/* * df5632_rig.c -- DF-5632/5633/5634/5635 rig: instantiate the REAL * in-tree iicbus stack (iicbus.ko + iicbb.ko [+ iic.ko]) under a fake * GPIO parent and drive the iicbus.c lifecycle primitives. * * Targets (sys/bus/iicbus/iicbus.c): * DF-5632 iicbus_add_child() is registered (DEVMETHOD at :66) with a * FreeBSD-era 4-arg/int prototype while DragonFly's * bus_add_child interface is 5-arg returning device_t * (sys/kern/bus_if.m:128-134). On dispatch the callee reads * order <- child (device_t), name <- order (int 0 -> NULL), * unit <- name (rodata address truncated), and the caller * receives 0-as-NULL instead of the new device. The rig's * df5632k driver uses the exact identify pattern of * iic.c:104-110 / iicsmb.c:137-142, so the skew fires on * stock iicbus.ko the moment the rig module loads. * DF-5633 iicbus_attach() (:144-146) unconditionally re-creates the * ic/iic/iicsmb trio on every attach; children survive * module/driver teardown (DS_NOTPRESENT), so every * detach+re-attach cycle leaks 3 struct bsd_device and mints * duplicate devclass units (iic0, iic1, ... -> duplicate * /dev/iicN on ONE physical bus). * DF-5634 children are created with no struct iicbus_ivar ever * allocated (root cause of DF-5559): stock iicbus has no * bus_read_ivar/write_ivar at all; with DF-5559's fix the * write side returns success while discarding the value * (ivar == NULL). Complete fix allocates ivars in * bus_add_child and frees them in bus_child_detached. * DF-5635 iicbus_detach() (:156-162) swallows bus_generic_detach()'s * error: a child that fails to detach leaves the bus * marked detached + driverless with its softc freed * (device_set_driver(NULL) kfree's dev->softc, * subr_bus.c:1943-1945) while the child is still attached; * the child's next iicbus_request_bus() derefs * device_get_softc(bus) == NULL (iiconf.c:88 -> :101). * * Rig structure (mirrors the DF-5539/5558/5563 fakebb rig): * * nexus -> fakebb0 (this module: GPIO emulator + /dev/df5632) * -> iicbb0 (real iicbb.ko) * -> iicbus0 (real iicbus.ko) <-- code under test * -> ic/iic/iicsmb trio (iicbus.c:144-146) * -> df5632k0 (this module's identify-based client * driver -- the DF-5632 skew victim) * * /dev/df5632 ioctls (dfctl) drive production newbus APIs on the * production iicbus device: device_detach(), device_probe_and_attach(), * BUS_ADD_CHILD(), BUS_READ_IVAR()/BUS_WRITE_IVAR(). */ #include #include #include #include #include #include #include #include #include #include #include #include #include "bus_if.h" #include "iicbb_if.h" #define FAKEBB_NACK_ADDR 0x6e /* slave refuses this address */ #define FAKEBB_TX_BASE 0xc0 /* slave TX pattern base */ /* dfctl <-> rig ioctl protocol */ #define DF5632_IOCTL_MAGIC 'D' struct df5632_req { int32_t arg; /* in: cycle count etc. */ int32_t rc; /* out: kernel return code */ int64_t v0, v1, v2, v3; /* out: witness values */ }; #define DF5632_STAT _IOWR(DF5632_IOCTL_MAGIC, 1, struct df5632_req) #define DF5632_CYCLE _IOWR(DF5632_IOCTL_MAGIC, 2, struct df5632_req) #define DF5632_ADDCHILD _IOWR(DF5632_IOCTL_MAGIC, 3, struct df5632_req) #define DF5632_IVAR_RT _IOWR(DF5632_IOCTL_MAGIC, 4, struct df5632_req) #define DF5632_FAILCHILD _IOWR(DF5632_IOCTL_MAGIC, 5, struct df5632_req) #define DF5632_DETACH_BUS _IOWR(DF5632_IOCTL_MAGIC, 6, struct df5632_req) #define DF5632_REQBUS _IOWR(DF5632_IOCTL_MAGIC, 7, struct df5632_req) static struct dev_ops df5632_ops; struct fakebb_softc { device_t self; /* fakebb0: the bus-owner token */ device_t iicbb; /* our iicbb child */ device_t iicbus; /* located iicbus grandchild (code under test) */ cdev_t cdev; /* /dev/df5632 */ /* emulated GPIO pin state (what the master drove) */ int sda, scl, last_scl; /* emulated I2C slave */ int started; /* START seen and no STOP yet */ int clk; /* SCL rising edges this byte slot (1..9) */ u_char shift; /* shift-in register */ int first_byte; /* next byte slot is the address */ int reading; /* current transfer direction */ u_char addr; /* addressed slave byte */ int nack_this; /* NACK the current address */ u_char rx[32]; /* bytes captured from master */ int rxlen; u_char txnext; /* next TX pattern byte */ u_char txcur; /* current TX byte being clocked out */ int starts, stops; }; static int df5632_childbusy = 0; /* df5632k detach returns EBUSY */ static int df5632_identify_add = 0; /* fire BUS_ADD_CHILD in identify */ SYSCTL_NODE(_hw, OID_AUTO, df5632, CTLFLAG_RW, 0, "DF-5632 rig"); SYSCTL_INT(_hw_df5632, OID_AUTO, childbusy, CTLFLAG_RW, &df5632_childbusy, 0, "df5632k child refuses to detach (DF-5635 trigger)"); SYSCTL_INT(_hw_df5632, OID_AUTO, identify_add, CTLFLAG_RW, &df5632_identify_add, 0, "df5632k_identify calls BUS_ADD_CHILD (DF-5632 skew trigger; " "ON STOCK KERNELS THIS PANICS at kldload: devclass_add_device " "negative-index write)"); TUNABLE_INT("hw.df5632.identify_add", &df5632_identify_add); /* ------------------------------------------------------------------ */ /* emulated wire: what a master reading SDA would see */ /* ------------------------------------------------------------------ */ static int fakebb_wire_sda(struct fakebb_softc *sc) { if (!sc->started) return (sc->sda); if (sc->clk == 9) { /* ACK slot: the slave owns the wire */ return (sc->nack_this ? 1 : 0); } if (sc->reading && !sc->first_byte && sc->clk >= 1 && sc->clk <= 8) return ((sc->txcur >> (8 - sc->clk)) & 1); return (sc->sda); /* slave idle: master's own level */ } /* ------------------------------------------------------------------ */ /* iicbb_if methods (the "fake GPIO" vtable) */ /* ------------------------------------------------------------------ */ static void fakebb_setsda(device_t dev, int val) { struct fakebb_softc *sc = device_get_softc(dev); val = val ? 1 : 0; if (sc->scl && sc->sda && !val) { /* SDA falling while SCL high: START / repeated START */ sc->started = 1; sc->clk = 0; sc->shift = 0; sc->first_byte = 1; sc->reading = 0; sc->nack_this = 0; sc->rxlen = 0; sc->starts++; } else if (sc->scl && !sc->sda && val && sc->started) { /* SDA rising while SCL high: STOP */ sc->started = 0; sc->stops++; } sc->sda = val; } static void fakebb_setscl(device_t dev, int val) { struct fakebb_softc *sc = device_get_softc(dev); val = val ? 1 : 0; if (sc->started) { if (val && !sc->last_scl) { /* rising edge: data bits are sampled here */ sc->clk++; if (sc->clk >= 1 && sc->clk <= 8) sc->shift = (u_char)((sc->shift << 1) | (fakebb_wire_sda(sc) & 1)); } else if (!val && sc->last_scl && sc->clk == 9) { /* falling edge of the ACK clock: byte slot done */ if (sc->first_byte) { sc->addr = sc->shift; sc->first_byte = 0; sc->reading = sc->shift & 1; sc->nack_this = (sc->addr == FAKEBB_NACK_ADDR); sc->txnext = FAKEBB_TX_BASE; if (sc->reading) sc->txcur = sc->txnext++; } else if (sc->reading) { sc->txcur = sc->txnext++; } else { if (sc->rxlen < (int)sizeof(sc->rx)) sc->rx[sc->rxlen] = sc->shift; sc->rxlen++; } sc->clk = 0; sc->shift = 0; } } sc->last_scl = val; sc->scl = val; } static int fakebb_getsda(device_t dev) { struct fakebb_softc *sc = device_get_softc(dev); return (fakebb_wire_sda(sc)); } static int fakebb_getscl(device_t dev) { struct fakebb_softc *sc = device_get_softc(dev); return (sc->scl); } static int fakebb_reset(device_t dev, u_char speed, u_char addr, u_char *oldaddr) { (void)dev; (void)speed; (void)addr; if (oldaddr != NULL) *oldaddr = 0; return (0); } static int fakebb_callback(device_t dev, int index, caddr_t data) { (void)dev; (void)data; return (0); /* bridge always grants */ } /* ------------------------------------------------------------------ */ /* newbus topology witness: dump the iicbus0 child list */ /* ------------------------------------------------------------------ */ static void df5632_dump_children(device_t bus, const char *tag) { device_t *kids; int nkid, i, error; error = device_get_children(bus, &kids, &nkid); if (error) { kprintf("[df5632] %s: device_get_children error=%d\n", tag, error); return; } kprintf("[df5632] %s: nchildren=%d\n", tag, nkid); for (i = 0; i < nkid; i++) { devclass_t dc = device_get_devclass(kids[i]); driver_t *dr = device_get_driver(kids[i]); device_state_t st = device_get_state(kids[i]); kprintf("[df5632] %s: child[%d] dev=%p devclass=%s unit=%d " "driver=%s state=%d\n", tag, i, kids[i], dc ? devclass_get_name(dc) : "(NULL)", device_get_unit(kids[i]), dr ? dr->name : "(none)", (int)st); } kfree(kids, M_TEMP); } static void df5632_dump_bus(device_t bus, const char *tag) { devclass_t dc; driver_t *dr; if (bus == NULL) { kprintf("[df5632] %s: iicbus == NULL\n", tag); return; } dc = device_get_devclass(bus); dr = device_get_driver(bus); kprintf("[df5632] %s: iicbus=%p devclass=%s driver=%s state=%d " "softc=%p\n", tag, bus, dc ? devclass_get_name(dc) : "(NULL)", dr ? dr->name : "(NONE-DRIVERLESS)", (int)device_get_state(bus), device_get_softc(bus)); } /* ------------------------------------------------------------------ */ /* df5632k: an identify-based iicbus client driver, the EXACT pattern */ /* of iic.c:104-110 / iicsmb.c:137-142 -- the DF-5632 skew victim */ /* ------------------------------------------------------------------ */ static devclass_t df5632k_devclass; static void df5632k_identify(driver_t *driver, device_t parent) { device_t rc; if (!df5632_identify_add) { kprintf("[df5632] df5632k_identify: SKIPPED " "(hw.df5632.identify_add=0)\n"); return; } if (device_find_child(parent, "df5632k", -1) != NULL) return; /* iic.c:109 verbatim (name substituted) */ rc = BUS_ADD_CHILD(parent, parent, 0, "df5632k", -1); kprintf("[df5632] df5632k_identify: BUS_ADD_CHILD returned %p " "(wanted: a real device_t)\n", rc); df5632_dump_children(parent, "identify-post-BUS_ADD_CHILD"); } static int df5632k_probe(device_t dev) { device_set_desc(dev, "DF-5632 identify-based iicbus client"); return (0); } static int df5632k_attach(device_t dev) { kprintf("[df5632] df5632k%d attached (unit=%d softc=%p)\n", device_get_unit(dev), device_get_unit(dev), device_get_softc(dev)); return (0); } static int df5632k_detach(device_t dev) { if (df5632_childbusy) { kprintf("[df5632] df5632k%d detach: REFUSING (EBUSY)\n", device_get_unit(dev)); return (EBUSY); } return (0); } static device_method_t df5632k_methods[] = { DEVMETHOD(device_identify, df5632k_identify), DEVMETHOD(device_probe, df5632k_probe), DEVMETHOD(device_attach, df5632k_attach), DEVMETHOD(device_detach, df5632k_detach), DEVMETHOD_END }; static driver_t df5632k_driver = { "df5632k", df5632k_methods, 1, /* minimal softc */ }; DRIVER_MODULE(df5632k, iicbus, df5632k_driver, df5632k_devclass, NULL, NULL); MODULE_DEPEND(df5632k, iicbus, 1, 1, 1); /* ------------------------------------------------------------------ */ /* /dev/df5632: userland entry into the newbus lifecycle APIs */ /* ------------------------------------------------------------------ */ static int df5632_open(struct dev_open_args *ap) { return (0); } static int df5632_close(struct dev_close_args *ap) { return (0); } static int df5632_ioctl(struct dev_ioctl_args *ap) { cdev_t cdev = ap->a_head.a_dev; struct fakebb_softc *sc = cdev->si_drv1; struct df5632_req *r = (struct df5632_req *)ap->a_data; u_long cmd = ap->a_cmd; device_t bus, child, rc; uintptr_t val = 0x42424242; int error = 0; int i; if (sc->iicbus == NULL) { sc->iicbus = devclass_get_device(devclass_find("iicbus"), 0); if (sc->iicbus == NULL) return (ENXIO); } bus = sc->iicbus; switch (cmd) { case DF5632_STAT: df5632_dump_bus(bus, "STAT"); df5632_dump_children(bus, "STAT"); r->rc = 0; break; case DF5632_CYCLE: /* production detach + re-attach of iicbus0: exactly what * devclass_delete_driver()/devclass_add_driver() do on * kldunload/kldload of iicbus.ko with a resident bridge */ for (i = 0; i < r->arg; i++) { error = device_detach(bus); if (error) { kprintf("[df5632] CYCLE %d: device_detach " "error=%d\n", i, error); break; } error = device_probe_and_attach(bus); if (error) { kprintf("[df5632] CYCLE %d: re-attach " "error=%d\n", i, error); break; } kprintf("[df5632] CYCLE %d: detach+reattach ok\n", i); } df5632_dump_children(bus, "CYCLE-done"); r->rc = error; break; case DF5632_ADDCHILD: /* manual BUS_ADD_CHILD through the iicbus driver's own * (skewed) method -- return value is the witness */ rc = BUS_ADD_CHILD(bus, bus, 0, "df5632c", -1); kprintf("[df5632] ADDCHILD: BUS_ADD_CHILD(\"df5632c\",-1) " "returned %p (iicbus_add_child \"returns 0\")\n", rc); df5632_dump_children(bus, "ADDCHILD-post"); r->rc = 0; r->v0 = (int64_t)(uintptr_t)rc; break; case DF5632_IVAR_RT: child = device_find_child(bus, "df5632k", -1); if (child == NULL) child = device_find_child(bus, "iic", -1); if (child == NULL) { kprintf("[df5632] IVAR_RT: no child\n"); r->rc = ENOENT; break; } error = BUS_WRITE_IVAR(bus, child, IICBUS_IVAR_ADDR, 0x42); kprintf("[df5632] IVAR_RT: WRITE_IVAR(0x42) error=%d\n", error); error = BUS_READ_IVAR(bus, child, IICBUS_IVAR_ADDR, &val); kprintf("[df5632] IVAR_RT: READ_IVAR error=%d val=0x%lx " "iicbus_get_addr=0x%x\n", error, (unsigned long)val, iicbus_get_addr(child)); r->rc = error; r->v0 = error; r->v1 = (int64_t)val; r->v2 = (int64_t)iicbus_get_addr(child); break; case DF5632_FAILCHILD: /* create the df5632k child the DIRECT way (no dispatch): * the asymmetry vs BUS_ADD_CHILD is itself DF-5632 * evidence -- the rendezvous contract only works when * callers bypass the iicbus bus_add_child method */ child = device_add_child(bus, "df5632k", -1); kprintf("[df5632] FAILCHILD: device_add_child -> %p\n", child); if (child == NULL) { r->rc = ENXIO; break; } error = device_probe_and_attach(child); kprintf("[df5632] FAILCHILD: probe_and_attach error=%d\n", error); df5632_dump_children(bus, "FAILCHILD-post"); r->rc = error; break; case DF5632_DETACH_BUS: error = device_detach(bus); kprintf("[df5632] DETACH_BUS: device_detach(iicbus0) " "returned %d (child df5632k0 busy=%d)\n", error, df5632_childbusy); df5632_dump_bus(bus, "DETACH_BUS-post"); df5632_dump_children(bus, "DETACH_BUS-post"); r->rc = error; break; case DF5632_REQBUS: kprintf("[df5632] REQBUS: calling iicbus_request_bus" "(iicbus0, self, WAIT|INTR) -- NULL softc => trap\n"); error = iicbus_request_bus(bus, sc->self, IIC_WAIT | IIC_INTR); kprintf("[df5632] REQBUS: returned %d\n", error); if (error == 0) iicbus_release_bus(bus, sc->self); r->rc = error; break; default: return (ENOTTY); } return (0); } /* ------------------------------------------------------------------ */ /* fakebb bus device plumbing */ /* ------------------------------------------------------------------ */ static void fakebb_identify(driver_t *driver, device_t parent) { device_t child; child = device_find_child(parent, "fakebb", 0); if (child == NULL) BUS_ADD_CHILD(parent, parent, 0, "fakebb", 0); } static int fakebb_probe(device_t dev) { device_set_desc(dev, "DF-5632 fake GPIO bit-bang i2c master+slave"); return (0); } static int fakebb_attach(device_t dev) { struct fakebb_softc *sc = (struct fakebb_softc *)device_get_softc(dev); device_t bus = NULL; devclass_t dc; int tries; sc->self = dev; sc->iicbb = device_add_child(dev, "iicbb", -1); if (sc->iicbb == NULL) return (ENXIO); /* cascades: iicbb0 -> iicbus0 (+ trio; df5632k via identify) */ bus_generic_attach(dev); for (tries = 0; tries < 50 && bus == NULL; tries++) { dc = devclass_find("iicbus"); if (dc != NULL) bus = devclass_get_device(dc, 0); if (bus == NULL) tsleep(sc, 0, "fkbw", hz / 20); } sc->iicbus = bus; sc->cdev = make_dev(&df5632_ops, 0, UID_ROOT, GID_WHEEL, 0600, "df5632"); if (sc->cdev == NULL) kprintf("[df5632] make_dev failed\n"); else sc->cdev->si_drv1 = sc; kprintf("[df5632] attach done: iicbus=%p cdev=%p childbusy=%d\n", bus, sc->cdev, df5632_childbusy); return (0); } static int fakebb_detach(device_t dev) { struct fakebb_softc *sc = (struct fakebb_softc *)device_get_softc(dev); device_t child; if (sc->cdev) { dev_ops_remove_minor(&df5632_ops, 0); sc->cdev = NULL; } child = sc->iicbb; bus_generic_detach(dev); if (child) device_delete_child(dev, child); return (0); } static void fakebb_child_detached(device_t dev, device_t child) { struct fakebb_softc *sc = (struct fakebb_softc *)device_get_softc(dev); if (child == sc->iicbb) sc->iicbb = NULL; } static struct dev_ops df5632_ops = { { "df5632", 0, 0 }, .d_open = df5632_open, .d_close = df5632_close, .d_ioctl = df5632_ioctl, }; static device_method_t fakebb_methods[] = { /* device interface */ DEVMETHOD(device_identify, fakebb_identify), DEVMETHOD(device_probe, fakebb_probe), DEVMETHOD(device_attach, fakebb_attach), DEVMETHOD(device_detach, fakebb_detach), /* bus interface */ DEVMETHOD(bus_child_detached, fakebb_child_detached), /* iicbb interface (the fake GPIO vtable) */ DEVMETHOD(iicbb_callback, fakebb_callback), DEVMETHOD(iicbb_setsda, fakebb_setsda), DEVMETHOD(iicbb_setscl, fakebb_setscl), DEVMETHOD(iicbb_getsda, fakebb_getsda), DEVMETHOD(iicbb_getscl, fakebb_getscl), DEVMETHOD(iicbb_reset, fakebb_reset), DEVMETHOD_END }; static driver_t fakebb_driver = { "fakebb", fakebb_methods, sizeof(struct fakebb_softc), }; static devclass_t fakebb_devclass; DRIVER_MODULE(fakebb, nexus, fakebb_driver, fakebb_devclass, NULL, NULL); MODULE_DEPEND(fakebb, iicbb, 1, 1, 1); MODULE_VERSION(fakebb, 1);