if (!bad) qlog("RESULT: DF-5585 fixed_nulltemplate: NULL-template guard " "skips the entry; no freed-memory writes, no fault\n"); return bad; } /* machine-checked unreachability proof for the SHIPPED table */ static int sc_matchmatrix(void) { /* full shipped table, pccard_cis_quirks.c:178-197; CIS strings per * pccarddevs:327,332 (&sp == space, see pccarddevs2h.awk) */ static struct pccard_function tpl_bi_f0 = { 0, 6, 0x07, 0x1000, 0x267 }; static struct pccard_config_entry tpl_bi_f0_cfe0 = { 0x07, 0x0010|0x0020|0x0100, 3, 1, 5, { { 0x0020, 0 } }, 0xffff, 0, { }, 0 }; static struct pccard_function tpl_bi_f1 = { 1, 2, 0x27, 0x1100, 0x277 }; static struct pccard_config_entry tpl_bi_f1_cfe0 = { 0x27, 0x0010|0x0100, 3, 1, 3, { { 0x0008, 0 } }, 0xffff, 0, { }, 0 }; static struct pccard_function tpl_svec_f0 = { 0, 6, 0x1, 0x100, 0x1 }; static struct pccard_config_entry tpl_svec_f0_cfe0 = { 0x1, 0x0001|0x0002|0x0004|0x0008|0x0020, 1, 1, 5, { { 0x20, 0x300 } }, 0xdeb8, 0, { }, 0 }; static struct pccard_function tpl_ndc_f0 = { 0, 6, 0x23, 0x3f8, 0x3 }; static struct pccard_config_entry tpl_ndc_f0_cfe0 = { 0x20, 0x0001|0x0020|0x0100, 1, 1, 5, { { 0x20, 0x300 } }, 0xdeb8, 0, { }, 0 }; static struct pccard_cis_quirk shipped[] = { { 0x0101, 0x0035, { NULL, NULL, NULL, NULL }, &tpl_3cxem556_f0, &tpl_3cxem556_f0_cfe0 }, { 0x0101, 0x0035, { NULL, NULL, NULL, NULL }, &tpl_3cxem556_f1, &tpl_3cxem556_f1_cfe0 }, { 0x0101, 0x003d, { NULL, NULL, NULL, NULL }, &tpl_3cxem556_f0, &tpl_3cxem556_f0_cfe0 }, { 0x0101, 0x003d, { NULL, NULL, NULL, NULL }, &tpl_3cxem556_f1, &tpl_3cxem556_f1_cfe0 }, { 0x0101, 0x0556, { NULL, NULL, NULL, NULL }, &tpl_bi_f0, &tpl_bi_f0_cfe0 }, { 0x0101, 0x0556, { NULL, NULL, NULL, NULL }, &tpl_bi_f1, &tpl_bi_f1_cfe0 }, { -1, -1, { "SVEC", "FD605 PCMCIA EtherNet Card", NULL, NULL }, &tpl_svec_f0, &tpl_svec_f0_cfe0 }, { -1, -1, { "NDC", "Ethernet", NULL, NULL }, &tpl_ndc_f0, &tpl_ndc_f0_cfe0 }, }; /* every card identity the shipped table can possibly match */ struct { const char *name; int32_t man, prod; char *s0, *s1; } ids[] = { { "3COM 3CXEM556 ", 0x0101, 0x0035, NULL, NULL }, { "3COM 3CXEM556INT ", 0x0101, 0x003d, NULL, NULL }, { "3COM 3CCFEM556BI ", 0x0101, 0x0556, NULL, NULL }, { "SVEC LANCARD ", -1, -1, (char *)"SVEC", (char *)"FD605 PCMCIA EtherNet Card" }, { "NDC ND5100_E ", -1, -1, (char *)"NDC", (char *)"Ethernet" }, { "no-match card ", 0xdead, 0xbeef, NULL, NULL }, }; int n_ids = sizeof(ids) / sizeof(ids[0]); int n_q = sizeof(shipped) / sizeof(shipped[0]); int c, i, nm, fastpath_ever = 0; struct pccard_softc s, *sc = &s; struct pccard_function *prev_tpl; rig_reset(); qlog("== matchmatrix: every card identity the SHIPPED 8-entry table " "can match\n"); for (c = 0; c < n_ids; c++) { memset(sc, 0, sizeof(*sc)); STAILQ_INIT(&sc->card.pf_head); sc->card.manufacturer = ids[c].man; sc->card.product = ids[c].prod; if (ids[c].s0) { snprintf(sc->card.cis1_info_buf, 128, "%s%c%s%c", ids[c].s0, 0, ids[c].s1, 0); sc->card.cis1_info[0] = sc->card.cis1_info_buf; sc->card.cis1_info[1] = sc->card.cis1_info_buf + strlen(ids[c].s0) + 1; } qlog(" card %s -> matches:", ids[c].name); nm = 0; prev_tpl = NULL; for (i = 0; i < n_q; i++) { if (pccard_cis_quirk_match(sc, &shipped[i])) { qlog(" [%d:pf=%s]", i, shipped[i].pf == &tpl_3cxem556_f0 ? "xemf0" : shipped[i].pf == &tpl_3cxem556_f1 ? "xemf1" : shipped[i].pf == &tpl_bi_f0 ? "bif0" : shipped[i].pf == &tpl_bi_f1 ? "bif1" : shipped[i].pf == &tpl_svec_f0 ? "svec" : shipped[i].pf == &tpl_ndc_f0 ? "ndc" : "??"); if (nm > 0 && prev_tpl == shipped[i].pf) { fastpath_ever = 1; qlog(" FAST-PATH-REACHED"); } prev_tpl = shipped[i].pf; nm++; } } if (nm == 0) qlog(" none"); qlog(" (set size %d)\n", nm); } qlog("RESULT: DF-5585 matchmatrix: shipped table fast-path reachable " "by ANY card identity: %s (match sets <= 2 entries, templates " "within a set always differ)\n", fastpath_ever ? "YES" : "NO"); return fastpath_ever; } int main(int argc, char **argv) { const char *w = (argc > 1) ? argv[1] : "all"; int bad = 0; if (!strcmp(w, "all")) { bad += sc_negative(); bad += sc_shippedfail(); bad += sc_repeat(0); bad += sc_repeat(1); bad += sc_nulltemplate(0); bad += sc_nulltemplate(1); bad += sc_matchmatrix(); } else if (!strcmp(w, "negative")) { bad += sc_negative(); } else if (!strcmp(w, "shippedfail")) { bad += sc_shippedfail(); } else if (!strcmp(w, "repeat")) { bad += sc_repeat(0); } else if (!strcmp(w, "fixed_repeat")) { bad += sc_repeat(1); } else if (!strcmp(w, "nulltemplate")) { bad += sc_nulltemplate(0); } else if (!strcmp(w, "fixed_nulltemplate")) { bad += sc_nulltemplate(1); } else if (!strcmp(w, "matchmatrix")) { bad += sc_matchmatrix(); } else { fprintf(stderr, "unknown scenario %s\n", w); return 2; } qlog("DF-5585 rig done (%s): freed-write findings=%d\n", w, bad); return bad ? 1 : 0; }